Our domain's Kerberos ticket lifetime is currently set to seven days, apparently because of an old configuration decision. I'd like to restore it to the typical default of 10 hours, but most of the documentation I've found focuses on increasing the lifetime rather than shortening it. Since we have a significant Linux presence, I'm wondering whether reducing the lifetime could cause compatibility or authentication problems. Has anyone made this change, and were there any notable effects?
2 Answers
The usual default Kerberos ticket lifetime is 10 hours, not seven days. A seven-day setting is a significant extension and is worth reviewing from a security standpoint. Before changing it broadly, test representative Windows and Linux clients, along with long-running services, but normal clients should renew or reacquire tickets as needed.
Most clients should request a replacement ticket automatically when the current one expires. The main impact is a small increase in authentication traffic to the domain controllers, but that’s generally negligible compared with the number of service tickets clients already request during a normal day. Properly implemented operating systems should handle ticket expiration without trouble, since expiration is expected behavior. In most environments, a lifetime somewhere around 4–10 hours is reasonable; highly controlled environments sometimes use shorter periods if their infrastructure can support it.
Exactly. Shortening the lifetime is generally fine as long as the clients and domain controllers are healthy. A one-hour lifetime can work in smaller, well-provisioned environments, but 10 hours is a much more typical balance.