How do I change the ticket lifetime in the default policy?

[Kevin Coffman]

On Tue, Feb 17, 2009 at 4:49 PM, Jason Edgecombe
<jason at rampaginggeek.com> wrote:
> Russ Allbery wrote:
>> Jason Edgecombe <jason at rampaginggeek.com> writes:
>>
>>
>>> We are extending the ticket lifetime for all of the users in our realm
>>> from 1 day to 7 days. We use MIT Kerberos in our realm. I know that
>>> "modprinc -maxlife 7day user at REALM.COM" will extend the ticket lifetime
>>> for an existing user, but how to I make it the default for new users?
>>>
>>
>> I believe the default for new users is taken from the max_life setting in
>> kdc.conf.
>>
>>
> hmm,
>
> my kdc.conf already has "max_life = 7d 0h 0m 0s" and the users don;t get
> 7 day tickets by default. Am I missing something?

The ticket lifetime is the minimum of 4 values:
1) maxlife for the user principal
2) maxlife for the service [principal]
3) max_life in the kdc.conf
4) requested lifetime in the ticket request

Sounds like you have changed 1) and 3).  You'll also need to modify
the maxlife for principal krbtgt/<REALM>@<REALM> to get TGTs with a
longer lifetime.  (You will have to alter other service principals if
you want to issue service tickets with longer lifetimes for those
services.)

I believe there is a default (requested) lifetime in kinit as well, so
you may need to specify a longer requested lifetime there ("kinit -l
7d").

K.C.