In the case of Heimdal Kerberos:

Or in the case of MIT Kerberos:

In either case, you will be asked for a password (twice with Heimdal). If you mistype, you will not receive a warning, but the keytab won't work.

Don't put the keytab in $HOME if $HOME is what it unlocks!

Ensure tight permissions on the keytab. It can be used as a password after all.

Destroy any existing credentials:

... before trying to use the keytab for Kerberos authentication.

With Heimdal:

Or with MIT:

Heimdal offers this:

* *  * * *  kinit -t /tmp/keytab.krb-username krb-username myscript.sh
	

I.e. myscript.sh runs as a child of kinit.

With MIT, this construction is impossible. Instead, the kinit command must be inside the script.

Warning

You cannot do this: * * * * * kinit -t /tmp/keytab.krb-username krb-username myscript.sh < $HOME/myinput > $HOME/myoutput ... because if you did, cron would start a shell, arrange the redirection of stdin and stdout, and only then would it start kinit. Thus, the shell would wait for I/O forever, lacking permission, and never get to the kinit part. It doesn't matter that kinit would later proceed to get the very permission its parent is waiting for. It just never gets to that point. To make matters worse, cron would start many of these processes, and none would ever finish. Permission on $HOME is only available to kinit itself and its children. So you have to arrange the redirection inside myscript.sh itself.