I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server I want to provide AD authentication services on).

  • The keytab file is for your own use, like if you wanted to set up a webserver with pass through authentication (i.e: logging them into the website as themselves without being prompted for a password again). – Bratchley May 28 '13 at 21:41
  • How did you prove it works? As in the password from AD works? Or passwordless login works? – kurtm Oct 17 '13 at 14:49

How did you prove this exactly?

If you use net ads join, Samba does in fact create a standard principal for a computer object. It just does not export this to a system keytab file, unless configured explicitly.

Check out the "kerberos method" parameter in smb.conf(5) (for samba 4.0; not sure about the older versions).

If you do not need to expose any other kerberized services, such as sshd or httpd, to machines in the domain, you do not need an explicit keytab. If your goal is to have single sign on, it is necessary to create extra principals and put them in the system keytab.


when you register a system with domain controller (net ads join), this will create a valid host principle for the system in /etc/krb5.keytab. This will create a computer object on AD. This object tracks the principle on the AD side what the data is stored in /etc/krb5.keytab client side.

If you just use NIS for the NSS layer and pam_krb5 in the PAM configs /etc/pam.d/system-auth and /etc/pam.d/password-auth, there will be no need for you to register this system to AD.


Does your system ever need to have system-level authentication? For example, did you want to use ssh's GSSAPI Authentication to authenticate? You'll need a keytab on the system that uses it. Another example: NFSv4 uses a local keytab to authenticate mountpoints using the Krb5 security feature.


How did you setup your UNIX to AD integration? Knowing your setup will help us properly answer your question.

AD is both a Kerberized and LDAP Directory Services environment. Kerberos is used for both authentication, encryption hence why keytabs are normally required.

If you like to get the benefits of Kerberos as part of your UNIX to AD integration without the headaches of manually managing keytabs, consider using Centrify Express http://www.centrify.com/express.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.