I'm following the instructions here:


to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'm wondering if this might be a case of me misunderstanding the instructions in the link. I've only started dealing with Kerberos recently and I find myself occasionally getting confused about some of the concepts and terminology.

The page instructs that the ipa-getkeytab command be run on the FreeIPA server to generate a keytab (which I assume contains a new host principal key) for a Windows machine being kerberized. At no point in the instructions does it say anything about copying that generated keytab over to the Windows machine. This is where my I feel my limited understanding of Kerberos begin to unravel.

When joining Linux machines to the FreeIPA server, the ipa-getkeytab command is used on the host that is joining (client) to request a keytab from the FreeIPA server. This has lead me to think a Windows machine would also need to obtain a keytab from the FreeIPA server somehow but the instructions for joining Windows machines just say to run the ipa-getkeytab command directly on the FreeIPA server instead.

If the Windows machine does not have a keytab with the host principal key then would I be correct in saying that it would not be able to use Kerberos to authenticate and get a ticket?

If the opposite is true then could someone please explain how it would work?

  • i don't know about IPA. But keytab must be on server for which it has been generated, clients will generate tickets against kerberos server then will send it to the server, the server is then able to decrypt the ticket thanks to the decrypt key stored in the keytab to check who you are. PS : be carefull, host name must be the real bios or dns name, not an alias. – Walfrat Aug 26 '16 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.