Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
vermaden.wordpress.com
Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
1–10 of 65 posts
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#2Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers."
OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database.
The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutable... Nowadays an LLM could do it for you at least.
At $job we use Linux / sssd, and I always found it super bloated and rather unreliable. It's nice coming home to FreeBSD and old boring stuff like pam_krb5 and nslcd. It just works.
The "ipa" command provided by FreeIPA for managing users/groups/etc is super convenient though.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#3Hah, what a coincidence, just started to look into yesterday how do I setup LDAP/OIDC on FreeBSD and today I was going to try FreeIPA or Keycloak. Thanks for sharing.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#4Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal
Better yet you’ll want to encrypt that file in some way when transferring it
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#5Hah, what a coincidence, just started to look into yesterday how do I setup LDAP/OIDC on FreeBSD and today I was going to try FreeIPA or Keycloak. Thanks for sharing.
I also covered Keycloak on FreeBSD in the past - here:
- https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebs...
Hope that helps.
Regards,
vermaden
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#6Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal Better yet you’ll want to encrypt that file in some way when transferring it
Good point - gonna add a notice about that - thank You.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#7I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#8I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#9I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory).
Modern, hybrid AD is not easy to use and difficult to manage.
Re: Native FreeBSD Kerberos/LDAP with FreeIPA/IDM
#10I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
Ideally you want to run all those trusted (read: security critical, if compromised entire system is no longer trustworthy) processes on separated and audited machines, but instead busy people end up running them all together because they happen to be packaged together (like FreeIPA or Active Directory), and that makes it even harder to secure them correctly.