Ack. If you can also fix up the spelling of "re-authentication" (in the
context part, not the part you changed), even better.
Russell - do you think we need the same Ack process for the manual now
that it's in a separate repo? I'd personally be happy with a policy
allowing anyone with commit access to push updates to the manual without
_necessarily_ requiring a ML review (i.e. just use your best judgement),
but up to you of course.
cheers,
Zane.
On 15/09/11 20:13, Adam Stokes wrote:
- Describes what env variables to set in order
to alter a couple of items for k5start like
a custom keytab and interval settings for checking
on ticket cache.
Signed-off-by: Adam Stokes<astokes(a)fedoraproject.org>
---
en-US/Security.xml | 26 ++++++++++++++++----------
1 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/en-US/Security.xml b/en-US/Security.xml
index 8a508d5..8882af5 100644
--- a/en-US/Security.xml
+++ b/en-US/Security.xml
@@ -95,16 +95,22 @@ Valid starting Expires Service principal
<para>For long running agents we want to make sure our agents have a
renewable kerberos ticket so that re-autenctication is not necessary.
An application is needed for this called
-<application><command>k5start</command></application>. The
- administrator of the agent needs to make sure this is running if they
- wish to refresh kerberos tickets without any further
- interaction.</para>
-
-<screen><prompt>#</prompt> <userinput>k5start -f
/etc/krb5.keytab -K 10 -l 10h qpidd/HAMMER</userinput></screen>
-
-<para>What this command is doing is setting a lifetime of 10 hours and
- periodically checking the expiration of the ticket every 10 minutes.
- Further information or examples can be found in the
+<application><command>k5start</command></application> and is
invoked
+ automatically if found. There are a couple of environment variables
+ that may be set in order to
alter<application><command>k5start</command>
+</application> startup behavior. For example, in order to alter where
+ the keytab file is found and also how
long<application><command>k5start
+</command></application> should wait before checking the ticket cache we
+ could run our agents like:</para>
+
+<screen><prompt>#</prompt> <userinput>export
KRB5_KEYTAB=/etc/matahari-agent.keytab</userinput>
+<prompt>#</prompt> <userinput>export
KRB5_INTERVAL=20</userinput>
+<prompt>#</prompt> <userinput>service matahari-sysconfig
start</userinput></screen>
+
+<para>What<application><command>k5start</command></application>
is
+ is doing is periodically checking the expiration of the ticket every
+ 10 minutes and is only reading the first principal from the defined
+ keytab file. Further information or examples can be found in the
<command>k5start</command> man page.<note>
<para>Windows does not have anything similar to
<application><command>k5start</command></application>. A windows