I am trying to research how to setup MySQL/MariaDB to authenticate against FreeIPA/LDAP. I am running into some issues/confusion. Do I need to add a new user account to tie mysql to? I've been following this website:FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log
| | | FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log Firstyear`s blog-a-log | |
|
I know that FreeRADIUS is not the same. But has anyone else gotten this to work? We have tons of mysql servers and want our users who need mysql access to have 1 source of authentication.
On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
I've been following this website: FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_service_accounts..html
None of that is particularly relevant unless you're specifically supporting MSCHAPv2 authentication.
The easiest solution for authenticating MySQL using FreeIPA is probably to join the MySQL server to the IPA domain and then use PAM authentication:
https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html
On ti, 31 loka 2017, Gordon Messmer via FreeIPA-users wrote:
On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
I've been following this website: FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_service_accounts..html
None of that is particularly relevant unless you're specifically supporting MSCHAPv2 authentication.
The easiest solution for authenticating MySQL using FreeIPA is probably to join the MySQL server to the IPA domain and then use PAM authentication:
https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html
If you are using MariaDB instead of MySQL, it is possible to configure GSSAPI (Kerberos) to authenticate. You'd still need to create users in MariaDB database first so that it knows these are valid ones: https://mariadb.com/kb/en/library/authentication-plugin-gssapi/
Alexander Bokovoy writes:
On ti, 31 loka 2017, Gordon Messmer via FreeIPA-users wrote:
On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
I've been following this website: FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_service_accounts..html
None of that is particularly relevant unless you're specifically supporting MSCHAPv2 authentication.
... which you shouldn't do because it's broken: https://www.schneier.com/blog/archives/2012/08/breaking_micros.html
The easiest solution for authenticating MySQL using FreeIPA is probably to join the MySQL server to the IPA domain and then use PAM authentication:
https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html
If you are using MariaDB instead of MySQL, it is possible to configure GSSAPI (Kerberos) to authenticate. You'd still need to create users in MariaDB database first so that it knows these are valid ones: https://mariadb.com/kb/en/library/authentication-plugin-gssapi/
For interest: GSSAPI encryption is forthcoming, but stalled on mariadb growing a proper plugin API.
Thanks, --Robbie
On 11/01/2017 09:46 AM, Robbie Harwood wrote:
None of that is particularly relevant unless you're specifically supporting MSCHAPv2 authentication.
... which you shouldn't do because it's broken: https://www.schneier.com/blog/archives/2012/08/breaking_micros.html
...and also not supported by MySQL, as far as I know. I suppose I could have said that, but I thought it was obvious. :)
Thank you for the feedback.
On Wednesday, November 1, 2017 3:26 PM, Gordon Messmer via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
On 11/01/2017 09:46 AM, Robbie Harwood wrote:
None of that is particularly relevant unless you're specifically supporting MSCHAPv2 authentication.
... which you shouldn't do because it's broken:https://www.schneier.com/blog/archives/2012/08/breaking_micros.html
...and also not supported by MySQL, as far as I know. I suppose I could have said that, but I thought it was obvious. :) _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Andrew Meyer -
Gordon Messmer -
Robbie Harwood