2

When attempting to load an SRVTAB over TFTP, I receive an "Unsupported keytype" error:

abc(config)#kerberos srvtab remote 1.2.3.4 abc.srvtab
Loading abc.srvtab from 1.2.3.4 (via Vlan123): !
[OK - 121 bytes]
Unsupported keytype 18!  Discarding...
No principals in srvtab!  Discarding...
Failed to retrieve srvtab from tftp://1.2.3.4/abc.srvtab

However, no error is received if the entry is specified manually:

abc(config)#kerberos srvtab entry host/abc@REALM 1 1418612000 1 18 32 0123456...

…but the resulting key doesn't work (and, despite no config-key having been set, the key value appears corrupted when viewing the configuration file). Worse still, the configuration leads IOS to attempt allocating gigabytes of memory when initiating a Kerberos session:

Dec 15 19:42:03.030: AAA/BIND(00000B9A): Bind i/f  
Dec 15 19:42:03.035: %SYS-2-MALLOCFAIL: Memory allocation of 4294580232 bytes failed from 0x1488F68, alignment 0 
Pool: Processor  Free: 5121120  Cause: Not enough free memory 
Alternate Pool: None  Free: 0  Cause: No Alternate pool 
 -Process= "Virtual Exec", ipl= 0, pid= 399
-Traceback= 53C8ECz 1DCFBF8z 1DD6FDCz 1DD77B4z 2ACF704z 1488F6Cz 146BF6Cz 148C61Cz 14816A8z 1255930z 1255BC4z 1255C64z 12483C0z 494B7Cz 299BEA8z 2996448z
Dec 15 19:42:03.040: Kerberos: Failed to generate authentication data!
Dec 15 19:42:03.040: AAA/AUTHEN/LOGIN (00000B9A): Pick method list 'default' 
Dec 15 19:42:03.040: kerberos(00000B9A): krb_is_user_authenticated 0

So, one presumes that aes256-cts-hmac-sha1-96 isn't supported on this device—but how can one determine which algorithms are supported?

19
  • What device and iOS version/edition? (show version for the iOS info.) Dec 15, 2014 at 19:58
  • @HopelessN00b: This particular device is a Catalyst 3560C, running IOS 15.0(2)SE5—however we have a number of Cisco devices and would be very grateful for a generic answer (if at all possible)!
    – eggyal
    Dec 15, 2014 at 20:02
  • Oh, geez, that complicates things. Last I looked a couple years ago, the easiest way to get this information was to upgrade all our devices to the latest iOS, so I did... though I was working with some gear that hadn't been updated in several years. Dec 15, 2014 at 20:06
  • @HopelessN00b: Mmmkay. Well, even taking this device alone: the IOS was "Compiled Fri 25-Oct-13 14:53"—so one would expect it to be fairly up-to-date with support for AES?
    – eggyal
    Dec 15, 2014 at 20:08
  • It's actually not that simple. Due to Clinton-era regulations that classified strong cryptography as munitions, Cisco (and a lot of other vendors), ended up splitting their products into two categories - one with no crypto that could be exported anywhere, and another with crypto that could only be shipped to designated "friendly" nations. At least as of a couple years ago, Cisco IOSes came in two flavors - one with cryptographic capabilities, and one without. Dec 15, 2014 at 20:25

0

You must log in to answer this question.

Browse other questions tagged .