# samba-tool domain exportkeytab

**`samba-tool domain exportkeytab`** is a Samba utility that exports a keytab file containing the Kerberos keys for a Samba domain controller or a machine account. This keytab file is essential for Kerberos authentication, as it allows services and systems to authenticate automatically (without interactive password prompts) using the stored credentials.

## Overview

* **Keytab Export**:\
  Exports the Kerberos keys associated with a domain controller or machine account into a keytab file.
* **Kerberos Integration**:\
  The keytab is used by Kerberos-aware services to obtain tickets, facilitating secure, automated authentication in an Active Directory environment.
* **Service Automation**:\
  With a valid keytab, services (e.g., web servers, file servers) can perform password-less logins to request Kerberos service tickets.

## Typical Usage and Options

The general syntax for exporting a keytab is:

```bash
samba-tool domain exportkeytab [OPTIONS] <KEYTAB_FILE>
```

### Common Options

* **`<KEYTAB_FILE>`**:\
  The destination path where the keytab file will be saved (e.g., `/etc/krb5.keytab`).
* **`--principal=<principal>`**:\
  Optionally specify a particular principal (such as `host/server.example.com`) for which to export the keytab. If omitted, the default machine account principal is used.
* **`--debuglevel=<level>`**:\
  Increases the verbosity of the command output, which is useful for troubleshooting.
* **`--help`**:\
  Displays usage and help information.

## Example Usages

1.  **Exporting the Default Keytab**

    To export the keytab for the default machine account to `/etc/krb5.keytab`:

    ```bash
    samba-tool domain exportkeytab /etc/krb5.keytab
    ```
2.  **Specifying a Principal**

    To export a keytab for a specific principal (e.g., `host/server.example.com`):

    ```bash
    samba-tool domain exportkeytab --principal=host/server.example.com /etc/krb5.keytab
    ```
3.  **Increasing the Debug Level**

    To get detailed output for troubleshooting:

    ```bash
    samba-tool domain exportkeytab --debuglevel=5 /etc/krb5.keytab
    ```

## When and Why to Use `samba-tool domain exportkeytab`

* **Service Integration**:\
  When configuring services that require Kerberos authentication (like web servers, file servers, or application servers), exporting a keytab file allows these services to authenticate without manual password entry.
* **Automated Authentication**:\
  The keytab enables non-interactive, automated logins—essential for background processes and scheduled tasks that need secure access to network resources.
* **Disaster Recovery and Migration**:\
  Exporting a keytab is part of backup and migration procedures, ensuring that the machine credentials can be restored or transferred if needed.

## Troubleshooting Tips

* **File Permissions**:\
  After exporting, ensure that the keytab file has restrictive permissions (typically readable only by root or the specific service) to protect sensitive credentials.
* **Kerberos Configuration**:\
  Verify that your `/etc/krb5.conf` file is correctly configured to match your domain settings, as misconfigurations here can prevent successful Kerberos authentication.
* **Verbose Output**:\
  Use the `--debuglevel` option to obtain more detailed information if the keytab export process fails or if you encounter unexpected errors.

## Conclusion

The **`samba-tool domain exportkeytab`** command is a vital tool for Samba administrators operating in Active Directory environments. By exporting a keytab file, you enable secure, password-less authentication for services and applications using Kerberos. This command ensures that machine credentials are available for automated processes and contributes to the overall reliability and security of your domain infrastructure.
