Lustre 1.6 Operations Manual

General Installation Notes
■
■
■
The host.domain should be the FQDN in your network. Otherwise, the server may
not recognize any GSS request.
To install a keytab entry on a node, use the ktutil 1 utility.
Lustre supports these encryption types for MIT Kerberos 5, v1.4 and higher:
■
■
■
■
■
des-cbc-crc
des-cbc-md5
des3-hmac-sha1
aes128-cts
aes256-cts
■ arcfour-hmac-md5
For MIT Kerberos 1.3.x, only des-cbc-md5 works because of a known issue
between libgssapi and the Kerberos library.
Note – The encryption type (or enctype) is an identifier specifying the encryption,
mode and hash algorithms. Each Kerberos key has an associated enctype that
identifies the cryptographic algorithm and mode used when performing
cryptographic operations with the key. It is important that the enctypes requested by
the client are actually supported on the system hosting the client. This is the case if
the defaults that control enctypes are not overridden.
1. Kerberos keytab file maintenance utility.
Chapter 11 Kerberos 11-5