Geek asks and answers

Creating keytab for use with kinit on Windows

I am writing a pGina plugin to get AFS and Kerberos TGT tokens from our KDC when I log in, while I wrote that the “function” of kinit is that it will not allow you to enter any input, unless from the keyboard, my idea is to simply redirect the standard input ...

Someone suggested using the keytab file for a principal that seemed very simple until I realized that I only used kutil on linux and I am having difficulty with the version of Windows that is ktpass.exe. I have repeatedly tried to use a large number of combinations of arguments to create keytab, but still have not had any success, the current command I am issuing is:

ktpass /out key.tab /mapuser user$@MERP.EDU /princ user.merp.edu@MERP.EDU /crypto RC4-HMAC-NT /ptype KRB5_NT_PRINCIPAL /pass mahpasswordlol /target MERP.EDU

Unfortunately, all of these exits

Using legacy password setting method

FAIL: ldap_bind_s failed: 0x31

According to my research, what is the authentication / cryptography problem, I tried it with other DES settings, but that also doesn’t work ... does anyone have any experience / ideas on how this might work?

+5
source share
1 answer

ktpass.exe is really terrible; I do not use it. Instead, just use ktutil on Unix to create the appropriate keyword regardless of the password, for example:

$ ktutil
ktutil:  addent -password -p foo@BAR -k 1 -e aes128-cts-hmac-sha1-96
Password for foo@BAR:
ktutil:  l
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    1                                  foo@BAR
ktutil:  wkt /tmp/zz
$ klist -ek /tmp/zz
Keytab name: WRFILE:/tmp/zz
KVNO Principal
---- --------------------------------------------------------------------------
   1 foo@BAR (aes128-cts-hmac-sha1-96)

LDAP , ktpass ; , ? , ( AD, , , ).

FWIW, : Unix AD. AD TGT, , Unix; , PuTTY SSH Unix, Firefox/Chrome/IE - Unix (Apache/mod_auth_kerb) ..

+8

More articles:


All Articles