Hi Christian

Sent from my iPhone

On 5 Dec 2019, at 15:59, Christian Heimes via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

On 05/12/2019 18.41, Vinícius Ferrão via FreeIPA-users wrote:
Hello,

Is it supported to install mod_ssl on the same machine of FreeIPA? I’m asking this because FreeIPA ships by default mod_nss and this may lead to conflicting issues inside /etc/httpd/conf.d. For example:

[root@headnode conf.d]# grep -iR virtualhost
nss.conf:<VirtualHost _default_:443>
nss.conf:</VirtualHost>                                  
ssl.conf:<VirtualHost _default_:443>
ssl.conf:</VirtualHost>       

Both add a default virtual host to 443.

What’s the correct procedure? Don’t use mod_ssl at all?

We switched from mod_nss to mod_ssl a couple of versions ago.

Oh, I can see the changes here: https://www.freeipa.org/page/Releases/4.7.0#mod_ssl

But I’m running EL 7.7, so I’m still on mod_nss.

On EL8 it’s already with mod_ssl, as I understood.

Well I’ll need to support both. Since EL8 support is on my roadmap.

Ok, things are much clearer now.

The correct procedure is: Don't install any additional services on a IPA
server. For security reasons you shouldn't host other web sites, too. If
the IPA server gets compromised, then all your users, computers, and
services in your network are compromised, too.

Yes I’m aware of the security implications, but as I said on another thread with Rob, it’s an HPC system and I’m using FreeIPA/IdM as the default authentication realm. It’s not for keeping an enterprise with normal clients, so the security implications are different.

I’m trying to make the services coexist without breakage between them.

Thanks all for the help on this topic.



Christian

--
Christian Heimes
Principal Software Engineer, Identity Management and Platform Security

Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Laurie Krebs, Michael O'Neill,
Thomas Savage

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org