Questo contenuto non è disponibile nella lingua selezionata.
2.3. Automatic Kerberos Host Keytab Renewal
SSSD automatically renews the Kerberos host keytab file in an AD environment if the adcli package is installed. The daemon checks daily if the machine account password is older than the configured value and renews it if necessary.
The default renewal interval is 30 days. To change the default:
- Add the following parameter to the AD provider in your
/etc/sssd/sssd.conffile:ad_maximum_machine_account_password_age = value_in_days
- Restart SSSD:
# systemctl restart sssd
To disable the automatic Kerberos host keytab renewal, set
ad_maximum_machine_account_password_age = 0.
