FreeIPA - ArchWiki

Jump to content

# FreeIPA

From ArchWiki

This article or section needs language, wiki syntax or style improvements. See Help:Style for reference.

Reason: Is this article only about the client? If so it should say so. (Discuss in Talk:FreeIPA)

This article or section needs expansion.

Reason: How do you install the client? There is freeipa-clientAUR. (Discuss in Talk:FreeIPA)

FreeIPA is an open-source Identity, Policy and Audit (IPA) suite, sponsored by RedHat, which provides services similar to Microsoft's Active Directory

## Manual configuration as IPA client

Make sure your clocks are synchronized. Kerberos will not work otherwise. NTP is recommended.

Instead of using `ipa-client-install` script for automated client configuration and enrollment, the following sections describe a manual procedure for enrolling the client `client.example.com` to the FreeIPA server `ipaserver.example.com` in the `example.com` domain.

### Configure SSSD and Kerberos

Follow the LDAP auth instructions to setup SSSD. Use a SSSD configuration similar to the following, substituting the requisite fields:

    /etc/sssd/sssd.conf

    [sssd]
    config_file_version = 2
    services = nss, pam, sudo, ssh
    domains = EXAMPLE.COM
    #debug_level = 9

    [domain/EXAMPLE.COM]
    #debug_level = 9
    cache_credentials = true
    krb5_store_password_if_offline = true
    id_provider = ipa
    auth_provider = ipa
    access_provider = ipa
    chpass_provider = ipa
    #ipa_domain=example.com  # Optional if you set SRV records in DNS
    #ipa_server=ipaserver.example.com  # Optional if you set SRV records in DNS
    ipa_hostname=client.example.com

Configure pam in similar way to LDAP, replacing `pam_ldap.so` with `pam_sss.so`.

Create an `/etc/krb5.conf` file for your domain:

    /etc/krb5.conf

    [libdefaults]
            default_realm = EXAMPLE.COM
            dns_lookup_realm = false
            dns_lookup_kdc = false
            rdns = false
            ticket_lifetime = 24h
            forwardable = yes
            #allow_weak_crypto = yes  # Only if absolutely necessary. Currently FreeIPA supports strong crypto.

    [realms]
            EXAMPLE.COM = {
                    admin_server = freeipaserver.example.com
                    kdc = freeipaserver.example.com:749
                    default_admin = example.com
            }

    [domain_realm]
            example.com = EXAMPLE.COM
            .example.com = EXAMPLE.COM

    [logging]
            default = FILE:/var/log/krb5libs.log
            kdc = FILE:/var/log/krb5kdc.log
            admin_server = FILE:/var/log/kadmin.log

### Enroll the client

On FreeIPA server, add the client to the IPA server (From Fedora documentation):

1. Login and request and admin session `kinit admin`
2. Create a host entry `ipa host-add --force --ip-address=192.168.166.31 client.example.com`
   (if the host does not have a static IP, use `ipa host-add client.example.com`)
3. Set the client to be managed by IPA `ipa host-add-managedby --hosts=ipaserver.example.com client.example.com`
4. Generate keytab for the client `ipa-getkeytab -s ipaserver.example.com -p host/client.example.com -k /tmp/client1.keytab`

Install the keytab on the client:

    $ scp user@ipaserver.example.com:/tmp/client1.keytab krb5.keytab
    # mv krb5.keytab /etc/krb5.keytab

### SSH integration

#### authorized_keys

You can configure SSHD to fetch users SSH public key from the LDAP directory by uncommenting those lines in `/etc/ssh/sshd_config`:

     AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
     AuthorizedKeysCommandUser nobody

Then restart sshd.

You can add your ssh key to your FreeIPA user account through the web interface or use the `-sshpubkey='ssh-rsa AAAA...'` argument to the `ipa user-mod` or `ipa user-create` commands.

Test it:

     sudo -u nobody sss_ssh_authorizedkeys <username>

You should see your ssh public key on standard output and no error message on standard error.

#### known_hosts

You can configure SSH to fetch hosts public key information from their directory entries in FreeIPA by adding those lines in `/etc/ssh/ssh_config`:

     GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
     ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

#### Kerberos/GSS API Authentication

You can enabled Kerberos / GSS API Authentication for the SSH Client to FreeIPA member hosts by uncommenting and changing the following lines in `/etc/ssh/ssh_config`:

     GSSAPIAuthentication yes
     GSSAPIDelegateCredentials yes

### See also

- Wikipedia:FreeIPA
- Manually Configuring a Linux Client from the FreeIPA user guide
- Freeipa30_SSSD_OpenSSH_integration.pdf

Categories:

- Networking
- Security
- Red Hat

Hidden categories:

- Pages or sections flagged with Template:Style
- Pages or sections flagged with Template:Expansion