Instructions on how to get a keytab file

[fatmcgav]

I'm trying to set this plugin up now, and am struggling with getting a Keytab file generated...

Do you have any instructions that could be added to the README?

[ptulpen]

Well, we use a service account for this and it works for us with: msktutil --update --use-service-account --account-name #youaccountname# --keytab /etc/foreman-proxy/realm_ad.keytab --dont-change-password --old-account-password #enterhere#

[martencassel]

>ktutil
addent -password -p Administrator@EXAMPLE.COM -k 1 -e RC4-HMAC
- enter password for username -
wkt realm_ad.keytab
q
> kdestroy
> kinit Administrator@EXAMPLE.COM -k -t realm_ad.keytab; 
> klist
Ticket cache: KEYRING:persistent:1000:1000
Default principal: Administrator@EXAMPLE.COM

Valid starting       Expires              Service principal
2017-01-27 10:30:00  2017-01-27 20:30:00  krbtgt/EXAMPLE.COM@EXAMPLE.COM
	renew until 2017-02-03 10:30:00

[martencassel]

RC4-HMAC is considered to weak nowadays.

>ktutil
addent -password -p foreman_ad@LAB.LOCAL -k 1 -e aes256-cts-hmac-sha1-96
- enter password for username -
wkt foreman_ad.keytab
q

https://support.microsoft.com/en-gb/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d

https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/unsupported-etype-error-accessing-trusted-domain