samba - Jun 2025 - Kerberos ticket expiry and share disconnect

Hi folks,

When starting to work on a Linux domain member PC early in the morning, 
and continuing for more than 10 hours, mounted shares disconnect 10 
hours after logging first logging in. It seems the kerberos expiry time 
of 10 hours is responsible for this behavior. It's really quite 
frustrating that documents just disappear in front of your eyes when 
this happens. Those problems have been reported numerous times in this 
list through the years.

Setting the default domain policies on the Samba AD DC with Microsoft 
ADUC (Default domain policy\Computer configuration\Policies\Windows 
settings\Security\Account policies\Kerberos policies) do not seem to 
have the slightest effect. The default expiry times remain both in Linux 
member servers, and in Windows clients.

I have tried to dig through the documentation, unfortunately with any 
positive results.

Do the Samba AD DC respect the set values at all? If not, how and where 
do I set the the kerberos ticket policies for the Samba domain? Do I use 
samba-tool, and in that case what is the command for setting the 
kerberos ticket expiry time? Do I set it in /etc/krb5.conf? Or in 
smb.conf? And do I set it in all Linux domain members? And what about 
Windows clients?

There is a Wiki page 
(https://wiki.samba.org/index.php/Samba_KDC_Settings), but there are no 
details into which file those settings go.

If somebody could share their knowledge about this, I would be grateful. 
The Wiki should also be updated, as it's sorely lacking in information 
value.

Best regards,

Peter

On Fri, 6 Jun 2025 11:48:50 +0200
Peter Milesson via samba <samba at lists.samba.org> wrote:
> Hi folks,
> 
> When starting to work on a Linux domain member PC early in the
> morning, and continuing for more than 10 hours, mounted shares
> disconnect 10 hours after logging first logging in. It seems the
> kerberos expiry time of 10 hours is responsible for this behavior.
> It's really quite frustrating that documents just disappear in front
> of your eyes when this happens. Those problems have been reported
> numerous times in this list through the years.
> 
> Setting the default domain policies on the Samba AD DC with Microsoft 
> ADUC (Default domain policy\Computer configuration\Policies\Windows 
> settings\Security\Account policies\Kerberos policies) do not seem to 
> have the slightest effect. The default expiry times remain both in
> Linux member servers, and in Windows clients.
> 
> I have tried to dig through the documentation, unfortunately with any 
> positive results.
> 
> Do the Samba AD DC respect the set values at all? If not, how and
> where do I set the the kerberos ticket policies for the Samba domain?
> Do I use samba-tool, and in that case what is the command for setting
> the kerberos ticket expiry time? Do I set it in /etc/krb5.conf? Or in 
> smb.conf? And do I set it in all Linux domain members? And what about 
> Windows clients?
> 
> There is a Wiki page 
> (https://wiki.samba.org/index.php/Samba_KDC_Settings), but there are
> no details into which file those settings go.
What, other than, from that wiki page:

Samba 4's KDC ticket life can be controlled using the parameters in
smb.conf 
> 
> If somebody could share their knowledge about this, I would be
> grateful. The Wiki should also be updated, as it's sorely lacking in
> information value.
The problem is, my shares do not disconnect after 10 hours, but other
than adding 'winbind refresh tickets = yes' to smb.conf, I do not
set/alter anything else.

How are you mounting the share ?

Rowland