Force to change password for users

[Carlos Lopez]

Hi all,

I have installed a new Kerberos server under RHEL9. All it is working ok, except when I try to create users. All users are created with "+needchange" flag enabled to force to the user to change own password.

At first user login, kerberos server reports password has expired:

2024-04-19T08:38:20.946335+00:00 rhelidmsrv01 krb5kdc[21392]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.19.11.14: REQUIRED PWCHANGE: ***@MYDOM.ORG for krbtgt/***@MYDOM.ORG, Password has expired
2024-04-19T08:38:20.946413+00:00 rhelidmsrv01 krb5kdc[21392]: closing down fd 13
2024-04-19T08:38:20.946712+00:00 rhelidmsrv01 krb5kdc[21392]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.19.11.14: NEEDED_PREAUTH: ***@MYDOM.ORG for kadmin/***@MYDOM.ORG, Additional pre-authentication required
2024-04-19T08:38:20.946747+00:00 rhelidmsrv01 krb5kdc[21392]: closing down fd 13
2024-04-19T08:38:20.950691+00:00 rhelidmsrv01 krb5kdc[21392]: AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 172.19.11.14: ISSUE: authtime 1713515900, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha1-96(18)}, ***@MYDOM.ORG for kadmin/***@MYDOM.ORG

But in the client side, user can login without problems and no password change is requested.

Any idea? maybe do I need to reconfigure something in sever side?

Best regards,
C. L. Martinez

[Greg Hudson]

Post by Carlos Lopez
But in the client side, user can login without problems and no password change is requested.

These are the messages I would expect in the log, including user1
getting a ticket to perform a password change.

You say the user can log in. Do they have tickets, or do you just mean
a login session is authorized based on the Kerberos interaction? What
client-side software is being used?

[Carlos Lopez]

User acquires kerberos ticket and login session is authorized. This log is for a ssh access ...

Best regards,
C. L. Martinez

________________________________________
From: Greg Hudson <***@mit.edu>
Sent: 19 April 2024 18:27
To: Carlos Lopez; ***@mit.edu
Subject: Re: Force to change password for users

Post by Carlos Lopez
But in the client side, user can login without problems and no password change is requested.

These are the messages I would expect in the log, including user1
getting a ticket to perform a password change.

You say the user can log in. Do they have tickets, or do you just mean
a login session is authorized based on the Kerberos interaction? What
client-side software is being used?

[Ken Hornstein]

Post by Carlos Lopez
User acquires kerberos ticket and login session is authorized. This log
is for a ssh access ...

I think you're missing some of the details that Greg is asking. When you
say "ssh access", do you mean that you are using gssapi-with-mic or
gssapi-keyex authentication with ssh, or does ssh ask for the user's
Kerberos password? If the latter, ssh does not have that native ability,
so it it going through the PAM stack to make that happen? If so, which
PAM module are you using?

--Ken