What is a keytab exactly?

南楼画角 提交于 2020-05-10 07:28:07

问题


I am trying to understand how Kerberos works and so came across this file called Keytab which, I believe, is used for authentication to the KDC server.

Just like every user and service(say Hadoop) in a kerberos realm has a service principal, does every user and service have a keytab file?

Also, does authentication using keytab work on symmetric key cryptography or public-private key?


回答1:


To answer your two questions, every user and service does not need a keytab file and keytabs use symmetric key cryptography.

I'm going to explain a bit more based on my understanding on how keytabs are used in mixed networks of Windows and non-Windows systems using Active Directory as the directory service. If the directory service is something other than AD, which is the most popular directory service out there, then I am not as familiar with how the keytab would be used but I imagine the concepts would be the exact same since it is all based on Kerberos. Again, in enterprise networks, every user and service does not need a keytab file.

Keytabs are cryptographic files containing a representation of the service and its long-term key (what Samson referred to as the password) as it exists in the directory service. In an Active Directory realm, keytabs are especially useful for services running on a non-Windows platform protected by the Kerberos protocol.

Keytabs are used to either

  1. de-crypt the Kerberos service ticket of an inbound AD user to the service
  2. or authenticate the service itself to another service on the network.

Point #2 is especially useful, since as Samson said, a service cannot manually type in it's password to authenticate itself, so the long-term key is helpfully encoded into the file. This is why the keytab file itself is sensitive and needs to be protected.

For additional in-depth information regarding keytabs, you can read more about keytabs here: Kerberos Keytabs – Explained.

I frequently go back and edit it based on questions I see here in this forum.



来源:https://stackoverflow.com/questions/43863275/what-is-a-keytab-exactly

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!