Automate krb5 tickets & renewal

auto-kinit.sh

#!/bin/bash

set -eu

# allow scripting password, pass as env var MDP
MDP=${MDP:-""}

# setup some vars
export u=$(whoami)
export kt=$HOME/.my-keytab
export KRB5CCNAME=/tmp/krb5cc_$(id -u)

if [[ -z "$MDP" ]]; then
        read -s -p "Enter password (user ${u}): "  MDP
        echo 
fi

# remove existing credentials
rm -f ${kt}
kdestroy &> /dev/null

# create new keytab file
ktutil > /dev/null <<EOF
addent -p ${u} -k 1 -password -f ${kt}
${MDP}
write_kt ${kt}
quit
EOF

# test creds work & show tickets
if ! kinit -k -t ${kt} ${u} &> /dev/null; then
        echo "password is incorrect"
        rm -f ${kt}
        exit 1
fi

# ensure the ticket cache & kinit done in .bashrc
kinit_cmd="kinit -k -t ${kt} ${u}"
krbcc_cmd="export KRB5CCNAME=${KRB5CCNAME}"
if ! grep -Fxq "${kinit_cmd}" ~/.bashrc; then
        echo "${krbcc_cmd}" >> ~/.bashrc
        echo "${kinit_cmd}" >> ~/.bashrc
fi

# and crontab hourly
cron_kinit="0 * * * * bash -c '${krbcc_cmd}; ${kinit_cmd}'"
tmpfile=$(mktemp)
crontab -l > $tmpfile &> /dev/null || true
if ! grep -Fxq "${cron_kinit}" ${tmpfile}; then
        echo "${cron_kinit}" >> ${tmpfile}
        crontab ${tmpfile}
fi

echo ".bashrc and crontab modified to automate ticket renewal"