Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

2
votes
1answer
1k views

IPA server NFS services adding issue centos 7.2

I'm having an issue with adding NFS services to IPA server (after login to the IPA server and kinit admin). When I execute the line below: [root@ipa ~]# ipa service-add nfs/server1.example.com I'm ...
1
vote
1answer
236 views

FreeIPA - Please explain the enroll vs add host permission

I want to create a user in my FreeIPA domain that will be able to automatically add and delete a host created (or deleted) by Foreman. I found 2 permissions: "System: Add Host" and "System: Enroll a ...
1
vote
1answer
54 views

Controlling access to VMware vCloud and OpenStack Nova Compute VMs using LDAP

We are thinking of using LDAP based Identity and Access Management setup with VMware vCloud and OpenStack Nova Compute VMs. VMware vCloud and OpenStack Nova Compute VMs are self-serve in that the end-...
1
vote
1answer
2k views

how to disable forwarder in freeipa servers named.conf

My IPA server's named.conf has this in it since I chose to enter a forwarder address during the ipa-server-install. forward first; forwarders { 132.206.44.21; 132.216.44....
1
vote
1answer
615 views

iptables: Allowing only established outgoing connections like DMZ

I want to simulate a DMZ like scenario where server1(inside DMZ, 10.1.1.0) should be able to respond to any incoming connection and cann't make a new outgoing connection on its own. I would ...
0
votes
1answer
18 views

Differences between two replication agreements in freeIPA

I am back from freeIPA replication documentation you can find here https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/ipa-replica-manage I totally ...
0
votes
1answer
241 views

FreeIPA DNS issues with AWS

I seem to be having an issue with DNS setup with split horizon/views in R53. We want to be able to get a copy of the internal zone from R53 from my local FreeIPA servers. Is this possible? I have ...
0
votes
1answer
191 views

Why both userPassword and krbPrincipalKey

When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the ...
0
votes
1answer
246 views

How to disable null base queries on freeipa server

I am using FreeIpa server 4.5 on CentOS 7.4. Now I want to disable Null Base queries on Ipa server. Please help. how i can do it. Thanks.
0
votes
1answer
720 views

sss_ssh_authorizedkeys returns error code 13 when called from sshd

I'm using a FreeIPA server configured with SSH keys added to users. I am trying to get servers to authenticate using the ssh keys from the IPA server, so I don't have to manage as many ...
0
votes
1answer
1k views

ldapserch to exclude disabled users from the user list

I am using FreeIPA for Identity access management, i have to provide an active user list (audit requirement). I am using a ldapsearch but i am getting all the user (active+disabled) in the list. ...
0
votes
1answer
653 views

FreeIPA Web UI not listening on IPv4

I installed FreeIPA on a VM. I went through the configuration and registered a client with ipa-client-install. After adding some users and groups on the IPA server I have confirmed that it is ...
0
votes
1answer
78 views

Can i add passsync for 2 deferent FreeIPA

I have 2 IPA server & both have deferent machines registered with it. Now i able to configure user sync agreement with Active Directory from both the IPA & i am able to see all AD users in ...
3
votes
0answers
89 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
3
votes
0answers
227 views

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need ...
2
votes
0answers
20 views

How to ignore/discard AD groups in FreeIPA

I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, ...
2
votes
0answers
952 views

All Free IPA clients unable to login

Environment: ~400 Servers enrolled in Prod IPA Prod IPA setup as Master/Master replication between two servers Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. ...
2
votes
0answers
253 views

FreeIPA : Keytab File for Adding Multiple NFS Clients

I'm relatively new to IPA and have been practicing setting up Kerberized NFS. I succeeded in initially sharing a directory from my VM Server1 to Server2. I accomplished the above by adding the NFS ...
2
votes
0answers
250 views

Free-ipa - Active Directory seems to be setup, but authentication is not working

Looking for some troubleshooting help here. I am trying to be able to authenticate AD users on a Centos7 cluster. For testing this, I am setting up a Windows Server 2012 R2 and the cluster in Azure. ...
2
votes
0answers
296 views

Minimal example of extending already existing API and CLI call in FreeIPA 4

I am looking to add fields into the user definition in FreeIPA 4.4. Right now I have modified the user schema and added the fields in the Web UI for editions. Now I would like to be able to change ...
1
vote
0answers
60 views

SSSD Default Domain Suffix no longer works

We have several EC-2 instances in an IPA domain with a trust relationship to our Active Directory Domain. On older instances ssh doesn't require the domain suffix from a Windows machine. But on newer ...
1
vote
0answers
71 views

FreeIPA : new/existing accounts expired when ssh'ing into replica

I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
1
vote
0answers
773 views

how to export all FreeIPA users list to a csv format?

How can export all FreeIPA users to a csv file?
1
vote
0answers
147 views

kerberos setup with freeipa installation

I tried installing freeipa on ubuntu v16 (cloud server) using the following: modified /etc/host to use the private IP address of the virtual machine and the corresponding host (the A name has ...
1
vote
0answers
336 views

How to make authconfig-tui use sssd instead of nslcd?

I've read that redhat's going to deprecate nslcd, and sssd is the future. So, I was following a video that shows how to setup IPA clients using authconfig-tui. Yes, I'm aware that it's been deprecated,...
1
vote
0answers
438 views

Issue with FreeIPA and Active Directory synchronisation

I'm trying to setup a FreeIPA and Active Directory synchronisation following Red Hat documentation. The ipa-replica-manage command returns a success but no user are imported in FreeIPA: [root@ipa ~]#...
1
vote
0answers
292 views

How to Configure freeIPA to host external DNS Zone

Is it possible to use freeIPA DNS servers to host an external DNS zone that will resolve records for external clients without exposing the internal zones and records? I need to host SPF and DKIM ...
1
vote
0answers
181 views

MAC OSX and FreeIPA integration?

There seem to be just one Documentation in FreeIPA and that also says to use weak crypto ciphers and does not seem to support the --mkhomedir option since there is no IPA-Client for MAC OSX 10 Anyone ...
1
vote
0answers
96 views

FreeIPA remove read and search permission

I want to disable the read and search permission that is granted to all user accounts by default. I don't want users to be able to display other users informations. is this possible? and is there ...
0
votes
0answers
11 views

Clean Freeipa install but unable to browse certificates page

I have install a clean Freeipa server. We use it for DNS, automount and users authentication. [root@ipa01 ~]# ipa --version VERSION: 4.6.4, API_VERSION: 2.230 Everything is working just fine but ...
0
votes
0answers
16 views

Kerberized WebDAV Folder Ownership/Permissions

I am running a CentOS file server bound to an IPA domain (IPA master is a different machine). I have successfully configured Apache with Kerberized WebDAV on the file server and I am able to login ...
0
votes
0answers
14 views

ubuntu 16.04 cannot start docker when userns is configured for IPA directory (non-local) user

We're using docker but want to implement userns to restrict root users in containers from having root access to the host (vm). However, on the ubuntu system, when we enable the userns setting in /etc/...
0
votes
0answers
29 views

How to ensure client authentication work with 389 server with anonymous bind disabled?

While working on Internal PT for PCI DSS compliance, it flags that LDAP (389 server, FreeIPA) the anonymous bind is allowing listing list of user accounts. Many searches are leading to setting up ...
0
votes
0answers
35 views

Installing FreeIPA with Puppet unmanaged failing

Currently, I'm trying to use a Puppet module to install the FreeIPA client, and I'm getting an error with it. I resolved the errors I had about the class structure, and right now my class is as ...
0
votes
0answers
121 views

FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow

I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate. ...
0
votes
0answers
205 views

Restricting access to users/groups of NFS mount through FreeIPA

I setup a NFS mount through the following guide with FreeIPA. Short instructions on first post: Unable to mount kerberized nfs? Long instructions: https://access.redhat.com/documentation/en-us/...
0
votes
0answers
95 views

Enroll OS X 10.13 in FreeIPA

I'm trying to enroll a Macbook in FreeIPA on my home network. I went to System Preferences > Users & Groups > Join Network Account Server and entered freeipa.example.com. It succeeded in ...
0
votes
0answers
333 views

Failed to start FreeIPA pki-tomcatd Service

Not able to start pki-tomcatd on FreeIPA server Command Output [root@ipa01]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-...
0
votes
0answers
94 views

is it possible to create local accounts with freeipa?

I would like to know if there exists an option within freeipa to force the creation of local user accounts when user connects to some host and not only create /home/username folder. Some software ...
0
votes
0answers
100 views

kerberos issue after installing freeipa

I tried installing freeipa on centos 7. I have modified the /etc/krb5.conf file to mention the realm details e.g. IPA.TESTDOMAIN.COM (valid domain). However, running kinit admin does not work - ...
0
votes
0answers
610 views

FreeIPA server installation failing on Debian 9 due to CA_UNREACHABLE

I've been trying to install FreeIPA server on a Debian 9 to handle centralised authentication (among a couple of other things) for a team of about 40 people. We're using Debian to make centralised ...
0
votes
0answers
61 views

/etc/hosts and /etc/hostname for FreeIPA on EC2

I'm having issues on what to define on the following files: /etc/hosts /etc/hostname The hostname contains the private hostname, while the hosts contains both mapping of the private and public IP. I'...
0
votes
0answers
516 views

FreeIPA broken replication

We have 3 IPA servers, ns01, ns02, ns03. Had some issues with ns03 about a month back and had to recreate the VM. We thought we had recreated and set it back up correctly however we discovered today ...
0
votes
0answers
141 views

VLANs, FreeIPA, and AD trust on different subnets - how do the computers see each another?

Let me preface this by saying I am completely unfamiliar with VLAN tagging. I understand the basic concept, but I lack any sort of real-world experience. I am looking into installing FreeIPA for a ...
0
votes
0answers
64 views

FreeIPA or similar with encrypted home for ubuntu?

I am new to sys-admin work. My objective is to setup a couple of computers with Ubuntu 16.04 which satisfy two objectives: home folders encrypted central authentication management Currently I am ...
0
votes
0answers
593 views

starting ipa.service failed all related services

[root@ipa ~]# systemctl ipa start Unknown operation 'ipa'. [root@ipa ~]# systemctl start ipa Job for ipa.service failed. See 'systemctl status ipa.service' and 'journalctl -n' ...
0
votes
0answers
73 views

Is it possible to turn a ca-full instance of FreeIPA 4.3 to a ca-less one?

I have a ca-full installation of FreeIPA 4.3, but I would like to turn it into a ca-less one. The installation doesn't have any replica, it is only one host. What would be the best path to achieve ...
0
votes
0answers
159 views

RHEVM 3.1.0 + ipa 4.2.0 domain authentification

There are good working RHEVM 3.1.0. There are external domains? wich added to RHEVM for authorization for distribution rights in RHEVM. Domains are ipa (3.0) and windows. Everything is working. Now I ...
0
votes
0answers
85 views

freeipa 4.1.0 on fedora20 not working

Has anyone successfully setup freeipa 4.0.3 on Fedora20 as a server and another fedora20 with freeipa 4.1.0 for the client side? because I can't figure out why im always having the error " user does ...
0
votes
0answers
82 views

FreeIPA issue: after ipa1 server kernel panic, not switching to ipa2 failover server

Our setup is as follows. All machines are running under Centos 5.8. We have a gateway machine with a firewall, gw.example.com, through which all external traffic is funneled. Behind it we have 2 ...