---
name: "ad-keytab"
section: "8"
platform: "linux"
package: "krb5-wallet-server"
version: "1.7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ad-keytab"
---

# ad-keytab(8)

Manage and display keytabs for Active Directory principals

## NAME

ad-keytab - Manage and display keytabs for Active Directory principals

## SYNOPSIS

ad-keytab create\|update\|delete\|show keytab-id \[keytab-file\] \[--ad\_server=hostname\] \[--computer\_rdn=dn\] \[--user\_rdn\] \[--dump\] \[--help\] \[--manual\] \[--debug\]

## DESCRIPTION

This script is a wrapper around msktutil and ldapsearch to simplify the creation of host and service keytabs.  The script is useful for boot strapping the Kerberos credentials required to use Active Directory as a backend keytab store for wallet.  The script shares the wallet configuration file.

Generally, two keytabs will need to be created to setup wallet.  One host keytab for the wallet server host and one service keytab for wallet to use when connecting to an Active Directory Domain Controller.

Note, this script does not update the Wallet database which means any keytabs created by it will be invisible from wallet.

## ACTIONS

- create

  Add a keytab to AD and update the keytab file.  Fails if the keytab already exists.

- update

  Update an existing keytab in AD and update the keytab file.  Fails if the keytab does not exist.

- delete

  Delete a keytab from AD and remove it from the keytab file.

- show

  Show AD's view of the account corresponding to the keytab.  This action does not use msktutil and queries AD directly using LDAP.

## OPTIONS AND ARGUMENTS

- keytab-id

  This is either host principal name of the form host/\<fqdn\> or a service principal name of the form service/\<id\>.  Service keytab identifiers cannot be longer than 18 characters because of an Active Directory restriction.

- keytab-filename

  The name of the keytab file.  Defaults to /etc/krb5.keytab.

- \--conf=filename

  The configuration file to read.  The script searches for a configuration file in the following order.

  ```
        * The command line switch --conf
        * The environment variable ADKEYTAB
        * The file .ad-keytab.conf
        * The file /etc/ad-keytab.conf
  ```

- \--ad\_server=hostname

  The name of the Active Directory host to connect to.  It is important what the script contact only \_one\_ server due to the fact that propagation within an Active Directory domain can be quite slow.

- \--base\_dn=ou=org,dc=domain,dc=tld

  The base distinguished name holding both computer and user accounts.

- \--computer\_rdn=dn

  The relative distinguished name to use as the base DN for both the creation of host keytabs and searches of Active Directory.  The distinguished name formed will be computer\_rdn,base\_dn.

- \--user\_rdn=dn

  The relative distinguished name to use as the base DN for LDAP searches of Active Directory for service keytabs.  The distinguished name formed will be user\_rdn\_rdn,base\_dn.

- \--dump

  When displaying keytab attributes show all of the attributes.

- \--help

  Displays help text.

- \--manual

  Displays more complete help text.

- \--debug

  Turns on debugging displays.

## SEE ALSO

Set the documentation for Wallet::Config for configuration information, i.e. perldoc Wallet::Config.

## AUTHOR

Bill MacAllister \<whm@dropbox.com\>

## COPYRIGHT AND LICENSE

Copyright 2016 Dropbox, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

SPDX-License-Identifier: MIT