Skip to main content

Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

Why is FreeIPA HBAC rule not enforced for sudo

Using FreeIPA on RHEL 9, I have both sudo rules configured and an HBAC rule. The HBAC rules are there to disable all access to certain accounts on some machines. I can test those with, e.g.: ipa ...
okapi's user avatar
  • 152
0 votes
0 answers
23 views

Restore a FreeIPA DNS system

I use FreeIPA on a server, a Centos Server 8 (a main and replica). This is used to authenticate system users, for logon purposes by using SSH key authentication, and also hosting DNS name records. A ...
skunkydude's user avatar
-1 votes
0 answers
27 views

FreeIPA behind home Internet router

I am currently running a freeIPA on an unraid server Fedora VM. Locally it works well. When I try to connect to server from outside the network it fails. I have forwarded ports 389 on my network ...
Diamond D's user avatar
0 votes
1 answer
61 views

The ipa-replica-install command failed, exception: ScriptError: A replication agreement for this host already exists

We have deployed a FreeIPA server in my company and we would like to deploy a replica. I have followed the procedure to deploy it on a personal server and it worked (https://www.freeipa.org/page/V4/...
NotBeCursed's user avatar
0 votes
1 answer
45 views

getent and id do not agree for freeipa user

I have a freeipa server with users which have different uid and gid. For example, I have user alice with uid 1024 and gid 1026. User bob has uid 1026 and gid 1028. Yes, confusing, but that's how I ...
laolux's user avatar
  • 121
0 votes
0 answers
220 views

FreeIPA, Keycloak and Radius with OTP used for Wifi, VPN and Docker registry auth result in logging in hell

we have configured our infrastructure to use FreeIPA for user database, keycloak as SSO auth and Radius as auth proxy. We use everywhere password + OTP policy. We have several apps connected to ...
Broskev's user avatar
  • 37
0 votes
1 answer
107 views

Is there a good way to transfer a DNS Zone from a bind9 server to a new domain with the same name running on freeIPA? [zone to ldif]

I'm working within a company network that has DNS servers but did not have an actual Domain. After installing a FreeIPA server and setting up the domain (same name as the DNS zone in the bind9 DNS ...
Alexander Wryn's user avatar
0 votes
0 answers
113 views

FreeIPA fails to deploy in kubernetes due to dbus error

I'm facing issues with deploying FreeIPA in kubernetes. I'm using provided image based on rocky 9, but this issue also happens on other images (based on fedora, CentOS etc.). Deploying it my local ...
Art's user avatar
  • 1
0 votes
0 answers
105 views

FreeIPA replica - unable to login via web UI

I've installed a freeipa replica (almalinux-8-4.9.12) from my master (centos-7-4.6.8). Both running in docker. On web UI login I get Login failed due to an unknown reason. error. And any ipa command ...
Dimuk91's user avatar
0 votes
0 answers
32 views

assign appliance.local to appliance.mydomain.com

I have an appliance that uses mdns to handle accessing of iot devices and plugins. when you click on add a plugin it goes to appliance.local to add that plugin to the system. As far as I can tell it ...
Kendrick's user avatar
  • 303
0 votes
0 answers
69 views

Free ipa errors when using SAN in certificate request

When I try to sign a CSR for a device and include the SAN ip attribute it errors with the following. ERROR: invalid 'csr': IP address in subjectAltName (x.x.x.x) unreachable from DNS names my IPA ...
Kendrick's user avatar
  • 303
0 votes
1 answer
302 views

freeipa server home directory automount

I have installed freeipa-server on centos and enrolled an ubuntu server to it, I have a freebsd server which is our storage server(I am going to enrolled the freebsd (storage server) to this freeipa-...
AAB's user avatar
  • 13
1 vote
1 answer
174 views

How do I make clients use a FreeIPA replica

I've got a setup with a primary and replica FreeIPA server and a number of clients. When taking the primary server down briefly for an OS upgrades, everything became really slow. To simulate this, I ...
okapi's user avatar
  • 152
0 votes
1 answer
147 views

kinit fails on freeipa master: File or directory not found

An upgrade from Fedora 36 to Fedora 38 has completely broken Kerberos authentication in our Freeipa realm. kinit <username> fails for every user but our domain admin. Hosts can't authenticate ...
cybertschunk's user avatar
1 vote
1 answer
275 views

FreeIPA subject name encoding mismatch when renewing certificate

When reading this question and answer, it seems this should be possible but I need a little more help understanding the answer. Is there a way to change the string format for an existing CSR "...
Sapg's user avatar
  • 11
0 votes
1 answer
830 views

Install FreeIPA on Amazon Linux 2023

The goal is to install "freeipa" on Amazon Linux 2023 AMI. Amazon Linux 2023 doesn't officially support the package by default, due to this AMI is made of Fedora 34, 35, 36, and CentOS 9 ...
Igor Ferretti's user avatar
1 vote
1 answer
430 views

FreeIPA SSH keys not working with Ubuntu

I have FreeIPA setup and its working fine so far with Centos7, Rocky8 and Rocky 9 machines. Users can SSH into machines using their SSH keys. Yesterday I added a Ubuntu machine and it wont let me SSH ...
Tipex's user avatar
  • 81
0 votes
1 answer
413 views

FreeIPA on Amazon Linux 2023

I want to install the FreeIPA client on Amazon Linux 2023. Unfortunately, Amazon Linux 2023 doesn't officially support the package. As a workaround I installed the Fedora repositories and managed to ...
Michael Angel P.'s user avatar
0 votes
1 answer
1k views

Refresh kerberos ticket instead of prompting for pam password

Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
dmgeurts's user avatar
0 votes
0 answers
456 views

Load Balancer for LDAP(S)

I have created a load balancer in the cloud with backend servers running FreeIPA. When I try to run: $ ldapsearch -x -H ldap:<IP-ADDRESS> -b "dc=example,dc=com ldap_sasl_bind(SIMPLE): Can't ...
N. J's user avatar
  • 125
0 votes
1 answer
120 views

Do I need pkinit for FreeIPA replicas to work?

I'm setting up FreeIPA servers using the ansible_freeipa collection role: ipa-server. I see there's an option for ipaserver_no_pkinit:. As far as I know it do not really need any pkinit, as I'll only ...
N. J's user avatar
  • 125
0 votes
1 answer
636 views

sssd.service restarting every 1 minute 50 seconds

I have 5 workstations that have been joined to a freeipa domain. I've noticed some weird authentication related issues on 3 of the workstations. I've discovered that all 3 workstations will restart ...
dutsnekcirf's user avatar
1 vote
1 answer
250 views

FreeIPA authentication issues across high latency link?

We recently setup a FreeIPA server. We're using it for central user management, DNS, and CA. It's been working great with one exception. Some of the workstations that authenticate with this FreeIPA ...
dutsnekcirf's user avatar
1 vote
1 answer
664 views

FreeIPA only as ldap server

I want to try setup FreeIPA in my home lab, but I do not want any more additonal stuff like, Certificates and DNS. I just want the IPA to work as a LDAP server. Does the FreeIPA installation support ...
N. J's user avatar
  • 125
0 votes
0 answers
80 views

DNS resolution using a VM under libvirt

I have a Fedora 36 laptop with libvirt configured and run free-IPA server, based on CentOS 8 as a virtual machine. The IP address of this IPA server is 192.168.122.20 and my host laptop has an IP ...
hypersonics's user avatar
1 vote
1 answer
1k views

FreeIPA import hashed passwords or sync with another ldap

We want to setup FreeIPA to work with our legacy user management system, we can output an ldif file and alter it into a FreeIPA compatible format and import it. Everything works nicely except for the ...
Michael Angel P.'s user avatar
0 votes
1 answer
344 views

Migrate LDAP records to FreeIPA and populate POSIX

We have a legacy application that we manage the employees, this application connects to an ApacheDS and provides LDAP authentication trough it. Now we want to implement FreeIPA but not as the source ...
Michael Angel P.'s user avatar
1 vote
2 answers
651 views

Setup SSH-Jumphost | Proxyjump with freeIPA and Kerberos-Tickets

I want to setup a bastion (ssh jumphost) to access the network behind a firewall. Both server are in a freeIPA domain. The client is a user machine and is not part of the IPA domain. Internet/client —&...
rbn_hln's user avatar
  • 11
0 votes
0 answers
1k views

How do I sync users and passwords from active directory to FreeIPA?

So I have an active directory domain, call it foo.com. Two server 2019 servers as DCs. I'm trying to move away from windows, to FreeIPA. I have a handful of users who login to a webmail server, ...
Dan Swartzendruber's user avatar
0 votes
1 answer
3k views

FreeIPA and Kerberos [Cannot contact any KDC for realm while getting initial credentials]

I hope this is the correct forum to ask. We run a cluster (Centos 7) using FreeIPA for account management. On Sunday the IPA server suddenly restarted and since then, users are no longer able to login ...
Yannick's user avatar
0 votes
0 answers
133 views

pam-auth-update update of /etc/pam.d/common-auth doesn't work

I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that ...
dmgeurts's user avatar
1 vote
1 answer
132 views

FreeIPA migrate the current NFSv4 storing home directories to another server

I have a FreeIPA set-up that uses NFSv4 to store users' home directories. NFS is running on the same physical server as the FreeIPA. CentOS btw. I'd like to move the NFS server on a new machine and ...
lolz's user avatar
  • 11
2 votes
1 answer
420 views

Cross realm constrained delegation

I have Red Hat IdM on RHEL8 with a two-way trust to AD on Windows 2019. What currently works: Constrained delegation for NFS clients. NFS clients can impersonate users from the IdM realm (gssproxy). ...
KrisVandenbergh's user avatar
0 votes
1 answer
261 views

Setting cgroup limits to all users in network

I have a FreeIPA user authentication set up. There are many users in the system already, along with many host systems (configured IPA clients). I want to set up cgroup restrictions on the tasks these ...
Avneesh Mishra's user avatar
1 vote
1 answer
2k views

Could not find imported module support code for freeipa.ansible_freeipa.ipaclient_test

My ansible controller is running on a Rocky 8.5 machine with the ansible-freeipa version 0.3.8-1.el8 rpm package installed. ansible 2.9.27 config file = /etc/ansible/ansible.cfg configured module ...
dutsnekcirf's user avatar
2 votes
1 answer
2k views

Freeipa web interface behind HAProxy

I am trying to configure the FreeIPA web interface to work behind my HAProxy instance. I found an old GitHub Gist for the configuration (https://gist.github.com/m4ce/d081ab39654c3e13bbe8b150986526a3) ...
Computroniks's user avatar
0 votes
1 answer
800 views

Kerberos credentials not renewed on ipa ubuntu client

When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
YuvGM's user avatar
  • 153
3 votes
1 answer
1k views

Extremely slow NFS openat performance

I've installed an NFS server on Ubuntu 20.04 and a FreeIPA Ubuntu 20.04 client with the users home directories served by the NFS server. Performance is extremely slow when accessing files. When I ...
YuvGM's user avatar
  • 153
0 votes
1 answer
147 views

How to get Gravitee to do recursive group lookups

I have set up Gravitee APIM 3x (gateway, rest-api, console and portal). This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the ...
Mogget's user avatar
  • 111
0 votes
2 answers
149 views

Putting .k5login credentials in ldap with freeipa

On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data. By using a .k5login file in home directories, it is ...
okapi's user avatar
  • 152
1 vote
0 answers
722 views

NFS stale file handle for regular user but not root

I've installed freeipa container on a Ubuntu server and an NFS server on the server itself. When I mount the NFS directory on a client machine or even the server itself, I can view the mounted ...
YuvGM's user avatar
  • 153
1 vote
0 answers
334 views

Indirect Group Membership with Keycloak and oauth2-proxy

I'm using oauth2-proxy/oauth2-proxy with Keycloak-oidc provider for authentication for some pods in my Kubernetes cluster. I can specify which groups are allowed to access a resource using the --...
cclloyd's user avatar
  • 613
0 votes
1 answer
2k views

FreeIPA not resolving itself

I plan on using FreeIPA as my authoritative DNS server for my network. All other records resolve just fine, however, FreeIPA is not resolving itself. Running dig ipa-hermes.lan.example.com yields no ...
cclloyd's user avatar
  • 613
0 votes
0 answers
699 views

How are external url's resolved by FreeIPA?

We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP ...
Bob C.'s user avatar
  • 75
0 votes
0 answers
617 views

Login loop for FreeIPA users

I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their ...
jerrb's user avatar
  • 1
0 votes
1 answer
3k views

FreeIPA: External DNS requests (google etc.) fail for clients on new subnet

I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both ...
crazzyfool's user avatar
1 vote
0 answers
383 views

Temporarily disable minimum password time in FreeIPA after password reset by support

We use FreeIPA 4.6.8 and we have users that of course forget their passwords. However, password policy has a minimum password time of 1 hour. When support resets their password for them and provides ...
Foghorn's user avatar
  • 123
1 vote
0 answers
256 views

freeipa Cannot obtain CA certificate error via ansible

I am trying to install my freeipa replica server via ansible role and I have this error: File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 1858, in get_ca_certs ...
Çiçek Adam's user avatar
0 votes
1 answer
129 views

Deleted Group in FreeIPA Still Comes Up

I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete. I go into "User Groups" in FreeIPA GUI and delete the ...
KingFish's user avatar
  • 125
1 vote
0 answers
1k views

How should we automount home directories stored at different NFS paths at /home/$USER?

We're currently transitioning to storing all of our organization's user information in Red Hat IDM (FreeIPA). We have several thousand users, and mount user home directories over NFS from a NetApp ...
neUrONDf's user avatar

1
2 3 4 5