Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

Multiple FreeIPA servers can easily be configured in a FreeIPA Domain in order to provide redundancy and scalability. The 389 Directory Server is the main data store and provides a full multi-master LDAPv3 directory infrastructure. Single-Sign-on authentication is provided via the MIT Kerberos KDC. Authentication capabilities are augmented by an integrated Certificate Authority based on the Dogtag project. Optionally Domain Names can be managed using the integrated ISC Bind server.

Security aspects related to access control, delegation of administration tasks and other network administration tasks can be fully centralized and managed via the Web UI or the ipa Command Line tool.

218 questions
0
votes
0 answers

pam-auth-update update of /etc/pam.d/common-auth doesn't work

I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that it won't break after an upgrade of something at…
dmgeurts
  • 13
  • 4
0
votes
1 answer

Setting cgroup limits to all users in network

I have a FreeIPA user authentication set up. There are many users in the system already, along with many host systems (configured IPA clients). I want to set up cgroup restrictions on the tasks these users are doing (specifically, for CPU and…
0
votes
0 answers

Could not find imported module support code for freeipa.ansible_freeipa.ipaclient_test

My ansible controller is running on a Rocky 8.5 machine with the ansible-freeipa version 0.3.8-1.el8 rpm package installed. ansible 2.9.27 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules',…
dutsnekcirf
  • 79
  • 1
  • 3
  • 14
0
votes
0 answers

FreeIPA user_add fails to add user "user already exists" when it doesn't

I am getting an error when trying to create users in FreeIPA. Can someone help me figure out the problem? ipa: ERROR: user with name "ttest" already exists ipa user_show ttest ipa: ERROR: ttest: user not found ipa user_find ttest --------------- 0…
0
votes
1 answer

Freeipa web interface behind HAProxy

I am trying to configure the FreeIPA web interface to work behind my HAProxy instance. I found an old GitHub Gist for the configuration (https://gist.github.com/m4ce/d081ab39654c3e13bbe8b150986526a3) as well as a medium article…
0
votes
1 answer

Kerberos credentials not renewed on ipa ubuntu client

When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the user does not have permissions for the nfs. I can…
YuvGM
  • 153
  • 4
0
votes
1 answer

How to get Gravitee to do recursive group lookups

I have set up Gravitee APIM 3x (gateway, rest-api, console and portal). This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the service to log users in, but they are not given a…
Mogget
  • 101
  • 1
  • 7
0
votes
2 answers

Putting .k5login credentials in ldap with freeipa

On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data. By using a .k5login file in home directories, it is possible to use ssh to connect to a different…
okapi
  • 140
  • 4
0
votes
0 answers

How to issue SSL certificate with Nginx docker container using FreeIPA?

Instead of using a self-signed SSL certificate (untrusted) I want to issue certificate from a trusted source in this case from a FreeIPA instance (I'm new to FreeIPA). How can this be done? Is Kerberos required for this?
N. J
  • 1
0
votes
1 answer

FreeIPA not resolving itself

I plan on using FreeIPA as my authoritative DNS server for my network. All other records resolve just fine, however, FreeIPA is not resolving itself. Running dig ipa-hermes.lan.example.com yields no A records bash-5.1# dig…
cclloyd
  • 583
  • 1
  • 13
  • 24
0
votes
0 answers

How are external url's resolved by FreeIPA?

We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP address as the DNS server on our internal network.…
Bob C.
  • 75
  • 1
  • 1
  • 7
0
votes
0 answers

Login loop for FreeIPA users

I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their passwords reset, can change their passwords but are sent…
jerrb
  • 1
  • 2
0
votes
1 answer

FreeIPA: External DNS requests (google etc.) fail for clients on new subnet

I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both internal DNS and external requests for google etc. …
0
votes
1 answer

Deleted Group in FreeIPA Still Comes Up

I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete. I go into "User Groups" in FreeIPA GUI and delete the offending group name. All sounds good, but then if I go to my…
Paul
  • 125
  • 6
0
votes
1 answer

FreeIPA - ssh as root prompted for password

I know the access via root won't work (client sshd_config and restricted account in FreeIPA). But is there a way to blacklist root either on the host or on FreeIPA so it's denied immediately rather than prompting for a password? I'm wondering if I'm…
dmgeurts
  • 13
  • 4