samba-tool exportkeytab does not create keytab if destination file exists and no error message is sent. ------------------------------------------------------------------------------ dc107:~# date +%Y%m%d-%H%M%S 20160128-152746 dc107:~# samba-tool domain exportkeytab /opt/initial_setup/administrator.keytab --principal=administrator dc107:~# ll /opt/initial_setup/administrator.keytab -rw------- 1 root root 427 27 janv. 12:11 /opt/initial_setup/administrator.keytab ** Destination file is still dated from previous day. dc107:~# kinit -V -k -t /opt/initial_setup/administrator.keytab administrator Using default cache: /tmp/krb5cc_0 Using principal: administrator@AD.DGFIP.FINANCES.GOUV.FR Using keytab: /opt/initial_setup/administrator.keytab kinit: Preauthentication failed while getting initial credentials ** kinit is not working: keytab was not generated. dc107:~# rm /opt/initial_setup/administrator.keytab dc107:~# samba-tool domain exportkeytab /opt/initial_setup/administrator.keytab --principal=administrator dc107:~# ll /opt/initial_setup/administrator.keytab -rw------- 1 root root 427 28 janv. 15:28 /opt/initial_setup/administrator.keytab ** Here the keytab has been created as file was removed before launching the command dc107:~# kinit -V -k -t /opt/initial_setup/administrator.keytab administrator Using default cache: /tmp/krb5cc_0 Using principal: administrator@AD.DGFIP.FINANCES.GOUV.FR Using keytab: /opt/initial_setup/administrator.keytab Authenticated to Kerberos v5 ** and of course now kinit works. dc107:~# samba --version Version 4.3.3-compiled_for_Centos7 ------------------------------------------------------------------------------
It works for me on 4.14.2: # export keytab pi@rpidc1:~ $ sudo samba-tool domain exportkeytab /opt/initial_setup/administrator.keytab --principal=administrator Export one principal to /opt/initial_setup/administrator.keytab pi@rpidc1:~ $ ls -l /opt/initial_setup/administrator.keytab -rw------- 1 root root 252 Apr 22 13:37 /opt/initial_setup/administrator.keytab # kinit as Administrator pi@rpidc1:~ $ sudo kinit -V -k -t /opt/initial_setup/administrator.keytab administrator Using default cache: /tmp/krb5cc_0 Using principal: administrator@SAMDOM.EXAMPLE.COM Using keytab: /opt/initial_setup/administrator.keytab Authenticated to Kerberos v5 # Success # following day, export keytab again without deleting /opt/initial_setup/administrator.keytab pi@rpidc1:~ $ sudo samba-tool domain exportkeytab /opt/initial_setup/administrator.keytab --principal=administrator Export one principal to /opt/initial_setup/administrator.keytab pi@rpidc1:~ $ ls -l /opt/initial_setup/administrator.keytab -rw------- 1 root root 252 Apr 23 08:53 /opt/initial_setup/administrator.keytab # Kinit as Administrator pi@rpidc1:~ $ sudo kinit -V -k -t /opt/initial_setup/administrator.keytab administrator Using default cache: /tmp/krb5cc_0 Using principal: administrator@SAMDOM.EXAMPLE.COM Using keytab: /opt/initial_setup/administrator.keytab Authenticated to Kerberos v5 # Success again