Public bug reported: Versions of krb5 prior to 1.21 store the time delta until password expiry in a signed 32-bit integer, meaning they cannot represent times more than 2^31-1 seconds in the future, or about 68 years. Windows Server 2025's Active Directory uses a fake password expiry date in 2100 for accounts with no password expiry date, which is further in the future than that, and therefore this delta wraps around to being negative. This then counts as being less than 1 week, so it goes on to print a password expiry warning (opting for the "most pressing" one of 1 hour, since it is also less than 3600 seconds).
This has been seen to occur on both Ubuntu 22.04 and Ubuntu 24.04, although the former is only by a colleague. The upstream bug fix for this is https://github.com/krb5/krb5/commit/29600cf1db888d91c42cbd6cf72652afe8c1ee66. Output appears as follows: waltham:~ jrtc4% kinit -l 365d Password for [email protected]: Warning: Your password will expire in less than one hour on Tue 14 Sep 2100 03:48:05 BST ** Affects: krb5 (Ubuntu) Importance: Undecided Status: New ** Description changed: Versions of krb5 prior to 1.21 store the time delta until password expiry in a signed 32-bit integer, meaning they cannot represent times more than 2^31-1 seconds in the future, or about 68 years. Windows Server 2025's Active Directory uses a fake password expiry date in 2100 for accounts with no password expiry date, which is further in the future than that, and therefore this delta wraps around to being negative. This then counts as being less than 1 week, so it goes on to print a password expiry warning (opting for the "most pressing" one of 1 hour, since it is also less than 3600 seconds). This has been seen to occur on both Ubuntu 22.04 and Ubuntu 24.04, although the former is only by a colleague. The upstream bug fix for this is https://github.com/krb5/krb5/commit/29600cf1db888d91c42cbd6cf72652afe8c1ee66. + + Output appears as follows: + + waltham:~ jrtc4% kinit -l 365d + Password for [email protected]: + Warning: Your password will expire in less than one hour on Tue 14 Sep 2100 03:48:05 BST -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162744 Title: kinit: Warns about password expiry for Windows Server 2025 DC To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2162744/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
