Recommnended way to get krb5.keytab files for KfW installations onWindows

[Holger Rauch]

Rehi,

replying to my own mail because the reply by Douglas E. Engert
(thanks for replying, Douglas!) unfortunately didn't make it
through.

I try to accesss a central file server running Debian Lenny and
offering file access via various protcols/services: FTP, SSH/SCP
(OpenSSH), OpenAFS, CIFS (via Samba daemons) from a Windows XP
box.

I know that for SSH access host principals are required for each
client and are supposed to be stored in a krb5.keytab file, at least
that's the case with MIT Kerberos on Linux/Unix.

Isn't that also the case when using Quest PuTTY (AFAIK the only free
implementation having GSSAPI support) and WinSCP for SSH access from a
WinXP client having KfW (MIT Kerberos for Windows) installed?

The main reason why I ask this is that I want to avoid having to use
ktpass.exe because of it's mapping option(s) - that sort of scares me
off.

Any hints are most welcome.

Thanks & kind regards,

       Holger

On Mon, 26 Oct 2009, Holger Rauch wrote:

> Hi,
> 
> since the kadmin utility is not included with the current KfW bundle
> from the MIT Kerberos web site (version 3.2.2), is it "safe" to
> create krb5.keytab files for KfW using kadmin on a Unix machine and
> transfer the file to the Windows box?
> 
> (Yes, I heard about ktpass.exe, but that's kind of awkward to use
> because of the username/principal mapping stuff that needs to be taken
> into account. Or is ktpass.exe the recommended utility and the kadmin
> on Unix+file transfer approach thus discouraged?)
> 
> I'm using KfW on a current (all updates applied) WinXP Professional
> system.
> 
> So, what's the easiest (and recommended) way to get krb5.keytab files
> that are usable by KfW installations?
> 
> (I need this for accessing a kerberized Samba server, a kerberized
> sshd using PuTTY/WinSCP, and a kerberized FTP server; all of these
> services are running on the same host).
> 
> Thanks for any hints & kind regards,
> 
>        Holger
> *** eSafe scanned this email for malicious content ***
> *** IMPORTANT: Do not open attachments from unrecognized senders  ***



> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

--
=========================================
Holger Rauch
Entwicklung Anwendungs-Software
Systemadministration UNIX

Tel.: +49 / 9131 / 877 - 141
Fax: +49 / 9131 / 877 - 266
Email: Holger.Rauch at empic.de
=========================================
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://mailman.mit.edu/pipermail/kerberos/attachments/20091211/102d3330/attachment.bin