- By default, Mac OS X and Mac OS X Server machines query NetInfo to resolve hostnames before falling back to DNS. Because NetInfo has an unqualified name for all the machines in the NetInfo database, the machine's own hostname will resolve to an unqualified name. Kerberos needs a FQDN to look up keys in the machine's keytab file.
- Generate the Keytab Files Generate the Keytab Files at Node Level Generate the Keytab Files at Process Level Verify the Service Principal Names and Keytab Files Step 6. Enable Delegation for the Kerberos Principal User Accounts in Active Directory Enabling Kerberos Authentication in a Domain.
If you want to associate a file with a new program (e.g. Shinobi life codes 2019 list. My-file.KEYTAB) you have two ways to do it. The first and the easiest one is to right-click on the selected KEYTAB file. From the drop-down menu select 'Choose default program', then click 'Browse' and find the desired program. A keytab file is small – only 1 kilobyte in size. Note that if you re-create a keytab using the same SPN, you will need to (1) first ensure the application server config is pointed to the new keytab file name (if you've changed it) and (2) you will also need to restart the application service engine. In both domains we need to create a separate user account (mapuser) for mapping the SPN. When adding a principal to the Keytab, we use the first keytab as an -in argument creating a new keytab with both keys. Step 1: Create the keytab for the domain to be merged (the second/third domain) First, create a keytab file in the KERBAUTH.COM domain.
How to create a keytab file for a Kerberos user logging into Active Directory. What's a keytab file? It's basically a file that contains a table of user accounts, with an encrypted hash of the user's password. Why have a keytab file? Well, when you want a server process to automatically logon to Active Directory on startup, you have two options: type the password (in clear text) into a config file somewhere, or store an encrypted hash of the password in a keytab file. Which is safer? Well, you can decide. In any case, you'd better do a good job of protecting the file (be it a config file or a keytab).Anyway, the accepted way to store a hashed password in Kerberos is to use a keytab file. Now the file can be created using a number of utilities. On a Windows machine, you can usektpass.exe. On Ubuntu Linux, you can use ktutil.
Before I demonstrate how to create the keytab, a word about encryption. There are a number of encryption types used for hashing a password. These include DES-CBC-CRC, DES-CBC-MD5, RC4-HMAC and a few others. Active Directory uses RC4-HMAC by default. Back in Windows 2000, you could also use the DES types without any trouble, but since Windows 2003, only RC4-HMAC is supported, unless you make a registry change (to all of your domain controllers). If you need to use DES for some reason, then refer to the Technet article at the bottom of the page.
Before attempting to create a keytab file, you'll need to know the user's kerberos principal name, in the form of [email protected], and the user's password.
Creating a KeyTab on Windows(tested on Windows Server 2008 R2)
Open a command prompt and type the following command:
ktpass /princ[email protected] /pass password /ptype KRB5_NT_PRINCIPAL /out username.keytab
Creating a KeyTab on Ubuntu Linux (tested on Ubuntu 10.10 - Maverick Meerkat)Open a terminal window and type the following commands:
ktutil
addent -password -p [email protected] -k 1 -e RC4-HMAC
- enter password for username -
wkt username.keytab
q
Testing the Keytab File
Now in order to test the keytab, you'll need a copy of kinit. You can use the version that's on Ubuntu, or if on Windows, you can install the latest Java runtime from Sun (JRE). In either case, you'll need to setup your /etc/krb5.conf file (on Linux) or c:windowskrb5.ini (on Windows). Either file should look something like this:
[libdefaults]
default_realm = MYDOMAIN.COM
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
How To Generate Keytab File For Mac Pro
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
MYDOMAIN.COM = {
kdc = mydomain.com:88
admin_server = mydomain.com
default_domain = mydomain.com
}
[domain_realm]
.mydomain.com = MYDOMAIN.COM
mydomain.com = MYDOMAIN.COM
[login]
krb4_convert = true
krb4_get_tickets = false
Once you've got your Kerberos file setup, you can use kinit to test the keytab. First, try to logon with your user account without using the keytab:
kinit username@MYDOMAIN.COM
- enter the password -
If that doesn't work, your krb5 file is wrong. If it does work, now try the keytab file:
kinit username@MYDOMAIN.COM -k -t username.keytab
Now you should successfully authenticate without being prompted for a password. Success!
Keytab File Location
More Information