Remove RC4 encryption from UNAB

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

When Active Directory disables RC4 algorithms, Unix Authentication Broker (UNAB) may still show deprecated encryption types in the local keytab. This article provides steps to remove RC4 encryption from the UNAB `uxauth.keytab` and re-register the endpoint using AES encryption.

Running `klist -ke /opt/CA/uxauth/etc/uxauth.keytab` displays deprecated encryption types:
```
KVNO Principal
---- --------------------------------------------------------------------------
2 host/####.####.private@####.PRIVATE (DEPRECATED:arcfour-hmac)
2 host/####.####.private@####.PRIVATE (aes128-cts-hmac-sha1-96)
2 host/####.####.private@####.PRIVATE (aes256-cts-hmac-sha1-96)

Environment

PAMSC / UNAB 14.1.x

Cause

The `uxauth.keytab` file was generated when RC4 was a permitted encryption type in the environment. Even if Active Directory is updated to disable RC4, the local keytab file retains the original keys until manually updated or recreated.

Resolution

There are two methods to ensure RC4 is removed from the UNAB endpoint.
Method 1: Re-register the UNAB endpoint
This is the recommended method to generate a clean keytab without deprecated algorithms.
Stop the UNAB agent:
```bash
   /opt/CA/uxauth/lbin/uxauthd.sh stop
   ```
Rename the existing keytab file:
```bash
   mv /opt/CA/uxauth/etc/uxauth.keytab /opt/CA/uxauth/etc/uxauth.keytab.old
   ```
Re-register the endpoint to Active Directory:
```bash
   /opt/CA/uxauth/bin/uxconsole -register -a <administrator> -w <password> -d <domain_name>
   ```
Note: If RC4 is disabled on the Active Directory side, the new keytab will be created without the RC4 algorithm key.

Method 2: Manually remove entries using ktutil
If re-registration is not preferred, use the Kerberos `ktutil` utility to remove specific slots.
Back up the existing keytab:
```bash
   cp /opt/CA/uxauth/etc/uxauth.keytab /opt/CA/uxauth/etc/uxauth.keytab.bak
   ```
Launch the utility:
```bash
   ktutil
   ```
Read the keytab and list the slots:
```bash
   read_kt /opt/CA/uxauth/etc/uxauth.keytab
   list
   ```
Delete the slot number corresponding to `arcfour-hmac` or other deprecated types:
```bash
   delent <slot_number>
   ```
Save and exit:
```bash
   write_kt /opt/CA/uxauth/etc/uxauth.keytab
   exit
   ```