Creating a keytab for an AD user
huaraz at moeller.plus.com
Sun Sep 23 11:05:03 EDT 2018
Hi Development Team,
Are you aware of a change in the salt of AD users ?
I could do the following for AD in the past and can still do it for a Samba server:
ktutil: addent -password -p markus -k 1 -e aes256-cts-hmac-sha1-96
Password for markus at SAMBA.HOME:
ktutil: wkt markus.keytab
#kinit -kt markus.keytab markus
Ticket cache: DIR::/run/user/1000/krb5cc/tktxfHebc
Default principal: markus at SAMBA.HOME
Valid starting Expires Service principal
23/09/18 15:56:34 24/09/18 01:56:34 krbtgt/SAMBA.HOME at SAMBA.HOME
renew until 24/09/18 15:56:34, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
But when I try to perform the same against AD 2012 It fails and when I look at the details I see the salt is not what I expect i.e. it is not DOMAINuser, but DOMAINfullname.
Is that a known change (i.e. which AD attribute is used instead of the user id) and can ktutil addent get an option to set the salt ?
More information about the krbdev