8 years ago or so I had a job that necessitated doing a bunch of LDAP integrations and I tried FreeIPA, openLDAP and others. It was such a pain. OpenLDAP (slapd) was actually configured using... LDAP. Yes, you configured an LDAP server using it's own protocol. It was not good. My fading impression of FreeIPA is that it had some nice things going for it, but it wasn't nearly as lightweight or friendly towards automation, it felt more like setting up a windows domain controller and clicking through a webUI to set things up.
Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
51–60 of 65 posts
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#52I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
LDAP Kerberos 5 SSSD is pretty easy to configure and more or less maintenance free for a small set of servers and users. By my personal experience.
The costs usually come from complexity: every new user needs its credentials, guidance to services and help in error situations. New services need to be integrated to existing systems. But those won't go away, be the system anything.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#53> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?
Because we (Heimdal) need to make a release, darn it. I'm going to cut an 8.0 beta within a week or two. Basically, an 8.0 release is super pent up -- years. It's got lots of very necessary stuff, including support for the extended GSS-API "cred store" APIs, which are very handy. Lots of iprop enhancements, "virtual service principal namespaces", "synthetic client principals", lots of PKINIT enhancements, modern publ…
Also things like support for GSS-API pre-authentication mechanisms (so, you can use an arbitrary security mechanism such as EAP to authenticate yourself to the KDC), the new SAnon mechanism, pulling in some changes from Apple's fork, replacing builtin crypto with OpenSSL, etc. Lack of release has been typical OSS lack of resources: no one is paid to work on Heimdal full time.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#548 years ago or so I had a job that necessitated doing a bunch of LDAP integrations and I tried FreeIPA, openLDAP and others. It was such a pain. OpenLDAP (slapd) was actually configured using... LDAP. Yes, you configured an LDAP server using it's own protocol. It was not good. My fading impression of FreeIPA is that it had some nice things going for it, but it wasn't nearly as lightweight or friendly towards automati…
> Yes, you configured an LDAP server using it's own protocol. It was not good.
It's still possible to configure OpenLDAP via the slapd.conf file. The old roadmap called for ditching configuration file support in 2.5 IIRC, but it proved hugely unpopular so the file works to this day. The new configuration style is mainly useful for live updating of access rules and indexing.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#55Earlier quoted context omitted.
This [0] may provide a hint. Heimdal was developed outside of the US and not subject to export restrictions, unlike MIT. So perhaps in the beginning it wasn’t the package of choice to begin with. And this [1] says for interoperability reasons. [0] https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/... [1] https://freebsdfoundation.org/project/import-mit-kerberos-in...
I don't think that has anything to do with FreeBSD's choice of MIT Kerberos or Heimdal.
Well, except the FreeBSD Foundation explicitly says MIT was chosen for interoperability.
Are you disputing the FreeBSD Foundation document?
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#56Earlier quoted context omitted.
I don't think that has anything to do with FreeBSD's choice of MIT Kerberos or Heimdal.
Well, except the FreeBSD Foundation explicitly says MIT was chosen for interoperability. Are you disputing the FreeBSD Foundation document?
Er, sorry, I meant the whole thing about Heimdal being non-U.S. based.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#57Earlier quoted context omitted.
Because we (Heimdal) need to make a release, darn it. I'm going to cut an 8.0 beta within a week or two. Basically, an 8.0 release is super pent up -- years. It's got lots of very necessary stuff, including support for the extended GSS-API "cred store" APIs, which are very handy. Lots of iprop enhancements, "virtual service principal namespaces", "synthetic client principals", lots of PKINIT enhancements, modern publ…
Also things like support for GSS-API pre-authentication mechanisms (so, you can use an arbitrary security mechanism such as EAP to authenticate yourself to the KDC), the new SAnon mechanism, pulling in some changes from Apple's fork, replacing builtin crypto with OpenSSL, etc. Lack of release has been typical OSS lack of resources: no one is paid to work on Heimdal full time.
Oh yeah, it's huge.
Also included are experimental:
- httpkadmind (which together with virtual service principal namespaces makes a very nice keytab orchestration system)
- bx509d (an online CA)
- JWT support for the above
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#58I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
Microsoft is pushing everyone onto Entra. There are so many exploits for AD but few for Entra. Tenable has been pushing an internal initiative to eliminate all AD use. This action speaks volumes considering they acquired an AD security company and sell a product specifically designed to secure AD. The consequences of a compromised AD domain are drastic. We should not try to build the same vulnerabilities into Linux e…
The byzantine and overly complex nature of FreeIPA is a feature not a bug. It lends itself to consulting money for RedHat et al in those legacy markets. Sure, the server might be free but good luck getting it running.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#59Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal Better yet you’ll want to encrypt that file in some way when transferring it
I modified the article to copy the keytab using scp(1) instead.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#60It is pity, we need Linux to tun open source software like FreeIPA/IDM. I want to deploy domain at my home lab, but there are only FreeBSDs and Windows (client versions, on desktops and laptops)... I don't want to install Linux.
Me too brother, me too.