1krb5_keytab_intro(3)        HeimdalKerberos5library       krb5_keytab_intro(3)
2
3
4

NAME

6       krb5_keytab_introThe keytab handing functions
7        -
8

Kerberos Keytabs

10       See the library functions here: Heimdal Kerberos 5 keytab handling
11       functions
12
13       Keytabs are long term key storage for servers, their equvalment of
14       password files.
15
16       Normally the only function that useful for server are to specify what
17       keytab to use to other core functions like krb5_rd_req()
18       krb5_kt_resolve(), and krb5_kt_close().
19
20   Keytab names
21       A keytab name is on the form type:residual. The residual part is
22       specific to each keytab-type.
23
24       When a keytab-name is resolved, the type is matched with an internal
25       list of keytab types. If there is no matching keytab type, the default
26       keytab is used. The current default type is FILE.
27
28       The default value can be changed in the configuration file
29       /etc/krb5.conf by setting the variable [defaults]default_keytab_name.
30
31       The keytab types that are implemented in Heimdal are:
32
33       · file store the keytab in a file, the type's name is FILE . The
34         residual part is a filename. For compatibility with other Kerberos
35         implemtation WRFILE and JAVA14 is also accepted. WRFILE has the same
36         format as FILE. JAVA14 have a format that is compatible with older
37         versions of MIT kerberos and SUN's Java based installation. They
38         store a truncted kvno, so when the knvo excess 255, they are truncted
39         in this format.
40
41       · keytab store the keytab in a AFS keyfile (usually
42         /usr/afs/etc/KeyFile ), the type's name is AFSKEYFILE. The residual
43         part is a filename.
44
45       · memory The keytab is stored in a memory segment. This allows
46         sensitive and/or temporary data not to be stored on disk. The type's
47         name is MEMORY. Each MEMORY keytab is referenced counted by and
48         opened by the residual name, so two handles can point to the same
49         memory area. When the last user closes using krb5_kt_close() the
50         keytab, the keys in they keytab is memset() to zero and freed and can
51         no longer be looked up by name.
52
53   Keytab example
54       This is a minimalistic version of ktutil.
55
56       int
57       main (int argc, char **argv)
58       {
59           krb5_context context;
60           krb5_keytab keytab;
61           krb5_kt_cursor cursor;
62           krb5_keytab_entry entry;
63           krb5_error_code ret;
64           char *principal;
65
66           if (krb5_init_context (&context) != 0)
67               errx(1, "krb5_context");
68
69           ret = krb5_kt_default (context, &keytab);
70           if (ret)
71               krb5_err(context, 1, ret, "krb5_kt_default");
72
73           ret = krb5_kt_start_seq_get(context, keytab, &cursor);
74           if (ret)
75               krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
76           while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){
77               krb5_unparse_name(context, entry.principal, &principal);
78               printf("principal: %s0, principal);
79               free(principal);
80               krb5_kt_free_entry(context, &entry);
81           }
82           ret = krb5_kt_end_seq_get(context, keytab, &cursor);
83           if (ret)
84               krb5_err(context, 1, ret, "krb5_kt_end_seq_get");
85           ret = krb5_kt_close(context, keytab);
86           if (ret)
87               krb5_err(context, 1, ret, "krb5_kt_close");
88           krb5_free_context(context);
89           return 0;
90       }
91
92Version 7.7.0                   Fri Jun 7 2019            krb5_keytab_intro(3)
Impressum