I have a new server running Ubuntu Bionic (18.04.01) with sssd 1.16.1-1ubuntu1.  The problem is that our Kerberos tickets are not being renewed while we are logged in.  I have tried using FILE and KEYRING credential caches.  SSH has Kerberos disabled, GSSAPI disabled, and is configured to use PAM.  Logging works, but the ticket expires without being renewed. We are using sssd-ad for auth.   I’ve cranked up the debug to level 9.  I am unsure where to start to try to troubleshoot.  Advice is appreciated.

Jay McCanta

F5 Networks, Inc.

Here’s a sample ticket:

Ticket cache: KEYRING:persistent:27644:krb_ccache_pBjYhsU

Default principal: mccanta-admin@OLYMPUS.F5NET.COM

10/31/2018 16:15:51  11/01/2018 02:15:51  krbtgt/EXAMPLE.COM@EXAMPLE.COM

              renew until 11/07/2018 16:15:51

/etc/sssd/sssd.conf (ad_access_filter omitted for security):

[sssd]

config_file_version = 2

domains = example.com

services = nss, pam

debug_level = 9

reconnection_retries = 3

[nss]

debug_level = 9

[pam]

debug_level = 9

[domain/example.com]

debug_level = 9

id_provider = ad

  default_ccache_tempate=KEYRING:persistent:%U

  krb5_renewable_lifetime=10d

  krb_renew_interval=2h

  auth_provider = ad

access_provider = ad

ldap_id_mapping = False

ad_gpo_access_control = permissive

Krb5.conf:

[libdefaults]

              default_realm = EXAMPLE.COM

              dns_lookup_realm = true

              dns_lookup_kdc = true

              ticket_lifetime = 24h

              renew_lifetime = 7d

              rdns = false

              forwardable = yes

                default_ccache_name=KEYRING:persistent:%{uid}

[realms]

              EXAMPLE.COM = {

                             default_domain = example.com

                                           #site=SE3CIP

                                           kdc=dc01.example.com:88

                                           kdc=dc02.example.com:88

              }

[domain_realm]

              example.com = EXAMPLE.COM

              .example.com = EXAMPLE.COM