Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

2.3. Automatic Kerberos Host Keytab Renewal

SSSD automatically renews the Kerberos host keytab file in an AD environment if the adcli package is installed. The daemon checks daily if the machine account password is older than the configured value and renews it if necessary.
The default renewal interval is 30 days. To change the default:
  1. Add the following parameter to the AD provider in your /etc/sssd/sssd.conf file: 
    ad_maximum_machine_account_password_age = value_in_days
  2. Restart SSSD: 
    # systemctl restart sssd
To disable the automatic Kerberos host keytab renewal, set ad_maximum_machine_account_password_age = 0.