| < wallet-report Manual Page | Russ Allbery > Software > wallet | wallet To-Do List > |
(Extract keytabs from the KDC without changing the key)
keytab-backend retrieve principal
keytab-backend retrieves a keytab for an existing principal from the KDC database without changing the current key. It allows generation of a keytab for a service without rekeying that service. It requires a kadmin.local patched to support the -norandkey option to ktadd.
This script is intended to run under remctld. On success, it prints the keytab to standard output, logs a success message to syslog (facility auth, priority info), and exits with status 0. On failure, it prints out an error message, logs an error to syslog (facility auth, priority err), and exits with a non-zero status.
The principal is checked for basic sanity (only accepting alphanumerics,
_, and - with an optional instance and then only
alphanumerics, _, -, and . in the realm) and then
checked against a configuration file that lists regexes of principals that
can be retrieved. When deploying this software, limit as tightly as
possible which principals can be downloaded in this fashion. Generally
only shared service principals used on multiple systems should be made
available in this way.
keytab-backend does not do any authorization checks. Those should be done by remctld before it is called.
The configuration file that controls which principals can have their
keytabs retrieved. Blank lines and lines starting with #, as well
as anything after # on a line, are ignored. All other lines should
be Perl regular expressions, one per line, that match principals whose
keytabs can be retrieved by keytab-backend. Any principal that
does not match one of those regular expressions cannot be retrieved.
The temporary directory used for creating keytabs. keytab-backend will create the keytab in this directory, make sure that was successful, and then delete the temporary file after the results have been sent to standard output.
kadmin.local(8), remctld(8)
This program is part of the wallet system. The current version is available from <http://www.eyrie.org/~eagle/software/wallet/>.
Russ Allbery <rra@stanford.edu>
| < wallet-report Manual Page | Russ Allbery > Software > wallet | wallet To-Do List > |