In windows all computer accounts have multiple SPNs; at least host/computer, host/computer.domain, some have as many as 10 (or even more!)
Heres my keytab 31 host/[EMAIL PROTECTED] (ArcFour with HMAC/md5) 31 host/[EMAIL PROTECTED] (ArcFour with HMAC/md5) 31 HTTP/[EMAIL PROTECTED] (ArcFour with HMAC/md5) 31 HTTP/[EMAIL PROTECTED] (ArcFour with HMAC/md5) 31 [EMAIL PROTECTED] (ArcFour with HMAC/md5) The keytab entry is the same for each one - I don't recall the keytab maint commands but you should be able to duplicate the key entry (I created my keytab using our commercial product that is much easier than doing it manually with ktpass etc) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Douglas E. Engert Sent: Wednesday, July 02, 2008 7:02 AM To: Shambhulal R. Sharma Cc: kerberos@mit.edu Subject: Re: windows 2003 AD and keytab file generation Shambhulal R. Sharma wrote: > Hi All > > I am trying to use Active Directory installed on Windows Server 2003 > as KDC. I followed the Microsoft step-by-step guide > http://technet.microsoft.com/en-us/library/bb742433.aspx to create a > windows user account, ktpass command to map a service principal name > to the windows user account and generate a keytab file. So far I can > map one service principal name to one windows user account which works fine. > > I have a requirement where multiple services running on a system > should map their service principals to a single Windows User > preferably computer account. I would like to generate/prepare a single > keytab file for all service [ftp,http, etc.] principal names using > ktpass and ktutil commands. > From reading your note and notes from others in the past, you may be confused by the use of the term "user account" in the Microsoft article. You need to have an account for the service, which has objectClass: top, person, organizationalPerson and user. (It can also have an objectClass computer.) This account has nothing to do with the users who will use the service. It is an account for the service. It has to have a sAMAccountName that is restricted to 19 characters and unique in the forest. We use a convention something like: <service>-<simplehostname>-<div> a fictional example: host-mylinux-it and the servicePrincipalName would be: host/[EMAIL PROTECTED] The account can be located anywhere in the directory tree. > My questions: > > Is it possible to use a computer account to map multiple service > principal names. I know about setspn command which can allow > add/delete/list operations to manage service principal association > with a windows user/computer account. Yes. But note that since there is only one password per account, all these principals will uses the same password to generate the keys. With RC4 there is no salt so they will have the same key. This may not be what you want. > > The problem seems to be with ktpass command, I do not know how I can > generate keytab file for all service principal associated with a > single user/computer account. Every time I try to use the ktpass -princ ... > command it changes the kvno number which invalidates the previous > keytab files. I tried ktpass with multiple -princ <...> -princ <...> > options, which generates the keytab file only for the last principal > name specified in the ktpass command line. The best way to do this is assign a different account for each service, so each has its own password and thus a different key. Like: host-mylinux host/[EMAIL PROTECTED] HTTP-mylinux HTTP/[EMAIL PROTECTED] You could then ues the unix tools to merge keytab files generated by ktpass if needed. Or you could use something like msktutil or the Solaris scripts to do all the ldap commands to AD to add/mod accounts and manage keytabs. > > Is it possible to have multiple service principals associated with a > single computer/user account. Due to some security reasons this is not > permitted on Windows. Yes it is, but the will share the same key. > > SAM SHARMA > > > > <http://technet.microsoft.com/en-us/library/bb742433.aspx#EBAA> > ________________________________________________ > Kerberos mailing list Kerberos@mit.edu > https://mailman.mit.edu/mailman/listinfo/kerberos > > -- Douglas E. Engert <[EMAIL PROTECTED]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos