AD-KEYTAB(8)

✨ AD-KEYTAB(8) ✨

okay bestie, welcome to ad-keytab, straight outta the wallet manual, section 8 🫶 this is the little script that handles your keytabs for Active Directory principals, and yes it's about to be your new fave. buckle up 💅

---

🌸 NAME 🌸

ad-keytab — manage and display keytabs for Active Directory principals ✨

---

🦋 SYNOPSIS 🦋

ad-keytab create|update|delete|show keytab-id [keytab-file]
[--ad_server=hostname] [--computer_rdn=dn] [--user_rdn] [--dump]
[--help] [--manual] [--debug]

---

💖 DESCRIPTION 💖

So this script is lowkey a wrapper around msktutil and ldapsearch, and its whole job is making host and service keytabs way less of a nightmare to create. no cap. 🎀

It's the plug for boot strapping the Kerberos credentials you need to use Active Directory as a backend keytab store for wallet. and it shares the wallet configuration file, so it's already in the group chat, it knows the vibes.

Generally you're gonna need two keytabs to set wallet up:

• one host keytab for the wallet server host itself 🖥️
• one service keytab for wallet to use when it connects to an Active Directory Domain Controller 🔌

⚠️ okay real talk for a sec: this script does not update the Wallet database. which means any keytabs it creates will be invisible from wallet. not a vibe, just a fact. 💀

---

👑 ACTIONS 👑

• create — adds a keytab to AD and updates the keytab file. Fails if the keytab already exists. (it said no duplicates, periodt 🙅)
• update — updates an existing keytab in AD and updates the keytab file. Fails if the keytab does not exist. (can't update what isn't there, bestie 😭)
• delete — deletes a keytab from AD and removes it from the keytab file. bye bye 💅
• show — shows AD's view of the account corresponding to the keytab. this one does not use msktutil at all — it queries AD directly using LDAP 👀

---

✨ OPTIONS AND ARGUMENTS ✨

• keytab-id — this is either a host principal name in the form host/<fqdn>, or a service principal name in the form service/<id>. heads up: service keytab identifiers cannot be longer than 18 characters because of an Active Directory restriction. that's the limit, no negotiating 🚫
• keytab-filename — the name of the keytab file. defaults to /etc/krb5.keytab 📁
• --conf=filename — the configuration file to read. the script goes hunting for a config file in this exact order:
  1. The command line switch --conf
  2. The environment variable ADKEYTAB
  3. The file .ad-keytab.conf
  4. The file /etc/ad-keytab.conf
• --ad_server=hostname — the name of the Active Directory host to connect to. and it genuinely matters that the script contacts only _one_ server, because propagation inside an Active Directory domain can be quite slow. pick one, stay loyal 🫶
• --base_dn=ou=org,dc=domain,dc=tld — the base distinguished name holding both computer and user accounts 🗂️
• --computer_rdn=dn — the relative distinguished name to use as the base DN for both creating host keytabs and searching Active Directory. the distinguished name it forms will be computer_rdn,base_dn.
• --user_rdn=dn — the relative distinguished name to use as the base DN for LDAP searches of Active Directory for service keytabs. the distinguished name it forms will be user_rdn_rdn,base_dn.
• --dump — when displaying keytab attributes, show all of the attributes. the whole tea ☕
• --help — displays help text.
• --manual — displays more complete help text. the extended cut 🎬
• --debug — turns on debugging displays. very loud, very informative 🔊

---

🌈 SEE ALSO 🌈

Set the documentation for Wallet::Config for configuration information, i.e. perldoc Wallet::Config. 👈 go read it, iykyk

---

🎀 AUTHOR 🎀

Bill MacAllister <whm@dropbox.com> — king behavior honestly 👑

---

💜 COPYRIGHT AND LICENSE 💜

Copyright 2016 Dropbox, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

SPDX-License-Identifier: MIT

---

and that's the whole page, bestie!! 🥳 this was version 1.5, dated 2024-04-30, from the wallet source, and it's been an absolute pleasure. go make some keytabs, you're gonna slay 💅✨🦋🌸