Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

0
votes
1answer
21 views

FreeIPA Unable to establish trust with Active Directory

I am trying to establish a trust between FreeIPA and Active Directory. Details on the infrastructure: 3 x IPA Servers all with replication between eachother (CentOS 7) 3 x Domain Controllers for AD ...
0
votes
0answers
11 views

Clean Freeipa install but unable to browse certificates page

I have install a clean Freeipa server. We use it for DNS, automount and users authentication. [root@ipa01 ~]# ipa --version VERSION: 4.6.4, API_VERSION: 2.230 Everything is working just fine but ...
0
votes
0answers
16 views

Kerberized WebDAV Folder Ownership/Permissions

I am running a CentOS file server bound to an IPA domain (IPA master is a different machine). I have successfully configured Apache with Kerberized WebDAV on the file server and I am able to login ...
1
vote
0answers
64 views

SSSD Default Domain Suffix no longer works

We have several EC-2 instances in an IPA domain with a trust relationship to our Active Directory Domain. On older instances ssh doesn't require the domain suffix from a Windows machine. But on newer ...
0
votes
0answers
14 views

ubuntu 16.04 cannot start docker when userns is configured for IPA directory (non-local) user

We're using docker but want to implement userns to restrict root users in containers from having root access to the host (vm). However, on the ubuntu system, when we enable the userns setting in /etc/...
1
vote
1answer
79 views

Kerberos delegation with Apache, SSSD and FreeIPA

Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =) I am simply trying to make my web application obtain Kerberos credentials on behalf of ...
0
votes
1answer
243 views

Kerberos: mount.nfs: access denied by server while mounting

An IPA server providing DNS, NTP and Kerberos auth to two of my lab servers, when tried to mount a Kerberised NFS share, I am getting this error: mount.nfs: access denied by server while mounting ...
0
votes
1answer
113 views

Import own CA root certificate into Docker container

I use a FreeIPA server on a CentOS machine. It also works as a Certification Authority. A few HTTP services are running with certificates issued by FreeIPA and everything works well. I have another ...
0
votes
0answers
29 views

How to ensure client authentication work with 389 server with anonymous bind disabled?

While working on Internal PT for PCI DSS compliance, it flags that LDAP (389 server, FreeIPA) the anonymous bind is allowing listing list of user accounts. Many searches are leading to setting up ...
0
votes
1answer
19 views

Differences between two replication agreements in freeIPA

I am back from freeIPA replication documentation you can find here https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/ipa-replica-manage I totally ...
0
votes
0answers
35 views

Installing FreeIPA with Puppet unmanaged failing

Currently, I'm trying to use a Puppet module to install the FreeIPA client, and I'm getting an error with it. I resolved the errors I had about the class structure, and right now my class is as ...
3
votes
1answer
161 views

macOS High Sierra issues mounting Kerberized NFSv4 shares

I'm using FreeIPA for LDAP/Kerberos and I've created a principal for a storage appliance (Dell/EMC UnityVSA VM). I have setup the VSA with a keytab from IPA, I've also setup within the VSA the LDAP ...
0
votes
0answers
123 views

FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow

I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate. ...
1
vote
1answer
27 views

Client setting for FreeIPA Puppet module not working

I'm trying to use the FreeIPA Puppet module, and I copied the below module, changing the data to reflect my environment. class {'freeipa': ipa_role => 'client', domain ...
0
votes
1answer
79 views

Samba access with Redhat IdM authentication from a windows 10 workstation with AD authentication

I'm posting this here after spending the last 5 days searching google, going thru test cases as well as analyzing network traffic in the event that someone could either point me in the right direction ...
2
votes
0answers
22 views

How to ignore/discard AD groups in FreeIPA

I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, ...
1
vote
0answers
76 views

FreeIPA : new/existing accounts expired when ssh'ing into replica

I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
0
votes
2answers
440 views

FreeRADIUS with LDAP vs Kerberos

The following site discusses how to setup FreeRADIUS to authenticate against an LDAP backend (it goes through a tutorial showing how to expose NT hashed passwords in FreeIPA so that FreeRADIUS can ...
2
votes
1answer
118 views

How do I update my machine time when there is a local ntpd server reference in ntpd.conf

My FreeIPA server's datetime had drifted about 10 min causing login failures. The ntpd service was functioning up and running. I checked the configuration and noticed that freeIPA had added a local ...
0
votes
0answers
218 views

Restricting access to users/groups of NFS mount through FreeIPA

I setup a NFS mount through the following guide with FreeIPA. Short instructions on first post: Unable to mount kerberized nfs? Long instructions: https://access.redhat.com/documentation/en-us/...
0
votes
0answers
97 views

Enroll OS X 10.13 in FreeIPA

I'm trying to enroll a Macbook in FreeIPA on my home network. I went to System Preferences > Users & Groups > Join Network Account Server and entered freeipa.example.com. It succeeded in ...
1
vote
1answer
45 views

In a FreeIPA environment, how do I log in without specifying the domain name?

There are essentially two parts to this question. I have a FreeIPA domain example.com with a few Fedora domain members. On each of these domain members, I'm able to sign in as a domain user without ...
0
votes
1answer
89 views

SSH login timeout while checking private key (sss_ssh_authorizedkeys)

I am having this issue right now with 3 servers at least. When attempting to connect to the server via ssh with a private key with a specific user, it shows the welcome banner, takes almost two ...
0
votes
0answers
343 views

Failed to start FreeIPA pki-tomcatd Service

Not able to start pki-tomcatd on FreeIPA server Command Output [root@ipa01]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-...
0
votes
0answers
98 views

is it possible to create local accounts with freeipa?

I would like to know if there exists an option within freeipa to force the creation of local user accounts when user connects to some host and not only create /home/username folder. Some software ...
1
vote
1answer
239 views

FreeIPA - Please explain the enroll vs add host permission

I want to create a user in my FreeIPA domain that will be able to automatically add and delete a host created (or deleted) by Foreman. I found 2 permissions: "System: Add Host" and "System: Enroll a ...
1
vote
0answers
793 views

how to export all FreeIPA users list to a csv format?

How can export all FreeIPA users to a csv file?
0
votes
0answers
102 views

kerberos issue after installing freeipa

I tried installing freeipa on centos 7. I have modified the /etc/krb5.conf file to mention the realm details e.g. IPA.TESTDOMAIN.COM (valid domain). However, running kinit admin does not work - ...
0
votes
0answers
615 views

FreeIPA server installation failing on Debian 9 due to CA_UNREACHABLE

I've been trying to install FreeIPA server on a Debian 9 to handle centralised authentication (among a couple of other things) for a team of about 40 people. We're using Debian to make centralised ...
1
vote
0answers
150 views

kerberos setup with freeipa installation

I tried installing freeipa on ubuntu v16 (cloud server) using the following: modified /etc/host to use the private IP address of the virtual machine and the corresponding host (the A name has ...
0
votes
0answers
61 views

/etc/hosts and /etc/hostname for FreeIPA on EC2

I'm having issues on what to define on the following files: /etc/hosts /etc/hostname The hostname contains the private hostname, while the hosts contains both mapping of the private and public IP. I'...
0
votes
1answer
248 views

FreeIPA DNS issues with AWS

I seem to be having an issue with DNS setup with split horizon/views in R53. We want to be able to get a copy of the internal zone from R53 from my local FreeIPA servers. Is this possible? I have ...
0
votes
1answer
191 views

Why both userPassword and krbPrincipalKey

When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the ...
0
votes
1answer
94 views

Why does ipa-getkeytab fail on samba server?

I am not a systems person, please forgive my lack of knowledge. I have set up FreeIPA 4.5 on Centos 7. I was able to successfully manage user login to a test server (Fedora 27). So, FreeIPA is "...
0
votes
0answers
525 views

FreeIPA broken replication

We have 3 IPA servers, ns01, ns02, ns03. Had some issues with ns03 about a month back and had to recreate the VM. We thought we had recreated and set it back up correctly however we discovered today ...
0
votes
0answers
141 views

VLANs, FreeIPA, and AD trust on different subnets - how do the computers see each another?

Let me preface this by saying I am completely unfamiliar with VLAN tagging. I understand the basic concept, but I lack any sort of real-world experience. I am looking into installing FreeIPA for a ...
1
vote
0answers
336 views

How to make authconfig-tui use sssd instead of nslcd?

I've read that redhat's going to deprecate nslcd, and sssd is the future. So, I was following a video that shows how to setup IPA clients using authconfig-tui. Yes, I'm aware that it's been deprecated,...
0
votes
1answer
76 views

Search for accented characters with regular characters in LDAP

I have a FreeIPA server in which some users' names (first and last) has accented characters (such as ī, ā, ū, ...). Is it possible to configure LDAP to search for these characters with regular ...
0
votes
1answer
1k views

Installing FreeIPA with DNS — NetworkError: cannot connect to 'ldap://labipa.example.com:389'

Environment I'm using: Red Hat Enterprise Linux 7.4 Virtualbox I've installed all the required packages: yum -y install ipa-server bind-dyndb-ldap ipa-server-dns Added the following in my /etc/...
0
votes
0answers
64 views

FreeIPA or similar with encrypted home for ubuntu?

I am new to sys-admin work. My objective is to setup a couple of computers with Ubuntu 16.04 which satisfy two objectives: home folders encrypted central authentication management Currently I am ...
0
votes
2answers
569 views

Cant delete SSSD cached user

Im testing a FreeIPA integration. One of the scenarios I'm trying is taking the server offline and making tests with the client, but I am facing an issue. I have logged in on the client with a newly ...
0
votes
1answer
3k views

Is Samba 4 a good alternative to FreeIPA?

Our goal is to set up one file server / print server on a small LAN. To solve file permissions issues and access issues we have encountered, we believe a type of LDAP solution should be part of this. ...
1
vote
1answer
464 views

How to set up a FreeIPA server on Arch Linux? [closed]

I am looking for instructions to set up a FreeIPA server on Arch Linux. Unfortunately, I am only seeing tutorials for setting up a FreeIPA server on RedHat or its derived distributions. (And I'm only ...
0
votes
1answer
248 views

How to disable null base queries on freeipa server

I am using FreeIpa server 4.5 on CentOS 7.4. Now I want to disable Null Base queries on Ipa server. Please help. how i can do it. Thanks.
1
vote
1answer
587 views

In FreeIPA, how do you add multiple external accounts to a group using the CLI?

I've tried multiple methods that don't appear to work, but I'm ultimately trying to add multiple external users to a non-POSIX group using the ipa group-add-member ... command. NOTE: These external ...
2
votes
0answers
957 views

All Free IPA clients unable to login

Environment: ~400 Servers enrolled in Prod IPA Prod IPA setup as Master/Master replication between two servers Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. ...
0
votes
1answer
722 views

sss_ssh_authorizedkeys returns error code 13 when called from sshd

I'm using a FreeIPA server configured with SSH keys added to users. I am trying to get servers to authenticate using the ssh keys from the IPA server, so I don't have to manage as many ...
0
votes
1answer
91 views

Freeipa krb credentials not destroyed, after logout from system via DM

When login to system (in IPA domain) via lightdm, kerberos credentials are automatically created. After logout, they are not destroyed. Steps for reproduse: Login to system via GUI as user. Logout. ...
2
votes
1answer
2k views

Problems connecting to a freeIPA client host via ssh

I am trying to set up an IPA environment with a CentOS 7.3 server and clients and I am experiencing a behavior that I am not able to understand. I am using IPA version 4.4.0. I was able to run ipa-...
1
vote
0answers
442 views

Issue with FreeIPA and Active Directory synchronisation

I'm trying to setup a FreeIPA and Active Directory synchronisation following Red Hat documentation. The ipa-replica-manage command returns a success but no user are imported in FreeIPA: [root@ipa ~]#...