Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

Filter by
Sorted by
Tagged with
3
votes
0answers
34 views

DNSSEC for private internal sub zones of an external domain

Consider the following scenario: example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com. Inside the company we have some internal ...
0
votes
1answer
27 views

FreeIPA host with dynamic IP

I'm trying to logon to Windows with FreeIPA User. Everything went fine when i created IPA host with specific ---ip-address but what if my host(windows machine) do not have static IP? i know after ...
0
votes
1answer
23 views

What are the drawbacks/issues when having REALM and DOMAIN with different names in FreeIPA?

I have been trying to configure a FreeIPA server for learning purposes and to have centralised access to all my self-hosted services for me and my family/friends. I started with this tutorial where ...
0
votes
2answers
433 views

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate ...
0
votes
1answer
72 views

FreeIPA on RPi3 Kerberos5 timeout

I pulled a magic trick from a hat. I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B. It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
0
votes
0answers
28 views

Why does ipa-client-install fail when downloading the CA cert

I want to setup centralized user management. First to grant access to Linux servers and later also to grant access to other services via LDAP. As i'm new to this, I did some research on Google and I ...
0
votes
0answers
31 views

How to connect LDAP server inside Vagrant from Apache Directory Studio?

Created an instance with Vagrantfile Vagrant.configure("2") do |config| config.vm.box = "centos/7" config.vm.define "node2" do |c| c.vm.hostname = "ipa.my.domain" c.vm.provider "...
0
votes
0answers
74 views

How to connect to LDAP server provided by FreeIPA from AWX?

Installed FreeIPA by yum install ipa-server bind-dyndb-ldap ipa-server-dns -y ipa-server-install --setup-dns On the FreeIPA server Add a new user ipa user-add test --password Search group ...
0
votes
0answers
37 views

How to access from one node to another one by ldapsearch on Vagrant?

Using vagrant created two nodes: node1 node2 Vagrantfile Vagrant.configure("2") do |config| config.vm.box = "centos/7" config.vm.define "node1" do |c| c.vm.hostname = "node1" c.vm....
0
votes
0answers
169 views

How to import ldif users into FreeIPA?

Maybe it needs two steps: Add users defined in the ldif file to OpenLDAP(Inside FreeIPA) Migrate those added users from OpenLDAP to IPA Current situation Setup FreeIPA server, initilized an admin ...
0
votes
0answers
30 views

NetworkError: cannot connect to 'ldap://ipa.myserver.net:389' during install of FreeIPA

Problem: When trying to install FreeIPA (Version 4.6.5) the installation breaks when trying to connect to the ldap server: [36/44]: adding entries for topology management [37/44]: initializing ...
0
votes
0answers
42 views

ipa-join from CentOS 8 Produces libcurl error / cannot join network

I am upgrading the servers on my network from CentOS 7 1908 to CentOS 8 1911. My server is using ipa-server v. 4.2.0-15 (CentOS 7) and my client is using ipa-server 4.8.0 (CentOS 8) When I try to ...
1
vote
0answers
39 views

What FreeIPA certificate profile is appropriate to issue a certificate for a VMWare VMCA instance?

This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, ...
1
vote
1answer
124 views

FreeIPA refuses to sign a VMWare certificate signing request (CSR)

I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using ...
0
votes
0answers
24 views

Is it possible to import group or role data from LDAP(FreeIPA) to Jenkins to use for its roles feature?

Jenkins has many roles features. If want to sync user data from LDAP(FreeIPA), even create group or role data in LDAP side, then can the data be used for Jenkins' roles feature? Are they the same?
0
votes
2answers
140 views

FreeIPA Installation Failing During CA Restart

I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
0
votes
2answers
50 views

How to configure Apache2 to use dogtag pki certificates

FreeIPA uses dogtag and NSS for PKI. Ubuntu and a lot of the world uses OpenSSL. I now have a pair of FreeIPA test servers replicating certificate functionality, and the single interface for ...
0
votes
1answer
65 views

User cannot access host after password reset in freeipa

Password of a user was expired and it was reset after the expiration in freeipa web. The user gets channel 0: open failed: administratively prohibited: open failed stdio forwarding failed error and ...
0
votes
1answer
49 views

ping resolves hostname but dig does not [closed]

I'm attempting to set up FreeIPA on a Centos KVM guest and one of the prerequisites is to make sure static hostname is set and that the hostname resolves to guest's IP address. My /etc/hosts file is ...
0
votes
0answers
17 views

for a 389 Directory Server, how can I verify I have the right Directory Manager password?

In FreeIPA, which includes 389 Directory Server, I'm trying to perform operations that require the Directory Manager's password. When first configuring the FreeIPA server instance, I may have recorded ...
0
votes
1answer
63 views

How to set Base DN from FreeIPA to Crowd OpenLDAP directory?

In the Crowd's directory adding item, it can add OpenLDAP and must set Base DN in it. However, how to find or set Base DN on the FreeIPA server? Crowd: FreeIPA: If don't set the right data ...
0
votes
0answers
25 views

FreeIPA: Inconsistent results if SSH'ing in versus “su -” ing to trusted AD user account

FreeIPA server v4.8.0, client v4.7.0. I'm finding that if I log into a FreeIPA client machine as root, then "su - user@ad.domain.com" (trusted AD domain user), "id" shows "user@ad.domain.com". ...
0
votes
1answer
176 views

For FreeIPA autodiscovery to work, what SRV records must exist on the DNS server?

I've configured FreeIPA for the most part. When I attempt to add a client, I must manually specify the domain and IPA server FQDN. I've read many sources discussing autodiscovery, but I have yet to ...
0
votes
1answer
118 views

Strange FreeRadius and Kerberos issue

Currently I am trying to get my FreeRadius server to talk to my FreeIPA server and through some Googling I discovered I need to have FreeRadius talk to Kerberos in order to do user look ups. So I make ...
0
votes
2answers
312 views

Have the Certificate Signing Request (CSR) signed by a Freeipa CA

We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too. I started the installation of the subordinate CA with the ipa-server-install --external-ca ...
0
votes
1answer
1k views

FreeIPA sudoers rule - how to add NOPASSWD for ALL commands (no prompt for password)

Using FreeIPA for sudoers rules and I am attempting to create what would be the same as standard sudoers line(s) of: user ALL=(ALL) NOPASSWD:ALL group ALL=(ALL) NOPASSWD:ALL to allow a specific user ...
0
votes
0answers
417 views

How to setup FreeIPA and FreeRadius for Cisco 4431 Integrated Services Router

I am trying to get my Cisco 4431 ISR to authenticate with FreeIPA, but Cisco devices only have an option to authenticate through Radius. So I am trying to get FreeRadius to talk to my FreeIPA for ...
0
votes
0answers
30 views

FreeIPA Allow Dictionary Passwords

When I try to set a password that contains a dictionary word for a user, it tells me dictionary words aren't allowed. How can I change the password policy to allow dictionary words?
0
votes
0answers
77 views

SuiteCRM FreeIPA authentication

I'm trying to get a SuiteCRM installation to authenticate against my freeIPA instance using their Unix logins. However, attempts to login produce authentication errors. Particularly, I'm a little ...
0
votes
0answers
8 views

Added Host in FreeIPA Doesn't Sync to Replica

I have a FreeIPA server with a replica. Adding a host to the replica is currently not syncing to the main FreeIPA server. User details modifications/password changes are working fine.
0
votes
0answers
70 views

FreeIPA with multiple domains not mapping ids correctly on NFS

I’ve got FreeIPA setup where I have multiple domains for client machines depending on their geography. For example, ca.example.com, and ny.example.com. I have a NFS server in nfs-server.ny.example....
0
votes
0answers
187 views

sssd cache preventing users from logging in

I use sssd to authenticate against RedHat IdM. Most of the time it works fine, but sometimes users become unable to log into hosts. We've found that, most of the time, what is required is that we stop ...
0
votes
1answer
177 views

<unknown client> for <unknown server>, Cannot decrypt ticket

After reinstalling FreeIPA server and client(s), one client refuses to authenticate. $ ipa user-find properly list users I can kinit user successfully. ipa server krb5krc.log krb5kdc[4425](info): ...
2
votes
1answer
2k views

Unable to log in to FreeIPA web ui - “Login failed due to an unknown reason.”

After Fedora server update, my Freeipa broke and I am not sure how to deal with it. Does anyone have some ideas what might be the issue? I am unable to log in to web UI nor execute any IPA command. $...
0
votes
0answers
26 views

Issues with DNS name resolution of different freeIPA masters DNS clients

I have two domains setup with two replicas. ipa1.wa.example.com ipa2.ny.example.com Servers pointing towards ipa1.wa.example.com as its DNS can ping servers in ipa1.wa.example.com via their short ...
0
votes
1answer
1k views

How do I list ALL IPA groups on Linux

I can get a list of groups on a linux server with the getent group command. However that only gives me local groups in the /etc/group file. The server is connected to IPA that is used to create ...
0
votes
1answer
215 views

FreeIPA Server Failing to Install Due to Encoding Failure

I'm trying to install FreeIPA server on a CentOS 7 node. Starting with a clean image, I am running the following code (some unrelated parts not included): echo 'LANG=en_US.utf-8' >> /...
0
votes
1answer
218 views

kpasswd not listening on port 464

I recently made a fresh install of FreeIPA (VERSION: 4.6.90.pre1+git20180411, API_VERSION: 2.229) on Ubuntu 18.04 LTS. Admin credentials work fine, I can log in to the web app just fine, creating ...
0
votes
1answer
100 views

FreeIPA 4.6.4 on CentOS 7 returns blank page on Firefox due to CSP

I have created a CentOS 7 droplet on DigitalOcean and installed and configured ipa-server 4.6.4 following DigitalOcean's how-to. Connecting from Firefox 67 gets a blank page; connecting from Chromium ...
0
votes
0answers
147 views

using FreeIPA sudo rules, `sudo --validate` never asks for a password

I have a system that is both a FreeIPA client and has local users. I have noted that the behavior of sudo --validate is different for users that are local or FreeIPA users, even given the same ...
0
votes
0answers
111 views

Removing Home Directory of Deleted Users in FreeIPA

Title says it. I tried looking up for documentation about how the home directory of a user can be removed after the end of its life cycle but there seems to be nothing. Is there any function in ...
0
votes
0answers
62 views

ansible freeipa atomic - how to deploy image with atomic modules via ansible

there are those ansible modules for atomic: https://docs.ansible.com/ansible/latest/modules/atomic_image_module.html https://docs.ansible.com/ansible/latest/modules/atomic_container_module.html i ...
1
vote
1answer
158 views

FreeIPA on Azure setup

I am trying to setup FreeIPA on Azure as 1 Server ---> 2 Clients without actually utilizing a domain name i.e. I want to use a fictitious domain name such as "example.azure.local" and still have the ...
0
votes
1answer
187 views

freeipa on subdomain - can't resolve A records

I just installed an freeipa server (with an master replica) for our infrastructure. For the freeipa domain I used an subdomain (of our real domain) e.g. "internal.foobar.com", and made two A records ...
1
vote
1answer
148 views

FreeIPA configuration on private network

We have an vpc setup on a private cloud provider (it looks like a cheap knock off of aws…) and I wanted to install freeipa for easier user management. I installed freeipa with its dns management (...
5
votes
1answer
432 views

How do I sign a new FreeIPA Server's internal CA with my organizational internal CA?

My organization has an internal Certificate Authority (CA) which we have already generated many internal certificates and have installed on machines. I am setting up a FreeIPA LDAP/Kerberos server ...
1
vote
1answer
77 views

FreeIPA Unable to establish trust with Active Directory

I am trying to establish a trust between FreeIPA and Active Directory. Details on the infrastructure: 3 x IPA Servers all with replication between eachother (CentOS 7) 3 x Domain Controllers for AD ...
1
vote
0answers
457 views

SSSD Default Domain Suffix no longer works

We have several EC-2 instances in an IPA domain with a trust relationship to our Active Directory Domain. On older instances ssh doesn't require the domain suffix from a Windows machine. But on newer ...
1
vote
1answer
311 views

Kerberos delegation with Apache, SSSD and FreeIPA

Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =) I am simply trying to make my web application obtain Kerberos credentials on behalf of ...
0
votes
1answer
1k views

Kerberos: mount.nfs: access denied by server while mounting

An IPA server providing DNS, NTP and Kerberos auth to two of my lab servers, when tried to mount a Kerberised NFS share, I am getting this error: mount.nfs: access denied by server while mounting ...