We have a single mesh of FreeIPA servers in several different locations, we capture logs (apache ErrorLog directive) to a log server in each of those locations. When auditors ask us questions we have to trawl log servers from all locations as our IdM administrators
might have used any of the IdM servers to make changes.
To limit that access to one site, I am considering stopping and disabling apache on all IdM servers at other sites and just wanted to check there are no unintended consequences in that action.
I'm not looking for enforcement, merely a means of persuading the team to use the web interface or command line tools at one site.