[Freeipa-users] How to determine cause/source of user lockout?

[John Duino]

Is there a (relatively easy) way to determine what is causing a user
account to be locked out? The admin account on our 'primary' ipa host is
locked out frequently, but somewhat randomly; sometimes it will be less
than 5 minutes it is available, and other times several hours.

ipa user-status admin will show something like:
Failed logins: 6
Last successful authentication: 20160516214142Z
Last failed authentication: 20160516224718Z
Time now: 2016-05-16T22:52:00Z

ipa user-unlock admin  does unlock it.

But parsing through the various logs on the affected host doesn't give me
what I need to know, primarily, which host(s) are trying to access admin
and causing it to lock.

FreeIPA 4.2.0 on CentOS 7.2.1511
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20160516/b365cfed/attachment.htm>