Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?

share|improve this question
according to technet.microsoft.com/en-us/library/bb742516.aspx the lifetime is 10 hrs. Where does it say that it is 25 ? – asudhak Nov 13 '12 at 3:45
2  
Judging by the fact that you've taken information from Stanford's IT services, it goes to show that, the lifetime of a ticket is dependent on where it is deployed. ~10 hours is the standard in most cases since it is the average working time in an office environment. Whereas Stanford may afford to have it 25 hrs. – asudhak Nov 13 '12 at 4:32
@eQuiNoX__ Btw, your link is broken by the ". itservices.stanford.edu/service/kerberos/user_guide/how – Henning Klevjer Nov 14 '12 at 7:01

1 Answer

up vote 1 down vote

The Kerberos (v5) RFC does not specify a lifetime but recommends nothing more than 25 hours life for each ticket (section 8.2) and a renewal time of max. one week. There is probably no good answer here as to why Stanford chose to break that recommendation.

share|improve this answer
Okay -- but any thoughts on why "25 hours" was chosen? Seems a bit odd to me. – uki Nov 13 '12 at 12:21
No, really no idea. Long hours at Stanford? Being a university, I would guess they have actually discussed and written down somewhere why they chose 25, but finding out who did or where could be a problem. – Henning Klevjer Nov 13 '12 at 12:25
   
My assumption would be that they made it just long enough that they could renew a ticket for the next day before expiry. Just a guess. – Rory Alsop♦ Nov 13 '12 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.