<div dir="ltr">Aha! See Max failures below...<div><br></div><div><div><div><div>[root@hostname ~]# ipa pwpolicy-show --user=admin</div><div> Group: global_policy</div><div> Max lifetime (days): 365</div><div> Min lifetime (hours): 1</div>
<div> History size: 1</div>
<div> Character classes: 1</div><div> Min length: 8</div><div> Max failures: 12</div><div> Failure reset interval: 0</div><div> Lockout duration: 0</div></div><div><br></div></div></div><div>is there a command like pam_tally2 for ipa to reset the number of failed logins?</div>
<div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Aug 1, 2013 at 2:59 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">Hebert, Henry wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Thank you for the respons Rob.<br>
<br>
<br>
[root@hostname ~]# ipa user-show admin<br>
User login: admin<br>
Last name: Administrator<br>
Home directory: /home/admin<br>
Login shell: /bin/bash<br>
UID: ####<br>
GID: ####<br>
Account disabled: False<br>
Password: True<br>
Member of groups: admins, trust admins<br>
Indirect Member of HBAC rule: hostname<br>
Kerberos keys available: True<br>
[root@hostname ~]#<br>
[root@hostname ~]#<br>
[root@hostname ~]#<br>
[root@hostname ~]# ipa user-status admin<br>
-----------------------<br>
Account disabled: False<br>
-----------------------<br>
Server: hostname<br>
Failed logins: 12<br>
Last successful authentication: 2013-07-25T13:14:27Z<br>
Last failed authentication: 2013-07-26T13:12:04Z<br>
Time now: 2013-08-01T18:52:44Z<br>
----------------------------<br>
Number of entries returned 1<br>
----------------------------<br>
</blockquote>
<br></div></div>
Sure seems like the password policy is preventing the login. You might try: ipa pwpolicy-show --user=admin<br>
<br>
Do you have any other users in the admins group?<br>
<br>
Do you know the Directory Manager password? (set during IPA install).<br>
<br>
rob<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
<br>
<br>
<br>
<br>
<br>
On Thu, Aug 1, 2013 at 2:26 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a><br></div><div class="im">
<mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote:<br>
<br>
Hebert, Henry wrote:<br>
<br>
I have inherited an ipa system that has been running fantastic.<br>
However<br>
the gui is no longer functioning. I was wondering if this list<br>
has seen<br>
this sort of error in the past.<br>
<br>
hostname# kinit admin<br>
kinit: Clients credentials have been revoked while getting initial<br>
credentials<br>
<br>
<br>
This is unrelated to the GUI. It appears that the admin account is<br>
disabled or locked due to too many failed logins. Using any other<br>
user, can you do ipa user-show admin?<br>
<br>
Look for:<br>
<br>
Account disabled: True<br>
<br>
If it is False then try ipa user-status admin see the number of<br>
failed logins.<br>
<br>
rob<br>
<br>
<br>
so i then tried<br></div>
<a href="http://docs.fedoraproject.org/__en-US/Fedora/17/html/FreeIPA___Guide/using-the-ui.html#tab.__ui-troubleshooting" target="_blank">http://docs.fedoraproject.org/<u></u>__en-US/Fedora/17/html/<u></u>FreeIPA___Guide/using-the-ui.<u></u>html#tab.__ui-troubleshooting</a><div class="im">
<br>
<<a href="http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/using-the-ui.html#tab.ui-troubleshooting" target="_blank">http://docs.fedoraproject.<u></u>org/en-US/Fedora/17/html/<u></u>FreeIPA_Guide/using-the-ui.<u></u>html#tab.ui-troubleshooting</a>><br>
<br>
<br>
[hostname]# cat /tmp/moz.log<br>
64608032[7fad03b53150]: using REQ_DELEGATE<br>
64608032[7fad03b53150]: service = hostname<br>
64608032[7fad03b53150]: using negotiate-gss<br>
64608032[7fad03b53150]: entering nsAuthGSSAPI::nsAuthGSSAPI()<br>
64608032[7fad03b53150]: Attempting to load gss functions<br>
64608032[7fad03b53150]: entering nsAuthGSSAPI::Init()<br></div>
64608032[7fad03b53150]: nsHttpNegotiateAuth::__<u></u>GenerateCredentials()<div class="im"><br>
[challenge=Negotiate]<br>
64608032[7fad03b53150]: entering nsAuthGSSAPI::GetNextToken()<br>
64608032[7fad03b53150]: gss_init_sec_context() failed:<br>
Unspecified GSS<br>
failure. Minor code may provide more information<br>
64608032[7fad03b53150]: leaving nsAuthGSSAPI::GetNextToken<br>
[rv=80004005]<br>
<br>
<br>
Thanks in advance!<br>
Henry<br>
<br>
--<br>
<br>
Henry Hebert<br>
System Administrator III<br>
<br>
<br>
<br></div>
______________________________<u></u>___________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.<u></u>com</a>><br>
<a href="https://www.redhat.com/__mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/__<u></u>mailman/listinfo/freeipa-users</a><div class="im"><br>
<<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><u></u>><br>
<br>
<br>
<br>
<br>
<br>
--<br>
<br>
Henry Hebert<br>
System Administrator III<br>
454 Life Sciences<br>
A Roche Company<br>
<br>
15 Commercial Street<br>
Branford, CT 06405<br>
Phone +1 203 871 2249<br>
Mobile +1 203 215 5904<br></div>
e-mail <a href="mailto:henry.hebert@roche.com" target="_blank">henry.hebert@roche.com</a> <mailto:<a href="mailto:henry.hebert@roche.com" target="_blank">henry.hebert@roche.com</a><u></u>>____<br>
<br>
/Visit our new webpage, featuring the “454 Sequencing breakthrough<br>
community webinar series” at <a href="http://www.454.com" target="_blank">www.454.com</a> <<a href="http://www.454.com/" target="_blank">http://www.454.com/</a>>/____<br>
<br>
*Confidentiality Note*<div class="im"><br>
This message is intended only for the use of the named recipient(s) and<br>
may contain confidential and/or privileged information. If you are not<br>
the intended recipient, please contact the sender and delete the<br>
message. Any unauthorized use of the information contained in this<br>
message is prohibited.<br>
<br>
</div></blockquote>
<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><p>Henry Hebert<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br></span>System Administrator III<br>454 Life Sciences<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br>
</span>A Roche Company<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br><br></span>15 Commercial Street<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br></span>Branford, CT 06405<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br>
</span>Phone +1 203 871 2249<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br></span>Mobile +1 203 215 5904<span style="font-size:12pt;font-family:'Times New Roman',serif"> <br></span>e-mail <a href="mailto:henry.hebert@roche.com" style="color:rgb(17,85,204)" target="_blank"><span style="font-family:'Times New Roman',serif;color:blue">henry.hebert@roche.com</span></a><span style="font-size:12pt;font-family:'Times New Roman',serif"><u></u><u></u></span></p>
<p><i>Visit our new webpage, featuring the “454 Sequencing breakthrough community webinar series” at <a href="http://www.454.com/" style="color:rgb(17,85,204)" target="_blank"><span style="font-family:'Times New Roman',serif;color:blue">www.454.com</span></a></i><span style="font-size:12pt;font-family:'Times New Roman',serif"><u></u><u></u></span></p>
<p><b><span style="font-size:8pt">Confidentiality Note</span></b><span style="font-size:8pt"><br>This message is intended only for the use of the named recipient(s) and may contain confidential and/or privileged information. If you are not the intended recipient, please contact the sender and delete the message. Any unauthorized use of the information contained in this message is prohibited.</span></p>
</div>
</div>