4.1.1.7 Create a kadmind Keytab (optional)

The kadmind keytab is the key that the legacy admininstration daemons kadmind4 and v5passwdd will use to decrypt administrators' or clients' Kerberos tickets to determine whether or not they should have access to the database. You need to create the kadmin keytab with entries for the principals kadmin/admin and kadmin/changepw. (These principals are placed in the Kerberos database automatically when you create it.) To create the kadmin keytab, run kadmin.local and use the ktadd command, as in the following example. (The line beginning with => is a continuation of the previous line.):

     shell% /usr/local/sbin/kadmin.local
     kadmin.local: ktadd -k /usr/local/var/krb5kdc/kadm5.keytab
     => kadmin/admin kadmin/changepw
      Entry for principal kadmin/admin with kvno 5, encryption
     	type Triple DES cbc mode with HMAC/sha1 added to keytab
     	WRFILE:/usr/local/var/krb5kdc/kadm5.keytab.
     Entry for principal kadmin/admin with kvno 5, encryption type DES cbc mode
     	with CRC-32 added to keytab
     	WRFILE:/usr/local/var/krb5kdc/kadm5.keytab.
     Entry for principal kadmin/changepw with kvno 5, encryption
     	type Triple DES cbc mode with HMAC/sha1 added to keytab
     	WRFILE:/usr/local/var/krb5kdc/kadm5.keytab.
     Entry for principal kadmin/changepw with kvno 5,
     	encryption type DES cbc mode with CRC-32 added to keytab
     	WRFILE:/usr/local/var/krb5kdc/kadm5.keytab.
     kadmin.local: quit
     shell%

As specified in the -k argument, ktadd will save the extracted keytab as
/usr/local/var/krb5kdc/kadm5.keytab. The filename you use must be the one specified in your kdc.conf file.