Lifetime of Kerberos tickets

Question

I have started with configuring kerberos.

Can anyone explain the ticket lifetime and renew lifetime we set in the krb5.conf file.

ticket_lifetime = 2d  
renew_lifetime = 7d

Is it like

1. After 2 days client will get the new renewed ticket ?
2. After 7 days do i need to create the key tabs again and send to client machines?

Answer 1

A Kerberos ticket has two lifetimes: a ticket lifetime and a renewable lifetime. After the end of the ticket lifetime, the ticket can no longer be used. However, if the renewable lifetime is longer than the ticket lifetime, anyone holding the ticket can, at any point before either lifetime expires, present the ticket to the KDC and ask for a new ticket. That new ticket will generally have a fresh ticket lifetime dating from the current time, although constrained by the renewable ticket lifetime.

That means you have to renew a ticket before it expires. You can't renew a ticket after it expires. But renewing a ticket doesn't require re-entering credentials, like a password or the key from the keytab. It can therefore be done quietly on the user's behalf by a program. (There are, for example, some system background utilities for Windows, Linux, and Mac OS X that watch the user's Kerberos tickets and renew them as needed up to the renewable lifetime.)

After the renewable lifetime is exhausted, or if one doesn't renew the ticket before the ticket lifetime expires, you have to re-enter credentials or use the key from a keytab.

Security-wise, the advantage of renewable tickets over tickets that just have a long lifetime is that the KDC can decline the renew request (if, for example, it had been discovered that the account was compromised and the renewable ticket may be in the hands of an attacker).

Renewable lifetimes don't have anything to do with keytabs. A keytab is good until you change the key for the principal, potentially forever.

Answer 2

There are two part of this one is ticket max life which is by default 1 day as det in /etc/krb5.conf file. Now when we create any principal its ticket maxlife is same as that of the krb5.conf ticket_lifetime. If we can to change the ticket life time for the user then give the command modprinc -maxlife "10 hrs" username.

Finally while generating the ticket we can set the life of that ticket. give the ticket life with kinit.

So there are three life.

• kerberos ticket life time
• principal max ticket life time which will be less than or equal to kerberos life time.
• kinit life time which is less that or equal to principal ticket life time.