I have set up a ubuntu 16.04 machine and integrated it into a windows active directory domain environment using this guide: https://www.unixmen.com/how-to-join-an-ubuntu-desktop-into-an-active-directory-domain/

I use kerberos authentication for several services (cifs, http etc.)

Login works fine and with $ klist i see a valid ticket after login which is valid for 10h and renewable for 7 days. Service principal is krbtgt/EXAMPLE.COM@EXAMPLE.COM

The machine needs to be online 24/7 and i need to request a new ticket before it gets invalid. I renew my ticket with a krenew deamon running $ krenew -i -K 10 at login. This also works fine!

But this only works until the renew lifetime expires.

I can manually request a ticket with $ kinit but i have to type in the user password.

My question is how can i automate the ticket request every 5 days?

I have read about $ kinit -v which should use the current credentials cache to authenticate for the ticket request but it doesn't work:

kinit: KDC can't fulfill requested option while validating credentials

I also read that i would need to create a keytab in this case. Is this true? If yes - How to create it?

Can anyone help?

  • i created a cronjob 0 6 */5 * * echo *password*|kinit but this is just a temporary solution as you might guress... – dynamight Dec 6 '16 at 12:13

Use a keytab fo get a TGT? You need to be extra careful though. If it leaks it has the same effect as leaking the password. ktutil is your friend, more precisely its 'addent' and 'wkt' sub commands.

user@host ~ $ ktutil 
ktutil:  addent -password  -p PRINCIPAL@REALM -e  arcfour-hmac -k 1
Password for PRINCIPAL@REALM: 
ktutil:  wkt test.keytab
ktutil: q
user@host ~ $ ls -l test.keytab 
-rw------- 1 user user 59 Feb 15 00:05 test.keytab

the passe that keytab to kinit to get a tgt.

auks plugin for slurm has a script that does somthing like that (https://github.com/hautreux/auks/blob/master/src/auksd/aukspriv)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.