Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Question

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things manually without using realm join or net ads join and so on. When I look at a kerberos keytab file (via ktutil) that was automagically generated by these ad joining utilities, I see entries like COMPUTER$DOMAIN.EXAMPLE.COM (note the dollar sign).

But if I follow articles that describe how you can do things manually (not using realmd, etc), such as creating keytabs using the ktpass command (Windows AD), setspn, and creating the service principles (such as RestrictedKrbHost/domain.example.com and HOST/domain.example.com, etc), then these keytab files don't contain these COMPUTER$DOMAIN.EXAMPLE.COM entries. Not sure if I have skipped something or misstepped, but it seems, when using utilities like ktpass on Windows, I cannot create these kind of entries manually, or I don't know how.

Question: How do automatic utilities (like realmd) work to create theseCOMPUTER$DOMAIN.EXAMPLE.COM entries in the keytabs, or put another way, how can I create them manually (Linux- or Windows-AD-side) if I do not use such utilities? Looking through the realmd sources is leaving my head a bit dizzy. (https://github.com/freedesktop/realmd/)

Thanks!

Answer 1

The tool I was looking for is called "msktutil", by Dan Perry and others (https://github.com/msktutil/msktutil). It can create the keytabs I was looking for ([email protected]>COM). A man page (Ubuntu) is here: https://manpages.ubuntu.com/manpages/eoan/man1/msktutil.1.html

It's a useful tool when you want to script docker images/containers that need to integrate with Windows Active Directory, while avoiding SSSD and mount-binding the host /var/lib/sss/pipes directory as data volume to the container. This utility also allows me to keep things nicely in sync with AD.