Set a timeout for kerberos login about pam-krb5 HOT 5 CLOSED

I've asked the MIT Kerberos developers if there's any way that either the application or the user can control this timeout.

from pam-krb5.

This mostly isn't under the control of a client of the Kerberos library such as this module, so far as I can see. However, if you build the module against Heimdal (instead of MIT Kerberos), it looks like you can set kdc_timeout in the [libdefaults] secton of /etc/krb5.conf to control how long the library will wait for a reply from the KDC. For Heimdal, the default is 3 seconds; I think the default for MIT may be longer.

from pam-krb5.

The MIT one seems to be like 2-3 minutes, but that might be an element of something like a DNS query getting hung and not how long for a connection. Still though, if any of that takes more than 10 seconds I don't really want to wait

from pam-krb5.

The MIT Kerberos developers unfortunately report that there is no way for the user or the application to control these timeouts. It doesn't look like there's a good solution at the PAM module level except to use Heimdal instead (which of course may affect more than just this).

from pam-krb5.

That's unfortunate, thanks for reaching out anyway.

Closing this issue for now as it doesn't seem like there's a good way to handle this on the module side, but feel free to reopen if this changes.

from pam-krb5.