ktpass troubles
Douglas E. Engert
deengert at anl.gov
Fri Dec 11 10:22:09 EST 2009
Vitaly Tskhovrebov wrote:
> It's funny, but when the "host" test was done, the "HTTP" was broken. It's a
> kind of street magic...
>
You can still use ktpass, but its much cleaner to use one principal
per account. They will each have separate key, and in separate
keytabs. You can still combine the the two keytabs with ktutil.
Your issues where with trying to have both a "HTTP" and "host" SPN
on the same account.
> There was no replication issue, 'cause I made commands on the target DC.
> I'll try next week this tool, thanks!
>
> --
> Vitaly.
>
> We don't use ktpass but msktutil instead:
>
> http://download.systemimager.org/~finley/msktutil/
>
> (If you use this, If the service name is not lowercase,
> use the --computer-name option rather then letting it
> derive the name.)
--
Douglas E. Engert <DEEngert at anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
More information about the Kerberos
mailing list