What is Merge Keytab
Keytab is a file containing pairs of Kerberos principals and encrypted keys. Keytabs are used in kerberos environment and for the purpose of authenticating and obtaining token without entering the password manually.
Why we need to merge two keytabs
Generally each user id should be having its own keytab to be used. Suppose there are two ids and we need to use a single keytab for both of them, then merge both of them.
For example, consider two ids userid1 and userid2 on the machine proxy1. We have two different keytabs for each of them as shown below.
userid1.server.keytab
userid2.server.keytab
Lets go as per our requirement and use single keytab and merge the above two different keytabs,
1. Understand what is stored in a keytab file,
# klist -ekt userid1.server.keytab
Keytab name: FILE:userid1.server.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
2 03/10/17 08:58:35 userid1/server.FQDN@REALM (aes128-cts-hmac-sha1-96)
2 03/10/17 08:58:35 userid1/server.FQDN@REALM (des3-cbc-sha1)
2 03/10/17 08:58:36 userid1/server.FQDN@REALM (des-cbc-crc)
2 03/10/17 08:58:36 userid1/server.FQDN@REALM (arcfour-hmac)
[Dev root @ server /unix/path]
# klist -ekt userid2.server.keytab
Keytab name: FILE:userid2.server.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
2 02/06/17 09:56:45 userid2/server.FQDN@REALM (aes128-cts-hmac-sha1-96)
2 02/06/17 09:56:45 userid2/server.FQDN@REALM (des3-cbc-sha1)
2 02/06/17 09:56:45 userid2/server.FQDN@REALM (des-cbc-crc)
2 02/06/17 09:56:45 userid2/server.FQDN@REALM (arcfour-hmac)
2. Merge using ktutil command
# ktutil
ktutil: rkt userid1.server.keytab [Enter these commands in your terminal followed by keytab name]
ktutil: rkt userid2.server.keytab [Enter these commands in your terminal followed by keytab name]
ktutil: wkt userid1userid2merged.keytab [Enter these commands in your terminal followed by keytab name]
ktutil: clear
ktutil: quit
3. Following single keytab file is created which is the merged one,
-rw------- 1 root root 802 Apr 24 10:25 userid1userid2merged.keytab
4. Look at the keytab file and observe the principals.
# klist -ekt userid1userid2merged.keytab
Keytab name: FILE:userid1userid2merged.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
2 04/24/17 10:25:10 userid1/server.FQDN@REALM (aes128-cts-hmac-sha1-96)
2 04/24/17 10:25:10 userid1/server.FQDN@REALM (des3-cbc-sha1)
2 04/24/17 10:25:10 userid1/server.FQDN@REALM (des-cbc-crc)
2 04/24/17 10:25:10 userid1/server.FQDN@REALM (arcfour-hmac)
2 04/24/17 10:25:10 userid2/server.FQDN@REALM (aes128-cts-hmac-sha1-96)
2 04/24/17 10:25:10 userid2/server.FQDN@REALM (des3-cbc-sha1)
2 04/24/17 10:25:10 userid2/server.FQDN@REALM (des-cbc-crc)
2 04/24/17 10:25:10 userid2/server.FQDN@REALM (arcfour-hmac)
5. Test it by logging to the user id and check there are no tickets generated prior,
/unix/path >kinit -kt userid2.server.keytab
kinit: Keytab contains no suitable keys for host/server.FQDN@REALM while getting initial credentials
/unix/path >klist -kt userid2.server.keytab
Keytab name: FILE:userid2.server.keytab
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
2 02/06/17 09:56:45 userid2/server.FQDN@REALM
2 02/06/17 09:56:45 userid2/server.FQDN@REALM
2 02/06/17 09:56:45 userid2/server.FQDN@REALM
2 02/06/17 09:56:45 userid2/server.FQDN@REALM
6. Obtain the ticket for user2 by running the below command and using the merged keytab. Similarly, you can login to user 1 and obtain the credentials by using merged keytab.
/unix/path >kinit -kt userid1userid2merged.keytab userid2/server.FQDN@REALM
/unix/path >klist
Ticket cache: FILE:/tmp/krb5cc_xxxxxx
Default principal: userid2/server.FQDN@REALM
Valid starting Expires Service principal
04/24/17 10:30:49 04/24/17 18:30:49 krbtgt/REALM@REALM
renew until 04/25/17 10:30:49
/unix/path >
No comments:
Post a Comment