I agree on the lifetime of 7 days, that's fine.
What I want to achieve is that I do not have to manually kinit the machine
again.
So that our users kan keep logging on, even after 7 days.
I thought SSSD would do this for me. I cannot log in to each server
everytime to make sure a new krbtgt is there ...
As per the manpage of kinit:
*-R*
requests renewal of the ticket-granting ticket. Note that an expired
ticket cannot be renewed, even if the ticket is still within its renewable
life.
If SSSD does a kinit -R, it should get a new krbtgt with a new expiration
date that's 7 days ahead, right?
On 1 December 2015 at 13:26, John Hodrien <J.H.Hodrien(a)leeds.ac.uk> wrote:
On Tue, 1 Dec 2015, Andy Airey wrote:
Hi,
>
> If I read the manpage <
http://linux.die.net/man/5/sssd-krb5> correctly,
> the
> setting krb5_renew_interval suggests that the krbtgt gets renewed.
>
> I thought this meant that the ticket gets renewed (a new krbtgt is
> generated) before the 7 days come to an end.
> Now, 7 days after kinit, we cannot log on tp the machine anymore with our
> krb5 credentials.
>
It'll get renewed regularly, as the valid lifetime of your ticket will be
more
like 10/12 hours. Just do a kinit, then klist, and see what it tells you.
You can ask for a longer life ticket, but AFAIK AD defaults to a max of 7
days. A long life ticket isn't particularly nice from a security point of
view either.
If there is another way, please enlighten me :).
>
SSSD can renew until it can't. In your original post you showed:
"renew until 12/07/15 13:16:40"
You can renew until that point, but you're not allowed to get a credential
valid after that point, so without a password you can feed to the KDC, or
additional privs for the machine, you're done aren't you?
It's doing nothing more than a kinit -R as I understand it, and it's bound
by
the same limitations.
jh
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org