Food for thought.
Thanks, Rob
______________________________________________________________________________________________
Daniel E. White
daniel.e.white@nasa.gov
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290
From:
Rob Crittenden <rcritten@redhat.com>
Date: Tuesday, January 14, 2020 at 14:21
To: FreeIPA users list <freeipa-users@lists.fedorahosted.org>
Cc: Daniel White <daniel.e.white@nasa.gov>
Subject: [EXTERNAL] Re: [Freeipa-users] Adding Hosts that are not ipa-clients ?
White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:
I am considering the Host Based Access Control features to help manage
things in our infrastructure that cannot be ipa-clients - like network
hardware (switches, routers)
With the understanding that my servers do not run the DNS, can I create
such hosts to use in host groups and HBAC rules ?
You can create hosts that don't exist in DNS using --force on the
command-line. I'm pretty sure there is the equivalent in the WUI.
And sure you could add them to HBAC rules but enforcement happens on the
client and if the client isn't running sssd with the IPA backend...
rob