[22194] in Kerberos
MIT Kerberos TGT forwarding + renewal bug?
daemon@ATHENA.MIT.EDU (Eric Andresen)
Mon Aug 16 12:27:39 2004
From: eandres@mars.asu.edu (Eric Andresen)
Date: 13 Aug 2004 10:40:58 -0700
Message-ID: <dc8fcea4.0408130940.2cc1f13a@posting.google.com>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Hi,
I recently discovered a rather stickly issue regarding ticket
forwarding. Mainly, if I ssh (using GSSAPI TGT delegation forwarding)
to another machine when the initial TGT was halfway through its
initial lifetime, let's say 30minutes for example, my resultant TGT on
the remote machine has a validity starttime of $now, and expiretime of
$expire, as expected.
The problem is that when you perform a 'kinit -R' on that remote
system, the maximum lifetime you'll receive as renewed is the delta
between those two values, in this case, 15 minutes.
I would personally expect a renewal to give me the full 30 minutes,
but it does not. This proves to be problematic as you get closer to
your expiration time, since it's quite possible to end up forwarding a
ticket with 1 minute left on it, and not being able to do anything
with it since it won't ever live longer than 1 minute before needing a
renewal.
I'm trying to track down a way to fix this in the source, but I'm not
sure what the cleanest way to do it would be... I see that the
krb5_ticket_times struct has both a 'authtime' and 'starttime', and
'starttime' is marked as optional. Does this mean that if starttime
was kept from the initial TGT that the renewals would work as I
expect, or do renewals use 'endtime-authtime'?
Thanks,
--
Eric Andresen
Systems Administrator
Mars Space Flight Facility
Arizona State University
eandres@mars.asu.edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
