ipa-getkeytab

Langue: en

Version: Oct 10 2007 (fedora - 04/07/09)

Section: 1 (Commandes utilisateur)

NAME

ipa-getkeytab - Get a keytab for a kerberos principal

SYNOPSIS

ipa-getkeytab [ -s ipaserver ] [ -p principal-name ] [ -k keytab-file ] [ -e encryption-types ] [ -q ]

DESCRIPTION

Retrieves a kerberos keytab.

Kerberos keytabs are used for services (like sshd) to perform kerberos authentication. A keytab is a file with one or more secrets (or keys) for a kerberos principal.

A kerberos service principal is a kerberos identity that can be used for authentication. Service principals contain the name of the service, the hostname of the server, and the realm name. For example, the following is an example principal for an ldap server:


   ldap/foo.example.com@EXAMPLE.COM

When using ipa-getkeytab the realm name is already provided, so the principal name is just the service name and hostname (ldap/foo.example.com from the example above).

WARNING: retrieving the keytab resets the secret for the Kerberos principal. This renders all other keytabs for that principal invalid.

OPTIONS

-s ipaserver
The IPA server to retrieve the keytab from (FQDN).
-p principal-name
The non-realm part of the full principal name.
-k keytab-file
The keytab file where to append the new key (will be created if it does not exist).
-e encryption-types
The list of encryption types to use to generate keys. ipa-getkeytab will use local client defaults if not provided. Valid values depend on the kerberos library version and configuration. Common values are: aes256-cts aes128-cts des3-hmac-sha1 arcfour-hmac des-hmac-sha1 des-cbc-md5 des-cbc-crc
-q
Quiet mode. Only errors are displayed.
--permitted-enctypes
This options returns a description of the permitted encryption types, like this: Supported encryption types: AES-256 CTS mode with 96-bit SHA-1 HMAC AES-128 CTS mode with 96-bit SHA-1 HMAC Triple DES cbc mode with HMAC/sha1 ArcFour with HMAC/md5 DES cbc mode with CRC-32 DES cbc mode with RSA-MD5 DES cbc mode with RSA-MD4

EXAMPLES

Add and retrieve a keytab for the NFS service principal on the host foo.example.com and save it in the file /tmp/nfs.keytab and retrieve just the des-cbc-crc key.


   # ipa-getkeytab -s ipaserver.example.com -p nfs/foo.example.com -k /tmp/nfs.keytab -e des-cbc-crc

Add and retrieve a keytab for the ldap service principal on the host foo.example.com and save it in the file /tmp/ldap.keytab.


   # ipa-getkeytab -s ipaserver.example.com -p ldap/foo.example.com -k /tmp/ldap.keytab

EXIT STATUS

The exit status is 0 on success, nonzero on error.