[8019] in Kerberos
workaround for default max_life of 0
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Wed Sep 18 11:22:09 1996
Date: Wed, 18 Sep 1996 11:00:05 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: Christopher Seawood <cseawood@qualcomm.com>
Cc: Christoph Hoegl <darkwing@bsdd.regensburg.com>, clouse@rsvl.unisys.com,
kerberos@MIT.EDU
Well, this is another one of those "oops" situations. :-)
If you do not set the max_life relation in kdc.conf, the KADM5 library
provides a default value of 0. Clearly KADM5 expects the KDC to
interpret a zero max_life as "unlimited," but the KDC is actually
interpreting it as zero, and thus generating tickets with no lifetime.
After thinking about it, I believe the KDC is right and KADM5 is
wrong.
The workaround to the problem is to add a max_life field to kdc.conf,
like this:
[realms]
DEMO.COM = {
<other stuff>
max_life = 10h 0m 0s
<other stuff>
}
The correct fix is for KADM5 to assume a reasonable default if
max_life is not specified, such as 8 hours. This will be fixed in the
next release.
Barry
PS: No one really expected a completely new admin system to be dropped
into Kerberos with a number of this kind of small, annoying problems
being found, did they? :-)
