Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our KDC servers are running either Ubuntu Dapper (2.6.15-28) or Hardy (2.6.24-19). The Kerberos software is the MIT implementation of Kerberos 5. By default, a Kerberos ticket lasts for 10 hours. However, we'd like to increase it a bit (e.g. 14 hours) to suit our needs better. I had done the following but the ticket lifetime still stays at 10 hours:

  1. On all the KDC servers, set the following parameter under "[realms]" in /etc/krb5kdc/kdc.conf and restarted the KDC daemon:

    max_life = 14h 0m 0s
  2. Via "kadmin", changed the "maxlife" for a test principal via "modprinc -maxlife 14hours ".

    "getprinc " shows that the maximum ticket life is indeed 14 hours: Maximum ticket life: 0 days 14:00:00

  3. On a Kerberos client machine, set the following parameters under [libdefaults], [realms], [domain_realm], and [login] in /etc/krb5.conf (everywhere basically since nothing I tried had worked):

    ticket_lifetime = 13hrs
    default_lifetime = 13hrs

With the above settings, I suppose that the ticket lifetime would be capped at 13 hours. When I do k5start -l 14h -t <principal>, I see that the end time for the "renew until" line is now 14 hours from the starting time:

Valid starting     Expires            Service principal
04/13/10 16:42:05  04/14/10 02:42:05  krbtgt/<realm>@<realm>
 renew until 04/14/10 06:42:03

"-l 13h" would make the end time in the "renew until" line 13 hours after the starting time.

However, the ticket still expires in 10 hours (04/13 16:42:05 - 014/14 02:42:05).

Am I not changing the right configuration file(s)/parameter(s), not specifying the right option when obtaining a Kerberos ticket, or something else?

share|improve this question

Turns out that I also had to change the "maxlife" parameter for the service principal as well. Specifically, I had to do "modprinc -maxlife 14hours krbtgt/[REALM_in_CAPS]" to get the lifetime increased to 14 hours.

To sum up, the ticket lifetime is the minimum of the following values:

  • max_life in kdc.conf on the KDC servers.

  • ticket_lifetime in krb5.conf on the client machine.

  • maxlife for the user principal.

  • maxlife for the service principal "krbtgt/[REALM_in_CAPS]" => What I had missed!

  • requested lifetime in the ticket request. For example:

    • k5start -l 14h
    • kinit -l 14h
  • maxlife for the AFS service principal "afs/[realm_in_lower_case]", if you want to increase the lifetime of your AFS token.

Mystery solved!

share|improve this answer
what other lifetime settings are involved when the user principal is in a different realm than the service principal and there is a one-way trust from the service realm to the user's realm? – Jayen Jul 4 '12 at 0:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.