19 Oct
2016
19 Oct
'16
10:39 a.m.
On Wed, Oct 19, 2016 at 5:12 PM, Brian Candler <b.candler@pobox.com> wrote:
However if I "kinit admin" so that I have an existing Kerberos ticket, and then start radiusd, it uses the existing ticket. And this means that user lookups fail: ... The solution is to override the credentials cache type:
KRB5CCNAME=MEMORY: KRB5_CLIENT_KTNAME=/etc/radiusd.keytab radiusd -X
Note, when using KRB5_CLIENT_KTNAME you should never acquire with 'kinit' (not even 'kinit -k). Otherwise even if the credentials were acquired for the same principal, the ticket won't get renewed when it expires. So having a distinct ccache is a good idea indeed.