ipa-getkeytab(1)

1ipa-getkeytab(1)             FreeIPA Manual Pages             ipa-getkeytab(1)
2
3
4

NAME

6       ipa-getkeytab - Get a keytab for a Kerberos principal
7

SYNOPSIS

9       ipa-getkeytab  -s  ipaserver  -p  principal-name  -k  keytab-file  [ -e
10       encryption-types ] [ -q ] [ -D|--binddn BINDDN  ]  [  -w|--bindpw  ]  [
11       -P|--password PASSWORD ]
12
13

DESCRIPTION

15       Retrieves a Kerberos keytab.
16
17       Kerberos  keytabs are used for services (like sshd) to perform Kerberos
18       authentication. A keytab is a file with one or more secrets  (or  keys)
19       for a Kerberos principal.
20
21       A  Kerberos  service  principal is a Kerberos identity that can be used
22       for authentication. Service principals contain the name of the service,
23       the  hostname  of the server, and the realm name. For example, the fol‐
24       lowing is an example principal for an ldap server:
25
26          ldap/foo.example.com@EXAMPLE.COM
27
28       When using ipa-getkeytab the realm name is  already  provided,  so  the
29       principal  name  is  just the service name and hostname (ldap/foo.exam‐
30       ple.com from the example above).
31
32       WARNING: retrieving the keytab resets the secret for the Kerberos prin‐
33       cipal.  This renders all other keytabs for that principal invalid.
34
35       This  is  used  during IPA client enrollment to retrieve a host service
36       principal and store it in /etc/krb5.keytab. It is possible to  retrieve
37       the  keytab  without  Kerberos  credentials if the host was pre-created
38       with a one-time password. The keytab can be retrieved by binding as the
39       host  and  authenticating  with this one-time password. The -D|--binddn
40       and -w|--bindpw options are used for this authentication.
41

OPTIONS

43       -s ipaserver
44              The IPA server to retrieve the keytab from (FQDN).
45
46       -p principal-name
47              The non-realm part of the full principal name.
48
49       -k keytab-file
50              The keytab file where to append the new key (will be created  if
51              it does not exist).
52
53       -e encryption-types
54              The   list   of  encryption  types  to  use  to  generate  keys.
55              ipa-getkeytab will use local client defaults  if  not  provided.
56              Valid values depend on the Kerberos library version and configu‐
57              ration.  Common values are: aes256-cts aes128-cts des3-hmac-sha1
58              arcfour-hmac des-hmac-sha1 des-cbc-md5 des-cbc-crc
59
60       -q     Quiet mode. Only errors are displayed.
61
62       --permitted-enctypes
63              This  options  returns a description of the permitted encryption
64              types, like this: Supported encryption types: AES-256  CTS  mode
65              with  96-bit  SHA-1 HMAC AES-128 CTS mode with 96-bit SHA-1 HMAC
66              Triple DES cbc mode with HMAC/sha1 ArcFour with HMAC/md5 DES cbc
67              mode  with  CRC-32  DES  cbc mode with RSA-MD5 DES cbc mode with
68              RSA-MD4
69
70       -P, --password
71              Use this password for the key instead of one randomly generated.
72
73       -D, --binddn
74              The LDAP DN to bind as when retrieving a keytab without Kerberos
75              credentials. Generally used with the -w option.
76
77       -w, --bindpw
78              The LDAP password to use when not binding with Kerberos.
79

EXAMPLES

81       Add  and  retrieve  a  keytab for the NFS service principal on the host
82       foo.example.com and save it in the file  /tmp/nfs.keytab  and  retrieve
83       just the des-cbc-crc key.
84
85          #  ipa-getkeytab  -s ipaserver.example.com -p nfs/foo.example.com -k
86       /tmp/nfs.keytab -e des-cbc-crc
87
88       Add and retrieve a keytab for the ldap service principal  on  the  host
89       foo.example.com and save it in the file /tmp/ldap.keytab.
90
91          #  ipa-getkeytab -s ipaserver.example.com -p ldap/foo.example.com -k
92       /tmp/ldap.keytab
93
94       Retrieve a keytab using LDAP credentials (this will typically  be  done
95       by  ipa-join(1) when enrolling a client using the ipa-client-install(1)
96       command:
97
98          # ipa-getkeytab -s ipaserver.example.com -p host/foo.example.com  -k
99       /etc/krb5.keytab           -D           fqdn=foo.example.com,cn=comput‐
100       ers,cn=accounts,dc=example,dc=com -w password
101

EXIT STATUS

103       The exit status is 0 on success, nonzero on error.
104
105       0 Success
106
107       1 Kerberos context initialization failed
108
109       2 Incorrect usage
110
111       3 Out of memory
112
113       4 Invalid service principal name
114
115       5 No Kerberos credentials cache
116
117       6 No Kerberos principal and no bind DN and password
118
119       7 Failed to open keytab
120
121       8 Failed to create key material
122
123       9 Setting keytab failed
124
125       10 Bind password required when using a bind DN
126
127       11 Failed to add key to keytab
128
129       12 Failed to close keytab
130
131
132
133FreeIPA                           Oct 10 2007                 ipa-getkeytab(1)