ipa-getkeytab(1)						 IPA Manual Pages						  ipa-getkeytab(1)

NAME

       ipa-getkeytab - Get a keytab for a Kerberos principal

SYNOPSIS

       ipa-getkeytab  -s  ipaserver  -p  principal-name  -k  keytab-file  [  -e encryption-types ] [ -q ] [ -D|--binddn BINDDN ] [ -w|--bindpw ] [
       -P|--password PASSWORD ]

DESCRIPTION

       Retrieves a Kerberos keytab.

       Kerberos keytabs are used for services (like sshd) to perform Kerberos authentication. A keytab is a file with  one  or	more  secrets  (or
       keys) for a Kerberos principal.

       A  Kerberos  service  principal is a Kerberos identity that can be used for authentication. Service principals contain the name of the ser-
       vice, the hostname of the server, and the realm name. For example, the following is an example principal for an ldap server:

	  ldap/foo.example.com@EXAMPLE.COM

       When using ipa-getkeytab the realm name is already provided, so the principal name is just the service name  and  hostname  (ldap/foo.exam-
       ple.com from the example above).

       WARNING: retrieving the keytab resets the secret for the Kerberos principal.  This renders all other keytabs for that principal invalid.

       This is used during IPA client enrollment to retrieve a host service principal and store it in /etc/krb5.keytab. It is possible to retrieve
       the keytab without Kerberos credentials if the host was pre-created with a one-time password. The keytab can be retrieved by binding as the
       host and authenticating with this one-time password. The -D|--binddn and -w|--bindpw options are used for this authentication.

OPTIONS

       -s ipaserver
	      The IPA server to retrieve the keytab from (FQDN).

       -p principal-name
	      The non-realm part of the full principal name.

       -k keytab-file
	      The keytab file where to append the new key (will be created if it does not exist).

       -e encryption-types
	      The  list  of encryption types to use to generate keys.  ipa-getkeytab will use local client defaults if not provided.  Valid values
	      depend on the Kerberos library version and configuration.  Common values	are:  aes256-cts  aes128-cts  des3-hmac-sha1  arcfour-hmac
	      des-hmac-sha1 des-cbc-md5 des-cbc-crc

       -q     Quiet mode. Only errors are displayed.

       --permitted-enctypes
	      This  options  returns a description of the permitted encryption types, like this: Supported encryption types: AES-256 CTS mode with
	      96-bit SHA-1 HMAC AES-128 CTS mode with 96-bit SHA-1 HMAC Triple DES cbc mode with HMAC/sha1 ArcFour with HMAC/md5 DES cbc mode with
	      CRC-32 DES cbc mode with RSA-MD5 DES cbc mode with RSA-MD4

       -P, --password
	      Use this password for the key instead of one randomly generated.

       -D, --binddn
	      The LDAP DN to bind as when retrieving a keytab without Kerberos credentials. Generally used with the -w option.

       -w, --bindpw
	      The LDAP password to use when not binding with Kerberos.

EXAMPLES

       Add  and  retrieve  a keytab for the NFS service principal on the host foo.example.com and save it in the file /tmp/nfs.keytab and retrieve
       just the des-cbc-crc key.

	  # ipa-getkeytab -s ipaserver.example.com -p nfs/foo.example.com -k /tmp/nfs.keytab -e des-cbc-crc

       Add and retrieve a keytab for the ldap service principal on the host foo.example.com and save it in the file /tmp/ldap.keytab.

	  # ipa-getkeytab -s ipaserver.example.com -p ldap/foo.example.com -k /tmp/ldap.keytab

       Retrieve  a  keytab  using  LDAP  credentials  (this  will  typically  be  done	by  ipa-join(1)  when  enrolling  a   client   using   the
       ipa-client-install(1) command:

	  #   ipa-getkeytab   -s   ipaserver.example.com   -p	host/foo.example.com   -k   /etc/krb5.keytab   -D  fqdn=foo.example.com,cn=comput-
       ers,cn=accounts,dc=example,dc=com -w password

EXIT STATUS

       The exit status is 0 on success, nonzero on error.

       0 Success

       1 Kerberos context initialization failed

       2 Incorrect usage

       3 Out of memory

       4 Invalid service principal name

       5 No Kerberos credentials cache

       6 No Kerberos principal and no bind DN and password

       7 Failed to open keytab

       8 Failed to create key material

       9 Setting keytab failed

       10 Bind password required when using a bind DN

       11 Failed to add key to keytab

       12 Failed to close keytab

IPA
								    Oct 10 2007 						  ipa-getkeytab(1)