On 05/12/2019 18.41, Vinícius Ferrão via FreeIPA-users wrote:
Hello,
Is it supported to install mod_ssl on the same machine of FreeIPA? I’m asking this
because FreeIPA ships by default mod_nss and this may lead to conflicting issues inside
/etc/httpd/conf.d. For example:
[root@headnode conf.d]# grep -iR virtualhost
nss.conf:<VirtualHost _default_:443>
nss.conf:</VirtualHost>
ssl.conf:<VirtualHost _default_:443>
ssl.conf:</VirtualHost>
Both add a default virtual host to 443.
What’s the correct procedure? Don’t use mod_ssl at all?
We switched from mod_nss to mod_ssl a couple of versions ago.
The correct procedure is: Don't install any additional services on a IPA
server. For security reasons you shouldn't host other web sites, too. If
the IPA server gets compromised, then all your users, computers, and
services in your network are compromised, too.
Christian
--
Christian Heimes
Principal Software Engineer, Identity Management and Platform Security
Red Hat GmbH,
http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Laurie Krebs, Michael O'Neill,
Thomas Savage