1

I followed all recommended MIT kerberos configuration settings. I created a principal and when I do kadmin.local getprinc I see the following 

kadmin.local:  getprinc [email protected]
Principal: [email protected]
Expiration date: [never]
Last password change: Sun Mar 13 07:55:56 UTC 2016
Password expiration date: [none]
Maximum ticket life: 1 day 00:00:00
Maximum renewable life: 10 days 00:00:00
Last modified: Sun Mar 13 07:55:56 UTC 2016 (root/[email protected])
Last successful authentication: [never]
Last failed authentication: [never]

When I do a kinit and then klist, I see the following (which is wrong because I don't see a renew until mm:dd:yy date in the response

Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: [email protected]

Valid starting       Expires              Service principal
03/13/2016 07:56:21  03/14/2016 07:56:19  krbtgt/[email protected]

When a renewal request is made, then I see this in the logs

TGS_REQ (1 etypes {23}) 10.0.0.10: TICKET NOT RENEWABLE: authtime 0,  [email protected] for krbtgt/[email protected], KDC can't fulfill requested option
Improve this question

1 Answer 1

Reset to default
1

Turned out that the Service Principal had a maximum renewal life of 0 days. Maybe I created that before making the conf changes..!

So this is the culprit krbtgt/[email protected]

When I modified the service principal like below, it worked..!

modprinc -maxlife 1days -maxrenewlife 7days +allow_renewable krbtgt/[email protected]
Improve this answer
1
  • Thanks for this! Something changed in my own domain where my tickets expired after 24h. I assume they must have been renewing before. I hadn't modified any of my principals so expect it was due to an upgrade. Modifying my krbtgt/REALM@REALM principal as you showed did the trick!
    – JFlo
    May 19, 2018 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .