2

I have set up a ubuntu 16.04 machine and integrated it into a windows active directory domain environment using this guide: https://www.unixmen.com/how-to-join-an-ubuntu-desktop-into-an-active-directory-domain/

I use kerberos authentication for several services (cifs, http etc.)

Login works fine and with $ klist i see a valid ticket after login which is valid for 10h and renewable for 7 days. Service principal is krbtgt/[email protected]

The machine needs to be online 24/7 and i need to request a new ticket before it gets invalid. I renew my ticket with a krenew deamon running $ krenew -i -K 10 at login. This also works fine!

But this only works until the renew lifetime expires.

I can manually request a ticket with $ kinit but i have to type in the user password.

My question is how can i automate the ticket request every 5 days?

I have read about $ kinit -v which should use the current credentials cache to authenticate for the ticket request but it doesn't work:

kinit: KDC can't fulfill requested option while validating credentials

I also read that i would need to create a keytab in this case. Is this true? If yes - How to create it?

Can anyone help?

2
  • i created a cronjob 0 6 */5 * * echo *password*|kinit but this is just a temporary solution as you might guress...
    – dynamight
    Dec 6, 2016 at 12:13
  • I've been also looking for a similar solution. kinit -v turns the same error as above.
    – shafuq
    Nov 14, 2022 at 8:57

1 Answer 1

0

Use a keytab fo get a TGT? You need to be extra careful though. If it leaks it has the same effect as leaking the password. ktutil is your friend, more precisely its 'addent' and 'wkt' sub commands.

user@host ~ $ ktutil 
ktutil:  addent -password  -p PRINCIPAL@REALM -e  arcfour-hmac -k 1
Password for PRINCIPAL@REALM: 
ktutil:  wkt test.keytab
ktutil: q
user@host ~ $ ls -l test.keytab 
-rw------- 1 user user 59 Feb 15 00:05 test.keytab

the passe that keytab to kinit to get a tgt.

auks plugin for slurm has a script that does somthing like that (https://github.com/hautreux/auks/blob/master/src/auksd/aukspriv)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .