29.3. Protecting Keytabs

To protect Kerberos keytabs from other users with access to the server, restrict access to the keytab to only the keytab owner. It is recommended to protect the keytabs right after they are retrieved.
For example, to protect the Apache keytab at /etc/httpd/conf/ipa.keytab:
  1. Set the owner of the file to apache.
    # chown apache /etc/httpd/conf/ipa.keytab
  2. Set the permissions for the file to 0600. This grants read, write, and execute permissions to the owner.
    # chmod 0600 /etc/httpd/conf/ipa.keytab