I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using sqlcmd.

To give more context, a snippet of my working Python code is below:

import subprocess

kinit = ['kinit', 'serviceaccount@DIRECTORY.COM', '-k', '-t', '/usr/local/var/krb5kdc/serviceaccount.keytab']
kinit_cl = subprocess.Popen(kinit, stdout=subprocess.PIPE)
kinit_output = kinit_cl.stdout.read()

klist = ['klist','-l']
klist_cl = subprocess.Popen(klist, stdout=subprocess.PIPE)
klist_output = klist_cl.stdout.read()
print klist_output

if 'KEYRING:persistent' in klist_output:
    print "Service Account Authenticated"
    #proceed to run sqlcmd queries

My question relates more to the management of the keytab where my credential is stored, which is great because my password is not stored in the clear. The password expires every 30 days though, and I've noticed that if I use kpasswd to change my password from the command line, it will ask for my old password. This would mean I would have to store it in the clear somewhere and pass it, whereas I am happy not knowing my password and letting a script manage this for me.

To generate a new strong password in Python wont be an issue, my question is what command can I use to change a password without being prompted for the old password. A command from kadmin.local says the password is changed, but the password accepted is still the old password. kadmin gives me the error below even though I added the service account in as an admin to the local file:

[root@osboxes krb5kdc]# kadmin.local -q "addprinc serviceaccount/admin"
Authenticating as principal serviceaccount/admin@DIRECTORY.COM with password.
WARNING: no policy specified for serviceaccount/admin@DIRECTORY.COM; 
defaulting to no policy
Enter password for principal "serviceaccount/admin@DIRECTORY.COM": 
Re-enter password for principal "serviceaccount/admin@DIRECTORY.COM": 
Principal "serviceaccount/admin@DIRECTORY.COM" created.
[root@osboxes krb5kdc]# kinit serviceaccount/admin
kinit: Client 'serviceaccount/admin@DIRECTORY.COM' not found in Kerberos database while getting initial credentials
[root@osboxes krb5kdc]# kadmin serviceaccount
kadmin: Client 'serviceaccount/admin@DIRECTORY.COM' not found in Kerberos database while initializing kadmin interface

Do I need to do this only through kadmin? Or else how would I script this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.