Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos.

Currently I have problems with automatically obtain and cache Kerberos ticket-granting ticket via 'kinit'.

If this were to be done manually, I would do this:

kinit aduser@REALM.COM

This prompts for the AD user password, hence there is a problem with automate this.

How can i automate this? I've found some posts mentioning using kadmin to create a database with the ad users password in it, but I've had no luck.

Thanks for input

share|improve this question
add comment

2 Answers

Stupid me:

echo "password" | kinit aduser@REALM

share|improve this answer
add comment

While you can just hard-code the password into your automation, the more correct Kerberos way to do this is to create a keytab for the principal and then use that to authenticate. kinit supports authenticating from a keytab using the -k -t <keytab-path> options.

The primary advantage of a keytab is that it isolates the credentials in a separate file and can be used directly by various Kerberos software (so you don't have to add code to read a password from a separate file). It can also be created with standard commands (with an AD KDC, use ktpass). There are some more advantages if you had a Linux KDC, such as easily randomizing keys stored in the keytab rather than using a weaker password.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.