I use MIT ktutil a lot on Linux and I am fed up using the following sequence, even if command shortcuts and file name completion are here to help:

rkt my.keytab

Isn't there a way to get the same result in a "one-line" way from the shell? Either with an alias, a function, or just with another tool?

4 Answers 4


I always use klist instead to list the contents of keytab files out instead of ktutil.

Example #1 - klist

$ klist -kt /etc/somedir/conf/some.keytab
Keytab name: FILE:/etc/somedir/conf/some.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   5 08/25/15 11:18:35 app/[email protected]
   5 08/25/15 11:18:35 app/[email protected]
   5 08/25/15 11:18:35 app/[email protected]
   7 08/25/15 11:18:35 app/[email protected]

Example #2 - process substitution

You can also use a redirect to ktutil's STDIN like so:

$ ktutil < <(echo -e "rkt /etc/somedir/conf/some.keytab\nlist")
ktutil:  rkt /etc/somedir/conf/some.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    5 app/[email protected]
   2    5 app/[email protected]
   3    5 app/[email protected]
   4    7 app/[email protected]

I found a way with a shell function, after guessing ktutil may accept commands from stdin:

rkt() { echo -e "read_kt $1\nlist\nquit" | ktutil | grep -v "^ktutil:"; }

And invoke with rkt my.keytab

Works as far as file name contains no space.


This can help to merge 2 keytab, using standad input to use in shell script

ktutil < <(echo -e "rkt/var/tmp/keytab/merge/krb5.keytab.server.keytab1\n
rkt /var/tmp/keytab/merge/krb5.keytab.server.keytab1\n
wkt /var/tmp/keytab/merge/krb5.keytab\n
ktutil:  rkt /var/tmp/keytab/merge/krb5.keytab.server.keytab1
ktutil:  rkt /var/tmp/keytab/merge/krb5.keytab.server.keytab1
ktutil:  wkt /var/tmp/keytab/merge/krb5.keytab
ktutil:  quit

Other answers provide a way to run a series of ktutil commands and then exit.

It's more difficult to do a series of commands and then get an interactive session, with full line editing capabilities.

You can achieve this with a script for the expect program, which should be available to install from your distro.

#!/usr/bin/env expect -f
spawn ktutil
send "read_kt [lrange $argv 0 1]\nl\n"
set CTRLZ \032
interact {
 -reset $CTRLZ {exec kill -STOP [pid]}
 \003 exit

Save as myktutil somewhere in your PATH and make it executable with chmod +x

Then you can do, for example:

$ myktutil foo.keytab

This will read in the keytab file foo.keytab, list the keys and then drop you into the interactive command at that point.

Extending the script to do non-trivial things will require familiarization with expect and the Tcl language.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .