0

Working with Samba 4 as a Windows “domain member”, I’d like to automate deployment of keytabs. Specifically, I’d like the equivalent of adding service principals to the appropriate tables. E. g.

# kadmin -k /etc/squid/proxy.keytab -w secret -p kadmin/admin -q "ktadd HTTP/proxy.my.domain"

Sadly, MS doesn’t appear to offer kadmin interoperability. Samba has commands like

# net rpc vampire keytab all.keytab -U Administrator%secret
# net ads keytab create -U Administrator%secret

neither of which however appears to be capable of selectively extracting service principals. Also, for a non-trivial site installation I imagine the “vampire” method to require too many system resources, not to mention the necessary postprocessing with ktutil.

In my test setup, the DC is a Windows2008 server, the client is running a 3.14-ish Linux, MIT KRB5 1.15.x, and Samba 4.x. The kerberized service in question is a Squid v3.5.x. Kerberos integration itself works well when creating keytabs on the DC (ktpass) and then copying them over to each machine manually. But I’d rather avoid this kind of pedestrian approach.

It doesn’t necessarily have to be a Samba based solution. That’s just the path I’m investigating ATM.

Improve this question

1 Answer 1

Reset to default
2
+50

The only hard part about what you're currently trying to do is extracting the existing password from the account/principal you're creating the keytab for. The rest of the info is readily available via LDAP queries against the DC via the msDS-KeyVersionNumber and servicePrincipalName attributes.

Assuming the current password on the account isn't set in stone, you could instead just reset/randomize it to something generated by the automation process. Then, you just use ktutil to create the keytab with the now known password and the queried KVNO and SPN(s).

Improve this answer
7
  • “extracting the existing password from the account/principal you're creating the keytab for” – I don’t follow. Those are service principals; they don’t have a password. I’m looking for the remote equivalent of ktpass princ SRV/[email protected] mapuser srv -pass admin-pw out srv.foo.bar.keytab that given admin credentials can be executed on srv.foo.bar.
    – phg
    Oct 5, 2017 at 9:28
  • All principals have a password. With the ktpass command, you're just never told what it is. The keytab file is effectively just a hash of that password (potentially multiple hashes using the various supported encryption types).
    – Ryan Bolger
    Oct 5, 2017 at 16:19
  • Bottom line though, you can generate a perfectly valid keytab file if you know the password, KVNO, and the UPN/SPN associated with the account.
    – Ryan Bolger
    Oct 5, 2017 at 16:20
  • 1
    Apologies, I meant all principals in an Active Directory. Service Principals in AD don't exist without an associated User account/principal. "servicePrincipalName" is a multi-valued attribute associated with a user (or computer) account as is "userPrincipalName".
    – Ryan Bolger
    Oct 6, 2017 at 15:13
  • 1
    And the kvno is queryable from the msDS-KeyVersionNumber attribute.
    – Ryan Bolger
    Oct 9, 2017 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .