Manage keytab files

Maintain the keytab file using either the character-based interface or iSeries™ Navigator.

As the network administrator, you need to maintain the keytab file, also called the key table, and its contents on the iSeries server. You can manage the keytab file and its associated keytab entries by using either the character-based interface or iSeries Navigator:

Manage keytab files using the character-based interface The keytab command is used to add, delete, or list a key from a key table. For example, to add a key for the service principal, krbsvr400, on the host, kdc1.myco.com, in realm MYCO.COM:
- On a Qshell command line, enter keytab add krbsvr400/kdc1.myco.com@MYCO.COM
- On an i5/OS™ control language (CL) command line, enter call qsys/qkrbkeytab parm('add' 'krbsvr400/kdc1.myco.com@MYCO.COM')
You will be prompted for the password that was used when the service was defined to the Kerberos server.
Manage keytab files using iSeries Navigator You can use iSeries Navigator to add keytab entries to the key table. iSeries Navigator allows you to add keytab entries for the following services:
- i5/OS Kerberos authentication
- LDAP
- HTTP Server powered by Apache
- iSeries NetServer™
To add a keytab entry to the keytab file, follow these steps:
1. In iSeries Navigator, expand your iSeries server > Security.
2. Right-click Network Authentication Service and select Manage Keytab.... This launches a portion of the Network Authentication Service wizard that enables you to add keytab entries.
3. On the Select keytab entries page, select the types of services for which you want to add keytab entries. For example, i5/OS Kerberos Authentication. Click Next.
4. On the Create i5/OS keytab entry page, enter and confirm a password. This password should be the same password that you use when you add the associated service principal to the Kerberos server. If you selected any of the other types of services, such as LDAP, HTTP Server powered by Apache, or iSeries NetServer in Step 3, you will also see pages that enable you to create keytab entries for each of those services.
5. On the Summary page, view the list of i5/OS services and service principals that will be added as keytab entries to the keytab file.

See the keytab usage notes on this Qshell command, for specifics on its usage and restrictions.