[29154] in Kerberos
Re: Unable to change lifetime with MIT krb5
daemon@ATHENA.MIT.EDU (Kevin Coffman)
Sun Jan 27 22:53:31 2008
Message-ID: <4d569c330801271945j9360b5aicb00718b9444e7b@mail.gmail.com>
Date: Sun, 27 Jan 2008 22:45:57 -0500
From: "Kevin Coffman" <kwc@citi.umich.edu>
To: vandegrift@gmail.com
In-Reply-To: <d013f562-295b-427d-b303-90d288e84bff@f10g2000hsf.googlegroups.com>
MIME-Version: 1.0
Content-Disposition: inline
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Jan 27, 2008 10:01 PM, <vandegrift@gmail.com> wrote:
> Hi everyone,
>
> I have a simple MIT Kerberos config. One KDC/KAS, a handful of
> client. I have a principal that I'd like to allow 24h expiration
> times on tickets.
>
> My kdc.conf has "max_life = 24h 0m 0s", but if I run "kinit -l 24h", I
> still get the default 10h expiration time.
>
> I noticed that the principal had been created with a 10h max life, so
> I did "modprinc -maxlife '24 hours' ross". The new lifetime is
> reflected in the getprinc output.
>
> Still, kinit only gets me a 10h ticket. What gives?
>
> I'm using the krb5 packages from Debian, if that makes a difference.
> Thanks!
>
> Ross
You also have to increase the maximum lifetime of the service you are
authenticating to. In this case that is the krbtgt service
(krbtgt/REALM@REALM).
K.C.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
