Questions tagged [freeipa]
FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.
239
questions
0
votes
0
answers
638
views
How are external url's resolved by FreeIPA?
We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP ...
0
votes
0
answers
578
views
Login loop for FreeIPA users
I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their ...
4
votes
4
answers
35k
views
How to reset Keytab for FreeIPA Server and Client
I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively.
I then added a user 'X' to FreeIPA using Web UI.
Now when i try to SSH as X to CLT, i ...
0
votes
1
answer
2k
views
FreeIPA: External DNS requests (google etc.) fail for clients on new subnet
I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both ...
1
vote
0
answers
344
views
Temporarily disable minimum password time in FreeIPA after password reset by support
We use FreeIPA 4.6.8 and we have users that of course forget their passwords. However, password policy has a minimum password time of 1 hour. When support resets their password for them and provides ...
1
vote
1
answer
600
views
How to Configure freeIPA to host external DNS Zone
Is it possible to use freeIPA DNS servers to host an external DNS zone that will resolve records for external clients without exposing the internal zones and records?
I need to host SPF and DKIM ...
1
vote
0
answers
230
views
freeipa Cannot obtain CA certificate error via ansible
I am trying to install my freeipa replica server via ansible role and I have this error:
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 1858, in get_ca_certs
...
0
votes
1
answer
102
views
Deleted Group in FreeIPA Still Comes Up
I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete.
I go into "User Groups" in FreeIPA GUI and delete the ...
5
votes
2
answers
10k
views
how to export all FreeIPA users list to a csv format?
How can export all FreeIPA users to a csv file?
1
vote
2
answers
1k
views
FreeIPA refuses to sign a VMWare certificate signing request (CSR)
I'm attempting to make VMWare's certificate authority (VMCA) v6.7 a trusted sub-CA of a FreeIPA certificate authority. I should be able to generate a certificate signing request within VMCA using ...
1
vote
0
answers
1k
views
How should we automount home directories stored at different NFS paths at /home/$USER?
We're currently transitioning to storing all of our organization's user information in Red Hat IDM (FreeIPA). We have several thousand users, and mount user home directories over NFS from a NetApp ...
4
votes
0
answers
618
views
How do I add an entryUUID field to the FreeIPA compat schema?
I am trying to add an entryUUID field to groups in the FreeIPA compat schema, but I am struggling to create the required attributeType. My LDIF for creating it is:
dn: cn=schema
changetype: modify
add:...
1
vote
0
answers
952
views
Linking authentication FreeIPA and SSO
Long story short, my goal is to have all user permissions managed in one place and then deployed everywhere. My thoughts are that Active Directory/FreeIPA is perfect for this sort of thing. It also ...
0
votes
1
answer
474
views
FreeIPA - ssh as root prompted for password
I know the access via root won't work (client sshd_config and restricted account in FreeIPA). But is there a way to blacklist root either on the host or on FreeIPA so it's denied immediately rather ...
0
votes
1
answer
885
views
is it possible to set default home-directory based on the users gidnumber?
I'm aware that I can change the general settings by running:
ipa config-mod --homedirectory=/some/path
what I would like to achieve is for IPA to change it to a different path based on the GID/...
1
vote
0
answers
344
views
FreeRADIUS cannot bind to FreeIPA
I have installed FreeRADIUS and FreeIPA on the same machine running Fedora 33. IPA is working as expected and can have clients join and authenticate. LDAP command line tools (ldapsearch, ldapmodify) ...
0
votes
1
answer
1k
views
FreeIPA access from internet if dc=domain,dc=local (freeipa.domain.local)
I installed FreeIPA, here is my etc/ipa/default.conf file
[global]
host = freeipa.domain.local
basedn = dc=domain,dc=local
realm = domain.LOCAL
domain = domain.local
xmlrpc_uri = https://freeipa....
0
votes
1
answer
814
views
Implementing LDAP with Public IP
I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos).
The problem is my servers (Ubuntu) running as public cloud with no private interface ...
5
votes
3
answers
4k
views
FreeIPA without web UI or change of ports
Can I install FreeIPA server without httpd (without web UI)??
Or at least can I change the ports?? (80->8880 and 443->8443)
0
votes
1
answer
494
views
Restrict web access on apache web server to FreeIPA users
We have an apache web server installed on a Centos 8 machine which is been used to easily expose user and group folders both internally and to other collaborators.
Most of the data exposed is plain ...
0
votes
1
answer
3k
views
FreeIPA Forward Zones not working
I have a few replica of FreeIPA 4.6.4 running. I'm trying to forward request for another DNS domain to their DNS server. dig/nslookup to the forwarder works, but queries to FreeIPA returns NXDOMAIN
...
0
votes
1
answer
3k
views
ubuntu ignores default_ccache_name
I'm having trouble with Kerberos and Ubuntu 20.04.
Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue.
The big goal is to have a SSO System, for ...
2
votes
0
answers
1k
views
FreeIPA - Login failed due to an unknown reason - SSL certificate: unable to get local issuer certificate
I believe my FreeIPA instance has a certificate issue, which manifests in the "Login failed due to an unknown reason" error on the web ui. This seems to be really close to the issue ...
0
votes
1
answer
2k
views
ipa-server installation failed
facing a problem when install ipa-server .
the problem is :
Configured /etc/sssd/sssd.conf
trying https://ipa.cse.local/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://ipa.cse.local/ipa/...
3
votes
1
answer
1k
views
NFS/krb5 authentication server lookup fails due to wrong principal name
When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server.
LOOKING_UP_SERVER: ... host/[email protected] ...
0
votes
1
answer
1k
views
How to find IPA user creation date?
Command ipa user-show $user -all doesn't show what I have described in title.
Do you have any ideas?
0
votes
0
answers
439
views
Signing CSR from user by sub CA using FreeIPA
There is a CSR from user with O=test_org, CN=test. It is necessary to sign it with CA test in FreeIPA. I do it by following command:
ipa cert-request test-client.csr --ca=ca-name --certificate-out=...
1
vote
2
answers
7k
views
ldapsearch to exclude disabled users from the user list
I am using FreeIPA for Identity access management, i have to provide an active user list (audit requirement). I am using a ldapsearch but i am getting all the user (active+disabled) in the list. ...
0
votes
0
answers
43
views
Centos OS7 not receiving user context from FreeIPA
Hopefully there is something simple I am missing here.
I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems.
SELinux is in permissive mode. Logins on the Centos 6 system ...
1
vote
1
answer
3k
views
FreeIPA : new/existing accounts expired when ssh'ing into replica
I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
0
votes
1
answer
748
views
FreeIpa. How to setup specific shell only on 1 host for group of users
I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
1
vote
0
answers
2k
views
FreeIPA Server Install with external CA
I am tasked with building a FreeIPA server to help us manage TLS certificates to support Nginx, Postgres and RabbitMQ. I have never worked with certs from an admin perspective so I may be making some ...
0
votes
1
answer
158
views
How do I add dot-slash (./) as a sudo command rule in FreeIPA?
I can't run scripts using dot-slash, because I don't know how to add it as a sudo command rule in FreeIPA. Users are not allowed to it.
./myscript.sh
How can add ./ as rule in FreeIPA like any other ...
0
votes
1
answer
1k
views
FreeIPA ssh auth not working remotle with .k5login file
I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem:
root@gwhost:~# ssh user@freeipa01
user@freeipa01's ...
3
votes
1
answer
2k
views
IPA server NFS services adding issue centos 7.2
I'm having an issue with adding NFS services to IPA server (after login to the IPA server and kinit admin). When I execute the line below:
[root@ipa ~]# ipa service-add nfs/server1.example.com
I'm ...
3
votes
0
answers
2k
views
DNSSEC for private internal sub zones of an external domain
Consider the following scenario:
example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com.
Inside the company we have some internal ...
0
votes
1
answer
416
views
FreeIPA host with dynamic IP
I'm trying to logon to Windows with FreeIPA User. Everything went fine when i created IPA host with specific ---ip-address but what if my host(windows machine) do not have static IP? i know after ...
0
votes
1
answer
973
views
What are the drawbacks/issues when having REALM and DOMAIN with different names in FreeIPA?
I have been trying to configure a FreeIPA server for learning purposes and to have centralised access to all my self-hosted services for me and my family/friends. I started with this tutorial where ...
0
votes
1
answer
211
views
FreeIPA on RPi3 Kerberos5 timeout
I pulled a magic trick from a hat.
I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B.
It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
0
votes
1
answer
2k
views
How does ipa-client know when IPA Fail Over occurs during Multi Master setup?
I have setup a multi-master IPA and it seems to be working fine.
So it seems like for this kind of a setup, we don't need to mention the --server option and only the --domain option should work fine. ...
1
vote
0
answers
783
views
NetworkError: cannot connect to 'ldap://ipa.myserver.net:389' during install of FreeIPA
Problem: When trying to install FreeIPA (Version 4.6.5) the installation breaks when trying to connect to the ldap server:
[36/44]: adding entries for topology management
[37/44]: initializing ...
0
votes
1
answer
3k
views
Installing FreeIPA with DNS -- NetworkError: cannot connect to 'ldap://labipa.example.com:389'
Environment I'm using:
Red Hat Enterprise Linux 7.4
Virtualbox
I've installed all the required packages:
yum -y install ipa-server bind-dyndb-ldap ipa-server-dns
Added the following in my /etc/...
1
vote
2
answers
2k
views
FreeIPA Installation Failing During CA Restart
I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
0
votes
1
answer
1k
views
User cannot access host after password reset in freeipa
Password of a user was expired and it was reset after the expiration in freeipa web.
The user gets channel 0: open failed: administratively prohibited: open failed
stdio forwarding failed error and ...
0
votes
2
answers
310
views
How to configure Apache2 to use dogtag pki certificates
FreeIPA uses dogtag and NSS for PKI. Ubuntu and a lot of the world uses OpenSSL. I now have a pair of FreeIPA test servers replicating certificate functionality, and the single interface for ...
0
votes
1
answer
1k
views
ping resolves hostname but dig does not [closed]
I'm attempting to set up FreeIPA on a Centos KVM guest and one of the prerequisites is to make sure static hostname is set and that the hostname resolves to guest's IP address. My /etc/hosts file is ...
0
votes
1
answer
4k
views
How to set Base DN from FreeIPA to Crowd OpenLDAP directory?
In the Crowd's directory adding item, it can add OpenLDAP and must set Base DN in it.
However, how to find or set Base DN on the FreeIPA server?
Crowd:
FreeIPA:
If don't set the right data ...
1
vote
2
answers
2k
views
Have the Certificate Signing Request (CSR) signed by a Freeipa CA
We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too.
I started the installation of the subordinate CA with the ipa-server-install --external-ca ...
0
votes
0
answers
535
views
Removing Home Directory of Deleted Users in FreeIPA
Title says it. I tried looking up for documentation about how the home directory of a user can be removed after the end of its life cycle but there seems to be nothing. Is there any function in ...
1
vote
1
answer
2k
views
For FreeIPA autodiscovery to work, what SRV records must exist on the DNS server?
I've configured FreeIPA for the most part. When I attempt to add a client, I must manually specify the domain and IPA server FQDN. I've read many sources discussing autodiscovery, but I have yet to ...