[22746] in Kerberos
Re: Renewable Tickets
daemon@ATHENA.MIT.EDU (Phil Dibowitz)
Mon Oct 25 15:55:41 2004
Date: Mon, 25 Oct 2004 12:52:50 -0700
From: Phil Dibowitz <phil@usc.edu>
To: Ken Raeburn <raeburn@mit.edu>
Message-ID: <20041025195250.GT26380@usc.edu>
Mime-Version: 1.0
In-Reply-To: <32BF440E-26BB-11D9-B5AB-000A95909EE2@mit.edu>
cc: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============91825853610522046=="
Errors-To: kerberos-bounces@mit.edu
--===============91825853610522046==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="TvDDZNY9vshwFF4e"
Content-Disposition: inline
--TvDDZNY9vshwFF4e
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Mon, Oct 25, 2004 at 03:22:23PM -0400, Ken Raeburn wrote:
> On Oct 25, 2004, at 15:02, Phil Dibowitz wrote:
> > [libdefaults]
> > ticket_lifetime =3D 600
>=20
> This won't do what you think. First, we're not parsing=20
> "ticket_lifetime", despite having some indications around that we do. =20
> Second, the time-interval parsing code requires a unit. (I think both=20
> of these will change in the 1.4 release.)
Thanks for the info, though I don't suspect that's the problem here.
> Try "700s" or "700m".
with:=20
[libdefaults]
ticket_lifetime =3D 600m
renew_lifetime =3D 700d
I get:
[phil@frantic phil]$ kinit
Password for phil@ISD.USC.EDU:=20
[phil@frantic phil]$ klist
Ticket cache: FILE:/tmp/krb5cc_36070
Default principal: phil@ISD.USC.EDU
Valid starting Expires Service principal
10/25/04 12:49:07 10/25/04 22:49:07 krbtgt/ISD.USC.EDU@ISD.USC.EDU
renew until 10/25/04 12:49:07
[phil@frantic phil]$ kdestroy=20
[phil@frantic phil]$ kinit -r 7d
Password for phil@ISD.USC.EDU:=20
[phil@frantic phil]$ klist
Ticket cache: FILE:/tmp/krb5cc_36070
Default principal: phil@ISD.USC.EDU
Valid starting Expires Service principal
10/25/04 12:49:36 10/25/04 22:49:36 krbtgt/ISD.USC.EDU@ISD.USC.EDU
renew until 10/25/04 12:49:36
> Also check the properties on the client and service principals=20
> (including the krbtgt principals). I forget whether max renewable=20
> lifetime is one of them, but if it is, it would be set when the=20
> principal is created or when you use "modprinc" in kadmin, and the=20
> config file specifications won't extend it, only (potentially) further=20
> limit it.
You had me all excited for a minute... but no:
kadmin: getprinc phil
=2E..
Maximum renewable life: 7 days 00:00:00
=3D(
--=20
Phil Dibowitz
Systems Architect and Administrator
Enterprise Infrastructure / ISD / USC
UCC 174 - 213-821-5427
--TvDDZNY9vshwFF4e
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFBfVmS7lkZ1Iyv898RArT5AKDSYezUALUroBXkZfYoiIU9DqBTOgCfQW6C
PgcqigTvPm1hEqnPPXHQ2qk=
=xC9f
-----END PGP SIGNATURE-----
--TvDDZNY9vshwFF4e--
--===============91825853610522046==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============91825853610522046==--
