I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an automated job, I'm trying to create a keytab file that can be used with kinit. Since this is a user account, not a service account, and I don't have admin access for AD, I can't use kadmin to create it. Instead, I'm trying to use ktutil to generate the correct keytab file and store it in a secure location. As I understand it, the keytab file just contains the raw encryption keys as produced by a standard string2key Kerberos function based on the user's password and salt. The salt comes from the server in the preauth, but it normally just the username and realm.

I can manually acquire a Kerberos ticket for the user:

kinit headless@REALM

Running klist -e, I see it's using the encryption type aes256-cts-hmac-sha1-96 for the service key and TGT. The kvno is a bit trickier to get, but from Wireshark, I found it's value. Using ktutil, I create the keytab:

# ktutil
add_entry -password -p headless@REALM -k 3 -e aes256-cts-hmac-sha1-96
write_kt headless.keytab

To use the keytab file, I'm running this:

kinit headless@REALM -k -t headless.keytab

However, I get a preauth error trying to get the TGT. From a little research, it sounds like the salt used in Microsoft AD might not be conventional so I tried extracting the salt from Wireshark by carefully examining the salt field from the PA-ETYPE-INFO2 preauth data in the Kerberos server response. Indeed, it included the username and realm, but adding the salt to the ktutil add_entry -s option and it still did not accept it.

What is the correct procedure to create a keytab file on Linux for a headless AD account?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.