0

I am using Python to connect to a SQL server database using pypyodbc and Microsoft ODBC provide for SQl server driver. It was looking for Kerberos ticket which I created by using following command:

$kinit [email protected]

But it gets expired everyday, how can I make it not to expire?

[sinXXXX4@uXXXXXXXd102 HealthCheck]$ klist
Ticket cache: FILE:/tmp/krb5cc_134202
Default principal: [email protected]

Valid starting       Expires              Service principal
03/09/2018 10:09:46  03/09/2018 20:09:46  
krbtgt/[email protected]
    renew until 03/10/2018 10:09:40
4
  • 1
    Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See What topics can I ask about here in the Help Center. Perhaps Super User or Unix & Linux Stack Exchange would be a better place to ask.
    – jww
    Mar 9, 2018 at 17:09
  • 2
    Either request a longer lifetime with kinit -l or look at the k5start tool.
    – match
    Mar 9, 2018 at 17:39
  • 1
    From a security standpoint, non-expiring (or even long-lived) tickets are a Bad Idea™. You can, however, renew an existing non-expired ticket using kinit -R. In your case, it looks like that buys you some extra time before having to re-authenticate.
    – Ben Thul
    Mar 9, 2018 at 17:40
  • Did you check this similar question: stackoverflow.com/questions/40917698/…? Or this one: stackoverflow.com/questions/41453395/…?
    – T-Heron
    Mar 10, 2018 at 2:10

1 Answer 1

0

Lifetime of the kerberos ticket depends on the ticket lifetime value set in /etc/krb5.conf of KDC server. The default value of this parameter is 24hours because of which your ticket is getting expired everyday. You can change the value of ticket_lifetime in /etc/krb5.conf of KDC server and restart the kadmin service and krb5kdc service so that changes become effective.

2
  • /sbin/service krb5kdc stop, /sbin/service kadmin stop, /sbin/service krb524 stop to stop the service. /sbin/service krb5kdc start, /sbin/service kadmin start, /sbin/service krb524 start to start the service. Source: techwalla.com/articles/how-to-restart-kerberos-in-linux
    – Nitin
    Sep 11, 2018 at 17:22
  • 1
    @Nitin: these are the commands which will help in restarting the kdc related services once the changes are made in the /etc/krb5.conf present at KDC server for changing ticket lifetime. Though I think restart of /sbin/service krb524 is not required. Only restarting service krb5kdc and kadmin will do the job.
    – Aman Khare
    Dec 3, 2018 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.