doc updates for allow_weak_crypto

Update documentation to be more helpful about allow_weak_crypto.

ticket: 6669
target_version: 1.8
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23750 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/doc/admin.texinfo b/doc/admin.texinfo
index b7c87ac400d0a5f1c529c50b4012168dee80ba35..5e80af3b40cfcbd6e756c01a93b24e21dd6dc412 100644 (file)
--- a/doc/admin.texinfo
+++ b/doc/admin.texinfo
@@ -456,8 +456,11 @@ key encryption.  The default value for this tag is
 @itemx allow_weak_crypto
 If this is set to 0 (for false), then weak encryption types will be
 filtered out of the previous three lists (as noted in @ref{Supported
-Encryption Types}).  The default value for this tag is true, but that
-default may change in the future.
+Encryption Types}).  The default value for this tag is false, which
+may cause authentication failures in existing Kerberos infrastructures
+that do not support strong crypto.  Users in affected environments
+should set this tag to true until their infrastructure adopts stronger
+ciphers.
 
 @itemx clockskew
 Sets the maximum allowable amount of clockskew in seconds that the

diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M
index b60836f3c1a2c77c27c49d5f4021ecac2ae892b7..9778e8178a6c3ebed799a9b6c292b4b18e1bde10 100644 (file)
--- a/src/config-files/krb5.conf.M
+++ b/src/config-files/krb5.conf.M
@@ -128,6 +128,14 @@ types that should be requested by the client, in the same format.
 This relation identifies the permitted list of session key encryption
 types.
 
+.IP allow_weak_crypto
+If this is set to 0 (for false), then weak encryption types will be
+filtered out of the previous three lists.  The default value for this
+tag is false, which may cause authentication failures in existing
+Kerberos infrastructures that do not support strong crypto.  Users in
+affected environments should set this tag to true until their
+infrastructure adopts stronger ciphers.
+
 .IP clockskew 
 This relation sets the maximum allowable amount of clockskew in seconds
 that the library will tolerate before assuming that a Kerberos message