On 03/06/2022 08:19, Sigbjorn Lie via FreeIPA-users wrote:
Hi list,
When I have a 2FA enabled user account, I receive the two password
prompt for sudo at a host, even on hosts where 2FA is not required. This
breaks Ansible for me, when using "become" with Ansible.
A way forward might be to use GSSAPIAuthentication to authenticate to
the remote server, GSSAPIDelegateCredentials to forward your Kerberos
TGT to the remote server, and (on the server side) configure pam_sss_gss
in sudo's PAM stack so that users with a valid Kerberos TGT do not get
prompted for their passwords at all.
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
