For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wire's avatar
Wire
Sep 03, 2013

APM - How to create a keytab file with multiple SPNs

Hi,   I have run into a problem using Kerberos Authentication when using CNAMEs in DNS.   You can search the web but basically if you use a CNAME record like "www CNAME www1" and then A records...
BIG-IP Access Policy Manager (APM)
design
kerberos
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 03, 2013

Are you saying that I should just use one keytab file on "Site A" with SPN of "HTTP/www1" and a different keytab file on "Site B" with SPN of "HTTP/www2" and ignoring the SPN of "HTTP/www" completely?

 

That depends if the initial problem also exists in other browsers. Does Firefox also use the A name? I don't remember if it does. If it's universal, and a browser will always use the A name, then you probably don't need to worry about a keytab for the CNAME.

 

The "-in" option in ktpass just allows you to add information from other keytabs. So if you have an existing keytab file (ie. for "www"), then you'd create a new keytab (ie. for "www1") and include the other keytab with the -in option to aggregate the two keys. Repeat this process for as many keytabs as you need.