I'm trying to write an idempotent script for Linux (MIT kerberos) that applies a given keytab to /etc/krb5.keytab
by merging with its existing content. On MacOS (which, I believe uses Heimdal) it's easy:
ktutil copy /tmp/ktnew /etc/krb5.keytab
If the key(s) in /tmp/ktnew
are already in /etc/krb5.keytab
then it doesn't change (this can be confirmed with before and after hashes).
The MIT version of ktutil
seems to only work interactively and does not have an equivalent to copy
. Using rkt
and wkt
appends (and, therefore, duplicates) rather than merges and is therefore not idempotent.
It it possible to do this idempotently (and non-interactively) using the MIT tools commonly found on Linux systems?