<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"Pré-formatação HTML Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EstiloDeEmail17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.Pr-formataoHTMLChar
{mso-style-name:"Pré-formatação HTML Char";
mso-style-priority:99;
mso-style-link:"Pré-formatação HTML";
font-family:Consolas;
color:black;
mso-fareast-language:EN-US;}
span.EstiloDeEmail20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="PT-BR" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hello Dmitri.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Server is running: ipa-server-3.0.0-37.el6.x86_64<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">My kerberos configuration looks like this on a client:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"># cat /etc/krb5.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[libdefaults]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> default_realm = DOMAIN.COM<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> default_keytab_name = FILE:/etc/krb5/krb5.keytab<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> default_tkt_enctypes = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc aes128-cts<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><span style="color:#1F497D">default_tgs_enctypes = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc aes128-cts<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[realms]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> DOMAIN.COM = {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> kdc = ldap.domain.com:88<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> admin_server = ldap.domain.com:749<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> default_domain = domain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[domain_realm]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> .domain.com = DOMAIN.COM<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> ldap.domain.com = DOMAIN.COM<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">[logging]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> kdc = FILE:/var/krb5/log/krb5kdc.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> admin_server = FILE:/var/krb5/log/kadmin.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> kadmin_local = FILE:/var/krb5/log/kadmin_local.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> default = FILE:/var/krb5/log/krb5lib.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">#<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">What does the KDC log show?: Where do I get this log from?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Atenciosamente/Best Regards</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">__________________________________________</span></b><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif";mso-fareast-language:PT-BR"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Luiz Fernando Vianna da Silva<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">ITM-I - Operação Cielo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">+55 (11) 3626-7126
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a href="mailto:luiz.vianna@tivit.com.br">luiz.vianna@tivit.com.br</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif";color:red;mso-fareast-language:PT-BR">T I V I T<br>
</span></b><b><span style="color:red;mso-fareast-language:PT-BR"><br>
</span></b><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">São Paulo - SP - CEP 05804-900<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a href="http://www.tivit.com.br/" title="http://www.tivit.com.br/
blocked::mailto:Camila.silva@tivit.com.br
mailto:Camila.silva@tivit.com.br"><span style="color:gray">www.tivit.com.br</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:PT-BR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#999999;mso-fareast-language:PT-BR">Esta mensagem, incluindo seus anexos, tem caráter confidencial e seu conteúdo é restrito ao destinatário da mensagem. Caso você a tenha
recebido por engano, queira, por favor, retorná-la ao destinatário e apagá-la de seus arquivos. Qualquer uso não autorizado, replicação ou disseminação desta mensagem ou parte dela é expressamente proibido. A TIVIT não se responsabilizará pelo conteúdo ou
pela veracidade desta informação.</span><span style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:PT-BR"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:PT-BR">De:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:PT-BR">
freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] <b>Em nome de
</b>Dmitri Pal<br>
<b>Enviada em:</b> quarta-feira, 1 de abril de 2015 13:27<br>
<b>Para:</b> freeipa-users@redhat.com<br>
<b>Assunto:</b> [Marketing Mail] Re: [Freeipa-users] Expired password change on AIX Client<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 04/01/2015 11:14 AM, Luiz Fernando Vianna da Silva wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-US">Hello All.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">I’ve searched the archives of this mailing list looking for an answer for this one, but all I found lead me nowhere.
</span><span lang="EN-US" style="font-family:Wingdings">L</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Closest thread to help me was: <a href="https://www.redhat.com/archives/freeipa-users/2014-March/msg00153.html">
https://www.redhat.com/archives/freeipa-users/2014-March/msg00153.html</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Has anyone figured out a way to have expired password changes work on AIX clients?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">I have tried adding “kpasswd_protocol = SET_CHANGE” as well as “kpasswd_protocol = RPCSEC_GSS” to the [realms] section but none of them worked.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Here is the output from an ssh test session for user “teste” on a AIX 7.1 machine:</span><o:p></o:p></p>
<p class="MsoNormal">-bash-4.2$ ssh teste@localhost<o:p></o:p></p>
<p class="MsoNormal">################################################################################<o:p></o:p></p>
<p class="MsoNormal"># NICE MOTD<o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">################################################################################</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">teste@localhost's password:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">[KRB5]: 3004-332 Your password has expired.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">3004-333 A password change is required.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">[KRB5]: 3004-332 Your password has expired.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">*******************************************************************************</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* Welcome to AIX Version 7.1! *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* Please see the README file in /usr/lpp/bos for information pertinent to *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* this release of the AIX Operating System. *</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">* *</span><o:p></o:p></p>
<p class="MsoNormal">* *<o:p></o:p></p>
<p class="MsoNormal">*******************************************************************************<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">################################################################################<o:p></o:p></p>
<p class="MsoNormal"># NICE MOTD<o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">################################################################################</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">WARNING: Your password has expired.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">You must change your password now and login again!</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Changing password for "teste"</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">teste's Old password:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">teste's New password:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Enter the new password again:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">3004-604 Your entry does not match the old password.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Connection to localhost closed.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">-bash-4.2$</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:PT-BR"><br>
So you are setting up AIX client using kerberos against IPA server and trying to log with a user that has expired password. Did I get it right?<br>
<br>
What version of the server you are using?<br>
How your kerberos configuration looks on a client?<br>
What does the KDC log show?<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Atenciosamente/Best Regards</span><o:p></o:p></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">__________________________________________</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">L</span></b><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">uiz
Fernando Vianna da Silva</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">ITM-I - Operação Cielo</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">+55 (11) 3626-7126
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a href="mailto:luiz.vianna@tivit.com.br">luiz.vianna@tivit.com.br</a></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";mso-fareast-language:PT-BR"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif";color:red;mso-fareast-language:PT-BR">T I V I T<br>
</span></b><b><span style="color:red;mso-fareast-language:PT-BR"><br>
</span></b><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">Av. Maria Coelho Aguiar, 215 - Bloco D - 5˚ Andar</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR">São Paulo - SP - CEP 05804-900</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:PT-BR"><a href="http://www.tivit.com.br/" title="http://www.tivit.com.br/
blocked::mailto:Camila.silva@tivit.com.br
mailto:Camila.silva@tivit.com.br"><span style="color:gray">www.tivit.com.br</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:PT-BR"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#999999;mso-fareast-language:PT-BR">Esta mensagem, incluindo seus anexos, tem caráter confidencial e seu conteúdo é restrito ao destinatário da mensagem. Caso você a tenha
recebido por engano, queira, por favor, retorná-la ao destinatário e apagá-la de seus arquivos. Qualquer uso não autorizado, replicação ou disseminação desta mensagem ou parte dela é expressamente proibido. A TIVIT não se responsabilizará pelo conteúdo ou
pela veracidade desta informação.</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:PT-BR"><br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:PT-BR"><br>
<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Thank you,<o:p></o:p></pre>
<pre>Dmitri Pal<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Sr. Engineering Manager IdM portfolio<o:p></o:p></pre>
<pre>Red Hat, Inc.<o:p></o:p></pre>
</div>
</body>
</html>