Can't login with kinit using 2FA

[Yaroslav Sidlovsky]

Hello there!

I've using this guide: https://fedoraproject.org/wiki/Infrastructure/Kerberos.
When I'm trying to execute command `kinit -n @FEDORAPROJECT.ORG -c
FILE:$HOME/armor.ccache`, I see this error:
```
Password for WELLKNOWN/ANONYMOUS(a)FEDORAPROJECT.ORG:
^C
```

A week ago I was able to login without problems using same guide.
What's wrong?

[Kevin Fenzi]

On Tue, Jun 15, 2021 at 01:51:01PM -0000, Yaroslav Sidlovsky wrote:
>  Hello there!
>  
>  I've using this guide: https://fedoraproject.org/wiki/Infrastructure/Kerberos.
>  When I'm trying to execute command `kinit -n @FEDORAPROJECT.ORG -c
> FILE:$HOME/armor.ccache`, I see this error:
>  ```
>  Password for WELLKNOWN/ANONYMOUS(a)FEDORAPROJECT.ORG:
>  ^C
>  ```
>  
>  A week ago I was able to login without problems using same guide.
>  What's wrong? 
check your /etc/krb5.conf file and make sure you have:

    forwardable = true
    rdns = false

Also, make sure you have fedora-packager-kerberos package installed.
It was recently split off the fedora-packager package.

Also, note that there is a 'fkinit' command now that does both parts for
you. :)

kevin

[Dan Horák]

On Tue, 15 Jun 2021 10:59:32 -0700
Kevin Fenzi <kevin(a)scrye.com&gt; wrote:

>  On Tue, Jun 15, 2021 at 01:51:01PM -0000, Yaroslav Sidlovsky wrote:
>  > Hello there!
>  > 
>  > I've using this guide: https://fedoraproject.org/wiki/Infrastructure/Kerberos.
>  > When I'm trying to execute command `kinit -n @FEDORAPROJECT.ORG -c
> FILE:$HOME/armor.ccache`, I see this error:
>  > ```
>  > Password for WELLKNOWN/ANONYMOUS(a)FEDORAPROJECT.ORG:
>  > ^C
>  > ```
>  > 
>  > A week ago I was able to login without problems using same guide.
>  > What's wrong? 
make sure you have the fedora-packager-kerberos package installed, I
suspect the last update of fedora-packager wasn't right


		Dan

> 
> check your /etc/krb5.conf file and make sure you have:
> 
>     forwardable = true
>     rdns = false
> 
> Also, make sure you have fedora-packager-kerberos package installed.
> It was recently split off the fedora-packager package.
> 
> Also, note that there is a 'fkinit' command now that does both parts for
> you. :)
> 
> kevin

[Michael Catanzaro]

On Tue, Jun 15 2021 at 09:18:34 PM +0200, Dan Horák <dan(a)danny.cz&gt; 
wrote:
>  make sure you have the fedora-packager-kerberos package installed, I
>  suspect the last update of fedora-packager wasn't right 
Whatever is needed for Fedora kerberos to work needs to be a dependency 
of gnome-online-accounts, since Fedora account is a supported account 
type there. You shouldn't need to install anything extra.

FWIW I don't have fedora-packager-kerberos installed, and kerberos is 
still working perfectly fine for me as of today.

[Vít Ondruch]

Dne 15. 06. 21 v 23:26 Michael Catanzaro napsal(a):
>  On Tue, Jun 15 2021 at 09:18:34 PM +0200, Dan Horák
> <dan(a)danny.cz&gt; wrote:
> > make sure you have the fedora-packager-kerberos package installed, I
> > suspect the last update of fedora-packager wasn't right
>
>  Whatever is needed for Fedora kerberos to work needs to be a 
>  dependency of gnome-online-accounts, since Fedora account is a 
>  supported account type there. You shouldn't need to install anything 
>  extra.
>
>  FWIW I don't have fedora-packager-kerberos installed, and kerberos is 
>  still working perfectly fine for me as of today. 

It depends how recent your Fedora is. Neither I had installed 
fedora-packager-kerberos up until yesterday, because the package is 
quite fresh:

https://src.fedoraproject.org/rpms/fedora-packager/c/a7fde86069c3595fdaf8...

So can I uninstall it if I am using GOA?


Vít

[Kevin Fenzi]

On Wed, Jun 16, 2021 at 01:24:58PM +0200, Vít Ondruch wrote:
>  
>  Dne 15. 06. 21 v 23:26 Michael Catanzaro napsal(a):
>  > On Tue, Jun 15 2021 at 09:18:34 PM +0200, Dan Horák <dan(a)danny.cz&gt; wrote:
>  > > make sure you have the fedora-packager-kerberos package installed, I
>  > > suspect the last update of fedora-packager wasn't right
>  > 
>  > Whatever is needed for Fedora kerberos to work needs to be a dependency
>  > of gnome-online-accounts, since Fedora account is a supported account
>  > type there. You shouldn't need to install anything extra. 
Well, it depends (see below)

>  > 
>  > FWIW I don't have fedora-packager-kerberos installed, and kerberos is
>  > still working perfectly fine for me as of today. 
It depends on if you have a OTP enrolled or not. 

>  It depends how recent your Fedora is. Neither I had installed
>  fedora-packager-kerberos up until yesterday, because the package is quite
>  fresh:
>  
>
> https://src.fedoraproject.org/rpms/fedora-packager/c/a7fde86069c3595fdaf8...
>  
>  So can I uninstall it if I am using GOA? 
If you do not have a OTP enrolled: yes. Everything is as it was before,
you can let GOA handle things and it will work fine. 

If you DO have a OTP enrolled, GOA won't work at all and you will need
to have fedora-packager-kerberos installed and manually use 'fkinit' to
get a ticket. 

I think there are plans to improve this use case in krb5 utils. 
I suppose we could also see if GOA could support this case somehow and
add a dep on fedora-packager-kerberos. Where should I file that? gitlab?
Or would someone else like to do so?

kevin

[Vít Ondruch]

Dne 16. 06. 21 v 18:54 Kevin Fenzi napsal(a):
>  On Wed, Jun 16, 2021 at 01:24:58PM +0200, Vít Ondruch wrote:
> > Dne 15. 06. 21 v 23:26 Michael Catanzaro napsal(a):
> >> On Tue, Jun 15 2021 at 09:18:34 PM +0200, Dan Horák <dan(a)danny.cz&gt; wrote:
> >>> make sure you have the fedora-packager-kerberos package installed, I
> >>> suspect the last update of fedora-packager wasn't right
> >> Whatever is needed for Fedora kerberos to work needs to be a dependency
> >> of gnome-online-accounts, since Fedora account is a supported account
> >> type there. You shouldn't need to install anything extra.
>  Well, it depends (see below)
>
> >> FWIW I don't have fedora-packager-kerberos installed, and kerberos is
> >> still working perfectly fine for me as of today.
>  It depends on if you have a OTP enrolled or not.
>
> > It depends how recent your Fedora is. Neither I had installed
> > fedora-packager-kerberos up until yesterday, because the package is quite
> > fresh:
> >
> >
> https://src.fedoraproject.org/rpms/fedora-packager/c/a7fde86069c3595fdaf8...
> >
> > So can I uninstall it if I am using GOA?
>  If you do not have a OTP enrolled: yes. Everything is as it was before,
>  you can let GOA handle things and it will work fine. 

I don't have enrolled my OTP. I am afraid, that once I enroll my OPT, 
I'd need to use it every time to refresh my kerberos ticket. That would 
destroy the GOA experience.

If I needed to confirm myself with OTP once in a while, that would be 
different story.


Vít


>  If you DO have a OTP enrolled, GOA won't work at all and you will need
>  to have fedora-packager-kerberos installed and manually use 'fkinit' to
>  get a ticket.
>
>  I think there are plans to improve this use case in krb5 utils.
>  I suppose we could also see if GOA could support this case somehow and
>  add a dep on fedora-packager-kerberos. Where should I file that? gitlab?
>  Or would someone else like to do so?
>
>  kevin
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Michael Catanzaro]

On Wed, Jun 16 2021 at 07:16:09 PM +0200, Vít Ondruch 
<vondruch(a)redhat.com&gt; wrote:
>  I don't have enrolled my OTP. I am afraid, that once I enroll my
> OPT, 
>  I'd need to use it every time to refresh my kerberos ticket. That 
>  would destroy the GOA experience. 
The other problem is that once you enroll an OTP, it's not possible to 
remove it. Hence, I've been afraid to enable it. I'd like to be able to 
change my mind later. I never even considered that g-o-a wouldn't be 
able to handle it, but I guess now that it's been pointed out, this 
should be pretty obvious. It doesn't have any way to store anything 
other than a static password, so of course it would not work. I would 
be *very* unhappy had I turned on the OTP, discovered it broke g-o-a, 
and then found myself unable to downgrade.

Michael

[Kevin Fenzi]

On Wed, Jun 16, 2021 at 07:16:09PM +0200, Vít Ondruch wrote:
>  
>  I don't have enrolled my OTP. I am afraid, that once I enroll my OPT, I'd
>  need to use it every time to refresh my kerberos ticket. That would destroy
>  the GOA experience. 
yes, once enrolled you do have to always use it. 

But you can just not enroll one, it's not at all manditory... 

kevin

[Michael Catanzaro]

On Wed, Jun 16 2021 at 09:54:02 AM -0700, Kevin Fenzi <kevin(a)scrye.com&gt; 
wrote:
>  I think there are plans to improve this use case in krb5 utils.
>  I suppose we could also see if GOA could support this case somehow and
>  add a dep on fedora-packager-kerberos. Where should I file that? 
>  gitlab?
>  Or would someone else like to do so? 
Do you have an account on GNOME GitLab? That would be the best place. I 
can report it for you if not.

[Kevin Fenzi]

On Wed, Jun 16, 2021 at 12:32:43PM -0500, Michael Catanzaro wrote:
>  On Wed, Jun 16 2021 at 09:54:02 AM -0700, Kevin Fenzi
> <kevin(a)scrye.com&gt;
>  wrote:
>  > I think there are plans to improve this use case in krb5 utils.
>  > I suppose we could also see if GOA could support this case somehow and
>  > add a dep on fedora-packager-kerberos. Where should I file that? gitlab?
>  > Or would someone else like to do so?
>  
>  Do you have an account on GNOME GitLab? That would be the best place. I can
>  report it for you if not. 
I do: 
https://gitlab.gnome.org/GNOME/gnome-online-accounts/-/issues/171
feel free to comment there. 

kevin

[David Howells]

Michael Catanzaro <mcatanzaro(a)gnome.org&gt; wrote:

>  Whatever is needed for Fedora kerberos to work needs to be a
> dependency of
>  gnome-online-accounts 
What if you're not using gnome?

David

[Michael Catanzaro]

On Thu, Jun 17 2021 at 10:09:26 AM +0100, David Howells 
<dhowells(a)redhat.com&gt; wrote:
>  What if you're not using gnome? 
Then you should install fedora-packager-kerberos? Or fedora-packager, 
which has a dependency on fedora-packager-kerberos.

Anyway, at first I thought that gnome-online-accounts needed a 
dependency on this new fedora-packager-kerberos if special kerberos 
configuration is required now, but as Kevin explained that dep is only 
required if using OTP, and OTP doesn't work with gnome-online-accounts 
anyway, so we're fine. (Well, as fine as we can be when enabling OTP is 
an irreversible trap that will permanently break your 
gnome-online-accounts, requiring the creation of a new FAS account to 
recover.)

Michael

[Simo Sorce]

On Thu, 2021-06-17 at 07:54 -0500, Michael Catanzaro wrote:
>  On Thu, Jun 17 2021 at 10:09:26 AM +0100, David Howells 
>  <dhowells(a)redhat.com&gt; wrote:
>  > What if you're not using gnome?
>  
>  Then you should install fedora-packager-kerberos? Or fedora-packager, 
>  which has a dependency on fedora-packager-kerberos.
>  
>  Anyway, at first I thought that gnome-online-accounts needed a 
>  dependency on this new fedora-packager-kerberos if special kerberos 
>  configuration is required now, but as Kevin explained that dep is only 
>  required if using OTP, and OTP doesn't work with gnome-online-accounts 
>  anyway, so we're fine. (Well, as fine as we can be when enabling OTP is 
>  an irreversible trap that will permanently break your 
>  gnome-online-accounts, requiring the creation of a new FAS account to 
>  recover.) 
I am pretty sure you can ask an admin to fix the FAS account if really
needed.
OTP cannot be reversed by users themselves, but admins can fix it if
really needed.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc

[Kevin Fenzi]

On Thu, Jun 17, 2021 at 11:00:33AM -0400, Simo Sorce wrote:
>  On Thu, 2021-06-17 at 07:54 -0500, Michael Catanzaro wrote:
>  > On Thu, Jun 17 2021 at 10:09:26 AM +0100, David Howells 
>  > <dhowells(a)redhat.com&gt; wrote:
>  > > What if you're not using gnome?
>  > 
>  > Then you should install fedora-packager-kerberos? Or fedora-packager, 
>  > which has a dependency on fedora-packager-kerberos.
>  > 
>  > Anyway, at first I thought that gnome-online-accounts needed a 
>  > dependency on this new fedora-packager-kerberos if special kerberos 
>  > configuration is required now, but as Kevin explained that dep is only 
>  > required if using OTP, and OTP doesn't work with gnome-online-accounts 
>  > anyway, so we're fine. (Well, as fine as we can be when enabling OTP is 
>  > an irreversible trap that will permanently break your 
>  > gnome-online-accounts, requiring the creation of a new FAS account to 
>  > recover.)
>  
>  I am pretty sure you can ask an admin to fix the FAS account if really
>  needed.
>  OTP cannot be reversed by users themselves, but admins can fix it if
>  really needed. 
Indeed. We do need to verify you are you before we clear your last token
thought. (gpg signed email from the same key as attached to your
account, etc).

kevin