- Describes what env variables to set in order to alter a couple of items for k5start like a custom keytab and interval settings for checking on ticket cache.
Signed-off-by: Adam Stokes astokes@fedoraproject.org --- en-US/Security.xml | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/en-US/Security.xml b/en-US/Security.xml index 8a508d5..8882af5 100644 --- a/en-US/Security.xml +++ b/en-US/Security.xml @@ -95,16 +95,22 @@ Valid starting Expires Service principal <para>For long running agents we want to make sure our agents have a renewable kerberos ticket so that re-autenctication is not necessary. An application is needed for this called - <application><command>k5start</command></application>. The - administrator of the agent needs to make sure this is running if they - wish to refresh kerberos tickets without any further - interaction.</para> - - <screen><prompt>#</prompt> <userinput>k5start -f /etc/krb5.keytab -K 10 -l 10h qpidd/HAMMER</userinput></screen> - - <para>What this command is doing is setting a lifetime of 10 hours and - periodically checking the expiration of the ticket every 10 minutes. - Further information or examples can be found in the + <application><command>k5start</command></application> and is invoked + automatically if found. There are a couple of environment variables + that may be set in order to alter <application><command>k5start</command> + </application> startup behavior. For example, in order to alter where + the keytab file is found and also how long <application><command>k5start + </command></application> should wait before checking the ticket cache we + could run our agents like:</para> + + <screen><prompt>#</prompt> <userinput>export KRB5_KEYTAB=/etc/matahari-agent.keytab</userinput> +<prompt>#</prompt> <userinput>export KRB5_INTERVAL=20</userinput> +<prompt>#</prompt> <userinput>service matahari-sysconfig start</userinput></screen> + + <para>What <application><command>k5start</command></application> is + is doing is periodically checking the expiration of the ticket every + 10 minutes and is only reading the first principal from the defined + keytab file. Further information or examples can be found in the <command>k5start</command> man page. <note> <para>Windows does not have anything similar to <application><command>k5start</command></application>. A windows