TARDIS Project

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

===== Disabling Accounts =====

Since [[hosts:architecture|MIT Kerberos KDC acts as the source of truth for authentication]], it is probably best to disable accounts there.

To do this, one could:
  - SSH into `enclave`, you may have to SSH proxy through ''sandbox'' or another gateway.
  - Enter the Kerberos admin shell 
    * ''kadmin -p sonic/admin@TARDISPROJECT.UK''
    * Password is stored on the admin vaultwarden.
    * (other principles are available)
  - Disable ticket issuance
    * Disable: ''modprinc -allow_tix [username]''
    * Re-enable: ''modprinc +allow_tix [username]''
    * This does not kick the user out of any active sessions, which could take up to a day or two to expire.
    * The user will receive a generic ''Invalid username or password.'' error when logging in via keycloak OIDC or password SSH.

This does not block authentication via SSH key, ie. ''~/.ssh/authorized_keys'' which should be handled separately. To do this, one could modify ''/etc/ssh/sshd_config'' on sandbox, adding the username to the ''DenyUsers'' section. For example:

  DenyUsers username1 username2 username3