Kerberos - KeyTab (Key Table)

About

All Kerberos server machines need a keytab file to authenticate to the KDC.

A keytab file contains one or more shared secret key.

A service will use a keytab file in much the same way as a user uses his/her password.

Default Location

/etc/krb5.keytab

Operating System

Windows

Use the setspn command to map the Kerberos service principal name, HTTP/<host name>, to a Microsoft user account. An example of setspn usage is as follows:

C:\Program Files\Support Tools>
setspn -A HTTP/myappserver.austin.ibm.com myappserver

Create a key tab with Kerberos - ktab

ktab.exe –k keytab-file-name –a [email protected]

(NB realm name must be specified in capitals).

Linux

To generate a .keytab file for a host computer that is not running the Windows operating system,

Connect to the AD domain controller
map the principal to the account and set the host principal password with ktpass

ktpass /princ host/[email protected] /mapuser Sample1 /pass MyPas$w0rd /out Sample1.keytab /crypto all /ptype KRB5_NT_PRINCIPAL /mapop set

Merge the .keytab file with the /Etc/Krb5.keytab file on a host computer that is not running the Windows operating system.

Documentation / Reference