...
How to increase to allowable time skew from 5 min to 1 hr and 5 min
Kerberos' use of timestamps is primarily intended to prevent replay attacks. In other words the protocol is designed to prevent an attacker from using previously captured network traffic and resubmitting it in order to gain unauthorized access to systems. The default allowable clock skew in most Kerberos deployments is In order to prevent intruders from resetting their system clocks in order to continue to use expired tickets, Kerberos V5 is set up to reject ticket requests from any host whose clock is not within the specified maximum clock skew of the KDC (as specified in the kdc.conf file). Similarly, hosts are configured to reject responses from any KDC whose clock is not within the specified maximum clock skew of the host (as specified in the krb5.conf file). The default value for maximum clock skew is 300 seconds, or five minutes. One possible way of avoiding any Kerberos related problems as a result of the DST rule changes is to change the allowable clock skew from 5 minutes to 1 hour and 5 minutes.
...