<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi all, Yes I check that one also. The IPA-server is running ntp and is is sync. The FreeOTP app is running on my phone which is synced by network, all looks fine.... Forgot to mention; this IPA-server is running on Fedora ARM on a Bananapi. non-otp logins go well. Winny <div class="moz-cite-prefix">Op 07-06-16 om 16:56 schreef Prashant Bapat: </div> <blockquote cite="mid:CAN9aUrgJ4SRvcvKPiCM1V77P_WoFN72qOoPvhjzm6rKSXzHxHA@mail.gmail.com" type="cite"> <div dir="ltr"> <div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">If this is TOTP (time based) you want to double check the time is properly set in both the server (NTP) and the device that is generating the OTP tokens. I have had issues with this with my users couple of times. </div> </div> <div class="gmail_extra"> <div class="gmail_quote">On 7 June 2016 at 19:43, Alexander Bokovoy <<a moz-do-not-send="true" href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 07 Jun 2016, Winfried de Heiden wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi all, I tried the FreeIPA webUI, ssh and "su - otpuser", all the same result. </blockquote> Ok. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Jun 07 14:44:37 ipa.blabla.bla krb5kdc[5887](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a moz-do-not-send="true" href="http://192.168.1.251" rel="noreferrer" target="_blank">192.168.1.251</a>: NEEDED_PREAUTH: <a class="moz-txt-link-abbreviated" href="mailto:otpuser@BLABLA.BLA">otpuser@BLABLA.BLA</a> for krbtgt/ <a class="moz-txt-link-abbreviated" href="mailto:BLABLA.BLA@BLABLA.BLA">BLABLA.BLA@BLABLA.BLA</a>, Additional pre-authentication required Jun 07 14:44:37 ipa.blabla.bla krb5kdc[5887](info): closing down fd 12 Jun 07 14:44:42 ipa.blabla.bla krb5kdc[5888](info): preauth (otp) verify failure: Connection timed out I just cannot figure out what's going wrong. What is trying to connect to causing this timeout? (yep, I disabled firewalld for this...) </blockquote> What is the output of systemctl status ipa-otpd.socket ? if it is disabled, do systemctl enable ipa-otpd.socket systemctl start ipa-otpd.socket <div class="HOEnZb"> <div class="h5"> -- / Alexander Bokovoy -- Manage your subscription for the Freeipa-users mailing list: <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a moz-do-not-send="true" href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </div> </div> </blockquote> </div> </div> </blockquote> </body> </html>