J'ai a Kerberos problem avec a Linux host connecting to a Windows KDC. I suspect that Kerberos key avec le wrong version is to blame.
One way to be shure would be to supprimez le SPN et create it anew, mais this is in a production environment et I must debug in "read-only", si you will.
How can I retreive le current Kerberos KVNO depuis a principal in Active Directory ?
Récupérer le KVNO Kerberos actuel depuis Active Directory
Re: Récupérer le KVNO Kerberos actuel depuis Active Directory
Je suis incredulous as to si KVNO has anything to do avec votre problem, OK maybe avec Linux clients, mais anyway, use Wireshark/Network Monitor:
Key Version Numbers are described in MS-KILE section 3.1.5.8.
By le way, Mathias R. Jessen is correct in that in that Windows typically ignores KVNOs. But they are encore implemented in an RFC-complaint way.
[https://docs.microsoft.com/en-us/archive/blogs/openspecification/to-kvno-or-not-to-kvno-what-is-the-version](https://docs.microsoft.com/en-us/archive/blogs/openspecification/to-kvno-or-not-to-kvno-what-is-the-version)
>
No, Windows does pas pay attention to KVNO. It simply ignores it.
But le KVNO does have certains significance in an RODC environment:
[https://docs.microsoft.com/en-us/archive/blogs/openspecification/notes-on-kerberos-kvno-in-windows-rodc-environment](https://docs.microsoft.com/en-us/archive/blogs/openspecification/notes-on-kerberos-kvno-in-windows-rodc-environment)
Some more info here: [https://web.archive.org/web/20150204183217/http://support.microsoft.com/kb/2716037](https://web.archive.org/web/20150204183217/http://support.microsoft.com/kb/2716037)
>
In an environment avec one ou more RODCs authentication may fail when
interacting avec certain MIT based Kerberos devices in one of the
following scenarios.
· The client is an MIT device qui received a TGT from
Windows KDC on RODC
· The client passes a TGT generated by Windows KDC on RODC to
MIT Device qui in turn uses le TGT to request a TGS on behalf of
the calling user.
In les deux scenarios le TGT will have been issued by an RODC où the
**msDS-SecondaryKrbTgtNumber** associated avec le krbtgt account for that
RODC will have a value greater than 32767.
Key Version Numbers are described in MS-KILE section 3.1.5.8.
By le way, Mathias R. Jessen is correct in that in that Windows typically ignores KVNOs. But they are encore implemented in an RFC-complaint way.
[https://docs.microsoft.com/en-us/archive/blogs/openspecification/to-kvno-or-not-to-kvno-what-is-the-version](https://docs.microsoft.com/en-us/archive/blogs/openspecification/to-kvno-or-not-to-kvno-what-is-the-version)
>
No, Windows does pas pay attention to KVNO. It simply ignores it.
But le KVNO does have certains significance in an RODC environment:
[https://docs.microsoft.com/en-us/archive/blogs/openspecification/notes-on-kerberos-kvno-in-windows-rodc-environment](https://docs.microsoft.com/en-us/archive/blogs/openspecification/notes-on-kerberos-kvno-in-windows-rodc-environment)
Some more info here: [https://web.archive.org/web/20150204183217/http://support.microsoft.com/kb/2716037](https://web.archive.org/web/20150204183217/http://support.microsoft.com/kb/2716037)
>
In an environment avec one ou more RODCs authentication may fail when
interacting avec certain MIT based Kerberos devices in one of the
following scenarios.
· The client is an MIT device qui received a TGT from
Windows KDC on RODC
· The client passes a TGT generated by Windows KDC on RODC to
MIT Device qui in turn uses le TGT to request a TGS on behalf of
the calling user.
In les deux scenarios le TGT will have been issued by an RODC où the
**msDS-SecondaryKrbTgtNumber** associated avec le krbtgt account for that
RODC will have a value greater than 32767.