20.5. Removing Keytabs

Refreshing Kerberos tickets adds a new key to the keytab, but it does not clear the keytab. If a host is being unenrolled and re-added to the IdM domain or if there are Kerberos connection errors, then it may be necessary to remove the keytab and create a new keytab.

This is done using the ipa-rmkeytab command. To remove all principals on the host, specify the realm with the -r option:

ipa-rmkeytab -r EXAMPLE.COM -k /etc/krb5.keytab

# ipa-rmkeytab -r EXAMPLE.COM -k /etc/krb5.keytab

To remove the keytab for a specific service, use the -p option to specify the service principal:

ipa-rmkeytab -p ldap/client.example.com -k /etc/krb5.keytab

# ipa-rmkeytab -p ldap/client.example.com -k /etc/krb5.keytab