A keytab is a file containing pairs of Kerberos principals and encrypted keys (these are derived from the Kerberos password). You can use this file to log into Kerberos without being prompted for a password. The most common personal use of these files is to allow scripts to authenticate to Kerberos without human interaction, or store a password in a plaintext file. The acquired credentials can then be used by the script to gain access to files stored in the Research File System (RFS) or Scholarly Data Archive (SDA), for example.
Warning: Anyone with read permission on a keytab can use all of the keys it contains, so you must restrict and monitor permissions on any key tab files you create. Also, consider the following:
- When you change your Kerberos password, you will need to recreate all your key tabs.
- When following the examples on this page, enter the commands exactly as they are shown.
Creating A Keytab FileYou can create a Key tab quickly on any computer with Kerberos. The file is computer independent, so you can perform the process once, and then copy the file to multiple computers. Note: The following assumes you have access to a Kerberos client (either on your own workstation or on a UITS shared system, such as Quarry). You may need to modify your path to include the location of
/usr/kerberos/sbin). Following is an example of the key tab file creation process using MIT Kerberos:
> ktutil ktutil: addent -password -p email@example.com -k 1 -e rc4-hmac Password for firstname.lastname@example.org: [enter your password] ktutil: addent -password -p email@example.com -k 1 -e aes256-cts Password for firstname.lastname@example.org: [enter your password] ktutil: wkt username.keytab ktutil: quitFollowing is an example using Heimdal Kerberos:
> ktutil -k username.keytab add -p email@example.com -e arcfour-hmac-md5 -V 1If the keytab created in Heimdal does not work, it is possible you will need an
aes256-ctsentry. In that case, you will need to find a computer with MIT Kerberos, and use that method instead.
Using A Key tab To Authenticate ScriptsTo execute a script so it has valid Kerberos credentials, use:
> kinit firstname.lastname@example.org -k -t mykeytab; myscriptReplace
usernamewith your username,
mykeytabwith the name of your keytab file, and
myscriptwith the name of your script.
Listing The Keys In A Key tab FileWith MIT Kerberos, to list the contents of a file, use
mykeytabwith the name of your file):
> klist -k mykeytab version_number email@example.com version_number firstname.lastname@example.orgThe output contains two columns listing version numbers and principal names. If multiple keys for a principal exist, the one with the highest version number will be used. With Heimdal Kerberos, use
> ktutil -k mykeytab list mykeytab: Vno Type Prinicpal 1 des3-cbc-md5 email@example.com ...
Deleting A Key From A Key tab FileIf you no longer need a key tab file, delete it immediately. If the keytab contains multiple keys, you can delete specific keys with the
ktutilcommand. You can also use this procedure to remove old versions of a key. An example using MIT Kerberos follows:
> ktutil ktutil: read_kt mykeytab ktutil: list ... slot# version# firstname.lastname@example.org version# ... ktutil: delent slot#Replace
mykeytabwith the name of your file,
usernamewith your username, and
version#with the appropriate version number. Verify that the version is gone, and then in
quitTo do the same thing using Heimdal Kerberos, use:
> ktutil -k mykeytab list ... version# type email@example.com ... > ktutil -k mykeytab remove -V version# -e type firstname.lastname@example.org
Merging Key tab FilesIf you have multiple files that need to be in one place, you can merge the keys with the
ktutilcommand. To merge keytab files using MIT Kerberos, use:
> ktutil ktutil: read_kt mykeytab-1 ktutil: read_kt mykeytab-2 ktutil: read_kt mykeytab-3 ktutil: write_kt krb5.keytab ktutil: quitReplace
mykeytab-(number)with the name of each key tab file. The final merged key tab would be
krb5.keytab. To verify the merge, use:
klist -k krb5.keytabTo do the same thing using Heimdal Kerberos, use:
> ktutil copy mykeytab-1 krb5.keytab > ktutil copy mykeytab-2 krb5.keytab > ktutil copy mykeytab-3 krb5.keytabThen, to verify the merge, use:
ktutil -k krb5.keytab list
Copying A Keytab File To Another ComputerThe key tab file is independent of the computer it's created on, its filename, and its location in the file system. Once it's created, you can rename it, move it to another location on the same computer, or move it to another Kerberos computer, and it will still function. The file is a binary file, so be sure to transfer it in a way that does not corrupt it. If possible, use SCP or another secure method to transfer the keytab between computers. If you have to use FTP, be sure to issue the
bincommand from your FTP client before transferring the file. This will set the transfer type to binary so the file will not be corrupted.
Tags: File, keys, Files, computer, Kerberos, keytab, keytab file, ktutil, mykeytab, password, version
This work is licensed under a
Creative Commons Attribution-