### The Keytab File

All Kerberos server machines need a keytab file, called `/etc/krb5.keytab`, to authenticate to the KDC. The keytab file is an encrypted, local, on-disk copy of the host's key. The keytab file, like the stash file (Create the Database) is a potential point-of-entry for a break-in, and if compromised, would allow unrestricted access to its host. The keytab file should be readable only by root, and should exist only on the machine's local disk. The file should not be part of any backup of the machine, unless access to the backup data is secured as tightly as access to the machine's root password itself.

In order to generate a keytab for a host, the host must have a principal in the Kerberos database. The procedure for adding hosts to the database is described fully in the "Adding or Modifying Principals" section of the Kerberos V5 System Administrator's Guide. See Create Host Keys for the Slave KDCs. for a brief description.) The keytab is generated by running `kadmin` and issuing the `ktadd` command.

For example, to generate a keytab file to allow the host trillium.mit.edu to authenticate for the services `host`, `ftp`, and `pop`, the administrator `joeadmin` would issue the command (on trillium.mit.edu):

         trillium% /usr/local/sbin/kadmin
         kadmin5: ktadd host/trillium.mit.edu ftp/trillium.mit.edu
         => pop/trillium.mit.edu
         kadmin: Entry for principal host/trillium.mit.edu@ATHENA.MIT.EDU with
         kvno 3, encryption type DES-CBC-CRC added to keytab
         WRFILE:/etc/krb5.keytab.
         kadmin: Entry for principal ftp/trillium.mit.edu@ATHENA.MIT.EDU with
         kvno 3, encryption type DES-CBC-CRC added to keytab
         WRFILE:/etc/krb5.keytab.
         kadmin: Entry for principal pop/trillium.mit.edu@ATHENA.MIT.EDU with
         kvno 3, encryption type DES-CBC-CRC added to keytab
         WRFILE:/etc/krb5.keytab.
         kadmin5: quit
         trillium%

If you generate the keytab file on another host, you need to get a copy of the keytab file onto the destination host (`trillium`, in the above example) without sending it unencrypted over the network. If you have installed the Kerberos V5 client programs, you can use encrypted `rcp`.