用于身份验证的 Linux keytab 文件
我是 Linux keytab 文件的新手。有没有适合新手的文档说明该文件在身份验证中的作用是什么？谢谢。
问候， 乔治
I am new to Linux keytab file. Any documents for a newbie about what is the function of this file in authentication? Thanks.
regards,
George
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，必须输入密码才能通过 Kerberos 进行身份验证。问题在于脚本或程序需要在没有人工交互的情况下进行身份验证。例如，您在半夜启动服务器，并希望所有服务都能启动，而不需要操作员在控制台输入一堆密码。
keytab 文件提供了此功能。本质上，它是一个或多个条目，每个条目由一个 Kerberos 帐户名（您将看到这些称为“主体”）和一个从密码派生的加密值组成。这些可以一起用于对 Kerberos 服务器进行身份验证，而无需人工交互。
这样做的价值在于，通过查看文件不可能知道密码。但是，任何对该文件具有读取访问权限的人都可以使用它来向 Kerberos 服务器进行身份验证，因此保持文件受到良好保护并且只有其所有者可读仍然很重要。
我无法找到密钥表文件的良好通用入门级参考，但是许多网站都为用户编写了自己的教程。尽管这些内容是针对特定受众和环境编写的，但许多内容都提供了有关该主题的良好背景。阅读这些内容的一个很好的起点是斯坦福大学的密钥表简介。
Ordinarily, one must enter a password to authenticate to Kerberos. The problem with this is when scripts or programs need to authenticate without human interaction. For example, you boot a server in the middle of the night and want all the services to start up without requiring an operator at the console to enter a bunch of passwords.
The keytab file provides this capability. In essence it is one or more entries, each consisting of a Kerberos account name (you will see these referred to as 'principals') and an encrypted value derived from the password. Together these can be used to authenticate to a Kerberos server without human interaction.
The value of this is that it is impossible to know the password from looking at the file. However, anyone with read access to the file can use it to authenticate to the Kerberos server so it is still important to keep the file well-protected and readable only by its owner.
I wasn't able to find a good, generic intro-level reference for keytab files, however many web sites have written their own tutorials for their users. Although these are written toward a specific audience and environment, many provide a good background on the subject. A good starting point to read up on these is Stanford's An Introduction to Keytabs.