Don't use ktutil
unless you're trying to make a keytab from an existing keytab. Use kadmin
instead.
# kadmin -p user/admin
Password for user/admin@EXAMPLE.COM:
kadmin: add_principal -randkey service/server.example.com
WARNING: no policy specified for service/server.example.com@EXAMPLE.COM; defaulting to no policy
Principal "service/server.example.com@EXAMPLE.COM" created.
kadmin: ktadd -k /etc/service/service.keytab service/server.example.com
Entry for principal service/server.example.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab
Entry for principal service/server.example.com with kvno 2, encryption type camellia256-cts-cmac added to keytab
kadmin: quit
Depending on your kdc's kdc.conf
you may end up with different encryption:salt types. The default list is:
aes256-cts-hmac-sha1-96:normal
aes128-cts-hmac-sha1-96:normal
des3-cbc-sha1:normal
arc‐four-hmac-md5:normal
You can also limit (or expand) the enctypes used in the keytab when creating it by using -e
and specifying the desired types.
If you are trying to make a keytab from an existing keytab:
# kutil
ktutil: read_kt /etc/krb5.keytab
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 6 host/server.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
2 6 host/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)
3 3 HTTP/server.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
4 3 HTTP/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)
ktutil: delete_entry 1
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 6 host/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)
2 3 HTTP/server.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
3 3 HTTP/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)
ktutil: delete_entry 1
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 3 HTTP/server.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
2 3 HTTP/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)
ktutil: write_kt /etc/httpd/http.keytab
ktutil: quit
# klist -ke /etc/httpd/http.keytab
Keytab name: FILE:/etc/httpd/http.keytab
KVNO Principal
---- ---------------------------------------------------------------------
3 HTTP/server.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
3 HTTP/server.example.com@EXAMPLE.COM (camellia256-cts-cmac)