Show Table of Contents
2.2. Automatic Kerberos Host Keytab Renewal
SSSD automatically renews the Kerberos host keytab file in an AD environment if the adcli package is installed. The daemon checks daily if the machine account password is older than the configured value and renews it if necessary.
The default renewal interval is 30 days. To change the default:
- Add the following parameter to the AD provider in your
/etc/sssd/sssd.conffile:ad_maximum_machine_account_password_age = value_in_days
- Restart SSSD:
# systemctl restart sssd
To disable the automatic Kerberos host keytab renewal, set
ad_maximum_machine_account_password_age = 0.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.