FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a ...

learn more… | top users | synonyms

3
votes
1answer
31 views

Integrating FreeIPA or RH IdM in an existing MS AD environment

I want to deploy FreeIPA or Red Hat IdM in my existing environment Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to ...
0
votes
2answers
51 views

FreeIPA 4.1.1 Fedora 21is not working

I am trying to install FreeIPA 4.1.1 on Fedora 21 yum install freeipa-* ipa-server-install Error during the installation: [10/27]: importing CA chain to RA certificate database [error] ...
4
votes
0answers
123 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
0
votes
0answers
16 views

freeipa 4.1.0 on fedora20 not working

Has anyone successfully setup freeipa 4.0.3 on Fedora20 as a server and another fedora20 with freeipa 4.1.0 for the client side? because I can't figure out why im always having the error " user does ...
0
votes
2answers
133 views

How to disable Null and Weak Ciphers on 389-Directory-Server

I am running 389-DS on CentOS. Version - '389-ds-base.i686 1.2.11.15-34.el6_5'. Security scans revealed that NullCiphers were found on Port 389 and 636. I tried to disable them by shutting down DS, ...
-1
votes
2answers
100 views

Windows domain + Linux Domain on One Network

Currently our network is all tied to Active Directory with both Windows and Linux workstations/servers. We would like to implement a Free IPA server that synchronizes authentication between a Linux ...
0
votes
1answer
73 views

FreeIPA/389 DS userPassword

I am connecting to FreeIPA LDAP (386 Directory Server) as admin. I can find a user, and add the userPassword attribute like #!RESULT OK #!CONNECTION ldap://freeipa1.localdomain:389 #!DATE ...
-2
votes
3answers
127 views

has no MX record

I have two servers running CentOS release 6.5 (Final). In one of them is installed FreeIPA: Name: freeipa.fi.example.com IP: 192.168.99.50 And the other Zimbra as mail server: Name: ...
0
votes
1answer
188 views

MacOS X 10.9 Mavericks Kerberos login w/ FreeIPA

Has anyone successfully set up authentication and authorization between MacOS X and FreeIPA? An old revision of the FreeIPA documentation explains how to get it working in 10.4 and nothing in their ...
0
votes
1answer
47 views

FreeIPA krb5.conf has example.com entries

I have installed and reinstalled FreeIPA ipa-server-3.0.0-37.el6.x86_64 on a fully updated OEL 6.5 server a couple (3) times now and even if I destroy the existing /etc/krb5.conf file and reinstall ...
0
votes
1answer
143 views

Configuring Redhat / CentOS 5 SSH to authenticate to IPA server with public keys

I'm trying to configure some Red Hat/CentOS servers to use an ipa-server on CentOS 6 for SSH authentication with public keys. I'm storing the public keys on the IPA server, which works great on ...
1
vote
1answer
730 views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
1answer
435 views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com ...
3
votes
2answers
203 views

VCenter 5.5 Appliance and FreeIPA 3 authentication

I have a vcenter appliance and freeipa running in my environment. There are no windows machines at all, nor will there be. I have setup vca to authenticate via LDAP to IPA and this works PER USER. the ...
2
votes
1answer
168 views

How can I force a mac mobile account user to be logged out or locked out when their LDAP account is disabled?

I have a FREEIPA LDAP server and a Mavericks Client. I have bound my Mac to my ldap and created a mobile account. What I want is when someone is disabled it logs out the user or locks the screen.
4
votes
3answers
268 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
1
vote
1answer
207 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
0
votes
2answers
357 views

Managing Linux user accounts + Samba + more

I have a network of about 3-6 CentOS servers, with about 5-10 users (currently, and near future). I'm looking for a solution for centralized managements of users. My requirements from it are: Linux ...
0
votes
1answer
973 views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
2
votes
0answers
896 views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
4
votes
1answer
3k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
3
votes
1answer
522 views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
0
votes
0answers
53 views

FreeIPA issue: after ipa1 server kernel panic, not switching to ipa2 failover server

Our setup is as follows. All machines are running under Centos 5.8. We have a gateway machine with a firewall, gw.example.com, through which all external traffic is funneled. Behind it we have 2 ...
6
votes
3answers
383 views

freeipa ssl ldap and round robin dns

I'm trying to ask this question in a way that's answerable, but part of the issue is knowing the implications of my current situation and if there's an issue or technical debt which'll bite me further ...
1
vote
1answer
406 views

How to configure freeIPA in multi domain environment?

I am having several servers in different domains. Example: 6 systems in domain abc.com (server1.abc.com, server2.abc.com ... server6.abc.com) and 5 systems in domain xyz.com (server1.xyz.com, ...
4
votes
1answer
936 views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
9
votes
3answers
516 views

IPA dynamic DNS updates only the AAAA record. Where are my A records?

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly ...
4
votes
2answers
552 views

backup and restoration of a freeipa infrastructure

I'm finding the documentation on ipa server backup and restoration sadly lacking, and being so centrally critical it's not something i'm really happy about shooting in the dark with - could some kind ...
9
votes
1answer
2k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
1
vote
1answer
267 views

iptables: Allowing only established outgoing connections like DMZ

I want to simulate a DMZ like scenario where server1(inside DMZ, 10.1.1.0) should be able to respond to any incoming connection and cann't make a new outgoing connection on its own. I would ...
1
vote
1answer
240 views

How to create a sudorule in freeIPA for the sudoedit builtin

Currently, when I want to grant some group of users access to edit a file, I proceed as follows: ipa sudocmd-add --desc=Vi IMproved default-mode, no-exec, no-suspend mode' '/usr/bin/rvim' ipa ...
0
votes
1answer
258 views

ipa root certificate signing

I am trying to get my ipa certificate signed by openca and its getting rejected due to hostname. The following hostnames were rejected because the system couldn't link them to your account, if they ...
0
votes
2answers
202 views

Accidentally disabled the administrator account on IPA server

I'm running ipa-server on Centos 6. I was going through the users disabling accounts and accidentally disabled the "administrator" account. Now I have no access to do anything. Is there any way to ...
3
votes
2answers
1k views

Google authenticator with Openldap or Fedora 389 Server or FreeIPA

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
7
votes
2answers
731 views

VMWare vCenter/ESXi with FreeIPA instead of Active Directory?

Can vCenter authenticate against FreeIPA instead of Active Directory? If so, how would you set it up? We have a pure Linux environment (CentOS) and need to have vCenter and our VM's have the same ...