salt.modules.kerberos

Manage Kerberos KDC

configuration

In order to manage your KDC you will need to generate a keytab that can authenticate without requiring a password.

# ktadd -k /root/secure.keytab kadmin/admin kadmin/changepw

On the KDC minion you will need to add the following to the minion configuration file so Salt knows what keytab to use and what principal to authenticate as.

auth_keytab: /root/auth.keytab
auth_principal: kadmin/admin
salt.modules.kerberos.create_keytab(name, keytab, enctypes=None)

Create keytab

CLI Example:

salt 'kdc.example.com' kerberos.create_keytab host/host1.example.com host1.example.com.keytab
salt.modules.kerberos.create_principal(name, enctypes=None)

Create Principal

CLI Example:

salt 'kdc.example.com' kerberos.create_principal host/example.com
salt.modules.kerberos.delete_principal(name)

Delete Principal

CLI Example:

salt 'kdc.example.com' kerberos.delete_principal host/example.com@EXAMPLE.COM
salt.modules.kerberos.get_policy(name)

Get policy details

CLI Example:

salt 'kdc.example.com' kerberos.get_policy my_policy
salt.modules.kerberos.get_principal(name)

Get princial details

CLI Example:

salt 'kdc.example.com' kerberos.get_principal root/admin
salt.modules.kerberos.get_privs()

Current privileges

CLI Example:

salt 'kdc.example.com' kerberos.get_privs
salt.modules.kerberos.list_policies()

List policies

CLI Example:

salt 'kdc.example.com' kerberos.list_policies
salt.modules.kerberos.list_principals()

Get all principals

CLI Example:

salt 'kde.example.com' kerberos.list_principals