0

I am creating a script where I can check to see if something is expired such as a kerberos ticket cache.

I need to get the expiration date/time, get the current date/time, and compare them to see if this first date/time would be expired.

I am creating a script to see if a kerberos ticket is still valid, or expired.

I can get the expiration date+time for both in epoch format (assuming that is best).

KRBEXPDATE=$(klist | grep -i krbtgt | awk '{print $3}')
KRBEXPTIME=$(klist | grep -i krbtgt | awk '{print $4}')
CURREPOCH=$(date +%s)
KRBEXPEPOCH=$(date --date="$KRBEXPDATE $KRBEXPTIME" +%s)

I want to see if the kerberos ticket is expired in an if statement, I am having trouble with the logic on if statement working with time. I may have answered my own question here, but should it be CURRENTEPOCH is greater than KRBEXPEPOCH then echo "ticket is not valid". Does this make sense?

if [[ "$CURREPOCH" > "$KRBEXPEPOCH" ]] ;
then
  echo "Ticket is not valid"
fi
  • 5
    I think > compares strings, not numbers. Maybe you should use -gt instead? See the comments under this answer. – Kamil Maciorowski Dec 16 '16 at 7:20
5

Comparing current date and expiration date, by converting them to seconds from epoch, is a good enough way of telling whether your ticket is expired or not. As long as you are obtaining CURREPOCH and KRBEXPEPOCH from the same host, you will be able to tell with good precision the current state of the ticket (if you don't get them from the same host, mind that the dates obtained may be relative to different time zones, and you would need to shift them accordingly).

However, as Kamil mentioned in his comment, the implementation you used in your answer has a crucial problem: as you can see in man bash, line 1753, the ">" operator compares strings. Which, for your application, is generally a wrong thing to do. To understand why, try this:

if [[ "1000" > "200" ]]; then
  echo "Statement is true"
else
  echo "Statement is false"
fi

As the number 1000 is in fact greater than 200, you might expect "Statement is true" to be printed out...but instead you get "Statement is false". That's because ">" acts like a strcmp(), comparing character-by-character the ASCII codes on the string (e.g. a < b would be true).

What you want to do is either use the "-gt" operator, like Kamil suggested, or compare them using bash's arithmetic expansion (which you can use in combination with if, as per man bash, line 270). Assuming you parsed the output of the klist command correctly, you can do either of these:

if [[ "$CURREPOCH" -gt "$KRBEXPEPOCH" ]]; then echo "expired"; fi
if (( $CURREPOCH > $KRBEXPEPOCH )); then echo "expired"; fi
  • Well, it seems to me the question is: is "CURRENTEPOCH being greater than KRBEXPEPOCH" the right way to tell the expired ticket? Problem with > is only an error in the implementation of this logic. The question about the logic stands still. That's why I made a comment, not an answer. – Kamil Maciorowski Dec 16 '16 at 14:09
  • You may be right, i updated the answer to include considerations about this technique. – Mario Vitale Dec 16 '16 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.