Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

vermaden.wordpress.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#31

Post by evanjrowley »

zokier wrote: post #7

I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.

Microsoft is pushing everyone onto Entra. There are so many exploits for AD but few for Entra.

Tenable has been pushing an internal initiative to eliminate all AD use. This action speaks volumes considering they acquired an AD security company and sell a product specifically designed to secure AD.

The consequences of a compromised AD domain are drastic. We should not try to build the same vulnerabilities into Linux environments, but it’s undeniable there is value in leveraging FreeIPA et al. to interoperate with legacy environments.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#32

Post by StopDisinfo910 »

doctorpangloss wrote: post #29
StopDisinfo910 wrote: post #27

Earlier quoted context omitted.

It's always been awful. OpenLDAP by itself is already attrocious and a pain to make work. I have always been convinced it was on purpose. It's the point where you were supposed to decide paying Redhat is actually a good idea and nowadays it pushes towards a cloud based authentication solution you can integrate. Realistically, who has any interest in fixing the mess?

> Realistically, who has any interest in fixing the mess? Okta is a multi billion dollar company, there is a lot of venture opportunity in this space.

I think that's actually directly in agreement with what I said. Okta built their own thing on the side without touching the Linux stack and is very happy for you to turn to them. So did Authentik actually.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#33

Post by p_ing »

nimbius wrote: post #20
zokier wrote: post #7

I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.

There used to be a time in history when a system administrator had to know all this shit in order to keep their job. I guess nowadays devops just means dev as we furiously pump tokens into the AI Wurlitzer whenever we dont know how to do something and hope it doesnt gaslight us into deleting prod. - Freeipa is Linux AD, includes DNS, dogtag, and OpenLDAP. - SSSD is how linux machines authenticate with a central direc…

Dang, your failure modes certainly are extreme. What companies actually performed a from-scratch rebuild because they failed to take a backup or thought "today's thursday, it's too complicated to restore!"?

If an "OS upgrade" nukes your directory, that means you're running a single DC. The question is... why would you do that?

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#34

Post by esseph »

cullumsmith wrote: post #26
whalesalad wrote: post #17

Earlier quoted context omitted.

Would be highly interested in learning more about this setup particularly the PowerDNS integration.

PowerDNS is an open-source DNS server that lets you store your DNS configuration in a variety of different backends, one of which is LDAP. For each of my "domain controllers, I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server. The KDC and PowerDNS both get their data from LDAP on 127.0.0.1, and LDAP changes are synchronized between all the nodes. This is convenient because you don't have to synchronize zone…

In addition to this, for those of you running Proxmox it has PowerDNS integration.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#35

Post by esseph »

amaccuish wrote: post #28
esseph wrote: post #19

Earlier quoted context omitted.

> dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.

Jumpcloud is SaaS.

Yes, but it's not Microsoft Active Directory or Entra, which was my point.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#36

Post by bzzzt »

dijit wrote: post #23
bzzzt wrote: post #9

Earlier quoted context omitted.

Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.

This is 100% the current situation, and it's worth mentioning because clearly you have a finger on the pulse here - and that needs to be stated for others. But, I wonder if Microsoft might reverse their stance on EntraID being SaaS; with the handwringing about sovreignty from Europe. Back when "the deal" was made with Microsoft to basically embed itself into the digital ecosystem of every government, major institutio…

I don't see Microsoft backing down from their SaaS push: it's necessary for authentication and authorization in all their Office 365 (or whatever it's called now) applications, also on platforms not running Microsoft clients. Beside that Entra is an OIDC server which makes it possible to integrate other SaaS applications in a domain which is near impossible to do if you only have local authentication.

Of course, you can still run local AD which synchronizes with Entra, but that means you get the worst of both worlds: you are paying for the cloud software but still have to manage your own servers.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#37

Post by bzzzt »

esseph wrote: post #19
bzzzt wrote: post #9

Earlier quoted context omitted.

Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.

> dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.

Those are all apps running in the cloud. I meant the classic Windows AD company LAN like solutions where the clients, server and network are tightly coupled.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#38

Post by bzzzt »

jabl wrote: post #21
bzzzt wrote: post #9

Earlier quoted context omitted.

Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.

There's https://himmelblau-idm.org/ for a Linux client for Entra. Haven't tried it myself though.

Looks nice, all it needs is an OSS server now ;)

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#39

Post by xorcist »

cullumsmith wrote: post #2

Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutabl…

I don't think it's exactly the same thing as sssd is primarily a cache. You can use pam_krb5 on Linux too. But can you disconnect your FreeBSD laptop and work as normal from cache? I agree that sssd is quite finicky however, and I'd love a simpler alternative.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#40

Post by xorcist »

StopDisinfo910 wrote: post #27
zokier wrote: post #7

I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.

It's always been awful. OpenLDAP by itself is already attrocious and a pain to make work. I have always been convinced it was on purpose. It's the point where you were supposed to decide paying Redhat is actually a good idea and nowadays it pushes towards a cloud based authentication solution you can integrate. Realistically, who has any interest in fixing the mess?

> you were supposed to decide paying Redhat

Fwiw, all Red Hat LDAP products are based on 389DS because they thought OpenLDAP had too many pain points or something.

Post reply on HN