<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> Thanks for the response, Simo. I left the systems alone overnight and mysteriously this morning both the password changing and the GSS logins work. That makes me a little nervous but I'm willing to assume the universe is throwing me a bone on this one ;) If the systems fall back to the old behavior, I'll be sure to send more info once I'm able to reproduce the problem. Jem Simo Sorce wrote: <blockquote cite="mid:1223544138.27224.5.camel@hopeson" type="cite"> <pre wrap="">Can you use ssh -vv and paste what you get there when trying to login ? (feel free to sanitize output if there is data that you do not want to share broadly). Simo. On Wed, 2008-10-08 at 11:40 -0500, <a class="moz-txt-link-abbreviated" href="mailto:puck@i29.net">puck@i29.net</a> wrote: </pre> <blockquote type="cite"> <pre wrap="">Sorry. I meant GSSAPI login. Jem Simo Sorce wrote: </pre> <blockquote type="cite"> <pre wrap="">On Wed, 2008-10-08 at 11:07 -0500, <a class="moz-txt-link-abbreviated" href="mailto:puck@i29.net">puck@i29.net</a> wrote: </pre> <blockquote type="cite"> <pre wrap="">I've run into a problem when setting up IPA for ssh logins. I've found that I need to set ChallengeResponseAuthentication to "yes" in my sshd_config to allow users to change their expired passwords on login, otherwise the login process just hangs and eventually times out. However, when I set it to "yes" password-less logins between my servers no longer work. Once I'm logged in, if I run a "kinit (username)" then the password-less login works again so I assume that when ChallengeResponseAuthentication is on, sshd just doesn't set that correctly. Can anyone recommend an sshd configuration that would allow both the password-less logins and allow users to change their passwords at login when they are expired? </pre> </blockquote> <pre wrap="">By "password-less" login you mean a gssapi login or an ssh-key aided login ? Simo. </pre> </blockquote> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </pre> </blockquote> <pre wrap=""> </pre> </blockquote> </body> </html>