1. Forum
  2. USENET
  3. comp.protocols.kerberos

  • KEYRING ccache can hide valid tickets when it contains expired ticket

    From Ao Shen@sa22@mails.tsinghua.edu.cn to kerberos on Sun Oct 11 23:18:30 2026
    From Newsgroup: comp.protocols.kerberos

    Hello list,

    I'm trying to use KEYRING as default ccache and noticed that when there is a service ticket expired, `klist` would truncate the list of available tickets
    in my ccache with an error message:

    klist: No credentials cache found while retrieving a ticket

    However, after a while, the error would be gone and everything returned
    normal.

    Running `strace -e trace=keyctl -e raw=keyctl klist` resulted in the following trace:

    <snipped>
    Ticket cache: KEYRING:persistent:1000:1000
    Default principal: <redacted>

    Valid starting Expires Service principal
    keyctl(0xb, 0x3bcd9d82, 0, 0, 0x1) = 0x20
    keyctl(0xb, 0x3bcd9d82, 0x555b0ccc3300, 0x20, 0x21) = 0x20
    keyctl(0xa, 0x3bcd9d82, 0x7fb2398031cb, 0x7fb2398031b5, 0) = 0x2d49e281 keyctl(0xb, 0x1cd27e1, 0, 0, 0) = 0x2ac
    keyctl(0xb, 0x1cd27e1, 0x555b0ccc3d20, 0x2ac, 0x2ad) = 0x2ac 2026-10-11T19:40:52 2026-10-11T19:50:52 host/<redacted>
    keyctl(0xb, 0x20d54b4d, 0, 0, 0x555b0ccbf030) = -1 EKEYEXPIRED (Key has expired)
    klist: No credentials cache found while retrieving a ticket

    It looks like that krcc_next_cred() would return KRB5_FCC_NOFILE when it encountered an expired key when it would be fine to ignore it and continue.

    According to kernel documentation[1], expired key can be retained in keyring for at most sys.kernel.keys.gc_delay seconds. After GC, the key would be removed, then krcc_next_cred() would work again.

    My kerberos version: Kerberos 5 release 1.22.2
    My operation system: Linux 6.18.52-gentoo #1 SMP PREEMPT_DYNAMIC Mon Sep 28 16:57:55 CST 2026 x86_64 AMD Ryzen 9 9950X3D 16-Core Processor AuthenticAMD GNU/Linux

    [1]: https://www.kernel.org/doc/html/v7.2/security/keys/core.html#garbage-collection

    --

    Ao Shen

    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Greg Hudson@ghudson@mit.edu to Ao Shen on Mon Oct 12 02:57:16 2026
    From Newsgroup: comp.protocols.kerberos

    I'm trying to use KEYRING as default ccache and noticed that when there is a service ticket expired, `klist` would truncate the list of available tickets in my ccache with an error message:

    klist: No credentials cache found while retrieving a ticket

    Thanks for investigating and reporting this bug. I confirmed that I can reproduce the error (using kvno on a server principal created with
    -maxlife 1m) and filed a PR to fix it:

    https://github.com/krb5/krb5/pull/1546

    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Ao Shen@sa22@mails.tsinghua.edu.cn to Greg Hudson on Mon Oct 12 15:34:48 2026
    From Newsgroup: comp.protocols.kerberos

    On Mon, Oct 12, 2026 at 02:57:16AM +0800, Greg Hudson wrote:
    Thanks for investigating and reporting this bug. I confirmed that I can reproduce the error (using kvno on a server principal created with -maxlife 1m) and filed a PR to fix it:

    https://github.com/krb5/krb5/pull/1546

    Thanks for your reply. I have tried the patch locally and can confirm that it fixed the issue.

    --

    Ao Shen

    --- Synchronet 3.22a-Linux NewsLink 1.2