Node:Changing the krbtgt Key, Previous:Cross-realm Authentication, Up:Administrating the Kerberos Database
A Kerberos Ticket Granting Ticket (TGT) is a service ticket for the principal krbtgt/REALM. The key for this principal is created when the Kerberos database is initialized and need not be changed. However, it will only have the encryption types supported by the KDC at the time of the initial database creation. To allow use of newer encryption types for the TGT, this key has to be changed.
Changing this key using the normal kadmin change_password
command
would invalidate any previously issued TGTs. Therefore, when changing
this key, normally one should use the -keepold flag to
change_password
to retain the previous key in the database as
well as the new key. For example:
kadmin: change_password -randkey -keepold krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
There is currently no way to remove the old key without running
change_password
without the -keepold flag (and thereby
invalidating all existing TGTs). After issuing this command, the old
key is still valid and is still vulnerable to (for instance) brute force
attacks. To completely retire an old key or encryption type, it's
therefore currently necessary to declare a flag day, run
change_password
without the -keepold flag, and force all
users to acquire new tickets.