Source: libkrb5-3 Version: 1.18.3-6 Tags: bullseye bookworm [Against libkrb5-3 not krb5-user since the warning is implemented within the library]
I have not had an opportunity to independently verify the behaviour actually occurs on Debian myself, but I believe https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2162744 also applies to the versions of krb5 in bullseye and bookworm. A copy of that bug report follows: Versions of krb5 prior to 1.21 store the time delta until password expiry in a signed 32-bit integer, meaning they cannot represent times more than 2^31-1 seconds in the future, or about 68 years. Windows Server 2025's Active Directory uses a fake password expiry date in 2100 for accounts with no password expiry date, which is further in the future than that, and therefore this delta wraps around to being negative. This then counts as being less than 1 week, so it goes on to print a password expiry warning (opting for the "most pressing" one of 1 hour, since it is also less than 3600 seconds). This has been seen to occur on both Ubuntu 22.04 and Ubuntu 24.04, although the former is only by a colleague. The upstream bug fix for this is https://github.com/krb5/krb5/commit/29600cf1db888d91c42cbd6cf72652afe8c1ee66. Output appears as follows: waltham:~ jrtc4% kinit -l 365d Password for [email protected]: Warning: Your password will expire in less than one hour on Tue 14 Sep 2100 03:48:05 BST Jessica
