Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
638 views

How are external url's resolved by FreeIPA?

We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP ...
0 votes
0 answers
578 views

Login loop for FreeIPA users

I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their ...
4 votes
4 answers
35k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
0 votes
1 answer
2k views

FreeIPA: External DNS requests (google etc.) fail for clients on new subnet

I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both ...
1 vote
0 answers
344 views

Temporarily disable minimum password time in FreeIPA after password reset by support

We use FreeIPA 4.6.8 and we have users that of course forget their passwords. However, password policy has a minimum password time of 1 hour. When support resets their password for them and provides ...
1 vote
1 answer
600 views

How to Configure freeIPA to host external DNS Zone

Is it possible to use freeIPA DNS servers to host an external DNS zone that will resolve records for external clients without exposing the internal zones and records? I need to host SPF and DKIM ...
1 vote
0 answers
230 views

freeipa Cannot obtain CA certificate error via ansible

I am trying to install my freeipa replica server via ansible role and I have this error: File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 1858, in get_ca_certs ...
0 votes
1 answer
102 views

Deleted Group in FreeIPA Still Comes Up

I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete. I go into "User Groups" in FreeIPA GUI and delete the ...
5 votes
2 answers
10k views

how to export all FreeIPA users list to a csv format?

How can export all FreeIPA users to a csv file?
1 vote
2 answers
1k views

FreeIPA refuses to sign a VMWare certificate signing request (CSR)

I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using ...
1 vote
0 answers
1k views

How should we automount home directories stored at different NFS paths at /home/$USER?

We're currently transitioning to storing all of our organization's user information in Red Hat IDM (FreeIPA). We have several thousand users, and mount user home directories over NFS from a NetApp ...
4 votes
0 answers
618 views

How do I add an entryUUID field to the FreeIPA compat schema?

I am trying to add an entryUUID field to groups in the FreeIPA compat schema, but I am struggling to create the required attributeType. My LDIF for creating it is: dn: cn=schema changetype: modify add:...
1 vote
0 answers
952 views

Linking authentication FreeIPA and SSO

Long story short, my goal is to have all user permissions managed in one place and then deployed everywhere. My thoughts are that Active Directory/FreeIPA is perfect for this sort of thing. It also ...
0 votes
1 answer
474 views

FreeIPA - ssh as root prompted for password

I know the access via root won't work (client sshd_config and restricted account in FreeIPA). But is there a way to blacklist root either on the host or on FreeIPA so it's denied immediately rather ...
0 votes
1 answer
885 views

is it possible to set default home-directory based on the users gidnumber?

I'm aware that I can change the general settings by running: ipa config-mod --homedirectory=/some/path what I would like to achieve is for IPA to change it to a different path based on the GID/...
1 vote
0 answers
344 views

FreeRADIUS cannot bind to FreeIPA

I have installed FreeRADIUS and FreeIPA on the same machine running Fedora 33. IPA is working as expected and can have clients join and authenticate. LDAP command line tools (ldapsearch, ldapmodify) ...
0 votes
1 answer
1k views

FreeIPA access from internet if dc=domain,dc=local (freeipa.domain.local)

I installed FreeIPA, here is my etc/ipa/default.conf file [global] host = freeipa.domain.local basedn = dc=domain,dc=local realm = domain.LOCAL domain = domain.local xmlrpc_uri = https://freeipa....
0 votes
1 answer
814 views

Implementing LDAP with Public IP

I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos). The problem is my servers (Ubuntu) running as public cloud with no private interface ...
5 votes
3 answers
4k views

FreeIPA without web UI or change of ports

Can I install FreeIPA server without httpd (without web UI)?? Or at least can I change the ports?? (80->8880 and 443->8443)
0 votes
1 answer
494 views

Restrict web access on apache web server to FreeIPA users

We have an apache web server installed on a Centos 8 machine which is been used to easily expose user and group folders both internally and to other collaborators. Most of the data exposed is plain ...
0 votes
1 answer
3k views

FreeIPA Forward Zones not working

I have a few replica of FreeIPA 4.6.4 running. I'm trying to forward request for another DNS domain to their DNS server. dig/nslookup to the forwarder works, but queries to FreeIPA returns NXDOMAIN ...
0 votes
1 answer
3k views

ubuntu ignores default_ccache_name

I'm having trouble with Kerberos and Ubuntu 20.04. Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue. The big goal is to have a SSO System, for ...
2 votes
0 answers
1k views

FreeIPA - Login failed due to an unknown reason - SSL certificate: unable to get local issuer certificate

I believe my FreeIPA instance has a certificate issue, which manifests in the "Login failed due to an unknown reason" error on the web ui. This seems to be really close to the issue ...
0 votes
1 answer
2k views

ipa-server installation failed

facing a problem when install ipa-server . the problem is : Configured /etc/sssd/sssd.conf trying https://ipa.cse.local/ipa/json [try 1]: Forwarding 'schema' to json server 'https://ipa.cse.local/ipa/...
3 votes
1 answer
1k views

NFS/krb5 authentication server lookup fails due to wrong principal name

When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server. LOOKING_UP_SERVER: ... host/[email protected] ...
0 votes
1 answer
1k views

How to find IPA user creation date?

Command ipa user-show $user -all doesn't show what I have described in title. Do you have any ideas?
0 votes
0 answers
439 views

Signing CSR from user by sub CA using FreeIPA

There is a CSR from user with O=test_org, CN=test. It is necessary to sign it with CA test in FreeIPA. I do it by following command: ipa cert-request test-client.csr --ca=ca-name --certificate-out=...
1 vote
2 answers
7k views

ldapsearch to exclude disabled users from the user list

I am using FreeIPA for Identity access management, i have to provide an active user list (audit requirement). I am using a ldapsearch but i am getting all the user (active+disabled) in the list. ...
0 votes
0 answers
43 views

Centos OS7 not receiving user context from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
1 vote
1 answer
3k views

FreeIPA : new/existing accounts expired when ssh'ing into replica

I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
0 votes
1 answer
748 views

FreeIpa. How to setup specific shell only on 1 host for group of users

I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
1 vote
0 answers
2k views

FreeIPA Server Install with external CA

I am tasked with building a FreeIPA server to help us manage TLS certificates to support Nginx, Postgres and RabbitMQ. I have never worked with certs from an admin perspective so I may be making some ...
0 votes
1 answer
158 views

How do I add dot-slash (./) as a sudo command rule in FreeIPA?

I can't run scripts using dot-slash, because I don't know how to add it as a sudo command rule in FreeIPA. Users are not allowed to it. ./myscript.sh How can add ./ as rule in FreeIPA like any other ...
0 votes
1 answer
1k views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...
3 votes
1 answer
2k views

IPA server NFS services adding issue centos 7.2

I'm having an issue with adding NFS services to IPA server (after login to the IPA server and kinit admin). When I execute the line below: [root@ipa ~]# ipa service-add nfs/server1.example.com I'm ...
3 votes
0 answers
2k views

DNSSEC for private internal sub zones of an external domain

Consider the following scenario: example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com. Inside the company we have some internal ...
0 votes
1 answer
416 views

FreeIPA host with dynamic IP

I'm trying to logon to Windows with FreeIPA User. Everything went fine when i created IPA host with specific ---ip-address but what if my host(windows machine) do not have static IP? i know after ...
0 votes
1 answer
973 views

What are the drawbacks/issues when having REALM and DOMAIN with different names in FreeIPA?

I have been trying to configure a FreeIPA server for learning purposes and to have centralised access to all my self-hosted services for me and my family/friends. I started with this tutorial where ...
0 votes
1 answer
211 views

FreeIPA on RPi3 Kerberos5 timeout

I pulled a magic trick from a hat. I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B. It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
0 votes
1 answer
2k views

How does ipa-client know when IPA Fail Over occurs during Multi Master setup?

I have setup a multi-master IPA and it seems to be working fine. So it seems like for this kind of a setup, we don't need to mention the --server option and only the --domain option should work fine. ...
1 vote
0 answers
783 views

NetworkError: cannot connect to 'ldap://ipa.myserver.net:389' during install of FreeIPA

Problem: When trying to install FreeIPA (Version 4.6.5) the installation breaks when trying to connect to the ldap server: [36/44]: adding entries for topology management [37/44]: initializing ...
0 votes
1 answer
3k views

Installing FreeIPA with DNS -- NetworkError: cannot connect to 'ldap://labipa.example.com:389'

Environment I'm using: Red Hat Enterprise Linux 7.4 Virtualbox I've installed all the required packages: yum -y install ipa-server bind-dyndb-ldap ipa-server-dns Added the following in my /etc/...
1 vote
2 answers
2k views

FreeIPA Installation Failing During CA Restart

I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
0 votes
1 answer
1k views

User cannot access host after password reset in freeipa

Password of a user was expired and it was reset after the expiration in freeipa web. The user gets channel 0: open failed: administratively prohibited: open failed stdio forwarding failed error and ...
0 votes
2 answers
310 views

How to configure Apache2 to use dogtag pki certificates

FreeIPA uses dogtag and NSS for PKI. Ubuntu and a lot of the world uses OpenSSL. I now have a pair of FreeIPA test servers replicating certificate functionality, and the single interface for ...
0 votes
1 answer
1k views

ping resolves hostname but dig does not [closed]

I'm attempting to set up FreeIPA on a Centos KVM guest and one of the prerequisites is to make sure static hostname is set and that the hostname resolves to guest's IP address. My /etc/hosts file is ...
0 votes
1 answer
4k views

How to set Base DN from FreeIPA to Crowd OpenLDAP directory?

In the Crowd's directory adding item, it can add OpenLDAP and must set Base DN in it. However, how to find or set Base DN on the FreeIPA server? Crowd: FreeIPA: If don't set the right data ...
1 vote
2 answers
2k views

Have the Certificate Signing Request (CSR) signed by a Freeipa CA

We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too. I started the installation of the subordinate CA with the ipa-server-install --external-ca ...
0 votes
0 answers
535 views

Removing Home Directory of Deleted Users in FreeIPA

Title says it. I tried looking up for documentation about how the home directory of a user can be removed after the end of its life cycle but there seems to be nothing. Is there any function in ...
1 vote
1 answer
2k views

For FreeIPA autodiscovery to work, what SRV records must exist on the DNS server?

I've configured FreeIPA for the most part. When I attempt to add a client, I must manually specify the domain and IPA server FQDN. I've read many sources discussing autodiscovery, but I have yet to ...