Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

He's dead, Jim. -- McCoy, "The Devil in the Dark", stardate 3196.1


devel / comp.protocols.kerberos / Re: renew ticket failed

SubjectAuthor
o Re: renew ticket failedGreg Hudson

1
Re: renew ticket failed

<mailman.50.1699573963.2263420.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=428&group=comp.protocols.kerberos#428

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: renew ticket failed
Date: Thu, 9 Nov 2023 18:52:33 -0500
Organization: TNet Consulting
Lines: 10
Message-ID: <mailman.50.1699573963.2263420.kerberos@mit.edu>
References: <CADX758cSLcoBWFGzjbbbGqBopv8z0hsJgo+2XXegQP4CZxuhSQ@mail.gmail.com>
<31501151-b503-4b1e-a6f3-345c44f0d7c3@mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="17953"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla Thunderbird
To: Dong Ye <yedong.ye@gmail.com>, <kerberos@mit.edu>
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu; dkim=pass (2048-bit key,
unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256
header.s=outgoing header.b=L68Fzr3J
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing;
t=1699573962; bh=Cv6z8+Gi9t7qDgCnRDBNFInZjPV1i5uuOETHYzCllD0=;
h=Message-ID:Date:MIME-Version:Subject:From:Content-Type;
b=L68Fzr3Jp9mFAqdupMNcqJJIz/3IJCrc5ZB6PPDK3IRfYZKmL65P7E1sE4oUnfV3C
u/5y6rODjwpo2Y5lzsAgKkiONSbWowOCzoLHKzTKuzHm+baZlpY94ExgVt9RL+Wpgj
G44c1L1fgX6k6tCvZF06eZaEuI9dkW+a1QH+JpyS5CWCpOl0JzUAO5uXnnTOzcT7/X
yvUD4xuYfbx1dvfcaAwp2KghFdqzmZWr0dIy4PTWBZAOmhV25tphLZttFjq9o226+r
jycwZixbYEk8Jhv0qc+Udr0pCB/w7N3mX1jaoZaeVpcvWEDcRymwepxZBWbxWaUfem
440eZU/FPdbPA==
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; dkim=pass (signature was verified)
header.d=mit.edu;dmarc=pass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu; pr=C
Content-Language: en-US
In-Reply-To: <CADX758cSLcoBWFGzjbbbGqBopv8z0hsJgo+2XXegQP4CZxuhSQ@mail.gmail.com>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: MN1PEPF0000F0DF:EE_|SA1PR01MB7342:EE_
X-MS-Office365-Filtering-Correlation-Id: b24b75ec-1c3a-49c0-c5e4-08dbe17ef329
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: AClzKmlv7/9k8Tc/c1knaoLLTSs7bYt7iegTvFwnP2lwtGSwFQMfTNWcSXUS5H33hMk3USpBmzzGjTG49GSa8VNLUUn2+3fEfKa69LdSD8v9LnAvuODTGgwcn4o2yoXrRBYTWq20BT9DBhWsj1XteESmfHcaOyDW4RFFZeMjT0SpUHoVdMyY/C//wIQKvm/mf5SfPA/zgvsjF3zwPjk9JCEwWSQtE7OnBVPu9p5Eo6bMfwUku6jJjVmVT6iCBUMeYoR1oSEkJyvNoEUwEMJDGgvLfvUAqkL2Om/TdtOTi0H3arwosDo8nRYF4uXZQMTFGWkI8en661/CwyGmeyZ2NQ0MiQsQP+h7ZrUXTb/vfQBSWgRjaKUjucO9qoL7ym8pv+1WfmdP5IJMP6qqng/Vyil8EHvVXKprSNnyNFpHpUDXsdVyBunmA9nb+JjIGSkOx6AuYopAC0IsRjaTB+JMAqLJ1HujkE8qT+05Qu6lF7ZAwEyS1EZxK6iOZZfOzsoAKyVZ7gclA8R4VXJ17EcQ8VYTUKk2/xyZBy1PzKtktwa4ry5qYQqMowhC2F4oecqRffIPUYPyFiax2RWTQ2Rjj2CqdFff7rC6d00munrzMSMCZQLlbLuW4yiGSa6QGk5EufmNgjsxBF8jfVREpX8nqBLAcPLUfiUVKnZwuE1IdH7Q+Sc1SxWhtULzRiEb/zdBuC2O4Qq3I1DMCJB+y84gFIzn35lhZduA7kbmlg9BllsFBqoy3oazeT/tPiMVREPi0vOp8UgPVPy2kUdrIlKlHg==
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu; PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(13230031)(4636009)(396003)(136003)(376002)(39860400002)(346002)(64100799003)(451199024)(1800799009)(75432002)(31686004)(478600001)(36756003)(3480700007)(86362001)(356005)(83380400001)(31696002)(786003)(70586007)(2616005)(68406010)(426003)(336012)(53546011)(6636002)(316002)(26005)(8676002)(956004)(7116003)(5660300002)(4744005)(7696005)(2906002)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Nov 2023 23:52:36.2755 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: b24b75ec-1c3a-49c0-c5e4-08dbe17ef329
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000F0DF.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR01MB7342
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <31501151-b503-4b1e-a6f3-345c44f0d7c3@mit.edu>
X-Mailman-Original-References: <CADX758cSLcoBWFGzjbbbGqBopv8z0hsJgo+2XXegQP4CZxuhSQ@mail.gmail.com>
 by: Greg Hudson - Thu, 9 Nov 2023 23:52 UTC

On 11/8/23 16:13, Dong Ye wrote:
> we encountered an issue where we can't renew the ticket before the
> ticket expires. Seems the ticket is renewable but its renew_till time is
> before its end_time. How is it possible?

It's possible if the ticket was requested that way ("kinit -l 2h -r 1h"
for instance). For a period of time (1.12 through 1.15) the MIT krb5
KDC issued non-renewable tickets for such requests, but that was found
to be disruptive to scripts, so it once again issues renewable tickets
whose end times can't be extended.

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor