Hi, Thanks a lot Florence, i was able to locate the issue - it seems some resources were previously enrolled to the previously installed version of FreeIPA and were trying to authenticate using an old keytab and locking the admin user.
On Tue, Apr 25, 2023 at 1:24 PM Florence Blanc-Renaud <f...@redhat.com> wrote: > Hi, > > First, you can check which password policy settings are applied to your > admin user: > # kinit admin > # ipa pwpolicy-show --user admin > Group: global_policy > Max lifetime (days): 90 > Min lifetime (hours): 1 > History size: 0 > Character classes: 0 > Min length: 8 > Max failures: 6 > Failure reset interval: 60 > Lockout duration: 600 > Max repeat: 5 > Grace login limit: -1 > > In the above example, the user can get locked after 6 authentication > failures. You can use the command "ipa user-status admin" to check how many > failed logins happened. > If the admin account gets locked because of failed logins, you need to > find if those are malicious attempts. Try to identify from which machine > the attempts are issued (from /var/log/krb5kdc.log), etc... > > flo > > On Tue, Apr 25, 2023 at 10:51 AM Yavor Marinov via FreeIPA-users < > freeipa-users@lists.fedorahosted.org> wrote: > >> Hello all, >> >> We have a really strange problem with our installation of FreeIPA 4.10. >> We are using latest Alma 9.1 as OS, but the default user account admin is >> getting constantly locked. After kinit-ing with different admin user and >> unlocking the account it becomes available. >> >> Another side effect of this is that WebUI starts reporting that the >> service is unavailable with a popup. Once user admin is unlocked and ipa >> services are restarted everything becomes available. >> >> Can you give me some heads up what should i check (password policy >> expiration is set to 90 days) >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org >> To unsubscribe send an email to >> freeipa-users-le...@lists.fedorahosted.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue >> >
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue