If you have multiple keytab files that need to be in one place, you can merge the keys with the ktutil command. Version# type ktutil -k mykeytab remove -V version# -e type keytab files To do the same thing using Heimdal Kerberos, use: Verify that the version is gone, and then in ktutil, enter:
Username with your username, and version# with the appropriate version number. Replace mykeytab with the name of your keytab file, You can also use this procedure to remove old versions of a key. If the keytab contains multiple keys, you can delete specific keys with the If you no longer need a keytab file, delete it immediately. With Heimdal Kerberos, use ktutil instead: If multiple keys for a principal exist, the one with the highest version number will be used. Version_number output contains two columns listing version numbers and principal names. Klist (replace mykeytab with the name of your keytab file): With MIT Kerberos, to list the contents of a keytab file, use Mykeytab with the name of your keytab file, and To execute a script so it has valid Kerberos credentials, use: In that case, you will need to find a computer with MIT Kerberos, and use that method instead.įor more about the ADS.IU.EDU Kerberos realm, see Current Kerberos realm at IU. If the keytab created in Heimdal does not work, it is possible you will need an aes256-cts entry. > ktutil -k username.keytab add -p -e arcfour-hmac-md5 -V 1 Ktutil: addent -password -p -k 1 -e aes256-ctsįollowing is an example using Heimdal Kerberos: Keytab files are not bound to the systems on which they were created you can create a keytab file on one computer and copy it for use on other computers.įollowing is an example of the keytab file creation process using MIT Kerberos: You can create keytab files on any computer that has a Kerberos client installed. You may need to modify your path to include the location of ktutil (for example, /usr/sbin or When following the examples on this page, enter the commands exactly as they are shown. To use the instructions and examples on this page, you need access to a Kerberos client, on either your personal workstation or an IU research supercomputer.
0 kommentar(er)
