| Description | I have a FreeIPA installation consisting of ipa-server-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64 on a CentOS Stream 8 server, with Fedora 32 clients. My IPA account is configured to use a password and OTP, with two tokens configured: one TOTP on my phone, another HOTP on a Yubikey.
Eventually the ipa-otpd starts to fail. In systemctl one sees things like:
● ipa-otpd@0-3991-0.service loaded failed failed ipa-otpd service
● ipa-otpd@1-3992-0.service loaded failed failed ipa-otpd service
with an overall 'degraded' state. However the OTP login continues to work correctly. The log for such failed services typically read:
# journalctl -u ipa-otpd@1-3992-0.service
-- Logs begin at Wed 2020-05-27 00:38:26 BST, end at Wed 2020-05-27 12:44:19 BST. --
May 27 10:08:38 skipper.[my domain] systemd[1]: Started ipa-otpd service (PID 3992/UID 0).
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: LDAP: ldapi://%2Fvar%2Frun%2Fslapd-[my realm].socket
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm]: request received
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm] user query start
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm]: user query end: uid=james,cn=users,cn=accounts,dc=cb,dc=[my dc]
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm]: bind start: uid=james,cn=users,cn=accounts,dc=cb,dc=[my dc]
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm]: bind end: success
May 27 10:08:38 skipper.[my domain] ipa-otpd[16008]: james@[my realm]: response sent: Access-Accept
May 27 11:09:34 skipper.[my domain] ipa-otpd[16008]: bind.c:088: Input/output error: IO error received on bind socket
May 27 11:09:34 skipper.[my domain] systemd[1]: ipa-otpd@1-3992-0.service: Main process exited, code=exited, status=1/FAILURE
May 27 11:09:34 skipper.[my domain] systemd[1]: ipa-otpd@1-3992-0.service: Failed with result 'exit-code'.
Not seen anything else incriminating (like SELinux denials). |
|---|
