[22753] in Kerberos
Re: Renewable Tickets
daemon@ATHENA.MIT.EDU (Phil Dibowitz)
Mon Oct 25 16:52:41 2004
Date: Mon, 25 Oct 2004 13:51:04 -0700
From: Phil Dibowitz <phil@usc.edu>
To: Kevin Coffman <kwc@citi.umich.edu>
Message-ID: <20041025205104.GE26380@usc.edu>
Mime-Version: 1.0
In-Reply-To: <009901c4bad3$af1ebeb0$6400000a@citi.umich.edu>
cc: kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============7643235160353723=="
Errors-To: kerberos-bounces@mit.edu
--===============7643235160353723==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="OCb6KclsKoh2FPBn"
Content-Disposition: inline
--OCb6KclsKoh2FPBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Mon, Oct 25, 2004 at 04:46:21PM -0400, Kevin Coffman wrote:
> > > Also check the properties on the client and service principals
> > > (including the krbtgt principals). I forget whether max renewable
> > > lifetime is one of them, but if it is, it would be set when the
> > > principal is created or when you use "modprinc" in kadmin, and the
> > > config file specifications won't extend it, only (potentially) further
> > > limit it.
> >=20
> > You had me all excited for a minute... but no:
> >=20
> > kadmin: getprinc phil
> > ...
> > Maximum renewable life: 7 days 00:00:00
>=20
>=20
> That's the client. What about
> getprinc krbtgt/ISD.USC.EDU@ISD.USC.EDU ?
Aha!
Maximum renewable life: 0 days 00:00:00
So... "krbtgt" is the principal for... the domain? I'm still catching up on
Kerberos here.
so a=20
modprinc -maxrenewlife 7d krbtgt/ISD.USC.EDU@ISD.USC.EDU
Should fix this?
--=20
Phil Dibowitz
Systems Architect and Administrator
Enterprise Infrastructure / ISD / USC
UCC 174 - 213-821-5427
--OCb6KclsKoh2FPBn
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFBfWc47lkZ1Iyv898RAjcuAJ4g9vI/hfz4wnoNaXyCtWu60UIjnQCgp7i6
yBiur3/Ol3VuXzeHODHwCgg=
=MSAv
-----END PGP SIGNATURE-----
--OCb6KclsKoh2FPBn--
--===============7643235160353723==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============7643235160353723==--
