On ti, 24 maalis 2020, Scott Reed via FreeIPA-users wrote:
Sumit,
Why would I not want to login to the server with IPA accounts? I can
control their access privileges with the IPA policies.
This is fully under your control. See man page for
ipa-server-install(1), it describes all options. You could have
specified --mkhomedir when running original ipa-server-install and that
would have configured automatic creation of the home directories on the
local /home file system.
Since you didn't do that, you can follow Sumit's suggestion to enable
on-demand home directory creation.
Note that it is still recommended to reduce access to IPA masters to
only allow users that have need to access there. Your IPA masters are
heart of your infrastructure, so be mindful on what operations regular
users are allowed to do on the machines. Many attacks against core
infrastructure are often based on proxying through mere users on other
systems to get local access to more privileged resources.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland