Following two documents from Red Hat explains the process of adding servers to AD domain. RHEL versions are different but steps are applicable to both.

Page 17 of: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/pdf/Windows_Integration_Guide/Red_Hat_Enterprise_Linux-7-Windows_Integration_Guide-en-US.pdf

Step 3-d, system is added to domain, then keys in host keytab are listed to make sure host principal keys are there:

# klist -k

Instructions in this document do not ask for obtaining TGT using the host keytab.

Per page 61 step 7 of "https://access.redhat.com/sites/default/files/attachments/rhel-ad-integration-deployment-guidelines-v1.5.pdf" , a host based TGT is obtained by running:

# kinit -­k <hostname>$

Where do we use this host based TGT?

With or without host TGT I am able to add Linux servers to AD domain and have users login using their AD credentials.

Does it play any role in renewal of host keytab when AD rotates the machine password every 30 days?

Another related question is, when I list the host keys, I see expired (and renewal date is past) ticket still listed:

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: TESTHOST$@AD.EXAMPLE.COM

Valid starting     Expires            Service principal
06/10/17 12:59:41  06/10/17 22:59:41  krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
        renew until 06/11/17 12:59:41
# date
Mon Jun 12 14:14:21 UTC 2017

Is it normal for klist to print expired host tickets? When does klist drop them from printing?



About the kinit with the host principal -- it's just a sanity check. There were too many people putting bogus keytabs on their hosts and then complaining that 'sssd is broken' that we had to put an explicit check to catch bad keytabs soon.

And about the klist -- that really depends on what the ccache back end is. With file, the credentials remain in the file even after they are expired, so klist just displays them. For example with KEYRING (which RHEL-7 uses), the credential just disappears when it expires, so nothing would be displayed. Either way is not harmful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.