question Re: how to find which keytab is it headless and it is service keytab in Support Questions

how to find which keytab is it headless and it is service keytab

irfangk1 — Tue, 20 Aug 2019 13:17:09 GMT

Need to know how to differentiate headless and service keytab.. any specific commands

Re: how to find which keytab is it headless and it is service keytab

jsensharma — Tue, 20 Aug 2019 04:38:12 GMT

From Standard Kerberos perspective there is no command to differentiate between headless/service keytab.

However, we can differentiate between headless / service keytabs you can find the detailed discussion about it in the following thread:
https://community.cloudera.com/t5/Support-Questions/Headless-Keytab-Vs-User-Keytab-Vs-Service-Keytab/m-p/175276

Try running the following command on your keytab:

Headless keytab

Headless principals are not bound to a specific host or node, they have the syntax: - @EXAMPLE.COM

# klist -kte /etc/security/keytabs/hdfs.headless.keytab Keytab name: FILE:/etc/security/keytabs/hdfs.headless.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 08/11/2019 01:58:27 hdfs-ker1latest@EXAMPLE.COM (des-cbc-md5) 2 08/11/2019 01:58:27 hdfs-ker1latest@EXAMPLE.COM (aes256-cts-hmac-sha1-96) 2 08/11/2019 01:58:27 hdfs-ker1latest@EXAMPLE.COM (des3-cbc-sha1) 2 08/11/2019 01:58:27 hdfs-ker1latest@EXAMPLE.COM (arcfour-hmac) 2 08/11/2019 01:58:27 hdfs-ker1latest@EXAMPLE.COM (aes128-cts-hmac-sha1-96)

If it is truly a headless keytab then it will not have a principal specific to a Host.

Service keytab

Service principal is something that does not need to be a POSIX user,they are mostly applications that have own arrangement on how they run on the OS level and need to interact with the Kerberized cluster. Notice it's principal name has hostname included.
Example:

# klist -kte /etc/security/keytabs/nn.service.keytab Keytab name: FILE:/etc/security/keytabs/nn.service.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 08/11/2019 01:58:40 nn/ker1latest1.example.com@EXAMPLE.COM (des-cbc-md5) 2 08/11/2019 01:58:40 nn/ker1latest1.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96) 2 08/11/2019 01:58:40 nn/ker1latest1.example.com@EXAMPLE.COM (des3-cbc-sha1) 2 08/11/2019 01:58:40 nn/ker1latest1.example.com@EXAMPLE.COM (arcfour-hmac) 2 08/11/2019 01:58:40 nn/ker1latest1.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)

Re: how to find which keytab is it headless and it is service keytab

jsensharma — Tue, 20 Aug 2019 04:42:01 GMT

@irfangk1
You can find more details about headless / service principals/keytabs in the following doc:
https://docs.hortonworks.com/HDPDocuments/HDP3/HDP-3.1.0/authentication-with-kerberos/content/kerberos_principals.html

Re: how to find which keytab is it headless and it is service keytab

jsensharma — Fri, 27 Sep 2019 12:20:09 GMT

@irfangk1

Was your query answered? If your question is answered then, Please make sure to mark the answer as the accepted solution.

If you find a reply useful, say thanks by clicking on the thumbs up button.

Please revert back if you have any followup query in this thread. That way we can find the solution/answer that way other community users can get the benefit.

Re: how to find which keytab is it headless and it is service keytab

irfangk1 — Mon, 30 Sep 2019 04:10:04 GMT

Yes