<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/01/2015 11:14 AM, Luiz Fernando
Vianna da Silva wrote:<br>
</div>
<blockquote
cite="mid:1B1DB5490C5E3A408CA3086D02CD34FA040CD102@rctr246"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EstiloDeEmail17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello All.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve searched the
archives of this mailing list looking for an answer for this
one, but all I found lead me nowhere.
</span><span style="font-family:Wingdings" lang="EN-US">L</span><span
lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Closest thread to help
me was: <a moz-do-not-send="true"
href="https://www.redhat.com/archives/freeipa-users/2014-March/msg00153.html">https://www.redhat.com/archives/freeipa-users/2014-March/msg00153.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Has anyone figured out a
way to have expired password changes work on AIX clients?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have tried adding
“kpasswd_protocol = SET_CHANGE” as well as “kpasswd_protocol
= RPCSEC_GSS” to the [realms] section but none of them
worked.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Here is the output from
an ssh test session for user “teste” on a AIX 7.1 machine:<o:p></o:p></span></p>
<p class="MsoNormal">-bash-4.2$ ssh teste@localhost<o:p></o:p></p>
<p class="MsoNormal">################################################################################<o:p></o:p></p>
<p class="MsoNormal"># NICE MOTD<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">################################################################################<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">teste@localhost's
password:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[KRB5]: 3004-332 Your
password has expired.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">3004-333 A password
change is required.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[KRB5]: 3004-332 Your
password has expired.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*******************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*
*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*
*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">* Welcome to AIX
Version 7.1!
*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*
*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*
*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">* Please see the README
file in /usr/lpp/bos for information pertinent to *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">* this release of the
AIX Operating System. *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">*
*<o:p></o:p></span></p>
<p class="MsoNormal">*
*<o:p></o:p></p>
<p class="MsoNormal">*******************************************************************************<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">################################################################################<o:p></o:p></p>
<p class="MsoNormal"># NICE MOTD<span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">################################################################################<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">WARNING: Your password
has expired.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">You must change your
password now and login again!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Changing password for
"teste"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">teste's Old password:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">teste's New password:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Enter the new password
again:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">3004-604 Your entry does
not match the old password.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Connection to localhost
closed.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">-bash-4.2$<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</blockquote>
<br>
So you are setting up AIX client using kerberos against IPA server
and trying to log with a user that has expired password. Did I get
it right?<br>
<br>
What version of the server you are using?<br>
How your kerberos configuration looks on a client?<br>
What does the KDC log show?<br>
<br>
<blockquote
cite="mid:1B1DB5490C5E3A408CA3086D02CD34FA040CD102@rctr246"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"
lang="EN-US">Atenciosamente/Best Regards</span><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black;mso-fareast-language:PT-BR"
lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"
lang="EN-US">__________________________________________</span></b><span
style="font-size:10.0pt;font-family:"Trebuchet
MS","sans-serif";color:black;mso-fareast-language:PT-BR"
lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"
lang="EN-US">L</span></b><b><span
style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">uiz
Fernando Vianna da Silva<o:p></o:p></span></b></p>
<p class="MsoNormal"><span
style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">ITM-I
- Operação Cielo<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">+55
(11) 3626-7126
<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a
moz-do-not-send="true"
href="mailto:luiz.vianna@tivit.com.br"><span
style="color:blue">luiz.vianna@tivit.com.br</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-family:"Arial","sans-serif";color:black;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span
style="font-family:"Arial","sans-serif";color:red;mso-fareast-language:PT-BR">T
I V I T<br>
</span></b><b><span
style="color:red;mso-fareast-language:PT-BR"><br>
</span></b><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Av.
Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">São
Paulo - SP - CEP 05804-900<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a
moz-do-not-send="true" href="http://www.tivit.com.br/"
title="http://www.tivit.com.br/
blocked::mailto:Camila.silva@tivit.com.br
mailto:Camila.silva@tivit.com.br"><span style="color:gray">www.tivit.com.br</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#999999;mso-fareast-language:PT-BR">Esta
mensagem, incluindo seus anexos, tem caráter confidencial e
seu conteúdo é restrito ao destinatário da mensagem. Caso
você a tenha recebido por engano, queira, por favor,
retorná-la ao destinatário e apagá-la de seus arquivos.
Qualquer uso não autorizado, replicação ou disseminação
desta mensagem ou parte dela é expressamente proibido. A
TIVIT não se responsabilizará pelo conteúdo ou pela
veracidade desta informação.</span><span
style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>