Hi,
please do not drop freeipa-users@ mailing list from CC:.
On ti, 20 heinä 2021, Galvanick Lucipher wrote:
Alexander,
thank you very much for your prompt answer. Just to make sure I understand,
when you say "I don't think it is possible to achieve", you are referring
to both active limiting of concurrent logins and detection of the number of
simultaneous sessions?
Both. There is no such thing in MIT Kerberos that would have prevented
issuing multiple tickets for the same Kerberos principal within a time
interval. There is no way to reliably coordinate such rate limiting across
multiple KDCs.
A TGT issued for a Kerberos principal is valid during a certain period.
If you are in possession of the ticket, you can use it to request
service tickets to other Kerberized server applications. Those
applications may or may not maintain their own knowledge of who is being
logged into that specific application at a time. There is, however, no
generic facility to prevent multiple logins.
On Linux clients such as IPA-enrolled systems, there might be some PAM
modules that could check currently opened login sessions and prevent
opening a new one but this is client-specific and cannot be used for
deployment-wide prevention of simultaneous authenticated logons.
Yours,
GK
On Tue, Jul 20, 2021 at 10:23 AM Alexander Bokovoy <abokovoy(a)redhat.com>
wrote:
> On ti, 20 heinä 2021, Galvanick Lucipher via FreeIPA-users wrote:
> >Hi all,
> >
> >I would like to use FreeIPA to restrict the number of simultaneous logins
> >to a given account, e.g. to prevent two active sessions simultaneously (or
> >at least capture the number of concurrent logins, so I can e.g. send an
> >alarm if Nlogins > 1). I've searched through the docs, but haven't
found
> >how to do it, neither at the FreeIPA level nor at the LDAP or Kerberos
> >levels.
> >
> >Is it possible to limit the number of simultaneous logins to a FreeIPA
> >account?
>
> I don't think it is possible to achieve. It is certainly not implemented
> at the moment.
>
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland