Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

Multiple FreeIPA servers can easily be configured in a FreeIPA Domain in order to provide redundancy and scalability. The 389 Directory Server is the main data store and provides a full multi-master LDAPv3 directory infrastructure. Single-Sign-on authentication is provided via the MIT Kerberos KDC. Authentication capabilities are augmented by an integrated Certificate Authority based on the Dogtag project. Optionally Domain Names can be managed using the integrated ISC Bind server.

Security aspects related to access control, delegation of administration tasks and other network administration tasks can be fully centralized and managed via the Web UI or the ipa Command Line tool.

218 questions
0
votes
1 answer

is it possible to set default home-directory based on the users gidnumber?

I'm aware that I can change the general settings by running: ipa config-mod --homedirectory=/some/path what I would like to achieve is for IPA to change it to a different path based on the GID/GIDnumber of the user created, e.g: ipa user-add user10…
flippson
  • 11
  • 1
0
votes
1 answer

Implementing LDAP with Public IP

I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos). The problem is my servers (Ubuntu) running as public cloud with no private interface provided. So, my only choice is using public but I'm…
BTH.S3
  • 1
0
votes
1 answer

Restrict web access on apache web server to FreeIPA users

We have an apache web server installed on a Centos 8 machine which is been used to easily expose user and group folders both internally and to other collaborators. Most of the data exposed is plain HTML files, png, etc... in specific folders in the…
GoNiS
  • 23
  • 4
0
votes
1 answer

ubuntu ignores default_ccache_name

I'm having trouble with Kerberos and Ubuntu 20.04. Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue. The big goal is to have a SSO System, for multiple services. Mostly it works as intended, but one…
Poehli
  • 103
  • 3
0
votes
1 answer

ipa-server installation failed

facing a problem when install ipa-server . the problem is : Configured /etc/sssd/sssd.conf trying https://ipa.cse.local/ipa/json [try 1]: Forwarding 'schema' to json server 'https://ipa.cse.local/ipa/json' cannot connect to…
0
votes
1 answer

How to find IPA user creation date?

Command ipa user-show $user -all doesn't show what I have described in title. Do you have any ideas?
petec
  • 1
0
votes
0 answers

Signing CSR from user by sub CA using FreeIPA

There is a CSR from user with O=test_org, CN=test. It is necessary to sign it with CA test in FreeIPA. I do it by following command: ipa cert-request test-client.csr --ca=ca-name --certificate-out=signed.crt After that IPA offer me to enter some…
MrSetplus
  • 1
  • 1
0
votes
0 answers

Centos OS7 not receiving user context from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system are as expected, using the context…
0
votes
1 answer

Unable to log in to FreeIPA web ui - “Login failed due to an unknown reason.”

I have few months old freeipa installation. However, lately when I came back to continue my administration with IPA server I cannot login to it. DNS is working in my private network without problem even I cannot login to IPA system. I'm using…
matsukan
  • 11
  • 6
0
votes
1 answer

How do I add dot-slash (./) as a sudo command rule in FreeIPA?

I can't run scripts using dot-slash, because I don't know how to add it as a sudo command rule in FreeIPA. Users are not allowed to it. ./myscript.sh How can add ./ as rule in FreeIPA like any other command rule:
gummiost
  • 115
  • 3
0
votes
1 answer

FreeIPA Forward Zones not working

I have a few replica of FreeIPA 4.6.4 running. I'm trying to forward request for another DNS domain to their DNS server. dig/nslookup to the forwarder works, but queries to FreeIPA returns NXDOMAIN For example, my internal zone is myzone.local. …
Billy K
  • 99
  • 1
  • 3
  • 14
0
votes
1 answer

FreeIpa. How to setup specific shell only on 1 host for group of users

I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
0
votes
1 answer

FreeIPA host with dynamic IP

I'm trying to logon to Windows with FreeIPA User. Everything went fine when i created IPA host with specific ---ip-address but what if my host(windows machine) do not have static IP? i know after first succesfull login to windows the login…
SimonLi
  • 49
  • 1
  • 6
0
votes
1 answer

What are the drawbacks/issues when having REALM and DOMAIN with different names in FreeIPA?

I have been trying to configure a FreeIPA server for learning purposes and to have centralised access to all my self-hosted services for me and my family/friends. I started with this tutorial where they state that "It is highly recommended that you…
Arehandoro
  • 131
  • 3
0
votes
2 answers

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate CAs that we are using expired and we are no longer…
1 2 3
14
15