MIT Kerberos Cheat Sheet

Example values: realm EXAMPLE.COM, user alice, host server.example.com, and service host. Replace them with your actual realm and principals. Kerberos realms are conventionally uppercase.

1. Client ticket basics

Obtain, inspect, renew, and destroy tickets

kinit alice@EXAMPLE.COM
klist
klist -ef
klist -s                 # Exit status indicates whether credentials are valid
kinit -R                 # Renew a renewable ticket
kdestroy                 # Destroy the current credential cache
kdestroy -A              # Destroy all credential caches (where supported)

kinit normally prompts for a password. klist -e displays encryption types; -f shows ticket flags. A successful kinit proves initial authentication, not that every service is configured correctly.

Request a service ticket

kvno host/server.example.com@EXAMPLE.COM
klist

kvno asks the KDC for a ticket to the service principal. The service must use the matching principal and key for authentication to succeed.

2. Principals and keytabs

Inspect a keytab

klist -k /etc/krb5.keytab
klist -kte /etc/krb5.keytab

Test keytab authentication

kinit -k -t /etc/krb5.keytab host/server.example.com@EXAMPLE.COM
klist
kdestroy

Use the exact principal stored in the keytab. For a non-default cache, set KRB5CCNAME deliberately and restore it afterward.

Use ktutil to inspect or manage keytabs

ktutil
ktutil: rkt /etc/krb5.keytab
ktutil: list -e
ktutil: quit

ktutil can also write keytabs. Treat commands that add, remove, or write entries as changes to credentials; work on a copy and verify the result before deployment.

3. KDC administration

Run administrative commands only from an authorized host/account. The remote kadmin client authenticates to the admin service; kadmin.local accesses the local KDC database directly and typically requires privileged access on the KDC.

Remote administration

kadmin -p admin/admin@EXAMPLE.COM
kadmin: listprincs
kadmin: getprinc alice@EXAMPLE.COM
kadmin: getprinc host/server.example.com@EXAMPLE.COM
kadmin: quit

Local administration on the KDC

sudo kadmin.local
kadmin.local: listprincs
kadmin.local: getprinc alice@EXAMPLE.COM
kadmin.local: addprinc newuser@EXAMPLE.COM
kadmin.local: cpw alice@EXAMPLE.COM
kadmin.local: quit

addprinc and cpw change the KDC database. Review the target principal carefully before executing them.

Create or update a service keytab

sudo kadmin.local
kadmin.local: addprinc -randkey host/server.example.com@EXAMPLE.COM
kadmin.local: ktadd -k /tmp/server.keytab host/server.example.com@EXAMPLE.COM
kadmin.local: quit
klist -kte /tmp/server.keytab
sudo install -o root -g root -m 0600 /tmp/server.keytab /etc/krb5.keytab

4. KDC database and services

Database maintenance

sudo kdb5_util dump /root/krb5db.dump
sudo kdb5_util load /root/krb5db.dump

Dump/load operations are for planned backup, recovery, or migration work—not routine troubleshooting. Secure the dump, test restoration procedures, and follow your site's KDC backup policy.

Check service state (systemd examples)

systemctl status krb5kdc
systemctl status kadmin
journalctl -u krb5kdc --since today
journalctl -u kadmin --since today

Service unit names differ by distribution. Some systems use names such as krb5-admin-server instead of kadmin.

5. Configuration and environment

File / variable	Purpose
/etc/krb5.conf	Client defaults, realm mapping, KDC discovery, DNS behavior, and crypto policy settings.
/var/kerberos/krb5kdc/kdc.conf	Common RHEL-family KDC configuration path; confirm your distribution's actual path.
/etc/krb5.keytab	Default host/service keytab; access should be tightly restricted.
KRB5_CONFIG	Override the Kerberos configuration file path.
KRB5CCNAME	Select a credential cache (for example, a FILE cache).
KRB5_KTNAME	Select a keytab for applications that honor this variable.

Useful configuration checks

grep -v '^[[:space:]]*#' /etc/krb5.conf
getent hosts kdc.example.com
timedatectl
env | grep '^KRB5'

Do not publish configuration output without checking it for internal hostnames, realm details, or other information you do not want to disclose.

6. Fast troubleshooting

Symptom	Check first
Clock skew too great	Compare client/KDC time and NTP synchronization: timedatectl.
Cannot contact any KDC	Check DNS/SRV records, routing, firewall, KDC service health, and krb5.conf.
Client not found	Verify the principal spelling and realm with kadmin or kadmin.local.
Server not found in Kerberos database	Verify the exact service principal and hostname used by the client.
Preauthentication failed	Check password, account/principal state, and system time; avoid repeated guesses on locked-down systems.
Key table entry not found	Use klist -kte to verify the principal, KVNO, and encryption type in the keytab.
Ticket acquired but service rejects it	Confirm service principal, keytab contents and permissions, KVNO consistency, hostname canonicalization, and application logs.

7. Quick reference

Command	Use
kinit	Acquire initial credentials / TGT.
klist	Inspect tickets and credential cache.
kdestroy	Remove cached credentials.
kvno	Request a service ticket and display its KVNO.
kadmin	Remote KDC administration.
kadmin.local	Local KDC database administration.
kdb5_util	KDC database dump/load and related maintenance.
ktutil	Inspect and manage keytab entries.

Zwiegnet Consultants work with Linux and UNIX authentication infrastructure, including MIT Kerberos and its integration with LDAP-backed identity environments. For help with a deployment or authentication issue, contact Zwiegnet.