Ack. If you can also fix up the spelling of "re-authentication" (in the context part, not the part you changed), even better.
Russell - do you think we need the same Ack process for the manual now that it's in a separate repo? I'd personally be happy with a policy allowing anyone with commit access to push updates to the manual without _necessarily_ requiring a ML review (i.e. just use your best judgement), but up to you of course.
cheers, Zane.
On 15/09/11 20:13, Adam Stokes wrote:
- Describes what env variables to set in order to alter a couple of items for k5start like a custom keytab and interval settings for checking on ticket cache.
Signed-off-by: Adam Stokesastokes@fedoraproject.org
en-US/Security.xml | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/en-US/Security.xml b/en-US/Security.xml index 8a508d5..8882af5 100644 --- a/en-US/Security.xml +++ b/en-US/Security.xml @@ -95,16 +95,22 @@ Valid starting Expires Service principal <para>For long running agents we want to make sure our agents have a renewable kerberos ticket so that re-autenctication is not necessary. An application is needed for this called -<application><command>k5start</command></application>. The
administrator of the agent needs to make sure this is running if they
wish to refresh kerberos tickets without any further
interaction.</para>
-<screen><prompt>#</prompt> <userinput>k5start -f /etc/krb5.keytab -K 10 -l 10h qpidd/HAMMER</userinput></screen>
-<para>What this command is doing is setting a lifetime of 10 hours and
periodically checking the expiration of the ticket every 10 minutes.
Further information or examples can be found in the
+<application><command>k5start</command></application> and is invoked
automatically if found. There are a couple of environment variables
that may be set in order to alter<application><command>k5start</command>
+</application> startup behavior. For example, in order to alter where
the keytab file is found and also how long<application><command>k5start
+</command></application> should wait before checking the ticket cache we
could run our agents like:</para>
+<screen><prompt>#</prompt> <userinput>export KRB5_KEYTAB=/etc/matahari-agent.keytab</userinput> +<prompt>#</prompt> <userinput>export KRB5_INTERVAL=20</userinput> +<prompt>#</prompt> <userinput>service matahari-sysconfig start</userinput></screen>
+<para>What<application><command>k5start</command></application> is
is doing is periodically checking the expiration of the ticket every
10 minutes and is only reading the first principal from the defined
keytab file. Further information or examples can be found in the <command>k5start</command> man page.<note> <para>Windows does not have anything similar to <application><command>k5start</command></application>. A windows