While testing automatic renewal for Kerberos tickets, I decided to check samba-gpupdate ability to apply lifetime values for tickets from Group Policies. Values allowed for lifetime have their minimum, maximum and "don’t expire" values (see https://learn.microsoft.com/ru-ru/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/kerberos-policy). They differ from Microsoft’s or aren’t processed in Samba at all. What goes wrong (applying values from RSAT console): - "Maximum lifetime for service ticket" value less than 60 minutes result in inability to retrieve service tickets because it converts minutes to hours by dividing minutes by 60 and stores the result as an integer (see https://github.com/samba-team/samba/blob/master/python/samba/gp/gp_sec_ext.py#L29). 2024-11-29 10:07:30.436|[I62543]| kdc:service_ticket_lifetime was changed from b'10' to 0 | {} - "Maximum lifetime for user ticket" set to zero results to -1 internally, which gets multiplied by 24 and renewal lifetime becomes incorrect too 2024-11-29 09:56:51.944|[I48023]| kdc:user_ticket_lifetime was changed from None to -1 | {} 2024-11-29 09:56:51.945|[I55506]| kdc:renewal_lifetime was changed from None to -24 | {} - "Maximum lifetime for user ticket renewal" set to zero results in inability to retrieve service tickets 2024-11-29 10:45:22.191|[I21553]| kdc:renewal_lifetime was changed from b'48' to 0 | {} samba-gpupdate can't connect to a DC to remove incorrect values from internal database because it needs an LDAP service ticket. Removing /var/cache/samba/gpo.tdb and restarting service works. Setting values in /etc/samba/smb.conf doesn't override incorrect values either. No documentation is available that describes "kdc:" parameters and their limits/special values, only a mention in "gpo update command" (https://bugzilla.samba.org/show_bug.cgi?id=10461). Example of an error when trying to run samba-gpupdate afterwards: gse_get_client_auth_token: gss_init_sec_context failed with [Unspecified GSS failure. Minor code may provide more information: Requested effective lifetime is negative or too short](2529638923)
(In reply to Ivan Korytov from comment #0) > - "Maximum lifetime for service ticket" value less than 60 minutes result in inability to retrieve service tickets In this situation we could round the lifetime up to one hour. We would have to decide whether to do this even for very short lifetimes (e.g. one minute). > - "Maximum lifetime for user ticket" set to zero results to -1 internally, which gets multiplied by 24 and renewal lifetime becomes incorrect too Is it just this option that uses this internal -1 representation?
(In reply to Jennifer Sutton from comment #1) > Is it just this option that uses this internal -1 representation? All of them can be set to -1. Ticket lifetime for user is set to -1 to indicate unrestricted lifetime in GptTmpl.inf, but in GUI is zero. Same for ticket lifetime for service. (maybe a bug) Renewal lifetime can be set to -1 if previously ticket lifetime for user and service is set to zero in GUI. Windows displays a dialog with recommended changes to disable (set as "not defined") renewal lifetime, but in GptTmpl.inf it is not removed and set to -1. Also, there is two special cases: - disable ticket renewal when "Maximum lifetime for user ticket renewal" set to zero - do not restrict/impose limit for user and service ticket lifetime I couldn't find a way to implement "not restricted" values for ticket lifetimes and "ticket renewal disabled" for renewal, so I postponed sending a patch as it wouldn't reflect settings described in group policy, only fix the described bug with calculations.