How to generate keytab for headless AD user

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP

up vote
0
down vote

favorite

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an automated job, I’m trying to create a keytab file that can be used with kinit. Since this is a user account, not a service account, and I don’t have admin access for AD, I can’t use kadmin to create it. Instead, I’m trying to use ktutil to generate the correct keytab file and store it in a secure location. As I understand it, the keytab file just contains the raw encryption keys as produced by a standard string2key Kerberos function based on the user’s password and salt. The salt comes from the server in the preauth, but it normally just the username and realm.

I can manually acquire a Kerberos ticket for the user:

kinit headless@REALM

Running klist -e, I see it’s using the encryption type aes256-cts-hmac-sha1-96 for the service key and TGT. The kvno is a bit trickier to get, but from Wireshark, I found it’s value. Using ktutil, I create the keytab:

# ktutil
add_entry -password -p headless@REALM -k 3 -e aes256-cts-hmac-sha1-96
write_kt headless.keytab
quit

To use the keytab file, I’m running this:

kinit headless@REALM -k -t headless.keytab

However, I get a preauth error trying to get the TGT. From a little research, it sounds like the salt used in Microsoft AD might not be conventional so I tried extracting the salt from Wireshark by carefully examining the salt field from the PA-ETYPE-INFO2 preauth data in the Kerberos server response. Indeed, it included the username and realm, but adding the salt to the ktutil add_entry -s option and it still did not accept it.

What is the correct procedure to create a keytab file on Linux for a headless AD account?

share|improve this question

    up vote
    0
    down vote

    favorite

    I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an automated job, I’m trying to create a keytab file that can be used with kinit. Since this is a user account, not a service account, and I don’t have admin access for AD, I can’t use kadmin to create it. Instead, I’m trying to use ktutil to generate the correct keytab file and store it in a secure location. As I understand it, the keytab file just contains the raw encryption keys as produced by a standard string2key Kerberos function based on the user’s password and salt. The salt comes from the server in the preauth, but it normally just the username and realm.

    I can manually acquire a Kerberos ticket for the user:

    kinit headless@REALM
    

    Running klist -e, I see it’s using the encryption type aes256-cts-hmac-sha1-96 for the service key and TGT. The kvno is a bit trickier to get, but from Wireshark, I found it’s value. Using ktutil, I create the keytab:

    # ktutil
    add_entry -password -p headless@REALM -k 3 -e aes256-cts-hmac-sha1-96
    write_kt headless.keytab
    quit
    

    To use the keytab file, I’m running this:

    kinit headless@REALM -k -t headless.keytab
    

    However, I get a preauth error trying to get the TGT. From a little research, it sounds like the salt used in Microsoft AD might not be conventional so I tried extracting the salt from Wireshark by carefully examining the salt field from the PA-ETYPE-INFO2 preauth data in the Kerberos server response. Indeed, it included the username and realm, but adding the salt to the ktutil add_entry -s option and it still did not accept it.

    What is the correct procedure to create a keytab file on Linux for a headless AD account?

    share|improve this question

      up vote
      0
      down vote

      favorite

      up vote
      0
      down vote

      favorite

      I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an automated job, I’m trying to create a keytab file that can be used with kinit. Since this is a user account, not a service account, and I don’t have admin access for AD, I can’t use kadmin to create it. Instead, I’m trying to use ktutil to generate the correct keytab file and store it in a secure location. As I understand it, the keytab file just contains the raw encryption keys as produced by a standard string2key Kerberos function based on the user’s password and salt. The salt comes from the server in the preauth, but it normally just the username and realm.

      I can manually acquire a Kerberos ticket for the user:

      kinit headless@REALM
      

      Running klist -e, I see it’s using the encryption type aes256-cts-hmac-sha1-96 for the service key and TGT. The kvno is a bit trickier to get, but from Wireshark, I found it’s value. Using ktutil, I create the keytab:

      # ktutil
      add_entry -password -p headless@REALM -k 3 -e aes256-cts-hmac-sha1-96
      write_kt headless.keytab
      quit
      

      To use the keytab file, I’m running this:

      kinit headless@REALM -k -t headless.keytab
      

      However, I get a preauth error trying to get the TGT. From a little research, it sounds like the salt used in Microsoft AD might not be conventional so I tried extracting the salt from Wireshark by carefully examining the salt field from the PA-ETYPE-INFO2 preauth data in the Kerberos server response. Indeed, it included the username and realm, but adding the salt to the ktutil add_entry -s option and it still did not accept it.

      What is the correct procedure to create a keytab file on Linux for a headless AD account?

      share|improve this question

      I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an automated job, I’m trying to create a keytab file that can be used with kinit. Since this is a user account, not a service account, and I don’t have admin access for AD, I can’t use kadmin to create it. Instead, I’m trying to use ktutil to generate the correct keytab file and store it in a secure location. As I understand it, the keytab file just contains the raw encryption keys as produced by a standard string2key Kerberos function based on the user’s password and salt. The salt comes from the server in the preauth, but it normally just the username and realm.

      I can manually acquire a Kerberos ticket for the user:

      kinit headless@REALM
      

      Running klist -e, I see it’s using the encryption type aes256-cts-hmac-sha1-96 for the service key and TGT. The kvno is a bit trickier to get, but from Wireshark, I found it’s value. Using ktutil, I create the keytab:

      # ktutil
      add_entry -password -p headless@REALM -k 3 -e aes256-cts-hmac-sha1-96
      write_kt headless.keytab
      quit
      

      To use the keytab file, I’m running this:

      kinit headless@REALM -k -t headless.keytab
      

      However, I get a preauth error trying to get the TGT. From a little research, it sounds like the salt used in Microsoft AD might not be conventional so I tried extracting the salt from Wireshark by carefully examining the salt field from the PA-ETYPE-INFO2 preauth data in the Kerberos server response. Indeed, it included the username and realm, but adding the salt to the ktutil add_entry -s option and it still did not accept it.

      What is the correct procedure to create a keytab file on Linux for a headless AD account?

      security authentication active-directory kerberos

      share|improve this question

      share|improve this question

      share|improve this question

      share|improve this question

      asked Nov 29 at 2:12

      penguin359

      8,66423040

      8,66423040

          active

          oldest

          votes

          Your Answer

          StackExchange.ready(function() {
          var channelOptions = {
          tags: “”.split(” “),
          id: “106”
          };
          initTagRenderer(“”.split(” “), “”.split(” “), channelOptions);

          StackExchange.using(“externalEditor”, function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using(“snippets”, function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: ‘answer’,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: “”,
          imageUploader: {
          brandingHtml: “Powered by u003ca class=”icon-imgur-white” href=”https://imgur.com/”u003eu003c/au003e”,
          contentPolicyHtml: “User contributions licensed under u003ca href=”https://creativecommons.org/licenses/by-sa/3.0/”u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href=”https://stackoverflow.com/legal/content-policy”u003e(content policy)u003c/au003e”,
          allowUrls: true
          },
          onDemand: true,
          discardSelector: “.discard-answer”
          ,immediatelyShowMarkdownHelp:true
          });

          }
          });

          draft saved
          draft discarded

          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin(‘.new-post-login’, ‘https%3a%2f%2funix.stackexchange.com%2fquestions%2f484811%2fhow-to-generate-keytab-for-headless-ad-user%23new-answer’, ‘question_page’);
          }
          );

          Post as a guest

          Required, but never shown

          active

          oldest

          votes

          active

          oldest

          votes

          active

          oldest

          votes

          active

          oldest

          votes

          draft saved
          draft discarded

          Thanks for contributing an answer to Unix & Linux Stack Exchange!

          • Please be sure to answer the question. Provide details and share your research!

          But avoid

          • Asking for help, clarification, or responding to other answers.
          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.

          Some of your past answers have not been well-received, and you’re in danger of being blocked from answering.

          Please pay close attention to the following guidance:

          • Please be sure to answer the question. Provide details and share your research!

          But avoid

          • Asking for help, clarification, or responding to other answers.
          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.

          draft saved

          draft discarded

          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin(‘.new-post-login’, ‘https%3a%2f%2funix.stackexchange.com%2fquestions%2f484811%2fhow-to-generate-keytab-for-headless-ad-user%23new-answer’, ‘question_page’);
          }
          );

          Post as a guest

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Required, but never shown

          Related Post

          Leave a Reply

          Your email address will not be published. Required fields are marked *