For ease of administration, you can configure ticket renewal and warning messages about Ticket Granting Ticket (TGT) expiration. Administrators can set warnings for all users, and users can customize their own warnings. For more information, see the warn.conf(4) and ktkt_warnd(1M) man pages.
This example shows several ways to configure the renewal and message system for TGTs.
# pfedit /etc/krb5/warn.conf ## ## renew the TGT 30 minutes before expiration and send message to users terminal ## [email protected] renew:log terminal 30m ## ## send a warning message to a specific email address 20 minutes before TGT expiration ## [email protected] mail 20m [email protected] ## # renew the TGT 20 minutes before expiration and send an email message on failure ## [email protected] renew:log-failure mail 20m - ## ## catch-all: any principal not matched above will get an email warning * mail 20m -
After configuring the messages, run the kclient command on new clients.
client# /usr/sbin/kclient -p /net/denver.example.com/export/install/kcprofile
On existing clients, enable the service.
# svcadm enable network/security/ktkt_warnExample 4-9 Configuring TGT Expiration Messages for a User
Each user can configure an individual warnd configuration file, which is named /var/user/$USER/krb-warn.conf. The existence of this file prevents the administrator file from being read.
% pfedit /var/user/mre/krb-warn.conf [email protected] renew:log mail 25m &
The TGT is renewed 25 minutes before expiration, the renewal is logged, and the Kerberos user mre is sent mail at that time.