FreeIPA - ArchWiki

# FreeIPA

From ArchWiki
Jump to navigation Jump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

This article or section needs language, wiki syntax or style improvements. See Help:Style for reference.

Reason: Is this article only about the client? If so it should say so. (Discuss in Talk:FreeIPA#)

This article or section needs expansion.

Reason: How do you install the client? There is freeipa-clientAUR. (Discuss in Talk:FreeIPA#)

FreeIPA is an open-source Identity, Policy and Audit (IPA) suite, sponsored by RedHat, which provides services similar to Microsoft's Active Directory

## Manual configuration as IPA client

Make sure your clocks are synchronized. Kerberos will not work otherwise. NTP is recommended.

Instead of using `ipa-client-install` script for automated client configuration and enrollment, the following sections describe a manual procedure for enrolling the client `client.example.com` to the FreeIPA server `ipaserver.example.com` in the `example.com` domain.

### Configure SSSD and Kerberos

Follow the LDAP auth instructions to setup SSSD. Use a SSSD configuration similar to the following, substituting the requisite fields:

    /etc/sssd/sssd.conf

    [sssd]
    config_file_version = 2
    services = nss, pam, sudo, ssh
    domains = EXAMPLE.COM
    #debug_level = 9

    [domain/EXAMPLE.COM]
    #debug_level = 9
    cache_credentials = true
    krb5_store_password_if_offline = true
    id_provider = ipa
    auth_provider = ipa
    access_provider = ipa
    chpass_provider = ipa
    #ipa_domain=example.com  # Optional if you set SRV records in DNS
    #ipa_server=ipaserver.example.com  # Optional if you set SRV records in DNS
    ipa_hostname=client.example.com

Configure pam in similar way to LDAP, replacing `pam_ldap.so` with `pam_sss.so`.

Create an `/etc/krb5.conf` file for your domain:

    /etc/krb5.conf

    [libdefaults]
            default_realm = EXAMPLE.COM
            dns_lookup_realm = false
            dns_lookup_kdc = false
            rdns = false
            ticket_lifetime = 24h
            forwardable = yes
            #allow_weak_crypto = yes  # Only if absolutely necessary. Currently FreeIPA supports strong crypto.

    [realms]
            EXAMPLE.COM = {
                    admin_server = freeipaserver.example.com
                    kdc = freeipaserver.example.com:749
                    default_admin = example.com
            }

    [domain_realm]
            example.com = EXAMPLE.COM
            .example.com = EXAMPLE.COM

    [logging]
            default = FILE:/var/log/krb5libs.log
            kdc = FILE:/var/log/krb5kdc.log
            admin_server = FILE:/var/log/kadmin.log

### Enroll the client

On FreeIPA server, add the client to the IPA server (From Fedora documentation):

1. Login and request and admin session `kinit admin`
2. Create a host entry `ipa host-add --force --ip-address=192.168.166.31 client.example.com`
   (if the host does not have a static IP, use `ipa host-add client.example.com`)
3. Set the client to be managed by IPA `ipa host-add-managedby --hosts=ipaserver.example.com client.example.com`
4. Generate keytab for the client `ipa-getkeytab -s ipaserver.example.com -p host/client.example.com -k /tmp/client1.keytab`

Install the keytab on the client:

    $ scp user@ipaserver.example.com:/tmp/client1.keytab krb5.keytab
    # mv krb5.keytab /etc/krb5.keytab

### SSH integration

#### authorized_keys

You can configure SSHD to fetch users SSH public key from the LDAP directory by uncommenting those lines in `/etc/ssh/sshd_config`:

     AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
     AuthorizedKeysCommandUser nobody

Then restart sshd.

You can add your ssh key to your FreeIPA user account through the web interface or use the `-sshpubkey='ssh-rsa AAAA...'` argument to the `ipa user-mod` or `ipa user-create` commands.

Test it:

     sudo -u nobody sss_ssh_authorizedkeys <username>

You should see your ssh public key on standard output and no error message on standard error.

#### known_hosts

You can configure SSH to fetch hosts public key information from their directory entries in FreeIPA by adding those lines in `/etc/ssh/ssh_config`:

     GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
     ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

#### Kerberos/GSS API Authentication

You can enabled Kerberos / GSS API Authentication for the SSH Client to FreeIPA member hosts by uncommenting and changing the following lines in `/etc/ssh/ssh_config`:

     GSSAPIAuthentication yes
     GSSAPIDelegateCredentials yes

### See also

- Wikipedia:FreeIPA
- Manually Configuring a Linux Client from the FreeIPA user guide
- Freeipa30_SSSD_OpenSSH_integration.pdf

Categories:

- Networking
- Security
- Red Hat

Hidden categories:

- Pages or sections flagged with Template:Style
- Pages or sections flagged with Template:Expansion