On Tue, 1 Dec 2015, John Hodrien wrote:
On Tue, 1 Dec 2015, Thackeray, Neil L wrote:
> I don't control the AD, but I looked and couldn't find a policy mandating
> machine password changes outside of the standard time. I am not running
> msktutil, but I don't really see why I should have to. This is what sssd
> is
> supposed to be doing for me, and it's working just fine in CentOS and
> RedHat
> out of the box.
You *shouldn't* need to, but if something was periodically updating the
machine password on this machine of yours, as is the norm with windows, and
as
can be acheived with certain tools, and wasn't updating the keytab, you'd
presumably see this.
This isn't an SSSD issue.
Your issue is that your keytab isn't valid after a week.
When it breaks, do a klist -k to see the current state of your keytab.
Then do a:
kvno HOSTNAME$
Those numbers should match. If kvno returns a higher number, then something
has changed the password and not updated the keytab.
jh