2

Using ISC-DHCPD to renew DHCP leases in an Active Directory domain. This requires using ktutil to generate a keytab for DHCPd to use in order to update secure dynamic DNS.

What I need to do is to be able to auto-renew the credential in the keytab. I'm aware of krenew and kinit -R, but what I need is something to automatically refresh them (indefinitely). I have near zero experience with bash or creating daemons.

I see that DHCPd is running as root, and I do have a Kerberos cache file at /tmp/krb5cc_0.

I'm using the Raspbian distribution.

3

use a cron job with kinit and the keytab (man kinit, look at options -k, eventually -t if you use other keytab than the host's).

Raspian is debian based, I believe, so maybe you can use the k5start package that should automate this for you.

  • I was looking at k5start as well, but I must be doing something wrong with the syntax as I don't see it detach. Note that the keytab/cred cache is created using sudo as I figure root needs to be the one that owns it. sudo k5start -p /var/run/k5start.pid -b -f /etc/dhcp/user.keytab -U -K 10 -l 10h -- sh -c 'ls -l /tmp/krb5cc_0' – Trevor Seward Mar 27 '16 at 17:51
  • try getting a root prompt instead of using it under sudo. You should consider using -L to see eventual errors in syslog as well. – natxo asenjo Mar 27 '16 at 19:42
  • 1
    This worked for me: sudo k5start -f /etc/dhcp/user.keytab -U -k /tmp/krb5cc_0 -K 10 -l 10h -p /var/run/k5start.pid -L -b. I can see k5start running as root via ps. Obviously I'll need to monitor to make sure the ticket renewal is functional, but I think this is what I need. – Trevor Seward Mar 27 '16 at 19:43
0

Not familiar with krenew, kinit or Kerberos myself but how regularly do you want the credential to be renewed? If it is once per some time interval then cron is a good tool for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.