3

Is there a way to list/show all SPN's in an kerberized AD using a Linux Client?

In Windows one can use setspn -T <domain> -Q */* to get them. Is there something similar? Haven't found anything yet.

Or is it even possible? Of course I request a TGT with my Linux client.

Improve this question

2 Answers 2

Reset to default
0

I am not clear on what you are asking, do you just want a list of all SPNs in an Active Directory domain/forest from a Linux box? You can use ldapsearch for SPNs via the servicePrincipalName attribute.

Improve this answer
1
  • Well in Windows I can use the setstpn -T <domain> -Q / command to check for what services I may request a ticket. I want to do the same in Linux, being authenticated to Kerberos, having a valid TGT, which I want to use to get a TGS for a service, I may not know the name, or just for all services. I can use kvno to request a ticket for a service of course, but I need to discover the name somehow. Thats what I try to do.
    – Thanathan
    Jul 23, 2015 at 13:56
0

You can use the ldapsearch tool from the openldap-client package of your favourite distro and then you can query SPN attributes like

ldapsearch -LLL -x -H ldap://example.local -D "administrator@example.local" -W -b "dc=example,dc=local,dc=com" "servicePrincipalName=*" sAMAccountName servicePrincipalName
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.