Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

16
votes
1answer
14k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
10
votes
3answers
2k views

IPA dynamic DNS updates only the AAAA record. Where are my A records?

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly ...
9
votes
2answers
2k views

VMware vCenter/ESXi with FreeIPA instead of Active Directory?

Can vCenter authenticate against FreeIPA instead of Active Directory? If so, how would you set it up? We have a pure Linux environment (CentOS) and need to have vCenter and our VM's have the same ...
7
votes
1answer
12k views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
7
votes
1answer
3k views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ipa-...
6
votes
3answers
1k views

freeipa ssl ldap and round robin dns

I'm trying to ask this question in a way that's answerable, but part of the issue is knowing the implications of my current situation and if there's an issue or technical debt which'll bite me further ...
6
votes
4answers
2k views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...
6
votes
1answer
14k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
6
votes
1answer
2k views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM 5....
5
votes
1answer
4k views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com admin@...
5
votes
2answers
4k views

Google authenticator with Openldap or Fedora 389 Server or FreeIPA

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
5
votes
3answers
3k views

backup and restoration of a freeipa infrastructure

I'm finding the documentation on ipa server backup and restoration sadly lacking, and being so centrally critical it's not something i'm really happy about shooting in the dark with - could some kind ...
5
votes
2answers
2k views

FreeIPA without web UI or change of ports

Can I install FreeIPA server without httpd (without web UI)?? Or at least can I change the ports?? (80->8880 and 443->8443)
4
votes
1answer
11k views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ~...
4
votes
4answers
19k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
4
votes
1answer
5k views

Granting sudo access to a SELinux confined user in freeIPA

I'm using freeIPA to define RBAC, HBAC and sudo rules, as well as SELinux user mappings for a domain of a couple hundred virtual machines, where I need to grant different levels of access to several ...
3
votes
3answers
7k views

FreeIPA : Installer not resolving domain name from hosts file

I have been having an issue while installing FreeIPA. The problem is that every time I run the installer the FreeIPA application does not read from the host file rather tries to resolve the domain ...
3
votes
2answers
2k views

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home ...
3
votes
1answer
4k views

Integrating FreeIPA or RH IdM in an existing MS AD environment

I want to deploy FreeIPA or Red Hat IdM in my existing environment Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to ...
3
votes
2answers
847 views

VCenter 5.5 Appliance and FreeIPA 3 authentication

I have a vcenter appliance and freeipa running in my environment. There are no windows machines at all, nor will there be. I have setup vca to authenticate via LDAP to IPA and this works PER USER. the ...
3
votes
1answer
154 views

macOS High Sierra issues mounting Kerberized NFSv4 shares

I'm using FreeIPA for LDAP/Kerberos and I've created a principal for a storage appliance (Dell/EMC UnityVSA VM). I have setup the VSA with a keytab from IPA, I've also setup within the VSA the LDAP ...
3
votes
1answer
518 views

Restrict LDAP attribute read to self in FreeIPA/RedHat IdM

In our environment, employeeNumber is a sensitive field and we don't want it to be readable by all users. By default, IdM/IPA has a default permission System: Read User Addressbook Attributes which ...
3
votes
0answers
89 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
3
votes
0answers
227 views

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need ...
2
votes
1answer
2k views

FreeIPA in LXD/LXC containers - cannot switch user

The Setup consists of one FreeIPA-Server and one Client, which both reside in unprivileged LXD-Containers on the same Host. Both containers and the host machine run Ubuntu 16.04. All Settings are ...
2
votes
2answers
3k views

Configure Gitlab to use FreeIPA as LDAP server

I'm running in ran into a bit of a trouble and I don't seem to be able to fix it. Please follow the scenario bellow: I have two servers: ONE (10.0.3.10): Ubuntu based, having Gitlab (as deb package)...
2
votes
1answer
2k views

Multiple sites/realms in FreeIPA

To start off, my experience lies in networking (Cisco) and Windows. That being said, I have been set off on a project to design a multi-site FreeIPA installation. I have single site FreeIPA without ...
2
votes
1answer
115 views

How do I update my machine time when there is a local ntpd server reference in ntpd.conf

My FreeIPA server's datetime had drifted about 10 min causing login failures. The ntpd service was functioning up and running. I checked the configuration and noticed that freeIPA had added a local ...
2
votes
1answer
612 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
2
votes
1answer
56 views

FreeIPA re-arrange custom attributes

I created several custom attributes and added them to LDAP and FreeIPA, but their order in the user page is very messy. I want to re-arrange them and put the related attributes together (such as '...
2
votes
1answer
563 views

Extending LDAP and FreeIPA

I'm working with FreeIPA and I've extended its attributes successfully, but noticed that the verification function in the Python plugin, added to FreeIPA, only works for the values entered through the ...
2
votes
1answer
2k views

Problems connecting to a freeIPA client host via ssh

I am trying to set up an IPA environment with a CentOS 7.3 server and clients and I am experiencing a behavior that I am not able to understand. I am using IPA version 4.4.0. I was able to run ipa-...
2
votes
1answer
3k views

ipa users cannot sudo on some machines only, including the ipa server

I'm having trouble with freeipa on a few machines. It's been very frustrating to debug so far. Here's the details of the issue; How it manifests: The user can login just fine to any host, but on ...
2
votes
1answer
972 views

FreeIPA and AD password synchronisation

I am attempting to integrate FreeIPA with Active Directory to provide single-sign-on for Windows and Linux users by following this guide. I have successfully created the 'winsync' agreement and ...
2
votes
1answer
492 views

How can I force a mac mobile account user to be logged out or locked out when their LDAP account is disabled?

I have a FREEIPA LDAP server and a Mavericks Client. I have bound my Mac to my ldap and created a mobile account. What I want is when someone is disabled it logs out the user or locks the screen.
2
votes
0answers
20 views

How to ignore/discard AD groups in FreeIPA

I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the distro's default repos. I have it configured for a one-way trust to an Active Directory deployment. On the client side, ...
2
votes
0answers
951 views

All Free IPA clients unable to login

Environment: ~400 Servers enrolled in Prod IPA Prod IPA setup as Master/Master replication between two servers Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. ...
2
votes
0answers
253 views

FreeIPA : Keytab File for Adding Multiple NFS Clients

I'm relatively new to IPA and have been practicing setting up Kerberized NFS. I succeeded in initially sharing a directory from my VM Server1 to Server2. I accomplished the above by adding the NFS ...
2
votes
0answers
250 views

Free-ipa - Active Directory seems to be setup, but authentication is not working

Looking for some troubleshooting help here. I am trying to be able to authenticate AD users on a Centos7 cluster. For testing this, I am setting up a Windows Server 2012 R2 and the cluster in Azure. ...
2
votes
1answer
1k views

IPA server NFS services adding issue centos 7.2

I'm having an issue with adding NFS services to IPA server (after login to the IPA server and kinit admin). When I execute the line below: [root@ipa ~]# ipa service-add nfs/server1.example.com I'm ...
2
votes
0answers
296 views

Minimal example of extending already existing API and CLI call in FreeIPA 4

I am looking to add fields into the user definition in FreeIPA 4.4. Right now I have modified the user schema and added the fields in the Web UI for editions. Now I would like to be able to change ...
2
votes
1answer
1k views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
2
votes
2answers
203 views

Cannot create a user in IPA server for remote login

I had created a new IPA IdM server in Centos 7 using script install-ipa-server. The installation was successful. After installation, I was not able to create a user using IPA user-add user, it asks ...
1
vote
2answers
78 views

Centos package naming for FreeIPA?

Where can I find information about CentOS package management? I installed Spacewalk recently and noticed that FreeIPA was listed as ready for an update. The versions are differently named, and the ...
1
vote
2answers
312 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
1
vote
3answers
1k views

Managing Linux user accounts + Samba + more

I have a network of about 3-6 CentOS servers, with about 5-10 users (currently, and near future). I'm looking for a solution for centralized managements of users. My requirements from it are: Linux ...
1
vote
1answer
459 views

How to set up a FreeIPA server on Arch Linux? [closed]

I am looking for instructions to set up a FreeIPA server on Arch Linux. Unfortunately, I am only seeing tutorials for setting up a FreeIPA server on RedHat or its derived distributions. (And I'm only ...
1
vote
1answer
84 views

Is it a bad idea store anything else than user information in FreeIPA?

At $company, we currently have a setup based on an OpenLDAP with some homegrown^Whomemutated hierarchy, plus some other data stored into MySQL. The OpenLDAP server contains data like internal users, ...
1
vote
2answers
3k views

freeipa admin password reset

I'm trying to figure out how to reset my freeipa3 admin password. I'm able to see the user when I search the domain: [root@ipaserver ipa]# LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -h localhost -ZZ -...
1
vote
1answer
2k views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...