keytab
termsecuritynetworking
A file holding a service account's long-term Kerberos keys, letting a service - often on Linux, outside the domain - decrypt the tickets clients present without interactive domain membership.
A keytab is a credential in file form: generated against the account that owns the SPN, protected like a password, and regenerated whenever that account's password changes.
A keytab file stores the long-term keys for one or more service principals, so a service can authenticate to Kerberos without a human typing a password. It is what makes unattended service authentication possible.
It is also a credential in a file, which is the thing to be precise about. Anyone who can read a keytab can impersonate that service, so file permissions are the control, and copying one between hosts distributes the credential rather than the configuration. Key version numbers matter during rotation: changing the password without regenerating the keytab leaves a file whose keys no longer match, and the resulting failure appears at the next ticket request rather than at the moment of the change.
Also known as: keytab file