chrisfu ad1ecedb5e kerberos_trust_setup: pin trust account to RC4 only (msDS-Supported... 4) ... The matching knoe-db change (commit `ff7546d`) re-keys the MIT-side cross-realm krbtgts with `-e arcfour-hmac:normal` to dodge the AES-salt mismatch between Samba and MIT. For the trust to actually carry traffic, the Samba side must also offer only RC4 on the trust account — otherwise the client picks AES, the two sides derive different keys from the same password (different salt conventions), and TGT decryption fails. Change `msDS-SupportedEncryptionTypes` from 28 (RC4+AES128+AES256) to 4 (RC4 only). RC4 has no salt, so keys derive from the password alone and both sides converge. Updated docstring + summary debug print to reflect the new value and the why. Tracked alongside the Junie brief at ~/dev/knoe-db/docs/plans/junie/kdc-trust-reset-repeatable.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-05-11 00:29:01 -07:00
..
deployments/svc-check-helm	infrastructure: restore ansible configuration and refactor samba_dns for internal zone - Restored the 'infrastructure' directory and root-level 'ansible.sh', 'ansible.cfg' scripts. - Refactored 'samba_dns' role to dynamically handle 'prole.org' and 'internal.prole.org' DNS zones. - Switched 'samba-tool' commands to use machine account authentication (-P) in 'samba_dns' and 'samba_reverse_dns'. - Updated AD DC inventory variables to use 127.0.0.1 and correct admin principal. - Added tags to 'samba_dns' tasks for better target execution. - Updated IDE project configuration for knoe-db.	2026-04-28 00:05:03 -07:00
inventory	fix(inventory): specify ssh key for zinfandel — non-default key name	2026-05-09 22:42:26 -07:00
playbooks	kerberos_trust_setup: pin trust account to RC4 only (msDS-Supported... 4)	2026-05-11 00:29:01 -07:00
roles	fix(acme): replace fragile key-file regex selector with rejectattr	2026-05-06 15:57:57 -04:00
setup	infrastructure: restore ansible configuration and refactor samba_dns for internal zone - Restored the 'infrastructure' directory and root-level 'ansible.sh', 'ansible.cfg' scripts. - Refactored 'samba_dns' role to dynamically handle 'prole.org' and 'internal.prole.org' DNS zones. - Switched 'samba-tool' commands to use machine account authentication (-P) in 'samba_dns' and 'samba_reverse_dns'. - Updated AD DC inventory variables to use 127.0.0.1 and correct admin principal. - Added tags to 'samba_dns' tasks for better target execution. - Updated IDE project configuration for knoe-db.	2026-04-28 00:05:03 -07:00
ansible.cfg	infrastructure: restore ansible configuration and refactor samba_dns for internal zone - Restored the 'infrastructure' directory and root-level 'ansible.sh', 'ansible.cfg' scripts. - Refactored 'samba_dns' role to dynamically handle 'prole.org' and 'internal.prole.org' DNS zones. - Switched 'samba-tool' commands to use machine account authentication (-P) in 'samba_dns' and 'samba_reverse_dns'. - Updated AD DC inventory variables to use 127.0.0.1 and correct admin principal. - Added tags to 'samba_dns' tasks for better target execution. - Updated IDE project configuration for knoe-db.	2026-04-28 00:05:03 -07:00