freeipa

#6511 Unexpected behavior of password policies when --failinterval is not set
Opened by pvomacka. Modified

Open
Close Issue

Steps to reproduce:
1) Create new Password policy
2) Set --maxfail to lets say 10 (value does not matter)
3) Set --lockouttime to lets say 60 (value does not matter)
4) Try to kinit as user in group for which the policy was created
5) The account is locked after various number of failed attemps, not exactly after 10.

It works correctly when --failinterval is set to number != 0 .

Doc string should be enhanced.

  • dkupka: What is the expected behaviour here? From source code I can tell that when not set 0 is used but what should then happen? Reset the counter after 0 seconds or disable counter reseting at all?
    • pvom: I don't know, I'm not sure how it should work or how it works. I have not found any information in: http://www.freeipa.org/page/V2/Group_Password_Policy or https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/user-pwdpolicy.html
    • tkrizek: when failinterval=0, I get locket out after exactly the specified amount of maxfail. After the lockouttime expires, I have only a single attempt to enter password, then account gets locked again. I can't reproduce the behavior described in the ticket.
    • pvom: I'll try to reproduce it again. Thank you for testing
    • pvom: it behaves correctly, but what confused me is when I lock user (after specified number of failtures) then increase number of allowed failtures (it allows additional attemps to log in till it reaches the new limit) then I have one attemp after the lockouttime expires - as Tomas described. So, it is not a bug but it would be good to document it.

Metadata Update from @pvomacka:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5

Metadata Update from @mbasti:
- Issue close_status updated to: None
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.7 (was: FreeIPA 4.5.1)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone
Metadata
None
None
None
High
defect
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.