<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi all, I am trying to setup Freeipa with otp using the freeotp app. All looks fine, adding the user to the FreeOTP app also works fine. The users looks like: ipa user-show otpuser User login: otpuser First name: otp Last name: user Home directory: /home/otpuser Login shell: /bin/bash Email address: <a class="moz-txt-link-abbreviated" href="mailto:otpuser@blabla.bla">otpuser@blabla.bla</a> UID: 10011 GID: 10011 User authentication types: otp Account disabled: False Password: True Member of groups: ipausers Kerberos keys available: True However, trying to login in will fail; /var/log/krb5kdc.log will tell: Jun 07 14:44:37 ipa.blabla.bla krb5kdc[5887](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 192.168.1.251: NEEDED_PREAUTH: <a class="moz-txt-link-abbreviated" href="mailto:otpuser@BLABLA.BLA">otpuser@BLABLA.BLA</a> for <a class="moz-txt-link-abbreviated" href="mailto:krbtgt/BLABLA.BLA@BLABLA.BLA">krbtgt/BLABLA.BLA@BLABLA.BLA</a>, Additional pre-authentication required Jun 07 14:44:37 ipa.blabla.bla krb5kdc[5887](info): closing down fd 12 Jun 07 14:44:42 ipa.blabla.bla krb5kdc[5888](info): preauth (otp) verify failure: Connection timed out I just cannot figure out what's going wrong. What is trying to connect to causing this timeout? (yep, I disabled firewalld for this...) Winny </body> </html>