FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a ...

learn more… | top users | synonyms

1
vote
0answers
18 views

ipa users cannot sudo on some machines only, including the ipa server

I'm having trouble with freeipa on a few machines. It's been very frustrating to debug so far. Here's the details of the issue; How it manifests: The user can login just fine to any host, but on ...
0
votes
0answers
11 views

Apache authentication against FreeIPA's Kerberos

I'm currently trying to set up Apache as an authentication portal. It's supposed to act as a reverse proxy with krb authentication. My apache server is named portal.test.com (debian container) My IPA ...
1
vote
1answer
20 views

FreeIPA and AD password synchronisation

I am attempting to integrate FreeIPA with Active Directory to provide single-sign-on for Windows and Linux users by following this guide. I have successfully created the 'winsync' agreement and ...
1
vote
1answer
18 views

FreeIPA AD Trust based Integration using SunLDAP to store Policies

If we want to use the FreeIPA Active Directory Trust Integration Option, can we use an existing implementation of SunLDAP to store the Policies (e.g. sudo, hbac etc.) Essentially we don't to create ...
1
vote
1answer
520 views

how to disable forwarder in freeipa servers named.conf

My IPA server's named.conf has this in it since I chose to enter a forwarder address during the ipa-server-install. forward first; forwarders { 132.206.44.21; 132.216.44....
0
votes
2answers
206 views

Joining realm failed: HTTP response code is 401, not 200

I am using an ipa-server for centralised user login in my enviornment. i have about 20 to 25 client machines to connect to this server. i was able to connect most of the client to the server using ...
0
votes
0answers
173 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
1answer
95 views

FreeIPA in LXD/LXC containers - cannot switch user

The Setup consists of one FreeIPA-Server and one Client, which both reside in unprivileged LXD-Containers on the same Host. Both containers and the host machine run Ubuntu 16.04. All Settings are ...
1
vote
0answers
15 views

How to Configure freeIPA to host external DNS Zone

Is it possible to use freeIPA DNS servers to host an external DNS zone that will resolve records for external clients without exposing the internal zones and records? I need to host SPF and DKIM ...
2
votes
0answers
60 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
0
votes
2answers
73 views

Build a production IPA server without integrate DNS and NTP with client

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's ...
3
votes
3answers
580 views

VCenter 5.5 Appliance and FreeIPA 3 authentication

I have a vcenter appliance and freeipa running in my environment. There are no windows machines at all, nor will there be. I have setup vca to authenticate via LDAP to IPA and this works PER USER. the ...
1
vote
2answers
48 views

Centos package naming for FreeIPA?

Where can I find information about CentOS package management? I installed Spacewalk recently and noticed that FreeIPA was listed as ready for an update. The versions are differently named, and the ...
0
votes
1answer
164 views

BIND DNS (with IPA) unable to Forward DNS Requests

I have been trying to install IPA on my CentOS system for several days, but I keep experiencing a problem with DNS forwarding, in that I am unable to get it working. I have tried this with two DNS ...
0
votes
0answers
28 views

How to integrate Freeipa authentication with Cacti?

I have been trying to integrate FreeIPA authentication with Cacti but unable to till now. Can someone please help me out in configuring one?? I followed this guide @ http://blog.zwiegnet.com/linux-...
1
vote
0answers
40 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
0
votes
0answers
29 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
2answers
6k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
0
votes
1answer
58 views

How does ipa-client know when IPA Fail Over occurs during Multi Master setup?

I have setup a multi-master IPA and it seems to be working fine. So it seems like for this kind of a setup, we don't need to mention the --server option and only the --domain option should work fine. ...
0
votes
2answers
294 views

How to install freeipa server with apache ssl/tls virtualhosts already present

Is it possible to run an FreeIPA server next to a full configured apache server with ssl/tls configured virtual hosts and if yes what do I have to do to not get a conflicting 443 port error during ...
1
vote
2answers
37 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
3
votes
1answer
51 views

Restrict LDAP attribute read to self in FreeIPA/RedHat IdM

In our environment, employeeNumber is a sensitive field and we don't want it to be readable by all users. By default, IdM/IPA has a default permission System: Read User Addressbook Attributes which ...
1
vote
2answers
105 views

Support users in openldap catalog with samba specific attributes

2016 is coming. We still use openldap. I have openldap server from ubuntu 12.04 with existing users. It provides the authentication layer in addition to containing the user, group, and machine ...
1
vote
3answers
1k views

Managing Linux user accounts + Samba + more

I have a network of about 3-6 CentOS servers, with about 5-10 users (currently, and near future). I'm looking for a solution for centralized managements of users. My requirements from it are: Linux ...
0
votes
0answers
34 views

FreeIPA: User not prompted to set new password upon password reset by admin

I have installed freeIPA in Centos 7. I login to t he web UI as admin, and create a new user as well as set a password. Documentation for freeIPA states that the user should then be prompted to ...
0
votes
1answer
43 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
0
votes
0answers
65 views

FreeIPA one domain starts showing “Internal Server Error”

When i want to check list of domains in one zone im getting "Internal Server Error". This is what i have in my http error log file: [Tue Nov 17 15:19:48.429112 2015] [:error] [pid 3930] (70007)The ...
1
vote
2answers
398 views

Replica between FreeIPA 3.3 to FreeIPA 4

I am trying to move our data from FreeIPA 3.3 CentOS 6.5 to FreeIPA 4 on Fedora 21 I tried to create a replica on IPA 4.1.2 with IPA 3.3 but it didn't work Got this error Configuring certificate ...
1
vote
1answer
144 views

How does a FreeIPA failed authentication session display browserconfig.html?

In FreeIPA, when browsing to the web UI, a failed authentication session should redirect to http://<servername>/browserconfig.html. Mine does not. Maybe I'm over complicating things, but the ...
-2
votes
1answer
160 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...
0
votes
1answer
155 views

FreeIPA show all dns records

Just as the title says. I'm stuck at ipa dnsrecord-show mydomain.com I get prompted for a hostname Usage: ipa [global-options] dnsrecord-show DNSZONE NAME [options] I've tried wildcards but it is ...
0
votes
1answer
487 views

freeipa admin password reset

I'm trying to figure out how to reset my freeipa3 admin password. I'm able to see the user when I search the domain: [root@ipaserver ipa]# LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -h localhost -ZZ -...
0
votes
1answer
52 views

FreeIPA - remove user password

I have created a user in FreeIPA. He has been assigned a password and SSH key. I want him to leave only SSH key. Is there a way, how to remove password??
2
votes
2answers
140 views

FreeIPA without web UI or change of ports

Can I install FreeIPA server without httpd (without web UI)?? Or at least can I change the ports?? (80->8880 and 443->8443)
0
votes
1answer
285 views

Install FreeIPA 4.1.0 on CentOS 6

I have installed FreeIPA master server in version 4.1.0 on the server with CentOS 7.1 and I need install replication server on the machine with Centos 6. Is there a way, how to install ipa-server ...
1
vote
0answers
47 views

MAC OSX and FreeIPA integration?

There seem to be just one Documentation in FreeIPA and that also says to use weak crypto ciphers and does not seem to support the --mkhomedir option since there is no IPA-Client for MAC OSX 10 Anyone ...
1
vote
2answers
928 views

Configure Gitlab to use FreeIPA as LDAP server

I'm running in ran into a bit of a trouble and I don't seem to be able to fix it. Please follow the scenario bellow: I have two servers: ONE (10.0.3.10): Ubuntu based, having Gitlab (as deb package)...
0
votes
1answer
195 views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...
0
votes
1answer
121 views

FreeIPA (LDAP): Refuse auth for users with expired password

I have a FreeIPA used mostly as an LDAP in many local web services. Unfortunatly LDAP authorizes users to login to 3-rd party applications even when user's password is expired (including first random ...
1
vote
1answer
466 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
2
votes
0answers
54 views

Cannot create a user in IPA server for remote login

I had created a new IPA IdM server in Centos 7 using script install-ipa-server. The installation was successful. After installation, I was not able to create a user using IPA user-add user, it asks ...
0
votes
1answer
738 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
2
votes
2answers
450 views

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home ...
0
votes
0answers
35 views

FreeIPA multi domain single master

I have 3 separate environments that I am using FreeIPA for authenticaiton in. Originally we were going connect each environment up to our Active Directory domain for centralized authentication but ...
1
vote
1answer
100 views

Setup freeIPA to handle Oracle Database name resolution

I am trying to setup freeIPA to handle Oracle Database name resolution. I have followed this tutorial for OpenLDAP http://www.idevelopment.info/data/Oracle/DBA_tips/LDAP/LDAP_8.shtml The schema ...
0
votes
1answer
46 views

ProcessMaker import groups from FreeIPA

I just connected ProcessMaker to FreeIPA using advanced LDAP authentication using this tutorial and I was able to import users list and login using FreeIPA accounts. My problem is that I can't ...
0
votes
1answer
186 views

RHEL 7/CENT0S 7 IPA/IDM transitive trusts

I have a situation I am having a hard time getting a clean answer on. I have a IDM/IPA domain setup and I have a trust setup with my Windows domain. That part is working perfectly. I have a one ...
12
votes
1answer
6k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
5
votes
3answers
2k views

backup and restoration of a freeipa infrastructure

I'm finding the documentation on ipa server backup and restoration sadly lacking, and being so centrally critical it's not something i'm really happy about shooting in the dark with - could some kind ...
2
votes
1answer
162 views

Extending LDAP and FreeIPA

I'm working with FreeIPA and I've extended its attributes successfully, but noticed that the verification function in the Python plugin, added to FreeIPA, only works for the values entered through the ...