On Tue, 1 Dec 2015, Andy Airey wrote:
I agree on the lifetime of 7 days, that's fine.
What I want to achieve is that I do not have to manually kinit the machine
again.
So that our users kan keep logging on, even after 7 days.
I thought SSSD would do this for me. I cannot log in to each server
everytime to make sure a new krbtgt is there ...
Now I'm lost. You wouldn't have to do it for the machine, because for the
machine you would have joined it to the domain and generated a keytab, so
would have a stored credential in /etc/krb5.keytab. This lasts indefinitely.
Renewals would only really relate to long running tasks running as a given
user.
jh