<div dir="ltr">Thanks, but I think I have a problem.<div><br></div><div>I have test user:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>[root@ipa-centos]# ipa user-show test</div></div><div><div> User login: test</div></div><div><div> First name: test</div></div><div><div> Last name: test</div></div><div><div> Home directory: /home/test</div></div><div><div> Login shell: /bin/sh</div></div><div><div> Principal name: <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a></div></div><div><div> Principal alias: <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a></div></div><div><div> Email address: <a href="mailto:test@mydomain.com">test@mydomain.com</a></div></div><div><div> UID: 152200001</div></div><div><div> GID: 152200001</div></div><div><div> Account disabled: False</div></div><div><div> Password: True</div></div><div><div> Member of groups: trust admins, ipausers, admins</div></div><div><div> Kerberos keys available: True</div></div></blockquote><div><br></div><div>And test host:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>[root@ipa-centos]# ipa host-show <a href="http://ipa-client.mydomain.com">ipa-client.mydomain.com</a></div></div><div><div> Host name: <a href="http://ipa-client.mydomain.com">ipa-client.mydomain.com</a></div></div><div><div> Principal name: host/<a href="mailto:ipa-client.mydomain.com@MYDOMAIN.COM">ipa-client.mydomain.com@MYDOMAIN.COM</a></div></div><div><div> Principal alias: host/<a href="mailto:ipa-client.mydomain.com@MYDOMAIN.COM">ipa-client.mydomain.com@MYDOMAIN.COM</a></div></div><div><div> SSH public key fingerprint: %SOME FINGERPRINTS%</div></div><div><div> Authentication Indicators: otp</div></div><div><div> Password: False</div></div><div><div> Keytab: True</div></div><div><div> Managed by: <a href="http://ipa-client.mydomain.com">ipa-client.mydomain.com</a></div></div></blockquote><div><br></div><div>When I trying to login to <a href="http://ipa-client.mydomain.com">ipa-client.mydomain.com</a> with password+otptoken I have error:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>[mynotebook]$ ssh <a href="mailto:test@ipa-client.mydomain.com">test@ipa-client.mydomain.com</a></div></div><div><div><a href="mailto:test@ipa-client.mydomain.com">test@ipa-client.mydomain.com</a>'s password: </div></div><div><div>Permission denied, please try again.</div></div></blockquote><br><div>Same if I trying to use just password.</div><div><br></div><div>On ipa server in krb5kdc.log I see:</div><div><br></div><div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a href="http://10.0.1.22">10.0.1.22</a>: NEEDED_PREAUTH: <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a> for krbtgt/<a href="mailto:MYDOMAIN.COM@MYDOMAIN.COM">MYDOMAIN.COM@MYDOMAIN.COM</a>, Additional pre-authentication required</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): closing down fd 12</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a href="http://10.0.1.22">10.0.1.22</a>: NEEDED_PREAUTH: <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a> for krbtgt/<a href="mailto:MYDOMAIN.COM@MYDOMAIN.COM">MYDOMAIN.COM@MYDOMAIN.COM</a>, Additional pre-authentication required</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): closing down fd 12</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a href="http://10.0.1.22">10.0.1.22</a>: ISSUE: authtime 1494946853, etypes {rep=18 tkt=18 ses=18}, <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a> for krbtgt/<a href="mailto:MYDOMAIN.COM@MYDOMAIN.COM">MYDOMAIN.COM@MYDOMAIN.COM</a></div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): closing down fd 12</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) <a href="http://10.0.1.22">10.0.1.22</a>: HIGHER_AUTHENTICATION_REQUIRED: authtime 1494946853, <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a> for host/<a href="mailto:ipa-client.mydomain.com@MYDOMAIN.COM">ipa-client.mydomain.com@MYDOMAIN.COM</a>, Required auth indicators not present in ticket: otp</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): closing down fd 12</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) <a href="http://10.0.1.22">10.0.1.22</a>: HIGHER_AUTHENTICATION_REQUIRED: authtime 1494946853, <a href="mailto:test@MYDOMAIN.COM">test@MYDOMAIN.COM</a> for host/<a href="mailto:ipa-client.mydomain.com@MYDOMAIN.COM">ipa-client.mydomain.com@MYDOMAIN.COM</a>, Required auth indicators not present in ticket: otp</div><div>May 16 11:00:53 ipa-centos krb5kdc[2280](info): closing down fd 12</div></div><div><br></div><div>What's wrong?</div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-05-16 17:16 GMT+03:00 Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Tue, May 16, 2017 at 04:48:42PM +0300, Andrey Dudin wrote:<br> > Hello all.<br> ><br> > tell me please. Is it possible to use password and otp auth at the one<br> > moment?<br> ><br> > For example I have DEV/STAGE servers and want to be able use password auth<br> > for ssh, but for PROD servers I want to use OTP auth for same user.<br> <br> </div></div>Authentication indicators can be used for this. If you add<br> <br> ipa host-mod --auth-ind=otp prod.server<br> <br> Only 2-factor authentication should be possible on prod.server. But<br> please note that e.g. ssh-key based authentication will still be<br> possible as well.<br> <br> HTH<br> <br> bye,<br> Sumit<br> <span class="HOEnZb"><font color="#888888"><br> > --<br> > Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><span style="font-size:12.8px">С уважением Дудин Андрей</span><br></div></div> </div>