1

We have lots of Linux (RHEL) machines authenticating against Active Directory.

Is one keytab for all Linux machines enough?

Do we need one keytab for each machine?

What are the PROS and CONS?

What are the risks of using one keytab for all the Linux machines?

  • 2
    I have zero experience with Kerberos but if I understand this correctly I'd say you need one keytab pet machine so that you can revoke them independently. – André Borie Nov 11 '16 at 10:21
2

The main point of Kerberos is authentication - it allows networked entities to prove their identity. In order for this to work, each entity needs to have a unique name (in Kerberos jargon, "principal name").

You won't want to share one keytab among all machines, because a keytab contains the secret key of a specific Kerberos principal name. Sharing a keytab would mean you are sharing that keytab's identity among all machines. The machines would all use Kerberos to declare that they are the same machinename, and Active Directory will not be able to tell the machines apart.

Consider an analogy: trying to share one keytab among multiple machines is similar to trying to share one Kerberos principal name among multiple users. You can instruct five people to all use the same username and password... and they can log in... but the system they log into will not realize that there are five separate people. The system would see multiple connections to one single account, since all the connections are using one single Kerberos principal name.

  • But although machines seems all one, users still need to authenticate so, if it is not important for me to differentiate machines in the AD, I can use the same keytab...am I right? – Eloy Roldán Paredes Nov 14 '16 at 15:37
  • 1
    I have more Kerberos experience than Windows AD experience. My Kerberos experience says that there are few reasons to ever share a keytab. I don't have enough AD experience to say if AD will allow you to share a keytab. – Jacob Nov 14 '16 at 20:00
  • I confirm you that AD allows you to share a keytab between machines and still users have to authenticate. If users must authenticate, what is the benefit of using different keytabs? I see a very big dissavantadge that is that different keytabs need good management. – Eloy Roldán Paredes Nov 22 '16 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.