[Freeipa-users] check host password age

[Stijn De Weirdt]

hi all,

(i'm new to freeipa, so it's possible i missed some docs here and there ;)

i'm looking to add hosts with some secret password to ipa, then during 
kickstart install they use this password to run ipa-client-install.

what i would like to do, is to check for all hosts which have a password 
that is older then a certain age. for those i will assume that something 
has gone wrong and i would like to close the installation window. (and i 
would do so by assigning another random password to that host)
i guess the timestamps are somehwere in the ldap schema, i would like to 
know where or how i can find them.
and if possible, how to do that using the ipalib python api.

btw, is it correct for me to assume that when has_keytab=True that the 
host password is useless or even better unusable with that host?


i'm running 3.0.0-25 on a sl6 machine.

many thanks,

stijn