-
Title
How to remove an SPN from a keytab file using vastool. -
Description
There is a requirement to remove an SPN from a keytab file. -
Resolution
To list what is in your keytab file run 'vastool ktutil -k <path to keytab file > list'. For example, see below:
[root@jb-rhel9 ~]# vastool ktutil -k /etc/opt/quest/vas/host.keytab list
/etc/opt/quest/vas/host.keytab:
Vno Type Principal
2 aes128-cts-hmac-sha1-96 host/jb-rhel9.jb.idm2@JB.IDM2
2 aes128-cts-hmac-sha1-96 JB-RHEL9$@JB.IDM2
2 aes128-cts-hmac-sha1-96 host/JB-RHEL9@JB.IDM2
2 aes128-cts-hmac-sha1-96 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 aes128-cts-hmac-sha1-96 cifs/JB-RHEL9@JB.IDM2
2 aes256-cts-hmac-sha1-96 host/jb-rhel9.jb.idm2@JB.IDM2
2 aes256-cts-hmac-sha1-96 JB-RHEL9$@JB.IDM2
2 aes256-cts-hmac-sha1-96 host/JB-RHEL9@JB.IDM2
2 aes256-cts-hmac-sha1-96 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 aes256-cts-hmac-sha1-96 cifs/JB-RHEL9@JB.IDM2
2 arcfour-hmac-md5 host/jb-rhel9.jb.idm2@JB.IDM2
2 arcfour-hmac-md5 JB-RHEL9$@JB.IDM2
2 arcfour-hmac-md5 host/JB-RHEL9@JB.IDM2
2 arcfour-hmac-md5 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 arcfour-hmac-md5 cifs/JB-RHEL9@JB.IDM2
To Remove:
Vastool ktutil remove -p < principal>
For example:
vastool ktutil remove -p host/jb-rhel9.jb.idm2@JB.IDM2
List the keytab contents again to ensure that it has been removed. Example:
vastool ktutil -k /etc/opt/quest/vas/host.keytab list
/etc/opt/quest/vas/host.keytab:
Vno Type Principal
2 aes128-cts-hmac-sha1-96 JB-RHEL9$@JB.IDM2
2 aes128-cts-hmac-sha1-96 host/JB-RHEL9@JB.IDM2
2 aes128-cts-hmac-sha1-96 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 aes128-cts-hmac-sha1-96 cifs/JB-RHEL9@JB.IDM2
2 aes256-cts-hmac-sha1-96 JB-RHEL9$@JB.IDM2
2 aes256-cts-hmac-sha1-96 host/JB-RHEL9@JB.IDM2
2 aes256-cts-hmac-sha1-96 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 aes256-cts-hmac-sha1-96 cifs/JB-RHEL9@JB.IDM2
2 arcfour-hmac-md5 JB-RHEL9$@JB.IDM2
2 arcfour-hmac-md5 host/JB-RHEL9@JB.IDM2
2 arcfour-hmac-md5 cifs/jb-rhel9.jb.idm2@JB.IDM2
2 arcfour-hmac-md5 cifs/JB-RHEL9@JB.IDM2