There are a number of useful Kerberos client utilities that can help you when working with authentication services.
kinit
kinit will initiate a new ticket from the Kerberos system. This is how you renew your tickets to access kerberized services or renew service principals for daemons. You can kinit interactively by simply running kinit and giving it the principal you want to init as:
1 2 3 | |
No response is good, and you can view your initialized ticket with klist (discussed later on).
You can also kinit with a keytab by giving it the path to a keytab and a principal.
1 2 | |
Note that it did not prompt me for a password. That is because it is using the stored principal key in the keytab to authenticate to the Kerberos server.
klist
klist is commonly used for two purposes: 1) List your current Kerberos tickets and 2) List the principals stored in a keytab. Running klist without any arguments will perform the first action.
1 2 3 4 5 6 7 | |
To list the contents of a keytab:
1 2 3 4 5 6 7 8 | |
The duplication of the principal names represents each of the encryption types that are stored in the keytab. In my case, I use three encryption types to store my principals. If you support older deprecated enc-types (as Kerberos calls them), you will see more entries here.
kdestroy
kdestroy destroys all Kerberos tickets for your current user. You can verify this by doing:
1 2 3 4 | |
ktutil
The Keytab Utility lets you view and modify keytab files. To start, you need to read in a keytab
1 2 3 4 5 6 7 8 | |
If you want to merge two keytabs, you can repeat the read command and the second keytab will be appended to the list. You can also selectively add and delete entries to the keytab as well. Once you are done, you can write the keytab out to a file.
1 2 3 | |