[22869] in Kerberos
Re: Maximum ticket lifetimes?
daemon@ATHENA.MIT.EDU (Christian Pfaffel)
Mon Nov 22 05:53:55 2004
To: Tillman Hodgson <tillman@seekingfire.com>
From: Christian Pfaffel <flash@itp.tu-graz.ac.at>
In-Reply-To: <20041119180750.GC61766@seekingfire.com>
Date: 22 Nov 2004 11:51:57 +0100
Message-ID: <7g8y8ui2b6.fsf@faeppc20.tu-graz.ac.at>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: 8bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Tillman Hodgson <tillman@seekingfire.com> writes:
> On Thu, Nov 18, 2004 at 08:59:41AM -0500, Eric Jonas wrote:
> > I have deployed an MIT kerberos KDC in my lab, and am attempting to
> > lengthen the ticket lifetime to a full day (this is using debian stable,
> > kerberos version 1.2.4-5woody6).
> >
> > I've edited /etc/krb5kdc/kdc.conf to have max_life = 24h
> >
> > and via kadmin:
> > modprinc -maxlife "1 day" krbtgt/MWL.AI.MIT.EDU@MWL.AI.MIT.EDU
> > modprinc -maxlife "1 day" jonas@MWL.AI.MIT.EDU
> >
> > getprinc shows that both of these were successful. Then I restarted the
> > kdc and kdc-admin processes on the kdc.
>
> Between this paragraph and the next, your testing methods and problem
> description appear to be missing :-)
>
> How are you calling kinit? (e.g., `kinit -l24h`)? What is the output of
> klist?
>
If You are using kinit for testing it might be valueable for You to
now that the default ticket lifetime is coded to be 10h. So without a
parameter (i.e. -l24h) You will always get 10h.
Christian
--
Christian Pfaffel <flash@itp.tu-graz.ac.at>
Technische Universität Graz Telefon: +43 / 316 / 873 - 81 90
Institut für Theoretische Physik Telefax: +43 / 316 / 873 - 86 78
Petersgasse 16, A-8010 Graz http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
