Fermilab Kerberos Tips

Creating a keytab file for a project principal

Before you begin, you should have requested and received a project principal and an initial password from the computer security team.

Definitions

Procedure

1. Decide where the keytab will be stored. Consider the following points:
   • It must be on local storage, which is not shared over the network.
   • The keytab file must be readable only by the unix account which should obtain tickets with it. (And, necessarily, by root.) It may prove convenient to also have it writable by that user.
   • Every directory in the tree above that file must have at least "x" (execute) access for this account.
   • The file should not be backed up, or the backup media should be stored as securely as the machine's disk itself.
   A good and common choice is /var/adm/krb5/foo.keytab.
2. Create the directory, if necessary, and set its ownership and permission. make sure the file does not exist.
3. Working as user root if projacct has no write access to /dir-path, otherwise as user projacct, execute this command:

   kadmin -r FNAL.GOV -p foo/bar/host.fnal.gov@FNAL.GOV \
  -q "ktadd -k /dir-path/file foo/bar/host.fnal.gov@FNAL.GOV"

   and provide the initial password you were given.
4. If you are root, set the ownership of the keytab:

   chown projacct /dir-path/file

5. Check the permissions on the file and all directories above it, then test it by su'ing to projacct (if you haven't already) and:

   kinit -l 5m -k -t /dir-path/file foo/bar/host.fnal.gov
klist -f
kdestroy


When you execute the kadmin command, the password is no longer valid for that principal. If you were issued the same initial password for multiple project principals, do create all their keytabs promptly.