Kerberos 암호화 종류의
rc4-hmac은 옛 AD 호환용이다. Microsoft 는 2026년부터 RC4 를 기본 지원 목록에서 빼고 있으므로 새 구성은aes256-cts·aes128-cts만 쓴다.[1]
| 설정 | 값 |
|---|---|
| Authentication Backend Order | Database then External |
| LDAP URL | ldap://ActiveDirectory.host_name.com:3268 |
| LDAP Bind User Distinguished Name | CN=ADMIN_ID,OU=OU_NAME,OU=DIFFERENCE_OU_NAME,DC=SITE,DC=COM |
| Active Directory Domain | site_name.com |
| LDAP User Search Filter | (sAMAccountName={0}) |
| LDAP User Search Base | OU=OU_NAME,OU=DIFFERENCE_OU_NAME,DC=SITE,DC=COM |
| LDAP Group Search Filter | (&(member={0})(objectclass=group)) |
| KDC Type | Active Directory |
| Active Directory Suffix | OU=credentials,OU=DIFFERENCE_OU_NAME,DC=SITE,DC=COM |
| Active Directory Delete Accounts on Credential Regeneration | Active |
| Kerberos Encryption Types | aes256-cts aes128-cts rc4-hmac |
| Kerberos Security Realm | site_name.com |
| Active Directory Account Prefix | prod- |
| Manage krb5.conf through Cloudera Manager | Active |
| Automatically Install CSD Repo URLs | Deactive |
| 설정 | 값 |
|---|---|
| Kerberos Encryption Types | aes256-cts aes128-cts rc4-hmac |
| Kerberos Security Realm | site_name.com |
| KDC Server Host | ActiveDirectory.host_name.com |
| KDC Admin Server Host | ActiveDirectory.host_name.com |
| Domain Name(s) | host_name.com .host_name.com |
| Active Directory Delete Accounts on Credential Regeneration | Active |
| Active Directory Set Encryption Types | Active |
| Active Directory Password Properties | length=12,minLowerCaseLetters=2,minUpperCaseLetters=2,minDigits=2,minSpaces=0,minSpecialChars=0,SpecialChars=?.!$%^*()-_+=~ |
| Active Directory Account Properties | accountExpires=0,objectClass-top,objectClass=person,objectClass=organizationalPerson,objectClass=user |
| Active Directory Account Prefix | prod- |
KB5021131 — Kerberos RC4 관련 변경. 2026-09-17 확인. https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d ↩︎