To my knowledge there is no built-in mechanism to disable a principal
after a certain number of failed logins. If you have preauth enabled you
could probably patch the KDC or write a script to monitor your logs.

However, without preauth the KDC has no idea whether a login attempt
(kinit) was successful or not.

-Mike


> Hi,
>
> $Subject.
> client use kerberos for authentication,
> my question is that is there anything i can do with kerberos server to
> reach this object?
>
> Or anything else can be helpful to this case?
>
> thanks
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos