0

Today I use the same keytab for all Linux servers (hundreds). I'm considering using a different keytab for each machine because I suppose that if I use the same keytab the Active Directory thinks I have only one machine but apart from this I don't see many benefits of using different keytabs.

Why should I use a different keytab for each Linux server that authenticates against Active Directory?

1

Using different keytabs for each machine allows you to selectively remove systems from your domain. If a single one of your systems was compromised, and you used the same keytab for all of your systems, and you want to boot the rogue system from your domain, you'll be forced to revoke the keytab from the AD server for all of your systems, not just the rogue system's keytab.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.