Sina Owolabi via FreeIPA-users wrote:
Hi List
I’ve been struggling with this for a while and I would really appreciate
some advice.
I have an openvpn server using freeIPA to authenticate users logging
into the office VPN.
Currently all users have access to all services on the OpenVPN server.
How do I use HBAC to properly restrict them to just OpenVPN? Do I need
them to have access to anything else?
You need to start by creating HBAC rules that grant general access to
systems. IPA ships with a default rule, allow_all, which allows HBAC
access on all services to all systems.
You'll need disable this rule but first you have to put other rules into
place which grant access to the systems you need access to (e.g. you
could create a ssh rule that allows all IPA admins to access all hosts).
What HBAC rules you need for OpenVPN depends on how you have OpenVPN
configured for auth.
rob