Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos.

Currently I have problems with automatically obtain and cache Kerberos ticket-granting ticket via 'kinit'.

If this were to be done manually, I would do this:

kinit aduser@REALM.COM

This prompts for the AD user password, hence there is a problem with automate this.

How can i automate this? I've found some posts mentioning using kadmin to create a database with the ad users password in it, but I've had no luck.

Thanks for input

share|improve this question

3 Answers 3

Stupid me:

echo "password" | kinit aduser@REALM

share|improve this answer
echo -n "$PASS" | kinit "$USER" do not output trailing newline – Dejan May 5 at 14:18
Or print a poster with your password and hang it out! Storing your password in plain text is a no-no – Havnar Nov 27 at 9:29

While you can just hard-code the password into your automation, the more correct Kerberos way to do this is to create a keytab for the principal and then use that to authenticate. kinit supports authenticating from a keytab using the -k -t <keytab-path> options.

The primary advantage of a keytab is that it isolates the credentials in a separate file and can be used directly by various Kerberos software (so you don't have to add code to read a password from a separate file). It can also be created with standard commands (with an AD KDC, use ktpass). There are some more advantages if you had a Linux KDC, such as easily randomizing keys stored in the keytab rather than using a weaker password.

share|improve this answer

You can automate the kinit process at login so that users dont have to manually type in "kinit" everytime after they login.

You need to edit .bash_profile at "/etc/skel/.bash_profile". Further details about implemnting it can be found on this site


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.