1ipa-getkeytab(1) IPA Manual Pages ipa-getkeytab(1)
2
6 ipa-getkeytab - Get a keytab for a Kerberos principal
7
9 ipa-getkeytab -p principal-name -k keytab-file [ -e encryption-types ]
10 [ -s ipaserver ] [ -q ] [ -D|--binddn BINDDN ] [ -w|--bindpw ] [
11 -P|--password PASSWORD ] [ --cacert CACERT ] [ -H|--ldapuri URI ] [
12 -Y|--mech GSSAPI|EXTERNAL ] [ -r ]
13
16 Retrieves a Kerberos keytab.
17 Kerberos keytabs are used for services (like sshd) to perform Kerberos
19 authentication. A keytab is a file with one or more secrets (or keys)
20 for a Kerberos principal.
21 A Kerberos service principal is a Kerberos identity that can be used
23 for authentication. Service principals contain the name of the service,
24 the hostname of the server, and the realm name. For example, the fol‐
25 lowing is an example principal for an ldap server:
26 ldap/foo.example.com@EXAMPLE.COM
28 When using ipa-getkeytab the realm name is already provided, so the
30 principal name is just the service name and hostname (ldap/foo.exam‐
31 ple.com from the example above).
32 ipa-getkeytab is used during IPA client enrollment to retrieve a host
34 service principal and store it in /etc/krb5.keytab. It is possible to
35 retrieve the keytab without Kerberos credentials if the host was
36 pre-created with a one-time password. The keytab can be retrieved by
37 binding as the host and authenticating with this one-time password. The
38 -D|--binddn and -w|--bindpw options are used for this authentication.
39 WARNING: retrieving the keytab resets the secret for the Kerberos prin‐
41 cipal. This renders all other keytabs for that principal invalid.
42 When multiple hosts or services need to share the same key (for
43 instance in high availability or load balancing clusters), the -r
44 option must be used to retrieve the existing key instead of generating
45 a new one (please refer to the EXAMPLES section).
46 Note that the user or host calling ipa-getkeytab needs to be allowed to
48 generate the key with ipa host-allow-create-keytab or ipa ser‐
49 vice-allow-create-keytab, and the user or host calling ipa-getkeytab -r
50 needs to be allowed to retrieve the keytab for the host or service with
51 ipa host-allow-retrieve-keytab or ipa service-allow-retrieve-keytab.
52
55 -p principal-name
56 The non-realm part of the full principal name.
57 -k keytab-file
59 The keytab file where to append the new key (will be created if
60 it does not exist).
61 -e encryption-types
63 The list of encryption types to use to generate keys.
64 ipa-getkeytab will use local client defaults if not provided.
65 Valid values depend on the Kerberos library version and configu‐
66 ration. Common values are: aes256-cts aes128-cts des3-hmac-sha1
67 arcfour-hmac des-hmac-sha1 des-cbc-md5 des-cbc-crc
68 -s ipaserver
70 The IPA server to retrieve the keytab from (FQDN). If this
71 option is not provided the server name is read from the IPA con‐
72 figuration file (/etc/ipa/default.conf). Cannot be used together
73 with -H.
74 -q Quiet mode. Only errors are displayed.
76 --permitted-enctypes
78 This options returns a description of the permitted encryption
79 types, like this: Supported encryption types: AES-256 CTS mode
80 with 96-bit SHA-1 HMAC AES-128 CTS mode with 96-bit SHA-1 HMAC
81 Triple DES cbc mode with HMAC/sha1 ArcFour with HMAC/md5 DES cbc
82 mode with CRC-32 DES cbc mode with RSA-MD5 DES cbc mode with
83 RSA-MD4
84 -P, --password
86 Use this password for the key instead of one randomly generated.
87 -D, --binddn
89 The LDAP DN to bind as when retrieving a keytab without Kerberos
90 credentials. Generally used with the -w option.
91 -w, --bindpw
93 The LDAP password to use when not binding with Kerberos. -D and
94 -w can not be used together with -Y.
95 --cacert
97 The path to the IPA CA certificate used to validate LDAPS/START‐
98 TLS connections. Defaults to /etc/ipa/ca.crt
99 -H, --ldapuri
101 LDAP URI. If ldap:// is specified, STARTTLS is initiated by
102 default. Can not be used with -s.
103 -Y, --mech
105 SASL mechanism to use if -D and -w are not specified. Use either
106 GSSAPI or EXTERNAL.
107 -r Retrieve mode. Retrieve an existing key from the server instead
109 of generating a new one. This is incompatibile with the --pass‐
110 word option, and will work only against a IPA server more recent
111 than version 3.3. The user requesting the keytab must have
112 access to the keys for this operation to succeed.
113
115 Add and retrieve a keytab for the NFS service principal on the host
116 foo.example.com and save it in the file /tmp/nfs.keytab and retrieve
117 just the des-cbc-crc key.
118 # ipa-getkeytab -p nfs/foo.example.com -k /tmp/nfs.keytab -e des-cbc-crc
120 Add and retrieve a keytab for the ldap service principal on the host
122 foo.example.com and save it in the file /tmp/ldap.keytab.
123 # ipa-getkeytab -s ipaserver.example.com -p ldap/foo.example.com -k /tmp/ldap.keytab
125 Retrieve a keytab using LDAP credentials (this will typically be done
127 by ipa-join(1) when enrolling a client using the ipa-client-install(1)
128 command:
129 # ipa-getkeytab -s ipaserver.example.com -p host/foo.example.com -k /etc/krb5.keytab -D fqdn=foo.example.com,cn=computers,cn=accounts,dc=example,dc=com -w password
131 Add and retrieve a keytab for a clustered HTTP service deployed on
133 client1.example.com and client2.example.com (already enrolled), using
134 the client-frontend.example.com host name:
135 # ipa host-add client-frontend.example.com --ip-address 10.1.2.3
137 # ipa service-add HTTP/client-frontend.example.com
138 # ipa service-allow-retrieve-keytab HTTP/client-frontend.example.com --hosts={client1.example.com,client2.example.com}
139 # ipa server-allow-create-keytab HTTP/client-frontend.example.com --hosts=client1.example.com
140 On client1, generate and retrieve a new keytab for client-fron‐
142 tend.example.com:
143 # kinit -k
144 # ipa-getkeytab -p HTTP/client-frontend.example.com -k /tmp/http.keytab
145 On client2, retrieve the existing keytab for client-frontend.exam‐
147 ple.com:
148 # kinit -k
149 # ipa-getkeytab -r -p HTTP/client-frontend.example.com -k /tmp/http.keytab
150
153 The exit status is 0 on success, nonzero on error.
154 0 Success
156 1 Kerberos context initialization failed
158 2 Incorrect usage
160 3 Out of memory
162 4 Invalid service principal name
164 5 No Kerberos credentials cache
166 6 No Kerberos principal and no bind DN and password
168 7 Failed to open keytab
170 8 Failed to create key material
172 9 Setting keytab failed
174 10 Bind password required when using a bind DN
176 11 Failed to add key to keytab
178 12 Failed to close keytab
180IPA Oct 10 2007 ipa-getkeytab(1)