11

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos.

Currently, I have problems with automatically obtain and cache Kerberos ticket-granting ticket via kinit. If this were to be done manually, I would do this:

kinit aduser@REALM.COM

This prompts for the AD user password, hence there is a problem with automate this.

How can I automate this? I've found some posts mentioning using kadmin to create a database with the AD users password in it, but I've had no luck.

20

While you can just hard-code the password into your automation, the more correct Kerberos way to do this is to create a keytab for the principal and then use that to authenticate. kinit supports authenticating from a keytab using the -k -t <keytab-path> options.

The primary advantage of a keytab is that it isolates the credentials in a separate file and can be used directly by various Kerberos software (so you don't have to add code to read a password from a separate file). It can also be created with standard commands (with an AD KDC, use ktpass). There are some more advantages if you had a Linux KDC, such as easily randomizing keys stored in the keytab rather than using a weaker password.

1
  • 2
    Keytab definitely seems to be the way to go. If you generate this in kadmin, make sure to use the -norandkey flag in ktadd if you don't want to invalidate the existing password. Aug 8 '16 at 14:11
19

Stupid me, you can simply use following command:

echo "password" | kinit aduser@REALM
2
  • 1
    echo -n "$PASS" | kinit "$USER" do not output trailing newline
    – Dejan
    May 5 '15 at 14:18
  • 16
    Or print a poster with your password and hang it out! Storing your password in plain text is a no-no
    – Havnar
    Nov 27 '15 at 9:29
2

According to the man-page you might use:

kinit --password-file="~/my.secret" aduser@REALM.COM

So you just might provide your password via a file.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.