On ma, 02 syys 2019, Rob Verduijn via FreeIPA-users wrote:
I found out that running ipa on rhel8 in the file /etc/krb5.conf.d/freeipa
prevents ad domain account users from logging in to the ipa server running
according to this site it's protection against dictionary attacks
commenting those two lines and restarting the sssd service allows the ad
domain users to login to the rhel8 systems
however, this means I lose the extra protection against dictionary attacks.
Is there a way to have both ?
( login for ad users on rhel8 and dictionary attack protection )
Windows systems do
not support SPAKE mechanism, so they should fall back
to encrypted timestamp. Question is mostly why the fallback doesn't
Could you please open a bug (against krb5) so that we can investigate?
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland