[37603] in Kerberos
Re: max_life problem
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Tue Aug 2 15:57:18 2016
Date: Tue, 2 Aug 2016 15:56:55 -0400 (EDT)
From: Benjamin Kaduk <kaduk@mit.edu>
To: Greg Hudson <ghudson@mit.edu>
In-Reply-To: <579F68C8.1070000@mit.edu>
Message-ID: <alpine.GSO.1.10.1608021553160.5272@multics.mit.edu>
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED;
BOUNDARY="-559023410-1849459314-1470167815=:5272"
Cc: =?KOI8-R?B?4czFy9PBzsTSIOLB0sHOyc4=?= <avbaranin@gmail.com>,
kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
---559023410-1849459314-1470167815=:5272
Content-Type: TEXT/PLAIN; charset=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
On Mon, 1 Aug 2016, Greg Hudson wrote:
> On 08/01/2016 04:29 AM, =D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B0=D0=BD=D0=B4=
=D1=80 =D0=91=D0=B0=D1=80=D0=B0=D0=BD=D0=B8=D0=BD wrote:
> > I use mit kerberos, version krb5-1.14.2, compiled from source.
> > And I can't to force kdc to issue tickets for more than 10 hours.
>
> In addition to the realm setting, the client and server entries in the
> KDC database can also have a max_life value. Using "getprinc" in
> kadmin, look at the "Maximum ticket life" on the user principal and on
> krbtgt/ALFA.IT. Are either of them ten hours? If so, you can change
> them with "modprinc -maxlife".
(It looks like this is on a Debian system, so I'll note that the debian
krb5-kdc package will create a kdc.conf that has max_life 10 hours on
first installation. So, principals created when such a kdc.conf was in
place would be affected by it.)
-Ben
---559023410-1849459314-1470167815=:5272
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
---559023410-1849459314-1470167815=:5272--
