I agree on the lifetime of 7 days, that's fine.

What I want to achieve is that I do not have to manually kinit the machine again.
So that our users kan keep logging on, even after 7 days.
I thought SSSD would do this for me. I cannot log in to each server everytime to make sure a new krbtgt is there ...

As per the manpage of kinit:

-R

requests renewal of the ticket-granting ticket. Note that an expired ticket cannot be renewed, even if the ticket is still within its renewable life.

If SSSD does a kinit -R, it should get a new krbtgt with a new expiration date that's 7 days ahead, right?



On 1 December 2015 at 13:26, John Hodrien <J.H.Hodrien@leeds.ac.uk> wrote:
On Tue, 1 Dec 2015, Andy Airey wrote:

Hi,

If I read the manpage <http://linux.die.net/man/5/sssd-krb5> correctly, the
setting krb5_renew_interval suggests that the krbtgt gets renewed.

I thought this meant that the ticket gets renewed (a new krbtgt is
generated) before the 7 days come to an end.
Now, 7 days after kinit, we cannot log on tp the machine anymore with our
krb5 credentials.

It'll get renewed regularly, as the valid lifetime of your ticket will be more
like 10/12 hours.  Just do a kinit, then klist, and see what it tells you.
You can ask for a longer life ticket, but AFAIK AD defaults to a max of 7
days.  A long life ticket isn't particularly nice from a security point of
view either.

If there is another way, please enlighten me :).

SSSD can renew until it can't.  In your original post you showed:

   "renew until 12/07/15 13:16:40"

You can renew until that point, but you're not allowed to get a credential
valid after that point, so without a password you can feed to the KDC, or
additional privs for the machine, you're done aren't you?

It's doing nothing more than a kinit -R as I understand it, and it's bound by
the same limitations.


jh
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org