In windows all computer accounts have multiple SPNs; at least
host/computer, host/computer.domain, some have as many as 10 (or even
more!)

Heres my keytab

31 host/paul-es5.ent2k3.seattle.test@ENT2K3.SEATTLE.TEST (ArcFour with
HMAC/md5)
31 host/paul-es5@ENT2K3.SEATTLE.TEST (ArcFour with HMAC/md5)
31 HTTP/paul-es5.ent2k3.seattle.test@ENT2K3.SEATTLE.TEST (ArcFour with
HMAC/md5)
31 HTTP/paul-es5@ENT2K3.SEATTLE.TEST (ArcFour with HMAC/md5)
31 paul-es5$@ENT2K3.SEATTLE.TEST (ArcFour with HMAC/md5)

The keytab entry is the same for each one - I don't recall the keytab
maint commands but you should be able to duplicate the key entry

(I created my keytab using our commercial product that is much easier
than doing it manually with ktpass etc)

-----Original Message-----
From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On
Behalf Of Douglas E. Engert
Sent: Wednesday, July 02, 2008 7:02 AM
To: Shambhulal R. Sharma
Cc: kerberos@mit.edu
Subject: Re: windows 2003 AD and keytab file generation



Shambhulal R. Sharma wrote:
> Hi All
>
> I am trying to use Active Directory installed on Windows Server 2003
> as KDC. I followed the Microsoft step-by-step guide
> http://technet.microsoft.com/en-us/l.../bb742433.aspx to create a
> windows user account, ktpass command to map a service principal name
> to the windows user account and generate a keytab file. So far I can
> map one service principal name to one windows user account which works

fine.
>
> I have a requirement where multiple services running on a system
> should map their service principals to a single Windows User
> preferably computer account. I would like to generate/prepare a single


> keytab file for all service [ftp,http, etc.] principal names using
> ktpass and ktutil commands.
>


From reading your note and notes from others in the past, you may be
confused by the use of the term "user account" in the Microsoft article.
You need to have an account for the service, which has objectClass:
top, person, organizationalPerson and user. (It can also have an
objectClass computer.) This account has nothing to do with the users
who will use the service.
It is an account for the service. It has to have a sAMAccountName that
is restricted to 19 characters and unique in the forest. We use a
convention
something like: --

a fictional example: host-mylinux-it
and the servicePrincipalName would be: host/myliniux.it.ga.com@GA.COM
The account can be located anywhere in the directory tree.

> My questions:
>
> Is it possible to use a computer account to map multiple service
> principal names. I know about setspn command which can allow
> add/delete/list operations to manage service principal association
> with a windows user/computer account.


Yes. But note that since there is only one password per account, all
these principals will uses the same password to generate the keys. With
RC4 there is no salt so they will have the same key. This may not be
what you want.

>
> The problem seems to be with ktpass command, I do not know how I can
> generate keytab file for all service principal associated with a
> single user/computer account. Every time I try to use the ktpass

-princ ...
> command it changes the kvno number which invalidates the previous
> keytab files. I tried ktpass with multiple -princ <...> -princ <...>
> options, which generates the keytab file only for the last principal
> name specified in the ktpass command line.


The best way to do this is assign a different account for each service,
so each has its own password and thus a different key.
Like:
host-mylinux host/mylinux.ga.com@GA.COM
HTTP-mylinux HTTP/mylinux.ga.com@GA.COM

You could then ues the unix tools to merge keytab files generated by
ktpass if needed.

Or you could use something like msktutil or the Solaris scripts to do
all the ldap commands to AD to add/mod accounts and manage keytabs.

>
> Is it possible to have multiple service principals associated with a
> single computer/user account. Due to some security reasons this is not


> permitted on Windows.


Yes it is, but the will share the same key.

>
> SAM SHARMA
>
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>


--

Douglas E. Engert
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos