Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


How can I export a Kerberos keytab with a given password, so I can use it to authenticate passwordlessly with MIT KfW, while still being able to authenticate with a password elsewhere? If it matters due to enctype issues or something like that, the KDC is MIT.

Thanks

share|improve this question
up vote 1 down vote accepted

I figured this out myself.

537> /usr/sbin/ktutil
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e aes256-cts-hmac-sha1-96
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e aes128-cts-hmac-sha1-96
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e des3-cbc-sha1
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e arcfour-hmac-md5
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e arcfour-hmac-md5-exp
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e des-cbc-md5
Password for fahad@CLUENET.ORG:
ktutil:  add_entry -password -p fahad@CLUENET.ORG -k 1 -e des-cbc-crc
Password for fahad@CLUENET.ORG:
ktutil:  write_kt keytab
ktutil:

I exported the keytab in all of the supported enctypes, for maximum compatibility.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.