When setting up a host (... or updating its keytab if it needs new entries), what's the standard way to set up keytabs?

Looks like the MIT Kerberos docs themselves recommend using ktadmin on the host itself (... sadly, I can't find the exact page anymore to link though). However... I'd presume this involves getting an admin-level ticket onto the new host (... e.g. by logging in using an admin password).

That is, if the host has been compromised, the attacker now has admin powers.

Alternatively, you could create the keytab somewhere else (e.g. on the KDC or your own, secure-enough machine) and copy it over to the new host. However, scp won't work if root ssh is disabled on the target; you can either copy it over to an unprivileged user's home (... an user account that's hopefully not used for anything else?), and make another copy as sudo root...

... or my personal solution is exporting a keytab, base64-ing it, and then running base64 -d | sudo tee /etc/krb5.keytab on the target. Which... works, but I presume there are more elegant solutions to this?

Or is "keylogger on host" a risk that everyone just accepts?

1 Answer 1


A keytab is the password derived into a key. That key is what allows you to authenticate to the KDC. As such, if the host itself is compromised it doesn't really matter if they saw the password or got the keytab. It's all the same to an attacker.

You also don't need admin credentials to generate a keytab. You only need the user's credential itself. That limits the attack to just that one account.

  • ... I didn't know users can generate keytabs for themselves; nice, thanks!!! But then... if I understand correctly, you're proposing to just type machine passwords (since they're our "users") into the new machine. Aren't machine passwords real long and auto-generated though? Or do people just use e.g. 12-character pwgen-originating ones?
    – Latanius
    Commented Oct 27, 2020 at 16:59
  • That's your call. You're creating the principals.
    – Steve
    Commented Oct 27, 2020 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .