<div dir="ltr">Here are some examples:<div><br><div><div>[root@mule ~]# ipa user-status freddie</div><div>-----------------------</div><div>Account disabled: False</div><div>-----------------------</div><div> Server: mule.bulb</div><div> Failed logins: 0</div><div> Last successful authentication: 2015-10-28T09:03:48Z</div><div> Last failed authentication: 2015-10-28T09:03:40Z</div><div> Time now: 2015-10-28T18:05:51Z</div><div>----------------------------</div><div>Number of entries returned 1</div><div>----------------------------</div><div>[root@mule ~]# ipa user-show freddie</div><div> User login: freddie</div><div> First name: fred</div><div> Last name: orispaa</div><div> Home directory: /home/freddie</div><div> Login shell: /bin/sh</div><div> UID: 50001</div><div> GID: 50001</div><div> Account disabled: False</div><div> Password: True</div><div> Member of groups: admins, ipausers</div><div> Indirect Member of Sudo rule: allow_all</div><div> Kerberos keys available: True</div><div> SSH public key fingerprint: DA:54:C4:27:3A:23:00:AE:AE:60:B7:1B:E1:E4:03:C5</div><div> freddie@mule (ssh-rsa)</div></div><div><br></div></div><div>With SSH:</div><div><br></div><div><div>[root@mule ~]$ ssh freddie@mule</div><div>freddie@mule's password:<br></div><div>Password expired. Change your password now.</div><div>Last login: Wed Oct 28 10:03:44 2015 from 127.0.0.1</div><div>WARNING: Your password has expired.</div><div>You must change your password now and login again!</div><div>Changing password for user freddie.</div><div>Current Password:</div><div>New password:</div><div>Retype new password:</div><div>passwd: Authentication token is no longer valid; new one required</div><div>Connection to mule closed.</div></div><div><br></div><div>(Now if I login again, the same process repeats, except the password has indeed changes)</div><div><br></div><div>With su the output is less informative:</div><div><div>[jj@mule ~]$ su - freddie</div><div>Password:</div><div>Password expired. Change your password now.</div><div>Current Password:</div><div>New password:</div><div>Retype new password:</div><div>su: incorrect password</div></div><div><br></div><div>(the password was correct and it HAS changed even though the output implies I entered the wrong current password).</div><div><br></div><div>Doing kinit:</div><div><br></div><div><div>-sh-4.1$ id</div><div>uid=50001(freddie) gid=50001(freddie) groups=50001(freddie),50000(admins)</div></div><div><div>-sh-4.1$ klist</div><div>klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_50001)</div><div>-sh-4.1$ kinit</div><div>Password for freddie@BULB:</div><div>Password expired. You must change it now.</div><div>Enter new password:</div><div>Enter it again:</div><div>kinit: Password has expired while getting initial credentials</div><div>-sh-4.1$ klist</div><div>klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_50001)</div></div><div><br></div><div>(again the password HAS changed)</div><div><br></div><div>In case it's of any relevance, note that root has no issue with kerberos credentials:</div><div><div>[root@mule ~]# kinit admin</div><div>Password for admin@BULB:</div><div>[root@mule ~]# klist</div><div>Ticket cache: FILE:/tmp/krb5cc_0</div><div>Default principal: admin@BULB</div><div><br></div><div>Valid starting Expires Service principal</div><div>10/28/15 19:14:56 10/29/15 19:14:53 krbtgt/BULB@BULB</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 28, 2015 at 2:44 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">urgrue wrote:<br>
> Didn't realize it was GMT, so OK that's not the issue. Any suggestions<br>
> on how to debug it? Everything looks OK, but passwords are just<br>
> perma-expired at all times.<br>
<br>
</span>Need more info on what you're seeing and how the passwords are being<br>
changed.<br>
<span class="HOEnZb"><font color="#888888"><br>
rob<br>
</font></span><span class="im HOEnZb"><br>
><br>
><br>
> On Tue, Oct 27, 2015, 21:45 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a><br>
</span><div class="HOEnZb"><div class="h5">> <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>> wrote:<br>
><br>
> urgrue wrote:<br>
> > Hi,<br>
> > On a new install, I'm being forced a password reset on every<br>
> login. Not<br>
> > sure why but this doesn't look right:<br>
> ><br>
> > # date<br>
> > Tue Oct 27 21:02:57 CET 2015<br>
> ><br>
> > # ipa user-status blah1<br>
> > <snip><br>
> > Last successful authentication: 2015-10-27T19:34:53Z<br>
> > Last failed authentication: 2015-10-27T19:34:20Z<br>
> > Time now: 2015-10-27T20:03:00Z<br>
> ><br>
> > Where is it getting this wrong time from?<br>
><br>
> What's wrong with the time? CET is one hour behind GMT right? That is<br>
> reflected by the difference between the output of date and "Time now".<br>
><br>
> Passwords administratively reset must be set by the user during the<br>
> first authentication. If the password needs further reset then yeah,<br>
> something is wrong, but the above looks ok.<br>
><br>
> rob<br>
><br>
<br>
</div></div></blockquote></div><br></div>