Questions tagged [freeipa]
FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.
231
questions
0
votes
0
answers
13
views
FreeIPA on Amazon Linux 2023
I want to install the FreeIPA client on Amazon Linux 2023.
Unfortunately, Amazon Linux 2023 doesn't officially support the package.
As a workaround I installed the Fedora repositories and managed to ...
0
votes
1
answer
81
views
Refresh kerberos ticket instead of prompting for pam password
Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
- 13
0
votes
0
answers
125
views
Load Balancer for LDAP(S)
I have created a load balancer in the cloud with backend servers running FreeIPA.
When I try to run:
$ ldapsearch -x -H ldap:<IP-ADDRESS> -b "dc=example,dc=com
ldap_sasl_bind(SIMPLE): Can't ...
- 131
0
votes
0
answers
87
views
How to validate ssh keys in AWX running in Kubernetes?
Background
We use Ansible/AWX running in Kubernetes (awx-operator) to manage workstations with dynamic hostnames. Authentication is handled by Red Hat IDM (FreeIPA) and the same credentials are used ...
- 330
0
votes
1
answer
58
views
Do I need pkinit for FreeIPA replicas to work?
I'm setting up FreeIPA servers using the ansible_freeipa collection role: ipa-server.
I see there's an option for ipaserver_no_pkinit:. As far as I know it do not really need any pkinit, as I'll only ...
- 131
0
votes
1
answer
191
views
sssd.service restarting every 1 minute 50 seconds
I have 5 workstations that have been joined to a freeipa domain. I've noticed some weird authentication related issues on 3 of the workstations. I've discovered that all 3 workstations will restart ...
- 249
1
vote
1
answer
109
views
FreeIPA authentication issues across high latency link?
We recently setup a FreeIPA server. We're using it for central user management, DNS, and CA. It's been working great with one exception.
Some of the workstations that authenticate with this FreeIPA ...
- 249
1
vote
0
answers
33
views
SSSD versus direct ldap IPA
I'm trying to setup so my sudoers in nsswitch.conf is using sss and not ldap directly. However, when I try to switch this and run a sudo I get following error:
Error
userX is not allowed to run sudo ...
- 131
0
votes
0
answers
33
views
FreeIPA How to list servers enrolled?
I need to unenroll every server in FreeIPA and in order to due so I want a way to list every instance that is enrolled either using CLI or API.
Is this possible?
- 131
0
votes
1
answer
254
views
FreeIPA only as ldap server
I want to try setup FreeIPA in my home lab, but I do not want any more additonal stuff like, Certificates and DNS. I just want the IPA to work as a LDAP server.
Does the FreeIPA installation support ...
- 131
0
votes
0
answers
39
views
DNS resolution using a VM under libvirt
I have a Fedora 36 laptop with libvirt configured and run free-IPA server, based on CentOS 8 as a virtual machine. The IP address of this IPA server is 192.168.122.20 and my host laptop has an IP ...
- 223
1
vote
1
answer
491
views
FreeIPA import hashed passwords or sync with another ldap
We want to setup FreeIPA to work with our legacy user management system, we can output an ldif file and alter it into a FreeIPA compatible format and import it. Everything works nicely except for the ...
0
votes
1
answer
154
views
Migrate LDAP records to FreeIPA and populate POSIX
We have a legacy application that we manage the employees, this application connects to an ApacheDS and provides LDAP authentication trough it. Now we want to implement FreeIPA but not as the source ...
0
votes
0
answers
568
views
Setup mail server in Docker with FreeIPA and Roundcube
I try to setup my own mail server with authentication against a Ldap(FreeIPA). All of them must running within a docker container. I don't know what I'm doing wrong. Maybe it's my ldap configuration.
...
- 101
1
vote
2
answers
411
views
Setup SSH-Jumphost | Proxyjump with freeIPA and Kerberos-Tickets
I want to setup a bastion (ssh jumphost) to access the network behind a firewall. Both server are in a freeIPA domain. The client is a user machine and is not part of the IPA domain.
Internet/client —&...
- 11
0
votes
0
answers
63
views
Changing permissions for anonymous bind requests?
I have a webmail server (roundcube) on CentOS 7. It's enrolled with a freeipa server, and authentication for email/ssh/etc using sssd is working perfectly. The issue: I have only a few users, so for ...
0
votes
0
answers
597
views
How do I sync users and passwords from active directory to FreeIPA?
So I have an active directory domain, call it foo.com. Two server 2019 servers as DCs. I'm trying to move away from windows, to FreeIPA. I have a handful of users who login to a webmail server, ...
0
votes
1
answer
2k
views
FreeIPA and Kerberos [Cannot contact any KDC for realm while getting initial credentials]
I hope this is the correct forum to ask.
We run a cluster (Centos 7) using FreeIPA for account management. On Sunday the IPA server suddenly restarted and since then, users are no longer able to login ...
- 1
0
votes
0
answers
105
views
pam-auth-update update of /etc/pam.d/common-auth doesn't work
I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that ...
- 13
1
vote
1
answer
93
views
FreeIPA migrate the current NFSv4 storing home directories to another server
I have a FreeIPA set-up that uses NFSv4 to store users' home directories. NFS is running on the same physical server as the FreeIPA. CentOS btw. I'd like to move the NFS server on a new machine and ...
- 11
2
votes
1
answer
335
views
Cross realm constrained delegation
I have Red Hat IdM on RHEL8 with a two-way trust to AD on Windows 2019.
What currently works:
Constrained delegation for NFS clients. NFS clients can impersonate users from the IdM realm (gssproxy).
...
0
votes
1
answer
168
views
Setting cgroup limits to all users in network
I have a FreeIPA user authentication set up. There are many users in the system already, along with many host systems (configured IPA clients). I want to set up cgroup restrictions on the tasks these ...
- 101
1
vote
1
answer
1k
views
Could not find imported module support code for freeipa.ansible_freeipa.ipaclient_test
My ansible controller is running on a Rocky 8.5 machine with the ansible-freeipa version 0.3.8-1.el8 rpm package installed.
ansible 2.9.27
config file = /etc/ansible/ansible.cfg
configured module ...
- 249
1
vote
1
answer
1k
views
Freeipa web interface behind HAProxy
I am trying to configure the FreeIPA web interface to work behind my HAProxy instance. I found an old GitHub Gist for the configuration (https://gist.github.com/m4ce/d081ab39654c3e13bbe8b150986526a3) ...
- 13
0
votes
1
answer
560
views
Kerberos credentials not renewed on ipa ubuntu client
When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
- 153
3
votes
1
answer
760
views
Extremely slow NFS openat performance
I've installed an NFS server on Ubuntu 20.04 and a FreeIPA Ubuntu 20.04 client with the users home directories served by the NFS server. Performance is extremely slow when accessing files. When I ...
- 153
0
votes
1
answer
122
views
How to get Gravitee to do recursive group lookups
I have set up Gravitee APIM 3x (gateway, rest-api, console and portal).
This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the ...
- 101
0
votes
2
answers
97
views
Putting .k5login credentials in ldap with freeipa
On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data.
By using a .k5login file in home directories, it is ...
- 140
1
vote
0
answers
432
views
NFS stale file handle for regular user but not root
I've installed freeipa container on a Ubuntu server and an NFS server on the server itself. When I mount the NFS directory on a client machine or even the server itself, I can view the mounted ...
- 153
1
vote
0
answers
258
views
Indirect Group Membership with Keycloak and oauth2-proxy
I'm using oauth2-proxy/oauth2-proxy with Keycloak-oidc provider for authentication for some pods in my Kubernetes cluster.
I can specify which groups are allowed to access a resource using the --...
- 593
0
votes
1
answer
885
views
FreeIPA not resolving itself
I plan on using FreeIPA as my authoritative DNS server for my network. All other records resolve just fine, however, FreeIPA is not resolving itself.
Running dig ipa-hermes.lan.example.com yields no ...
- 593
0
votes
0
answers
502
views
How are external url's resolved by FreeIPA?
We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP ...
- 75
0
votes
0
answers
433
views
Login loop for FreeIPA users
I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their ...
- 1
0
votes
1
answer
2k
views
FreeIPA: External DNS requests (google etc.) fail for clients on new subnet
I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both ...
- 11
1
vote
0
answers
286
views
Temporarily disable minimum password time in FreeIPA after password reset by support
We use FreeIPA 4.6.8 and we have users that of course forget their passwords. However, password policy has a minimum password time of 1 hour. When support resets their password for them and provides ...
- 123
1
vote
0
answers
163
views
freeipa Cannot obtain CA certificate error via ansible
I am trying to install my freeipa replica server via ansible role and I have this error:
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 1858, in get_ca_certs
...
- 33
0
votes
1
answer
72
views
Deleted Group in FreeIPA Still Comes Up
I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete.
I go into "User Groups" in FreeIPA GUI and delete the ...
- 125
1
vote
0
answers
837
views
How should we automount home directories stored at different NFS paths at /home/$USER?
We're currently transitioning to storing all of our organization's user information in Red Hat IDM (FreeIPA). We have several thousand users, and mount user home directories over NFS from a NetApp ...
- 11
1
vote
0
answers
806
views
Linking authentication FreeIPA and SSO
Long story short, my goal is to have all user permissions managed in one place and then deployed everywhere. My thoughts are that Active Directory/FreeIPA is perfect for this sort of thing. It also ...
0
votes
1
answer
394
views
FreeIPA - ssh as root prompted for password
I know the access via root won't work (client sshd_config and restricted account in FreeIPA). But is there a way to blacklist root either on the host or on FreeIPA so it's denied immediately rather ...
- 13
0
votes
1
answer
621
views
is it possible to set default home-directory based on the users gidnumber?
I'm aware that I can change the general settings by running:
ipa config-mod --homedirectory=/some/path
what I would like to achieve is for IPA to change it to a different path based on the GID/...
- 11
1
vote
0
answers
303
views
FreeRADIUS cannot bind to FreeIPA
I have installed FreeRADIUS and FreeIPA on the same machine running Fedora 33. IPA is working as expected and can have clients join and authenticate. LDAP command line tools (ldapsearch, ldapmodify) ...
- 11
4
votes
0
answers
536
views
How do I add an entryUUID field to the FreeIPA compat schema?
I am trying to add an entryUUID field to groups in the FreeIPA compat schema, but I am struggling to create the required attributeType. My LDIF for creating it is:
dn: cn=schema
changetype: modify
add:...
- 101
0
votes
1
answer
681
views
Implementing LDAP with Public IP
I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos).
The problem is my servers (Ubuntu) running as public cloud with no private interface ...
- 1
0
votes
1
answer
385
views
Restrict web access on apache web server to FreeIPA users
We have an apache web server installed on a Centos 8 machine which is been used to easily expose user and group folders both internally and to other collaborators.
Most of the data exposed is plain ...
- 23
1
vote
0
answers
741
views
Unable to add users from Keycloack on FreeIPA via LDAP although Keycloack host has permissions set in FreeIPA
I have the following setup:
FreeIPA 4.8.7 via docker (freeipa/freeipa-server:centos-8)
Keycloack 12.0.1
The FreeIPA users are in cn=users,cn=accounts,dc=freeipa,dc=example,dc=com
Keycloack DN: ...
- 111
0
votes
1
answer
2k
views
ubuntu ignores default_ccache_name
I'm having trouble with Kerberos and Ubuntu 20.04.
Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue.
The big goal is to have a SSO System, for ...
- 103
2
votes
0
answers
1k
views
FreeIPA - Login failed due to an unknown reason - SSL certificate: unable to get local issuer certificate
I believe my FreeIPA instance has a certificate issue, which manifests in the "Login failed due to an unknown reason" error on the web ui. This seems to be really close to the issue ...
- 21
0
votes
1
answer
2k
views
ipa-server installation failed
facing a problem when install ipa-server .
the problem is :
Configured /etc/sssd/sssd.conf
trying https://ipa.cse.local/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://ipa.cse.local/ipa/...
3
votes
1
answer
944
views
NFS/krb5 authentication server lookup fails due to wrong principal name
When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server.
LOOKING_UP_SERVER: ... host/[email protected] ...
- 31