shell script ktutil cannot pass password in aspnet runtime

[char-iot]

Describe the Bug

new blazor project, standard DOCKERFILE
generate keytab file so that the app can connect to existing MSSQL database with integrated security
but keytab.sh always get addent: Cannot read password while adding new entry
same script works in ubuntu 2004, wsl2 ubuntu 2004, wsl2 debian bullseye and MSSQL docker image mcr.microsoft.com/mssql/server:2019-latest

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["BlazorDBConnetApp/BlazorDBConnetApp.csproj", "BlazorDBConnetApp/"]
RUN dotnet restore "BlazorDBConnetApp/BlazorDBConnetApp.csproj"
COPY . .
WORKDIR "/src/BlazorDBConnetApp"
RUN dotnet build "BlazorDBConnetApp.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "BlazorDBConnetApp.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app

RUN apt install -y krb5-config 
RUN apt-get install -y krb5-user

COPY BlazorDBConnetApp/keyfiles/krb5.conf /etc/krb5.conf
COPY BlazorDBConnetApp/keyfiles/keytab.sh .
COPY BlazorDBConnetApp/keyfiles/BlazorDBConnetApp-entrypoint.sh .

COPY --from=publish /app/publish .
ENTRYPOINT ["/app/BlazorDBConnetApp-entrypoint.sh"]

BlazorDBConnetApp-entrypoint.sh

#!/bin/bash
/app/keytab.sh & dotnet BlazorDBConnetApp.dll

keytab.sh

#!/bin/bash
user="UserName"
pass="PassWord"
printf "%b" "addent -password -p $user -k 1 -e aes256-cts-hmac-sha1-96\n$pass\nwrite_kt $user.keytab" | ktutil

Steps to Reproduce

see description above

Other Information

Output of docker version

Click to expand!

Client: Docker Engine - Community
 Version:           20.10.17
 API version:       1.41
 Go version:        go1.17.11
 Git commit:        100c701
 Built:             Mon Jun  6 23:02:57 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Desktop
 Engine:
  Version:          20.10.17
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.17.11
  Git commit:       a89b842
  Built:            Mon Jun  6 23:01:23 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.8
  GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker info

Click to expand!

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Docker Buildx (Docker Inc., v0.9.1)
  extension: Manages Docker extensions (Docker Inc., v0.2.9)
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0)
  scan: Docker Scan (Docker Inc., v0.19.0)
WARNING: Plugin "/home/user/.docker/cli-plugins/docker-compose" is not valid: failed to fetch metadata: fork/exec /home/user/.docker/cli-plugins/docker-compose: no such file or directory

Server:
 Containers: 34
  Running: 32
  Paused: 0
  Stopped: 2
 Images: 22
 Server Version: 20.10.17
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc version: v1.1.4-0-g5fd4c4d
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 5.10.102.1-microsoft-standard-WSL2
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 25.05GiB
 Name: docker-desktop
 ID: XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5000
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support

[mthalman]

Since this error is coming from ktutil, you're probably going to have better luck in diagnosing the issue by asking for help from the broader Linux community, like https://unix.stackexchange.com. I did find this post related to this error message: https://stackoverflow.com/a/69653057/3174766.

[char-iot]

well, it does feel like it. based on your comment I just tried with docker run -it debian:bullseye /bin/bash in multiple images, debian:bullseye, debian:buster, ubuntu:20.04 and ubuntu:18.04. To my surprise in ubuntu:16.04 it works (printf "%b" "addent -password -p $user -k 1 -e aes256-cts-hmac-sha1-96\n$pass\nwrite_kt $user.keytab" | ktutil) but it also works in ubuntu 2004 VM on vmware.

I'll try my luck at stackexchange, too. I'll report back if there is an answer.

[char-iot]

https://stackoverflow.com/a/69653057/3174766 this one works. tested both in debian:bullseye and mcr.microsoft.com/dotnet/aspnet:6.0
just need a cron job for kinit to refresh the ticket and another one for regeneration of the keytab file with keytab.sh
PS: I tried this the before I open this post and it didn't work. don't know what I did wrong, but second time is a charm :D

docker run -it debian:bullseye /bin/bash

apt-get update
apt install -y krb5-config
apt-get install -y krb5-user

cat >> /keytab.sh <<'EOF'
user="UserName"
pass="PassWord"
{
    echo "addent -password -p ${user} -k 1 -e AES256-SHA1"
    sleep 1
    echo "${pass}"
    sleep 1
    echo "write_kt ${user}.keytab"
} | ktutil
EOF

chmod +x keytab.sh
./keytab.sh