Revision as of 07:14, 9 May 2013

Description

Demonstrate that MIT Kerberos 1.11 no longer requires clients to synchronize their system clocks with that of the KDC.

Perform prerequisite setup before you run these tests.
You need a domain account, either a user or administrator.
Get the client's current system time.
```
 $ date 
```
```
 Mon Mar 11 15:47:05 EDT 2013 
```
Set the system time on the client to be more than 24 hours ahead of the client's current system time. This will ensure that the client and Active Directory server's clocks are not synchronized.
```
sudo date -s "Next week"
```

Check that you have an appropriate entry in your credentials cache using the klist command.
```
$ klist
```
- You should see a line that has a service principal named "krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM"

Try setting other time offsets to break kerberos clock syncing:

* More than a day backward
* Less than a day backwards/forwards

If you want to file a bug related to this issue, run the command with the the KRB5_TRACE=/dev/stderr environment variable, like this:

$ KRB5_TRACE=/dev/stderr kinit user@AD.EXAMPLE.COM

@@ Line 8: / Line 8: @@
 #: <pre> Mon Mar 11 15:47:05 EDT 2013 </pre>
 # Set the system time on the client to be more than 24 hours ahead of the client's current system time. This will ensure that the client and Active Directory server's clocks are not synchronized.
-#: <pre> $ sudo date -s "12 MAR 2013 15:47:05 EDT" </pre>
+#: <pre>sudo date -s "Next week"</pre>
-#: <pre> Tue Mar 12 15:47:05 EDT 2013</pre>
 |actions=
 # Use an Active Directory domain user account to authenticate to the Active Directory server using kinit