[22867] in Kerberos
Re: Maximum ticket lifetimes?
daemon@ATHENA.MIT.EDU (Tillman Hodgson)
Fri Nov 19 13:08:33 2004
Date: Fri, 19 Nov 2004 12:07:50 -0600
From: Tillman Hodgson <tillman@seekingfire.com>
To: kerberos@mit.edu
Message-ID: <20041119180750.GC61766@seekingfire.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.58L.0411180853320.23207@amalgam.mit.edu>
Errors-To: kerberos-bounces@mit.edu
On Thu, Nov 18, 2004 at 08:59:41AM -0500, Eric Jonas wrote:
> I have deployed an MIT kerberos KDC in my lab, and am attempting to
> lengthen the ticket lifetime to a full day (this is using debian stable,
> kerberos version 1.2.4-5woody6).
>
> I've edited /etc/krb5kdc/kdc.conf to have max_life = 24h
>
> and via kadmin:
> modprinc -maxlife "1 day" krbtgt/MWL.AI.MIT.EDU@MWL.AI.MIT.EDU
> modprinc -maxlife "1 day" jonas@MWL.AI.MIT.EDU
>
> getprinc shows that both of these were successful. Then I restarted the
> kdc and kdc-admin processes on the kdc.
Between this paragraph and the next, your testing methods and problem
description appear to be missing :-)
How are you calling kinit? (e.g., `kinit -l24h`)? What is the output of
klist?
> I'm really stumped at this point because all the mailing list posts with
> these questions highlighted the importance of changing the maximum life on
> the above tickets as well as the kdc, which I've done.
That's the common stumbling block in my experience, yup.
> Is there something obvious I'm missing, or someplace I should look for
> more data? Also, is there someplace I can set the "24h" to be the maximum
> lifetime for all tickets created in the future?
One thing that comes to mind is that "maxinum" != "default". Are you
calling kinit with a ticket length parameter?
-T
--
Page 12: Unix is a set of tools for smart people.
- Harley Hahn, _The Unix Companion_
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
