ktpass troubles

Douglas E. Engert deengert at anl.gov
Fri Dec 11 10:22:09 EST 2009



Vitaly Tskhovrebov wrote:
> It's funny, but when the "host" test was done, the "HTTP" was broken. It's a
> kind of street magic...
> 

You can still use ktpass, but its much cleaner to use one principal
per account. They will each have separate key, and in separate
keytabs. You can still combine the the two keytabs with ktutil.
Your issues where with trying to have both a "HTTP" and "host" SPN
on the same account.

> There was no replication issue, 'cause I made commands on the target DC.
> I'll try next week this tool, thanks!
> 
> --
> Vitaly.
> 
> We don't use ktpass but msktutil instead:
> 
> http://download.systemimager.org/~finley/msktutil/
> 
> (If you use this, If the service name is not lowercase,
> use the --computer-name option rather then letting it
> derive the name.)

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444



More information about the Kerberos mailing list