search

rdbreak / rhce7env

This is a RHCE 7 study environment built with Vagrant/Ansible
https://join.slack.com/t/redhat-certs/shared_invite/zt-7ju3rz7b-_G3Njp3PDwdBG_81SwPeLA
MIT License
9 stars 2 forks source link

IPA Server Port 464 not enabled for KPASSWD Reset #5

Open thejandg opened 4 years ago

thejandg commented 4 years ago

When getting a ticket from KDC using a user account with expired password, user will be prompt to reset password via kpasswd protocol which communicates via port 464.
IPA Server does not have that port permitted, resulting in the password changing to fail.
The user will not be able to login.

Reproduce Issue Install the 4 Virtual Machines from the repository. Ensure the IPA Server and client machine is up. Set System1 IP Address as 192.168.55.21/24 and set it to use LDAP + Kerberos authentication against ipa.test.example.com. (Base DN: dc=test,dc=example,dc=com | Kerberos Realm: TEST.EXAMPLE.COM) Login to user lisa and request a ticket via kinit. Should be prompted to reset password and unsuccessful in contacting any KDC Error message.

Below is a pcap file recorded on the IPA Server and a screenshot of the output. attachment.zip

rdbreak commented 3 years ago

Would you mind creating a pull request for this change?