Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

vermaden.wordpress.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#41

Post by p_ing »

ptx wrote: post #11

> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?

This [0] may provide a hint. Heimdal was developed outside of the US and not subject to export restrictions, unlike MIT. So perhaps in the beginning it wasn’t the package of choice to begin with.

And this [1] says for interoperability reasons.

[0] https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/...

[1] https://freebsdfoundation.org/project/import-mit-kerberos-in...

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#42

Post by linksnapzz »

nimbius wrote: post #20
zokier wrote: post #7

I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.

There used to be a time in history when a system administrator had to know all this shit in order to keep their job. I guess nowadays devops just means dev as we furiously pump tokens into the AI Wurlitzer whenever we dont know how to do something and hope it doesnt gaslight us into deleting prod. - Freeipa is Linux AD, includes DNS, dogtag, and OpenLDAP. - SSSD is how linux machines authenticate with a central direc…

There used to be a time in history when a system administrator had to know all this shit in order to keep their job. I guess nowadays devops just means dev as we furiously pump tokens into the AI Wurlitzer whenever we dont know how to do something and hope it doesnt gaslight us into deleting prod.

Thanks, that sentence made my day.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#43

Post by cullumsmith »

xorcist wrote: post #39
cullumsmith wrote: post #2

Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutabl…

I don't think it's exactly the same thing as sssd is primarily a cache. You can use pam_krb5 on Linux too. But can you disconnect your FreeBSD laptop and work as normal from cache? I agree that sssd is quite finicky however, and I'd love a simpler alternative.

You are correct, sssd has a ton of features (like basically replicating the entire domain locally and caching passwords so you can roam away from your corp network). If you need those things, you need sssd.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#44

Post by beagle3 »

Is there a simpler system for a small local network? For my home lab use case, it is almost sufficient to rsync /etc/{passwd,group,hosts,…..} - I manually sync them because changes are few and far between.

I wanted to set up a central authority - i don’t care about multi master or even resilience to failure in that central authority.

But even a small setup is relatively complicated. I remember yp setup in the early ‘90s looked complicated but it is a piece of cake compared to modern systems. They provide a lot, but they don’t scale down - and it feels to me that they are complicated much more than is required for their feature list.

Take LDAP, for example - it is only “lightweight” compared to the thing it replaced. But it is ridiculously complicated for what it is. It is designed for a bandwidth-scarce, intermittent connection world; for a modern world, I’d just put it all in an SQLite database and rsync it all over the place (and use remote queries, the replicas only used for offline validation).

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#45

Post by jimmyswimmy »

beagle3 wrote: post #44

Is there a simpler system for a small local network? For my home lab use case, it is almost sufficient to rsync /etc/{passwd,group,hosts,…..} - I manually sync them because changes are few and far between. I wanted to set up a central authority - i don’t care about multi master or even resilience to failure in that central authority. But even a small setup is relatively complicated. I remember yp setup in the early ‘…

I would love a simpler system. Everything is pointing me back towards using a Windows server eval instance for this, which feels like a pretty heavy way to manage a bunch of alpine containers. FreeIPA, openLDAP and I think the other one I tried was Keycloak - all were more trouble to configure than they were worth. I'm shocked it never occurred to me to just rsync the passwd files, or SCP them using an update service. Would love a nicer way to manage users across a very small network without needing so much complexity as these other services.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#46

Post by scottylogan »

throw0101a wrote: post #24

Perhaps worth noting that keytab files often need to be refresh as TGTs expire; handy utility to do that: * https://www.eyrie.org/~eagle/software/kstart/ * https://www.freshports.org/security/kstart/

The keytabs don't need to be refreshed, but the ticket caches - where the TGTs are stored - do.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#47

Post by esseph »

bzzzt wrote: post #37
esseph wrote: post #19

Earlier quoted context omitted.

> dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.

Those are all apps running in the cloud. I meant the classic Windows AD company LAN like solutions where the clients, server and network are tightly coupled.

> Those are all apps running in the cloud.

Authentik and others can be deployed as docker containers that can be deployed any way you wish.

> I meant the classic Windows AD company LAN like solutions where the clients, server and network are tightly coupled.

In any mixed environment these days of Windows PCs, MacOS, and Linux, yeah, you can use a SaaS like jumpcloud with support for all of them, or you can integrate them into the ldap/kerb backend of your choice. Bonus points if your network devices are using RADIUS auth to the same identity source.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#48

Post by radarsat1 »

cullumsmith wrote: post #2

Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutabl…

> The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations ..

As a long time Linux user on personal machines, I found myself for the first time a couple of years ago needing to support a small team and given them all login access to our small cluster. I figured, hey it's annoying to coordinate user ids over these machines, I should just set up OpenLDAP.. little did I know.. honestly I'm pretty handy at dealing with Linux but I was shocked to discover how complicated and annoying it was to set up and use OpenLDAP with NFS automounting home directories.

For the first time in my life I was like, "oh this is why people spend years studying system administration.."

I did get it working eventually but it was hard to trust it and the configuration GUI was not very good and I never fully got passwd working properly so I had to intervene to help people change their passwords.. in the end we ended up just using manually coordinated local accounts.

The whole time I'm just thinking, I must be missing something, it can't be this bad.. I'm still a bit flabbergasted by the experience.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#49

Post by cryptonector »

ptx wrote: post #11

> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?

Because we (Heimdal) need to make a release, darn it. I'm going to cut an 8.0 beta within a week or two.

Basically, an 8.0 release is super pent up -- years. It's got lots of very necessary stuff, including support for the extended GSS-API "cred store" APIs, which are very handy. Lots of iprop enhancements, "virtual service principal namespaces", "synthetic client principals", lots of PKINIT enhancements, modern public key cryptography (but not PQ), etc.

The issue is that the maintainers (myself included) have been busy with other things. But the pressure to do a release has ramped up significantly recently.

Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

#50

Post by cryptonector »

p_ing wrote: post #41
ptx wrote: post #11

> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?

This [0] may provide a hint. Heimdal was developed outside of the US and not subject to export restrictions, unlike MIT. So perhaps in the beginning it wasn’t the package of choice to begin with. And this [1] says for interoperability reasons. [0] https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/... [1] https://freebsdfoundation.org/project/import-mit-kerberos-in...

I don't think that has anything to do with FreeBSD's choice of MIT Kerberos or Heimdal.
Post reply on HN