When setting up a host (... or updating its keytab if it needs new entries), what's the standard way to set up keytabs?
Looks like the MIT Kerberos docs themselves recommend using ktadmin on the host itself (... sadly, I can't find the exact page anymore to link though). However... I'd presume this involves getting an admin-level ticket onto the new host (... e.g. by logging in using an admin password).
That is, if the host has been compromised, the attacker now has admin powers.
Alternatively, you could create the keytab somewhere else (e.g. on the KDC or your own, secure-enough machine) and copy it over to the new host. However, scp won't work if root ssh is disabled on the target; you can either copy it over to an unprivileged user's home (... an user account that's hopefully not used for anything else?), and make another copy as sudo root...
... or my personal solution is exporting a keytab, base64-ing it, and then running
base64 -d | sudo tee /etc/krb5.keytab on the target. Which... works, but I presume there are more elegant solutions to this?
Or is "keylogger on host" a risk that everyone just accepts?