title: If a Kerberos keytab has multiple entries, how keep wrong person from using an entry?
body: <p>Kerberos keytab files are located at <code>/etc/krb5/krb5.keytab</code> by convention, which is a non-user-specific location. That keytab (and all keytabs) can contain multiple entries. </p>
  
  <p>Let's suppose a computer has three users: Alice, Bob, and Eve. They each add an entry to the shared keytab through the following process, but with their respective names:</p>
  
  <pre><code>$ ktutil
  ktutil:  addent -password -p alice@REALM.COM -e aes256-cts -k 1
  Password for alice@REALM.COM:
  ktutil:  list -e
  slot KVNO Principal
  ---- ---- ---------------------------------------------------------------------
     1    1            alice@REALM.COM (aes256-cts-hmac-sha1-96)
  ktutil:  wkt krb5.keytab
  </code></pre>
  
  <p>Later on, Alice, Bob, and Eve can all use their keytab entry to authenticate a script like so, respectively:</p>
  
  <pre><code>&gt; kinit alice@REALM.COM -k -t mykeytab; myscript
  </code></pre>
  
  <p>What keeps Eve from using Alice or Bob's entries in the keytab? I haven't found anything explicitly covering how to keep keytabs with multiple entries secure. If we don't want Eve using Alice's entry, should they have separate keytabs protected by file permissions?</p>
  
  <p>Or, is this the Kerberos trust model? If they each have access to this keytab, then we implicitly trust them to use any entry? Should we only have trusted services sharing a keytab?</p>
  
  <p>Thanks in advance for tips. Just want to make sure I'm understanding the trust model correctly.</p>