Copyright 1987, 1989 by the Student Information Processing Board of the Massachusetts Institute of Technology. For copying and distribution information, please see the file kerberosv5/mit-sipb-copyright.h.
Portions Copyright (c) 2004, Sun Microsystems, Inc. All Rights Reserved
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
/etc/krb5/warn.conf
The warn.conf file contains configuration information specifying how users will be warned by the ktkt_warnd daemon about ticket expiration. In addition, this file can be used to auto-renew the user's Ticket-Granting Ticket (TGT) instead of warning the user. Credential expiration warnings and auto-renew results are sent, by means of syslog, to auth.notice.
Each Kerberos client host must have a warn.conf file in order for users on that host to get Kerberos warnings from the client. Entries in the warn.conf file must have the following format:
principal [renew[:opt1,...optN]] syslog|terminal time
or:
principal [renew[:opt1,...optN]] mail time [email address]principal
Specifies the principal name to be warned. The asterisk (*) wildcard can be used to specify groups of principals.
Automatically renew the credentials (TGT) until renewable lifetime expires. This is equivalent to the user running kinit -R. The renew options include: log-success
Log the result of the renew attempt on success using the specified method (syslog|terminal|mail).
Log the result of the renew attempt on failure using the specified method (syslog|terminal|mail). Some renew failure conditions are: TGT renewable lifetime has expired, the KDCs are unavailable, or the cred cache file has been removed.
Same as specifing both log-success and log-failure.
Note -
If no log options are given, no logging is done.
Sends the warnings to the system's syslog. Depending on the /etc/syslog.conf file, syslog entries are written to the /var/adm/messages file and/or displayed on the terminal.
Sends the warnings to display on the terminal.
Sends the warnings as email to the address specified by email_address.
Specifies how much time before the TGT expires when a warning should be sent. The default time value is seconds, but you can specify h (hours) and m (minutes) after the number to specify other time values.
Specifies the email address at which to send the warnings. This field must be specified only with the mail field.
Example 1 Specifying Warnings
The following warn.conf entry
* syslog 5m
specifies that warnings will be sent to the syslog five minutes before the expiration of the TGT for all principals. The form of the message is:
jdb@ACME.COM: your kerberos credentials expire in 5 minutes
Example 2 Specifying Renewal
The following warn.conf entry:
* renew:log terminal 30m
...specifies that renew results will be sent to the user's terminal 30 minutes before the expiration of the TGT for all principals. The form of the message (on renew success) is:
myname@ACME.COM: your kerberos credentials have been renewed
Kerberos warning daemon
See attributes(5) for descriptions of the following attributes:
| ATTRIBUTE TYPE ATTRIBUTE VALUE |
| Interface Stability Evolving |
kinit(1), kdestroy(1), ktkt_warnd(1M), syslog.conf(4), utmpx(4), attributes(5), kerberos(5), pam_krb5(5)
The auto-renew of the TGT is attempted only if the user is logged-in, as determined by examining utmpx(4).