Can I pass a cryptographic hash of a user's password to Kerberos while creating principals?

Question

I am running MIT Kerberos V and I would like to automate the creation of principals. The page here explains how to do this by providing principal names and passwords on the command line like so:

awk '{ print "ank +needchange -pw", $2, $1 }' < /tmp/princnames | 
    time /usr/sbin/kadmin.local> /dev/null

Where ank is a synonym for add_principal (per kadmin(5)) and it is assumed that /tmp/princnames is of the form:

principal1 password1
principal2 password2
...

The obvious drawback of this is that each principal's password must be supplied in the clear. Is there any way I can pass a crypto hash instead?

This is for two reasons:

1. Security, obviously.
2. I'm migrating from an old system and would like my users to be able to authenticate with their old passwords so I would like to pass their hashed passwords from the shadow file to Kerberos.

Answer 1

You cannot use a hash of the user’s password; you need the password itself. Kerberos is a shared-secret system: the Kerberos authentication servers (key distribution centers, or KDCs) share a secret with each principal in the system: for a user, that is a set of keys derived from the password.

Answer 2

I found a partial solution to this. It only works for Heimdal implementations of the Kerberos protocol, which unfortunately doesn't help me. Here it is in case it can help someone else.

The Oracle article called Configuring Kerberos Clients (the link is to a section titled "How to Configure Automatic Migration of Users in a Kerberos Realm") explains how you can use a PAM module called pam_krb5_migrate in order to automatically create Kerberos V principals when an existing shadow user logs in with their old Unix password.

On Debian, this module can be found in the libpam-krb5-migrate-heimdal package.