From 7ad9f5d3d5ff2eec43bc355c4e7e9514aff01a31 Mon Sep 17 00:00:00 2001 From: Nathaniel McCallum Date: Fri, 5 Dec 2014 11:18:55 -0500 Subject: Prefer TCP connections to UDP in krb5 clients In general, TCP is a better fit for FreeIPA due to large packet sizes. However, there is also a specific need for TCP when using OTP. If a UDP packet is delivered to the server and the server takes longer to process it than the client timeout (likely), the OTP value will be resent. Unfortunately, this will cause failures or even lockouts. Switching to TCP avoids this problem altogether. https://fedorahosted.org/freeipa/ticket/4725 Reviewed-By: Martin Kosek --- ipa-client/ipa-install/ipa-client-install | 1 + 1 file changed, 1 insertion(+) (limited to 'ipa-client') diff --git a/ipa-client/ipa-install/ipa-client-install b/ipa-client/ipa-install/ipa-client-install index 69f63d322..dfe0e3b75 100755 --- a/ipa-client/ipa-install/ipa-client-install +++ b/ipa-client/ipa-install/ipa-client-install @@ -1043,6 +1043,7 @@ def configure_krb5_conf(cli_realm, cli_domain, cli_server, cli_kdc, dnsok, libopts.append({'name':'rdns', 'type':'option', 'value':'false'}) libopts.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'}) libopts.append({'name':'forwardable', 'type':'option', 'value':'yes'}) + libopts.append({'name':'udp_preference_limit', 'type':'option', 'value':'0'}) # Configure KEYRING CCACHE if supported if kernel_keyring.is_persistent_keyring_supported(): -- cgit