I've proposed to migrate from OpenLDAP to FreeIPA solution in my organization because the former did not met our requirements as we moving to Single Sign On. We migrated to FreeIPA but set it up with internal DNS name. This was dumb decision as we have a lot of external hosts in AWS and other datacenters which we want to join to our FreeIPA for authentication with one credential and utilize policies (HBAC, sudoers) easily and centrally.
We found that there is two solutions:
- setup tunnels between AWS and datacenters for making our DNS zone and FreeIPA servers available;
- redeploy whole FreeIPA with external DNS name and expose FreeIPA servers to Internet.
We end up with second option because first one is very complex, but second option make us think about security.
What came to mind is:
- disable anonymous bind;
- prohibit unencrypted traffic and improve communications security by using options: nsslapd-minssf=128, nsslapd-require-secure-binds=on, sslVersionMin=TLS1.1.
So, there is several questions:
1) Is there anything else from security perspective that we should care, configure properly (Kerberos DC for example)?
2) We want to share with users only one Web service from specific replica so users will not cause replication conflicts by modifying entries in other replicas. Is it ok if we close web ports (80, 443) only to localhost on other replicas and leave all other ports on all replicas opened to internet (389,636,88,464)?
3) How secure and strong is default SASL/GSSAPI replication mechanism? I've noticed that traffic is encrypted but can be decrypted by using servers kerberos keytab
4) Overall, even with all previous concerns taken into account cared is it proper to open FreeIPA to internet? This is kinda rhetorical question as we see that this is only choice for us but just want to hear some advices, expert vision.
P.S. We don't utilize FreeIPA internal DNS service. DNS is configured on external hosts
Thanks in advance.
reading official guide one may assume - I do - that "Using SSH Without
Passwords" should work out-of-box (centos 7.6) - is such assumption valid?
For me this does not work - ssh still asks for passwords.
If this is due to some failure/problem, then where to look and how to
many thanks, L.
I am trying to create a certificate for an older network printer.
Unfortunately, I cannot just load a certificate and private key of my
own creation. The printer only supports certificates created from a
CSR of its own creation, which does not include the SAN.
Is it possible to make IPA copy the CN into the SAN?
Ian Pilcher arequipeno(a)gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
I am using IPA for my DNS and have 3 total servers in the group. 2 of them
are responding to queries just fine, but the 3rd (which is bare metal, not
a VM like the others) is not resolving the queries issued to it. Running
ipactl status returns all services running:
[root@ipa3 /]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
*named Service: RUNNING *
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
We tried restarting the services but didn't change anything. Next we tries
to do a forced sync of the server with one of its working replicas:
ipa-replica-manage force-sync --from ipa1.example.com
We also tried re-initializing the non-working replica:
ipa-replica-manage re-initialize --from ipa1.example.com
However, it still won't resolve any queries directed to it. Any ideas of
what to try next?
BYU Dept. of Chemistry and Biochemistry
My IPA shows every user as "disabled" when in UI I go to the user's page.
Also the password policy fields are empty and if I am filling in something
new like phone number it's not showing up in the IU after I save it. But in
cli everything is correct and shown. Users list also shows everyone as
"enabled". Did anyone have seen something like this?
With best regards,
phone, Telegram, WhatsApp, etc:+420-773-591-443
7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B
I have a use-case when an application needs to access the secret stored in IPA Vault. The problem is that the application is containerized...
So what would be the best practice to authenticate to the Vault?
The logic says we should use REST API, but how to authenticate to the IPA, without having to put user/password in a file inside the container...?
Enroll the container with IPA and use Kerberos...?
Or mount a keytab file from the enrolled parent host and install Kerberos package in the container to use it...?
Does anyone have an experience with this?
I’m exploring the use of IPA in a synchronisation (rather than trust) arrangement with AD, as this fits a particular use-case we have here quite well.
Our AD is very large, so a large number of users are synchronised into IPA and they come across by default as ‘Disabled’. This is fine - an administrator can easily enable those who need access.
However, the users all show up as ‘Active users’, rather than ‘Stage users’. But it would be much better if they were ‘Stage users’ to start with, and needed to be explicitly activated before moving into ‘Active users’.
It seems that IPA doesn’t work this way in a synchronisation agreement? Is there any way to configure the system so that it does?
Is there an API endpoint I can use to perform OTP verification without the users password
(i.e. just with their DN or uid)?
I've got a non-web application with its own authentication system that I'd like to
add MFA to, and I'd rather avoid copying the OTP secrets to it or re-writing the