Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

Multiple FreeIPA servers can easily be configured in a FreeIPA Domain in order to provide redundancy and scalability. The 389 Directory Server is the main data store and provides a full multi-master LDAPv3 directory infrastructure. Single-Sign-on authentication is provided via the MIT Kerberos KDC. Authentication capabilities are augmented by an integrated Certificate Authority based on the Dogtag project. Optionally Domain Names can be managed using the integrated ISC Bind server.

Security aspects related to access control, delegation of administration tasks and other network administration tasks can be fully centralized and managed via the Web UI or the ipa Command Line tool.

230 questions
3
votes
2 answers

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home directories from the nfs server The problem is, that…
Richard
  • 739
  • 8
  • 15
3
votes
0 answers

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need the user account storage schemes to be SHA1…
Andor
  • 591
  • 5
  • 16
3
votes
2 answers

VCenter 5.5 Appliance and FreeIPA 3 authentication

I have a vcenter appliance and freeipa running in my environment. There are no windows machines at all, nor will there be. I have setup vca to authenticate via LDAP to IPA and this works PER USER. the issue im having is even when defining the groups…
driz
  • 277
  • 1
  • 12
3
votes
1 answer

Extremely slow NFS openat performance

I've installed an NFS server on Ubuntu 20.04 and a FreeIPA Ubuntu 20.04 client with the users home directories served by the NFS server. Performance is extremely slow when accessing files. When I strace the process with time spent in syscalls, I…
YuvGM
  • 153
  • 4
3
votes
1 answer

NFS/krb5 authentication server lookup fails due to wrong principal name

When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server. LOOKING_UP_SERVER: ... host/nfsclient.internal.domain.tld@IPA.DOMAIN.TLD for…
ifndef
  • 31
  • 1
3
votes
0 answers

DNSSEC for private internal sub zones of an external domain

Consider the following scenario: example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com. Inside the company we have some internal privates zones, for Active Directory and a Unix Domain:…
Vinícius Ferrão
  • 5,520
  • 11
  • 55
  • 95
2
votes
1 answer

FreeIPA sudoers rule - how to add NOPASSWD for ALL commands (no prompt for password)

Using FreeIPA for sudoers rules and I am attempting to create what would be the same as standard sudoers line(s) of: user ALL=(ALL) NOPASSWD:ALL group ALL=(ALL) NOPASSWD:ALL to allow a specific user or group to execute any/all commands without…
Alex
  • 21
  • 1
  • 3
2
votes
0 answers

How to ignore/discard AD groups in FreeIPA

I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, I have installed and configured the…
Eil
  • 389
  • 2
  • 5
  • 12
2
votes
1 answer

How do I update my machine time when there is a local ntpd server reference in ntpd.conf

My FreeIPA server's datetime had drifted about 10 min causing login failures. The ntpd service was functioning up and running. I checked the configuration and noticed that freeIPA had added a local server to synchronize the time in my ntpd.conf…
Kevin Vasko
  • 185
  • 6
2
votes
0 answers

How to make authconfig-tui use sssd instead of nslcd?

I've read that redhat's going to deprecate nslcd, and sssd is the future. So, I was following a video that shows how to setup IPA clients using authconfig-tui. Yes, I'm aware that it's been deprecated, but I still wanted to try it. In the video, the…
Somu
  • 125
  • 6
2
votes
1 answer

In FreeIPA, how do you add multiple external accounts to a group using the CLI?

I've tried multiple methods that don't appear to work, but I'm ultimately trying to add multiple external users to a non-POSIX group using the ipa group-add-member ... command. NOTE: These external users are coming in via a trust with an Active…
slm
  • 7,615
  • 16
  • 56
  • 76
2
votes
1 answer

Problems connecting to a freeIPA client host via ssh

I am trying to set up an IPA environment with a CentOS 7.3 server and clients and I am experiencing a behavior that I am not able to understand. I am using IPA version 4.4.0. I was able to run ipa-server-install on the server and ipa-client-install…
andreee
  • 133
  • 1
  • 6
2
votes
2 answers

FreeIPA client on LXC container sshd access denied

On Proxmox 4.4 I installed Centos 7 VM with FreeIPA server: ipa-server-install --idstart 10000 --setup-dns I can use IPA users and log in to other VMs on Proxmox, but when I try same for Centos 7 LXC container I got errors: May 6 13:15:50 aaaaaa…
heniekk
  • 121
  • 7
2
votes
0 answers

Free-ipa - Active Directory seems to be setup, but authentication is not working

Looking for some troubleshooting help here. I am trying to be able to authenticate AD users on a Centos7 cluster. For testing this, I am setting up a Windows Server 2012 R2 and the cluster in Azure. I have carefully followed the instructions here…
2
votes
1 answer

Multiple sites/realms in FreeIPA

To start off, my experience lies in networking (Cisco) and Windows. That being said, I have been set off on a project to design a multi-site FreeIPA installation. I have single site FreeIPA without a problem. Where I am running into problems is…
user396032
  • 31
  • 1
  • 4
1 2
3
15 16