Working with Samba 4 as a Windows “domain member”, I’d like to automate deployment of keytabs. Specifically, I’d like the equivalent of adding service principals to the appropriate tables. E. g.
# kadmin -k /etc/squid/proxy.keytab -w secret -p kadmin/admin -q "ktadd HTTP/proxy.my.domain"
Sadly, MS doesn’t appear to offer kadmin
interoperability.
Samba has commands like
# net rpc vampire keytab all.keytab -U Administrator%secret
# net ads keytab create -U Administrator%secret
neither of which however appears to be capable of selectively extracting service principals. Also, for a non-trivial site installation I imagine the “vampire” method to require too many system resources, not to mention the necessary postprocessing with ktutil.
In my test setup, the DC is a Windows2008 server, the client is running a 3.14-ish Linux, MIT KRB5 1.15.x, and Samba 4.x. The kerberized service in question is a Squid v3.5.x. Kerberos integration itself works well when creating keytabs on the DC (ktpass) and then copying them over to each machine manually. But I’d rather avoid this kind of pedestrian approach.
It doesn’t necessarily have to be a Samba based solution. That’s just the path I’m investigating ATM.