Note: This step is not required when using JDK 1.8.0_161 or greater. JDK 1.8.0_161 enables unlimited strength encryption by default.

By default, CentOS and Red Hat Enterprise Linux 5.5 (and higher) use AES-256 encryption for Kerberos tickets, so the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy File must be installed on all cluster hosts as detailed below. Alternatively, the Kerberos instance can be modified to not use AES-256.

The passwords of relevant principals, such as Ticket Granting Ticket principal (krbtgt/REALM@REALM), may need to change.

  Note: If AES-256 remains in use despite disabling it, it may be because the aes256-cts:normal setting existed when the Kerberos database was created. To resolve this issue, create a new Kerberos database and then restart both the KDC and the kadmin server.

To verify the type of encryption used in your cluster:

1. For MIT KDC: On the local KDC host, type this command in the kadmin.local or kadmin shell to create a test principal:

   kadmin:  addprinc test

   For Active Directory: Create a new AD account with the name, test.

2. On a cluster host, type this command to start a Kerberos session as test:

   $ kinit test 

3. On a cluster host, type this command to view the encryption type in use:

   $ klist -e 

   If AES is being used, output like the following is displayed after you type the klist command (note that AES-256 is included in the output):

   Ticket cache: FILE:/tmp/krb5cc_0
   Default principal: test@Cloudera Manager
   Valid starting     Expires            Service principal
   05/19/11 13:25:04  05/20/11 13:25:04  krbtgt/Cloudera Manager@Cloudera Manager
       Etype (skey, tkt): AES-256 CTS mode with 96-bit SHA-1 HMAC, AES-256 CTS mode with 96-bit SHA-1 HMAC