Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red Hat (==FreeIPA). I understand that in theory IPA provides "MS Windows domain"-like solution, but at a glance it's not so easy and mature product [yet]. Aside with SSO, is there any security features which are available only in IPA domain and not available when I'm using LDAP? I'm not interesting in DNS and NTP parts of IPA domain.

TIA, Vitaly

share|improve this question

1 Answer 1

First of all, I would say IPA is perfectly suited for a production environment as of now (and has been for quite a time), although you should be using the 3.x series by now.

IPA does not provide a "MS Windows AD-like" solution, rather it provides the capability to setup a trust relationship between an Active Directory and a IPA domain, which is a Kerberos REALM, actually.

With regards to some of the security features that you can use out of the box with IPA not present in a standard LDAP installation, or a LDAP-based Kerberos REALM, let's name a few:

  • storing SSH keys for users
  • SELinux mappings
  • HBAC rules
  • sudo rules
  • setting password policies
  • certificate (X509) handling

Related to SSO, keep in mind that the target application must support Kerberos authentication and LDAP authorization. Or be able to talk to SSSD.

Lastly, you don't need to configure NTP nor DNS if you don't want to, both are optional. However, I'd very much recommend using both, as you can always delegate NTP on a higher stratum, and setup forwarders for anything outside your realm easily.

share|improve this answer
1  
Thank you, this list and your explanation are really useful! - does IPA3 officially released for RHEL? - I'll re-check - for some reason I was sure that password policy can be easily deployed with LDAP [IMHO, even just with old-school *nix tools] –  Vitaly Jun 16 '13 at 17:05
    
@Vitaly Yes, IPA 3.0 is included in Red Hat 6.4. Be sure to check the upgrade notes before just blindly upgrading. –  Michael Hampton Jul 9 '13 at 3:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.