On Tue, 1 Dec 2015, Andy Airey wrote:
Hi,
If I read the manpage <
http://linux.die.net/man/5/sssd-krb5> correctly, the
setting krb5_renew_interval suggests that the krbtgt gets renewed.
I thought this meant that the ticket gets renewed (a new krbtgt is
generated) before the 7 days come to an end.
Now, 7 days after kinit, we cannot log on tp the machine anymore with our
krb5 credentials.
It'll get renewed regularly, as the valid lifetime of your ticket will be more
like 10/12 hours. Just do a kinit, then klist, and see what it tells you.
You can ask for a longer life ticket, but AFAIK AD defaults to a max of 7
days. A long life ticket isn't particularly nice from a security point of
view either.
If there is another way, please enlighten me :).
SSSD can renew until it can't. In your original post you showed:
"renew until 12/07/15 13:16:40"
You can renew until that point, but you're not allowed to get a credential
valid after that point, so without a password you can feed to the KDC, or
additional privs for the machine, you're done aren't you?
It's doing nothing more than a kinit -R as I understand it, and it's bound by
the same limitations.
jh