Corporate needs are simple – one ring to rule them all place to get users from. On the open source path there are several ways to achieve that. Alongside ‘plain’ OpenLDAP there is also FreeIPA – which is open source and free version of the Red Hat Identity Management (IDM).
This guide will show you how to make basic FreeIPA install and connect a FreeBSD 13.1-RELEASE system to it.
The Table of Contents for this article looks as follows.
- Connect FreeBSD to FreeIPA/Red Hat Identity Management
- FreeIPA
- FreeIPA Requirements
- FreeIPA Setup
- FreeBSD Client
- FreeBSD Packages
- FreeBSD Setup
- FreeIPA/IDM Setup Part
- Finish Setup with Web Browser in FreeIPA/IDM Page
- FreeBSD FreeIPA Login Test
- FreeBSD Jail as FreeIPA/IDM Client
- Basic FreeBSD Jail Preparations
- Configure FreeBSD Jail to Connect to FreeIPA/IDM Server
- Linux FreeIPA/IDM Client
- FreeIPA/IDM Setup Part
- Linux FreeIPA/IDM Client Setup
FreeIPA
As typical CentOS is dead (yes there is CentOS Stream available but its not a RHEL clone) I have two options here. Rocky Linux and Alma Linux. I will use the latter as it seems more popular and more up to date. In this guide the FreeIPA/IDM server will hosted on the Alma Linux 8.6 system.
To make things easier I installed that Alma Linux 8.6 with single 20GB / root on the /dev/sda1 partition. No separate /boot. No LVM. Just good old plain fucking simple single raw partition for everything. Seems no one does it these days π
[root@idm ~]# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 20G 0 disk
ββsda1 8:1 0 20G 0 part /
FreeIPA Requirements
The minimum hardware requirements for installing FreeIPA server are as follows.
RAM: 4GB
CPU: 2
HDD: 10GB
DNS: fully qualified domain name for FreeIPA
must be resolvable from DNS server configured in system
For this installation I have used the 10.0.0.0/24 network.
The FreeIPA/IDM server will get the 10.0.0.40 IP.
The FreeIPA/IDM Linux client rhlike.vercorp.org will get the 10.0.0.41 IP.
The FreeIPA/IDM FreeBSD client fbsd.vercorp.org will get the 10.0.0.42 IP.
The FreeIPA/IDM FreeBSD client fbsdjail.vercorp.org will get the 10.0.0.43 IP.
For lack of better ideas I have used vercorp.org/VERCORP.ORG as domain/realm names and idm.vercorp.org as the FreeIPA/IDM hostname.
Details of FreeIPA/IDM idm.vercorp.org system below.
IP: 10.0.0.40/24
GW: 10.0.0.1
DNS: 1.1.1.1
hostname: idm.vercorp.org
domain: vercorp.org
realm: VERCORP.ORG
FreeBSD fbsd.vercorp.org system.
IP: 10.0.0.42/24
GW: 10.0.0.1
hostname: fbsd.vercorp.org
FreeBSD Jail fbsdjail.vercorp.org system.
IP: 10.0.0.43/24
GW: 10.0.0.1
hostname: fbsdjail.vercorp.org
If you are curious what is hidden in the 10.0.0.42 IP – then its a typical Alma Linux that I first used to try if the FreeIPA/IDM works at all π
FreeIPA Setup
Because Anaconda is far from being a usable installer – this is how the only enp0s3 interface config looks like after manual intervention.
[root@idm ~]# cat /etc/sysconfig/network-scripts/ifcfg-enp0s3
NAME=enp0s3
DEVICE=enp0s3
TYPE=Ethernet
BOOTPROTO=none
UUID=b49cd1ab-d3eb-421d-b408-c052acc077da
ONBOOT=yes
IPADDR=10.0.0.40
NETMASK=255.255.255.0
GATEWAY=10.0.0.1
IPV6INIT=no
DNS1=1.1.1.1
PROXY_METHOD=none
BROWSER_ONLY=no
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
Before we will go into setup procedures – we will update that Alma Linux system.
[root@idm ~]# yum update -y
[root@idm ~]# reboot
After the reboot we will disable the IPv6 stack for main interface (enp0s3) as FreeIPA installer has some problem with it. We do not need IPv6 here anyway so …
[root@idm ~]# cat << EOF >> /etc/sysctl.conf
# DISABLE IPv6 FOR MAIN enp0s3 INTERFACE
net.ipv6.conf.enp0s3.disable_ipv6=1
EOF
Lets set our FreeIPA/IDM hostname if we missed that at the Anaconda installer part. We will also setup the system time zone.
[root@idm ~]# hostnamectl set-hostname idm.vercorp.org
[root@idm ~]# hostnamectl
Static hostname: idm.vercorp.org
Icon name: computer-vm
Chassis: vm
Machine ID: b8bfb8bcc23147eb9cc7b62c72a09c32
Boot ID: 06158ef430d9467d959076ab4396314e
Virtualization: oracle
Operating System: AlmaLinux 8.6 (Sky Tiger)
CPE OS Name: cpe:/o:almalinux:almalinux:8::baseos
Kernel: Linux 4.18.0-372.26.1.el8_6.x86_64
Architecture: x86-64
[root@idm ~]# timedatectl set-timezone Europe/Warsaw
[root@idm ~]# timedatectl set-local-rtc 0
[root@idm ~]#Β timedatectl
Local time: Mon 2022-10-17 15:08:28 CEST
Universal time: Mon 2022-10-17 13:08:28 UTC
RTC time: Sat 2022-10-15 00:28:10
Time zone: Europe/Warsaw (CEST, +0200)
System clock synchronized: yes
NTP service: inactive
RTC in local TZ: no
Lets add the system IP and name to the /etc/hosts file now.
[root@idm ~]# echo "$( hostname -i | awk '{print $NF}' ) $( hostname ) $( hostname -s )" >> /etc/hosts
[root@idm ~]# grep idm /etc/hosts
10.0.0.40 idm.vercorp.org idm
[root@idm ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.40 idm.vercorp.org idm
We need to enable the FreeIPA/IDM module in yum(8).
[root@idm ~]# yum module list idm
Last metadata expiration check: 0:00:31 ago on Tue 18 Oct 2022 01:02:51 PM CEST.
AlmaLinux 8 - AppStream
Name Stream Profiles Summary
idm DL1 adtrust, client, common [d], dns, server The Red Hat Enterprise Linux Identity Management system module
idm client [d] common [d] RHEL IdM long term support client module
Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled
[root@idm ~]# yum module enable idm:DL1 -y
Last metadata expiration check: 0:01:06 ago on Tue 18 Oct 2022 01:02:51 PM CEST.
Dependencies resolved.
=====================================================================================================
Package Architecture Version Repository Size
=====================================================================================================
Enabling module streams:
389-ds 1.4
httpd 2.4
idm DL1
pki-core 10.6
pki-deps 10.6
Transaction Summary
=====================================================================================================
Complete!
Some additional step needed.
[root@idm ~]# yum distro-sync
Last metadata expiration check: 0:10:07 ago on Mon 17 Oct 2022 03:14:32 PM CEST.
Dependencies resolved.
Nothing to do.
Complete!
We will now install FreeIPA/IDM with DNS as this setup is the most simplistic one. We focus on FreeBSD part here in that article.
[root@idm ~]# yum install -y bind-utils chrony nc
[root@idm ~]# yum module install idm:DL1/dns -y
One can use the ‘interactive’ installer and answer ‘by hand’ for all the asked questions – but to be honest I prefer to type my command once and make it ‘happen’ altogether without my time wasted.
As you probably guessed – we will use the unattended mode for the FreeIPA/IDM installer.
[root@idm ~]# ipa-server-install \
--domain vercorp.org \
--realm VERCORP.ORG \
--reverse-zone=0.0.10.in-addr.arpa. \
--no-forwarders \
--no-ntp \
--setup-dns \
--ds-password [password] \
--admin-password [password] \
--unattended
Checking DNS domain 0.0.10.in-addr.arpa., please wait ...
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
Version 4.9.8
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure DNS (bind)
* Configure SID generation
* Configure the KDC to enable PKINIT
Excluded by options:
* Configure the NTP client (chronyd)
Warning: skipping DNS resolution of host idm.vercorp.org
Checking DNS domain vercorp.org., please wait ...
Checking DNS domain 0.0.10.in-addr.arpa., please wait ...
Checking DNS domain 0.0.10.in-addr.arpa., please wait ...
Using reverse zone(s) 0.0.10.in-addr.arpa.
Trust is configured but no NetBIOS domain name found, setting it now.
The IPA Master Server will be configured with:
Hostname: idm.vercorp.org
IP address(es): 10.0.0.40
Domain name: vercorp.org
Realm name: VERCORP.ORG
The CA will be configured with:
Subject DN: CN=Certificate Authority,O=VERCORP.ORG
Subject base: O=VERCORP.ORG
Chaining: self-signed
BIND DNS server will be configured to serve IPA domain with:
Forwarders: No forwarders
Forward policy: only
Reverse zone(s): 0.0.10.in-addr.arpa.
Disabled p11-kit-proxy
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/41]: creating directory server instance
Validate installation settings ...
Create file system structures ...
Perform SELinux labeling ...
Create database backend: dc=vercorp,dc=org ...
Perform post-installation tasks ...
[2/41]: tune ldbm plugin
[3/41]: adding default schema
[4/41]: enabling memberof plugin
[5/41]: enabling winsync plugin
[6/41]: configure password logging
[7/41]: configuring replication version plugin
[8/41]: enabling IPA enrollment plugin
[9/41]: configuring uniqueness plugin
[10/41]: configuring uuid plugin
[11/41]: configuring modrdn plugin
[12/41]: configuring DNS plugin
[13/41]: enabling entryUSN plugin
[14/41]: configuring lockout plugin
[15/41]: configuring topology plugin
[16/41]: creating indices
[17/41]: enabling referential integrity plugin
[18/41]: configuring certmap.conf
[19/41]: configure new location for managed entries
[20/41]: configure dirsrv ccache and keytab
[21/41]: enabling SASL mapping fallback
[22/41]: restarting directory server
[23/41]: adding sasl mappings to the directory
[24/41]: adding default layout
[25/41]: adding delegation layout
[26/41]: creating container for managed entries
[27/41]: configuring user private groups
[28/41]: configuring netgroups from hostgroups
[29/41]: creating default Sudo bind user
[30/41]: creating default Auto Member layout
[31/41]: adding range check plugin
[32/41]: creating default HBAC rule allow_all
[33/41]: adding entries for topology management
[34/41]: initializing group membership
[35/41]: adding master entry
[36/41]: initializing domain level
[37/41]: configuring Posix uid/gid generation
[38/41]: adding replication acis
[39/41]: activating sidgen plugin
[40/41]: activating extdom plugin
[41/41]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
[1/10]: adding kerberos container to the directory
[2/10]: configuring KDC
[3/10]: initialize kerberos container
[4/10]: adding default ACIs
[5/10]: creating a keytab for the directory
[6/10]: creating a keytab for the machine
[7/10]: adding the password extension to the directory
[8/10]: creating anonymous principal
[9/10]: starting the KDC
[10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa-custodia
[1/5]: Making sure custodia container exists
[2/5]: Generating ipa-custodia config file
[3/5]: Generating ipa-custodia keys
[4/5]: starting ipa-custodia
[5/5]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/29]: configuring certificate server instance
[2/29]: stopping certificate server instance to update CS.cfg
[3/29]: backing up CS.cfg
[4/29]: Add ipa-pki-wait-running
[5/29]: secure AJP connector
[6/29]: reindex attributes
[7/29]: exporting Dogtag certificate store pin
[8/29]: disabling nonces
[9/29]: set up CRL publishing
[10/29]: enable PKIX certificate path discovery and validation
[11/29]: authorizing RA to modify profiles
[12/29]: authorizing RA to manage lightweight CAs
[13/29]: Ensure lightweight CAs container exists
[14/29]: Ensuring backward compatibility
[15/29]: starting certificate server instance
[16/29]: configure certmonger for renewals
[17/29]: requesting RA certificate from CA
[18/29]: publishing the CA certificate
[19/29]: adding RA agent as a trusted user
[20/29]: configure certificate renewals
[21/29]: Configure HTTP to proxy connections
[22/29]: updating IPA configuration
[23/29]: enabling CA instance
[24/29]: importing IPA certificate profiles
[25/29]: migrating certificate profiles to LDAP
[26/29]: adding default CA ACL
[27/29]: adding 'ipa' CA entry
[28/29]: configuring certmonger renewal for lightweight CAs
[29/29]: deploying ACME service
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv)
[1/3]: configuring TLS for DS instance
[2/3]: adding CA certificate entry
[3/3]: restarting directory server
Done configuring directory server (dirsrv).
Configuring ipa-otpd
[1/2]: starting ipa-otpd
[2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd)
[1/22]: stopping httpd
[2/22]: backing up ssl.conf
[3/22]: disabling nss.conf
[4/22]: configuring mod_ssl certificate paths
[5/22]: setting mod_ssl protocol list
[6/22]: configuring mod_ssl log directory
[7/22]: disabling mod_ssl OCSP
[8/22]: adding URL rewriting rules
[9/22]: configuring httpd
Nothing to do for configure_httpd_wsgi_conf
[10/22]: setting up httpd keytab
[11/22]: configuring Gssproxy
[12/22]: setting up ssl
[13/22]: configure certmonger for renewals
[14/22]: publish CA cert
[15/22]: clean up any existing httpd ccaches
[16/22]: enable ccache sweep
[17/22]: configuring SELinux for httpd
[18/22]: create KDC proxy config
[19/22]: enable KDC proxy
[20/22]: starting httpd
[21/22]: configuring httpd to start on boot
[22/22]: enabling oddjobd
Done configuring the web interface (httpd).
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
[4/10]: enabling DS global lock
[5/10]: disabling Schema Compat
[6/10]: starting directory server
[7/10]: upgrading server
[8/10]: stopping directory server
[9/10]: restoring configuration
[10/10]: starting directory server
Done.
Restarting the KDC
dnssec-validation yes
Configuring DNS (named)
[1/12]: generating rndc key file
[2/12]: adding DNS container
[3/12]: setting up our zone
[4/12]: setting up reverse zone
[5/12]: setting up our own record
[6/12]: setting up records for other masters
[7/12]: adding NS record to the zones
[8/12]: setting up kerberos principal
[9/12]: setting up named.conf
created new /etc/named.conf
created named user config '/etc/named/ipa-ext.conf'
created named user config '/etc/named/ipa-options-ext.conf'
created named user config '/etc/named/ipa-logging-ext.conf'
[10/12]: setting up server configuration
[11/12]: configuring named to start on boot
[12/12]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Restarting the web server to pick up resolv.conf changes
Configuring DNS key synchronization service (ipa-dnskeysyncd)
[1/7]: checking status
[2/7]: setting up bind-dyndb-ldap working directory
[3/7]: setting up kerberos principal
[4/7]: setting up SoftHSM
[5/7]: adding DNSSEC containers
[6/7]: creating replica keys
[7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records
Configuring SID generation
[1/8]: creating samba domain object
[2/8]: adding admin(group) SIDs
[3/8]: adding RID bases
[4/8]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[5/8]: activating sidgen task
[6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[7/8]: adding fallback group
[8/8]: adding SIDs to existing users and groups
This step may take considerable amount of time, please wait..
Done.
Configuring client side components
This program will set up IPA client.
Version 4.9.8
Using existing certificate '/etc/ipa/ca.crt'.
Client hostname: idm.vercorp.org
Realm: VERCORP.ORG
DNS Domain: vercorp.org
IPA Server: idm.vercorp.org
BaseDN: dc=vercorp,dc=org
Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring vercorp.org as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
* 53: bind
UDP Ports:
* 88, 464: kerberos
* 53: bind
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
3. Kerberos requires time synchronization between clients
and servers for correct operation. You should consider enabling chronyd.
Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful
[root@idm ~]#
Seems that all went well and now we have our FreeIPA/IDM installed.
Lets check several things.
[root@idm ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
[root@idm ~]# systemctl list-unit-files | grep ipa | grep service
ipa-ccache-sweep.service disabled
ipa-custodia.service disabled
ipa-dnskeysyncd.service disabled
ipa-healthcheck.service disabled
ipa-ods-exporter.service disabled
[email protected] static
ipa.service enabled
Seems to be installed and working.
What about the /etc/sssd/sssd.conf config.
[root@idm ~]# cat /etc/sssd/sssd.conf
[domain/vercorp.org]
id_provider = ipa
ipa_server_mode = True
ipa_server = idm.vercorp.org
ipa_domain = vercorp.org
ipa_hostname = idm.vercorp.org
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ifp, ssh, sudo
domains = vercorp.org
[nss]
homedir_substring = /home
memcache_timeout = 600
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
allowed_uids = ipaapi, root
[session_recording]
There is also /etc/ssh/ssh_config.d/04-ipa.conf file …
[root@idm ~]# cat /etc/ssh/ssh_config.d/04-ipa.conf
# IPA-related configuration changes to ssh_config
#
PubkeyAuthentication yes
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
#VerifyHostKeyDNS yes
# assumes that if a user does not have shell (/sbin/nologin),
# this will return nonzero exit code and proxy command will be ignored
Match exec true
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
For some reason we need to manually enable and start the Apache HTTP server.
[root@idm ~]# systemctl enable --now httpd
You can now access the FreeIPA/IDM at your browser on the http://idm.vercorp.org address. If you use the http://10.0.0.40 IP then you will be redirected to the http://idm.vercorp.org address so make sure you have added that host to your local /etc/hosts file.
On the second screen you will see that I have already created the vermaden user.
FreeBSD Client
UPDATE: Newer instructions for FreeBSD 13.2-RELEASE are available at the Connect FreeBSD 13.2 to FreeIPA/IDM article.
We will get straight into the point. After having FreeBSD 13.1-RELEASE installed in the most ‘default’ way in the bsdinstall(8) installer – the Auto ZFS road – we will now fetch the up to date FreeBSD Ports tree with portsnap(8) tool.
This is the main /etc/rc.conf config file.
# cat /etc/rc.conf
hostname="fbsd"
ifconfig_vtnet0="inet 10.0.0.42 netmask 255.255.255.0"
defaultrouter="10.0.0.1"
sshd_enable="YES"
moused_enable="YES"
dumpdev="AUTO"
zfs_enable="YES"
syslogd_flags="-ss"
sssd_enable="YES"
FreeBSD Packages
We need to have FreeBSD Ports tree.
# portsnap auto
Lets check what is the current default SAMBA version on FreeBSD.
# grep -i samba /usr/ports/Mk/*default*
PYTHON2 PYTHON3 RUBY RUST SAMBA SSL TCLTK VARNISH
SAMBA_DEFAULT?= 4.12
To omit a lot of pointless compilation I will first install all precompiled packages – that would also install needed dependencies. Then we will rebuild just the several needed packages.
# pkg install krb5 sudo cyrus-sasl cyrus-sasl-gssapi pam_mkhomedir openldap26-client samba412
Settings in the /etc/make.conf file.
# cat /etc/make.conf
# USE /usr/ports/obj PLACE
WRKDIRPREFIX=${PORTSDIR}/obj
OPTIONS_UNSET= DOCS EXAMPLES DEBUG X11
OPTIONS_UNSET+= DBUS GSSAPI_BASE GSSAPI_HEIMDAL
OPTIONS_SET+= GSSAPI_MIT
WITH_GSSAPI= yes
WANT_OPENLDAP_SASL= yes
Lets configure the needed ports.
# \
for I in /usr/ports/security/sudo \
/usr/ports/security/sssd \
/usr/ports/security/krb5 \
/usr/ports/security/cyrus-sasl2-gssapi \
/usr/ports/security/pam_mkhomedir \
/usr/ports/net/openldap26-client
do
make -C ${I} rmconfig
done
# \
for I in /usr/ports/security/sudo \
/usr/ports/security/sssd \
/usr/ports/security/krb5 \
/usr/ports/security/cyrus-sasl2-gssapi \
/usr/ports/security/pam_mkhomedir \
/usr/ports/net/openldap26-client
do
make -C ${I} config-recursive
done
The curses(3X) selection will look more or less like these below.
=> security/sudo | OPTIONS___________________________________________________________________________
[x] AUDIT Enable BSM audit support
[ ] DISABLE_AUTH Do not require authentication by default
[ ] DISABLE_ROOT_SUDO Do not allow root to run sudo
[ ] DOCS Build and/or install documentation
[ ] EXAMPLES Build and/or install examples
[ ] INSULTS Enable insults on failures
[x] LDAP LDAP protocol support
[ ] NLS Native Language Support
[ ] NOARGS_SHELL Run a shell if no arguments are given
[ ] OPIE Enable one-time passwords (no PAM support)
[ ] PAM Pluggable authentication module support
[ ] PYTHON Enable python plugin support
[x] SSSD Enable SSSD backend support.
=> security/sudo | Kerberos 5 Authentication (no PAM support)
( ) GSSAPI_BASE GSSAPI support via base system (needs Kerberos)
( ) GSSAPI_HEIMDAL GSSAPI support via security/heimdal
(*) GSSAPI_MIT GSSAPI support via security/krb5
=> security/sssd | OPTIONS___________________________________________________________________________
[ ] DOCS Build and/or install documentation
[x] SMB Install IPA and AD providers (requires Samba4)
=> security/cyrus-sasl2-gssapi | OPTIONS_____________________________________________________________
( ) GSSAPI_BASE GSSAPI support via base system (needs Kerberos)
( ) GSSAPI_HEIMDAL GSSAPI support via security/heimdal
(*) GSSAPI_MIT GSSAPI support via security/krb5
=> net/openldap26-client | OPTIONS___________________________________________________________________
[ ] DEBUG Build with debugging support
[ ] DOCS Build and/or install documentation
[ ] FETCH Enable fetch(3) support
[x] GSSAPI With GSSAPI support
=> security/krb5 | OPTIONS___________________________________________________________________________
[ ] DNS_FOR_REALM Enable DNS lookups for Kerberos realm names
[ ] EXAMPLES Build and/or install examples
[x] KRB5_HTML Install krb5 HTML documentation
[x] KRB5_PDF Install krb5 PDF documentation
[x] LDAP LDAP protocol support
[ ] LMDB OpenLDAP Lightning Memory-Mapped Database support
[ ] NLS Native Language Support
=> security/krb5 | Command Line Editing for kadmin and ktutil
(*) READLINE Command line editing via libreadline
( ) LIBEDIT Command line editing via libedit
We can now check what options have been saved.
# cat /var/db/ports/security_sudo-sssd/options
_OPTIONS_READ=sudo-sssd-1.9.11p3
_FILE_COMPLETE_OPTIONS_LIST=AUDIT DISABLE_AUTH DISABLE_ROOT_SUDO DOCS EXAMPLES INSULTS LDAP NLS NOARGS_SHELL OPIE PAM PYTHON SSSD GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
OPTIONS_FILE_SET+=AUDIT
OPTIONS_FILE_SET+=GSSAPI_MIT
OPTIONS_FILE_SET+=LDAP
OPTIONS_FILE_SET+=NLS
OPTIONS_FILE_SET+=SSSD
OPTIONS_FILE_UNSET+=DISABLE_AUTH
OPTIONS_FILE_UNSET+=DISABLE_ROOT_SUDO
OPTIONS_FILE_UNSET+=DOCS
OPTIONS_FILE_UNSET+=EXAMPLES
OPTIONS_FILE_UNSET+=GSSAPI_BASE
OPTIONS_FILE_UNSET+=GSSAPI_HEIMDAL
OPTIONS_FILE_UNSET+=INSULTS
OPTIONS_FILE_UNSET+=NOARGS_SHELL
OPTIONS_FILE_UNSET+=OPIE
OPTIONS_FILE_UNSET+=PAM
OPTIONS_FILE_UNSET+=PYTHON
# cat /var/db/ports/security_sssd/options
_OPTIONS_READ=sssd-1.16.5_6
_FILE_COMPLETE_OPTIONS_LIST=DOCS SMB
OPTIONS_FILE_UNSET+=DOCS
OPTIONS_FILE_SET+=SMB
# cat /var/db/ports/security_cyrus-sasl2/options
_OPTIONS_READ=cyrus-sasl-2.1.28
_FILE_COMPLETE_OPTIONS_LIST=ALWAYSTRUE AUTHDAEMOND DOCS KEEP_DB_OPEN OBSOLETE_CRAM_ATTR OBSOLETE_DIGEST_ATTR SASLDB_IN_VAR BDB1 BDB GDBM LMDB ANONYMOUS CRAM DIGEST LOGIN NTLM OTP PLAIN SCRAM
OPTIONS_FILE_SET+=ANONYMOUS
OPTIONS_FILE_SET+=AUTHDAEMOND
OPTIONS_FILE_SET+=BDB1
OPTIONS_FILE_SET+=CRAM
OPTIONS_FILE_SET+=DIGEST
OPTIONS_FILE_SET+=LOGIN
OPTIONS_FILE_SET+=NTLM
OPTIONS_FILE_SET+=OBSOLETE_CRAM_ATTR
OPTIONS_FILE_SET+=OBSOLETE_DIGEST_ATTR
OPTIONS_FILE_SET+=OTP
OPTIONS_FILE_SET+=PLAIN
OPTIONS_FILE_SET+=SCRAM
OPTIONS_FILE_UNSET+=ALWAYSTRUE
OPTIONS_FILE_UNSET+=BDB
OPTIONS_FILE_UNSET+=DOCS
OPTIONS_FILE_UNSET+=GDBM
OPTIONS_FILE_UNSET+=KEEP_DB_OPEN
OPTIONS_FILE_UNSET+=LMDB
OPTIONS_FILE_UNSET+=SASLDB_IN_VAR
# cat /var/db/ports/net_openldap26-client/options
_OPTIONS_READ=openldap26-client-2.6.3
_FILE_COMPLETE_OPTIONS_LIST=DEBUG DOCS FETCH GSSAPI
OPTIONS_FILE_SET+=GSSAPI
OPTIONS_FILE_UNSET+=DEBUG
OPTIONS_FILE_UNSET+=DOCS
OPTIONS_FILE_UNSET+=FETCH
# cat /var/db/ports/security_krb5/options
# This file is auto-generated by 'make config'.
# Options for krb5-1.20
_OPTIONS_READ=krb5-1.20
_FILE_COMPLETE_OPTIONS_LIST=DNS_FOR_REALM EXAMPLES KRB5_HTML KRB5_PDF LDAP LMDB NLS READLINE LIBEDIT
OPTIONS_FILE_UNSET+=DNS_FOR_REALM
OPTIONS_FILE_UNSET+=EXAMPLES
OPTIONS_FILE_SET+=KRB5_HTML
OPTIONS_FILE_SET+=KRB5_PDF
OPTIONS_FILE_SET+=LDAP
OPTIONS_FILE_UNSET+=LMDB
OPTIONS_FILE_SET+=NLS
OPTIONS_FILE_SET+=READLINE
OPTIONS_FILE_UNSET+=LIBEDIT
… and build them.
# \
for I in /usr/ports/security/sudo \
/usr/ports/security/sssd \
/usr/ports/security/krb5
/usr/ports/security/cyrus-sasl2-gssapi \
/usr/ports/security/pam_mkhomedir \
/usr/ports/net/openldap26-client \
do
make -C ${I} build
done
… unsinstall them and create their packages.
# \
for I in /usr/ports/security/sudo \
/usr/ports/security/sssd \
/usr/ports/security/krb5
/usr/ports/security/cyrus-sasl2-gssapi \
/usr/ports/security/pam_mkhomedir \
/usr/ports/net/openldap26-client \
do
make -C ${I} deinstall package
done
After some time we have our built packages.
# find /usr/ports/obj/ -name \*.pkg
/usr/ports/obj/usr/ports/lang/perl5.32/work/perl-5.32.1/symbian/ext/Moped/Msg/Msg.pkg
/usr/ports/obj/usr/ports/security/pam_mkhomedir/work/pkg/pam_mkhomedir-0.2.pkg
/usr/ports/obj/usr/ports/security/cyrus-sasl2-gssapi/work/pkg/cyrus-sasl-gssapi-2.1.28.pkg
/usr/ports/obj/usr/ports/security/krb5/work/pkg/krb5-1.20.pkg
/usr/ports/obj/usr/ports/security/sudo/work/pkg/sudo-1.9.11p3.pkg
/usr/ports/obj/usr/ports/security/sssd/work-default/pkg/sssd-1.16.5_6.pkg
/usr/ports/obj/usr/ports/net/openldap26-client/work/pkg/openldap26-client-2.6.3.pkg
In the future I need to add some short guide to build them regularly with Synth or Poudriere π
Now we need to install these packages in quite nontypical way. One by one – in specified order. It will not be needed it we would have a separate additional pkg(8) repository with Poudriere build packages.
Our packages:
# ls -1 *.pkg
cyrus-sasl-gssapi-2.1.28.pkg
krb5-1.20.pkg
openldap26-client-2.6.3.pkg
pam_mkhomedir-0.2.pkg
sssd-smb4-1.16.5_6.pkg
sudo-sssd-1.9.11p3.pkg
… and their install process.
# pkg install -y c-ares
# pkg add sssd-smb4-1.16.5_6.pkg
# pkg install -y cyrus-sasl-gssapi-2.1.28.pkg
(...)
New packages to be INSTALLED:
cyrus-sasl: 2.1.28
cyrus-sasl-gssapi: 2.1.28
krb5: 1.20
(...)
# pkg delete -f -y krb5
(...)
Installed packages to be REMOVED:
krb5: 1.20
(...)
# pkg add krb5-1.20.pkg
# pkg install -y sssd
# pkg add sudo-sssd-1.9.11p3.pkg
# pkg delete -f -y sssd
(...)
Installed packages to be REMOVED:
sssd: 1.16.5_6
(...)
# pkg install ding-libs ldb21 nspr nss pcre samba412
# pkg add sssd-smb4-1.16.5_6.pkg
FreeBSD Setup
Create needed dirs.
# mkdir -p \
/usr/local/etc/ipa \
/var/log/sssd \
/var/run/sss/private \
/var/db/sss
Set system hostname.
# hostname fbsd.vercorp.org
# hostname
fbsd.vercorp.org
Fetch the FreeIPA/IDM certificate.
# fetch -o /usr/local/etc/ipa/ca.crt http://10.0.0.40/ipa/config/ca.crt
FreeIPA/IDM Setup Part
We need to execute several instructions on the FreeIPA/IDM to connect FreeBSD client to it.
Its adding the A and PTR records in DNS for the 10.0.0.42 address and adding the fbsd.vercorp.org host.
We also need to generate the key for our fbsd.vercorp.org system.
[root@idm ~]# kinit admin
Password for admin@VERCORP.ORG:
[root@idm ~]# ipa dnsrecord-add vercorp.org fbsd --a-rec=10.0.0.42 --a-create-reverse
Record name: fbsd
A record: 10.0.0.42
[root@idm ~]# ipa host-add fbsd.vercorp.org
-----------------------------
Added host "fbsd.vercorp.org"
-----------------------------
Host name: fbsd.vercorp.org
Principal name: host/fbsd.vercorp.org@VERCORP.ORG
Principal alias: host/fbsd.vercorp.org@VERCORP.ORG
Password: False
Keytab: False
Managed by: fbsd.vercorp.org
[root@idm ~]# ipa-getkeytab -s idm.vercorp.org -p host/[email protected] -k /root/fbsd.vercorp.org.keytab
Keytab successfully retrieved and stored in: /root/fbsd.vercorp.org.keytab
Now we need to get ‘our’ key from FreeIPA/IDM server … along with proper /etc/hosts file.
# scp [email protected]:/root/fbsd.vercorp.org.keytab /usr/local/etc/ipa/krb5.keytab
# cat << EOF > /etc/hosts
::1 localhost localhost.my.domain
127.0.0.1 localhost localhost.my.domain
10.0.0.40 idm.vercorp.org idm
10.0.0.42 fbsd.vercorp.org fbsd
EOF
Now the /usr/local/etc/openldap/ldap.conf file.
# cat << EOF > /usr/local/etc/openldap/ldap.conf
BASE dc=org,dc=vercorp
URI ldap://idm.vercorp.org/
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
SASL_MECH GSSAPI
SASL_REALM VERCORP.ORG
ssl start_tls
TLS_CACERT /usr/local/etc/ipa/ca.crt
EOF
… and /etc/krb5.conf file.
# cat << EOF > /etc/krb5.conf
[libdefaults]
default_realm = VERCORP.ORG
default_keytab_name = FILE:/usr/local/etc/ipa/krb5.keytab
default_tkt_enctypes = aes256-cts des-cbc-crc aes128-cts arcfour-hmac
default_tgs_enctypes = aes256-cts des-cbc-crc aes128-cts arcfour-hmac
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
ticket_lifetime = 24h
forwardable = yes
[realms]
VERCORP.ORG = {
kdc = idm.vercorp.org:88
master_kdc = idm.vercorp.org:88
admin_server = idm.vercorp.org:749
default_domain = vercorp.org
pkinit_anchors = FILE:/usr/local/etc/ipa/ca.crt
}
[domain_realm]
.vercorp.org = VERCORP.ORG
vercorp.org = VERCORP.ORG
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmin.log
kadmin_local = FILE:/var/log/krb5/kadmin_local.log
default = FILE:/var/log/krb5/krb5lib.log
EOF
… and /usr/local/etc/sssd/sssd.conf file.
# cat << EOF > /usr/local/etc/sssd/sssd.conf
[domain/vercorp.org]
# debug_level = 9
cache_credentials = True
krb5_store_password_if_offline = True
krb5_realm = VERCORP.ORG
ipa_domain = vercorp.org
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = fbsd.vercorp.org
chpass_provider = ipa
ipa_server = _srv_, idm.vercorp.org
ldap_tls_cacert = /usr/local/etc/ipa/ca.crt
krb5_keytab = /usr/local/etc/ipa/krb5.keytab
[sssd]
services = nss, pam, ssh, sudo
config_file_version = 2
domains = vercorp.org
[nss]
filter_users = root,toor
homedir_substring = /usr/home/%u
[pam]
[sudo]
# debug_level = 0x3ff0
[ssh]
EOF
# chmod 600 /usr/local/etc/sssd/sssd.conf
FreeBSD have user account under /usr/home to make sure /home also points there.
# ln -s /usr/home /home
The automatic startup of sssd(8) daemon (not to confuse with sshd(8)) needs to be also configured.
# sysrc sssd_enable=YES
# service sssd start
We also need to configure /etc/nsswitch.conf file.
# cp /etc/nsswitch.conf /etc/nsswitch.conf.BCK
# diff -u /etc/nsswitch.conf.BCK /etc/nsswitch.conf
--- /etc/nsswitch.conf.BCK 2022-10-24 20:10:09.163251000 +0200
+++ /etc/nsswitch.conf 2022-10-24 20:10:57.207406000 +0200
@@ -2,15 +2,17 @@
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD$
#
-group: compat
+group: files sss
group_compat: nis
hosts: files dns
-netgroup: compat
+# netgroup: compat
networks: files
-passwd: compat
+passwd: files sss
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
+sudoers: sss files
+netgroup: files
The final /etc/nsswitch.conf file looks as follows.
# cat /etc/nsswitch.conf
#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD$
#
group: files sss
group_compat: nis
hosts: files dns
# netgroup: compat
networks: files
passwd: files sss
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
sudoers: sss files
netgroup: files
Now the /etc/pam.d/system file.
# cp /etc/pam.d/system /root/etc---pam.d---system.BCK
# diff -u /root/etc---pam.d---system.BCK /etc/pam.d/system
--- /root/etc---pam.d---system.BCK 2022-10-24 20:13:05.546657000 +0200
+++ /etc/pam.d/system 2022-10-24 20:16:36.722666000 +0200
@@ -7,19 +7,23 @@
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
-#auth sufficient pam_krb5.so no_warn try_first_pass
+auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
+auth sufficient /usr/local/lib/pam_sss.so use_first_pass
auth required pam_unix.so no_warn try_first_pass nullok
# account
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
+account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail
# session
#session optional pam_ssh.so want_agent
session required pam_lastlog.so no_fail
+session required /usr/local/lib/pam_mkhomedir.so mode=0700
# password
#password sufficient pam_krb5.so no_warn try_first_pass
+password sufficient /usr/local/lib/pam_sss.so use_authtok
password required pam_unix.so no_warn try_first_pass
The final /etc/pam.d/system file looks as follows.
# cat /etc/pam.d/system
#
# $FreeBSD$
#
# System-wide defaults
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth sufficient /usr/local/lib/pam_sss.so use_first_pass
auth required pam_unix.so no_warn try_first_pass nullok
# account
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail
# session
#session optional pam_ssh.so want_agent
session required pam_lastlog.so no_fail
session required /usr/local/lib/pam_mkhomedir.so mode=0700
# password
#password sufficient pam_krb5.so no_warn try_first_pass
password sufficient /usr/local/lib/pam_sss.so use_authtok
password required pam_unix.so no_warn try_first_pass
Now its time for /etc/pam.d/sshd file.
# cp /etc/pam.d/sshd /root/etc---pam.d---sshd.BCK
# diff -u /root/etc---pam.d---sshd.BCK /etc/pam.d/sshd
--- /root/etc---pam.d---sshd.BCK 2022-10-24 20:17:34.063630000 +0200
+++ /etc/pam.d/sshd 2022-10-24 20:19:16.165810000 +0200
@@ -7,8 +7,9 @@
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
-#auth sufficient pam_krb5.so no_warn try_first_pass
+auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
+auth sufficient /usr/local/lib/pam_sss.so use_first_pass
auth required pam_unix.so no_warn try_first_pass
# account
@@ -16,11 +17,14 @@
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
+account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail
# session
#session optional pam_ssh.so want_agent
session required pam_permit.so
+session required /usr/local/lib/pam_mkhomedir.so mode=0700
# password
#password sufficient pam_krb5.so no_warn try_first_pass
+password sufficient /usr/local/lib/pam_sss.so use_authtok
password required pam_unix.so no_warn try_first_pass
Final /etc/pam.d/sshd file below.
# cat /etc/pam.d/sshd
#
# $FreeBSD$
#
# PAM configuration for the "sshd" service
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth sufficient /usr/local/lib/pam_sss.so use_first_pass
auth required pam_unix.so no_warn try_first_pass
# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail
# session
#session optional pam_ssh.so want_agent
session required pam_permit.so
session required /usr/local/lib/pam_mkhomedir.so mode=0700
# password
#password sufficient pam_krb5.so no_warn try_first_pass
password sufficient /usr/local/lib/pam_sss.so use_authtok
password required pam_unix.so no_warn try_first_pass
Small modification in the /etc/ssh/ssh_config and /etc/ssh/sshd_config files.
# cat << EOF >> /etc/ssh/ssh_config
GSSAPIAuthentication yes
EOF
# cat << EOF >> /etc/ssh/sshd_config
GSSAPIAuthentication yes
UsePAM yes
EOF
Finish Setup with Web Browser in FreeIPA/IDM Page
Visit the https://idm.vercorp.org/ipa/ui/#/e/hbacrule/details/freebsd page.
Next create the HBAC Rule named freebsd as showed below.
… and the Sudo Rule named freebsd name.
FreeBSD FreeIPA Login Test
After all these time consuming and pointless instructions we can now finally try to login to our FreeBSD client.
% ssh -l vermaden 10.0.0.42
([email protected]) Password:
Last login: Mon Oct 24 21:06:36 2022 from 10.0.0.3
FreeBSD 13.1-RELEASE releng/13.1-n250148-fc952ac2212 GENERIC
Welcome to FreeBSD!
Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories: https://www.FreeBSD.org/security/
FreeBSD Handbook: https://www.FreeBSD.org/handbook/
FreeBSD FAQ: https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums: https://forums.FreeBSD.org/
Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with: pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.
Show the version of FreeBSD installed: freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages: man man
FreeBSD directory layout: man hier
To change this login announcement, see motd(5).
You can upload the dmesg of your system to help developers get an overview of commonly
used hardware and peripherals for FreeBSD. Use the curl package to upload it like this:
curl -v -d "nickname=$USER" -d "description=FreeBSD/$(uname -m) on \
$(kenv smbios.system.maker) $(kenv smbios.system.product)" -d "do=addd" \
--data-urlencode 'dmesg@/var/run/dmesg.boot' http://dmesgd.nycbug.org/index.cgi
vermaden@fbsd:~ $ :> ~/.hushlogin
vermaden@fbsd:~ $ id
uid=1408200003(vermaden) gid=1408200000(admins) groups=1408200000(admins)
vermaden@fbsd:~ $ pwd
/home/vermaden
vermaden@fbsd:~ $ grep vermaden /etc/passwd /etc/group
vermaden@fbsd:~ $
vermaden@fbsd:~ $ getent passwd vermaden
vermaden:*:1408200003:1408200000:vermaden vermaden:/home/vermaden:/bin/sh
vermaden@fbsd:~ $ sudo su -
Password for vermaden@VERCORP.ORG:
root@fbsd:~ # logout
vermaden@fbsd:~ $ sudo -i
root@fbsd:~ #
Strange … seems to work properly π
FreeBSD Jail as FreeIPA/IDM Client
As ‘full’ FreeBSD system is able to connect to the FreeIPA/IDM server we will not configure FreeBSD Jail to do the same.
The FreeIPA/IDM FreeBSD client fbsdjail.vercorp.orgwill get the 10.0.0.43 IP.
Basic FreeBSD Jail Preparations
Lets setup the Jail for a start.
# mkdir -p /jail/fbsdjail /jail/BASE
# cd /jail/fbsdjail
# fetch -o /jail/BASE/13.1-RELEASE-base.txz https://download.freebsd.org/ftp/releases/amd64/13.1-RELEASE/base.txz
# tar --unlink -xvf ../BASE/13.1-RELEASE-base.txz
# cat << EOF > /etc/jail.conf
# GLOBAL
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
exec.consolelog = "/var/log/jail_${name}_console.log";
mount.devfs;
host.hostname = ${name};
path = /jail/${name};
# JAILS
fbsdjail {
ip4.addr = 10.0.0.43;
host.hostname = fbsdjail.vercorp.org;
interface = wlan0;
allow.raw_sockets;
allow.sysvipc;
}
EOF
# cat /etc/resolv.conf | tee /jail/fbsdjail/etc/resolv.conf
nameserver 10.0.0.1
# echo 10.0.0.43 fbsdjail.vercorp.org fbsdjail | tee -a /etc/hosts | tee -a /jail/fbsdjail/etc/hosts
# cat /etc/hosts /jail/fbsdjail/etc/hosts
10.0.0.43 fbsdjail.vercorp.org fbsdjail
10.0.0.43 fbsdjail.vercorp.org fbsdjail
# cat << EOF > /jail/fbsdjail/etc/rc.conf
# DAEMONS | yes
syslogd_flags="-ss"
sshd_enable=YES
# OTHER
clear_tmp_enable=YES
clear_tmp_X=YES
dumpdev=NO
update_motd=NO
EOF
# sed -i '' s/quarterly/latest/g /jail/fbsdjail/etc/pkg/FreeBSD.conf
# grep latest /jail/fbsdjail/etc/pkg/FreeBSD.conf
url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest",
Now we can start our FreeBSD Jail.
# service jail onestart fbsdjail
Starting jails: fbsdjail.
# jls
JID IP Address Hostname Path
1 10.0.0.43 fbsdjail.vercorp.org /jail/fbsdjail
# jls -v
JID Hostname Path
Name State
CPUSetID
IP Address(es)
1 fbsdjail.vercorp.org /jail/fbsdjail
fbsdjail ACTIVE
3
10.0.0.43
# jexec fbsdjail
root@fbsdjail:/ #
Our FreeBSD Jail works. Lets move to next steps.
Configure FreeBSD Jail to Connect to FreeIPA/IDM Server
I could not repaste all of the instructions above – the ones that we used for a ‘full’ FreeBSD system – but the same applies to a FreeBSD Jail. π
This means that earlier Basic FreeBSD Jail Preparations section covers all that is needed in case of ‘full’ FreeBSD versus FreeBSD Jail when it comes to the FreeIPA/IDM connection.
Linux FreeIPA/IDM Client
This article is not about Linux client – which is pretty straight-forward to connect to the FreeIPA/IDM server – but for the completness of the topic – here are the instructions I used to attach Alma Linux to the FreeIPA/IDM server.
Linux rhlike.vercorp.org system.
IP: 10.0.0.41/24
GW: 10.0.0.1
hostname: rhlike.vercorp.org
First – install the @idm:client and sssd packages.
client # yum -y install @idm:client sssd
FreeIPA/IDM Setup Part
Now – as earlier with FreeBSD – the FreeIPA/IDM part comes to play.
[root@idm ~]# kinit admin
Password for [email protected]:
[root@idm ~]# klist
Ticket cache: KCM:0
Default principal: [email protected]
Valid starting Expires Service principal
10/19/2022 13:33:52 10/20/2022 13:11:28 krbtgt/[email protected]
[root@idm ~]# ipa user-find
---------------
2 users matched
---------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
Principal alias: [email protected], [email protected]
UID: 1896600000
GID: 1896600000
Account disabled: False
User login: vermaden
First name: vermaden
Last name: vermaden
Home directory: /home/vermaden
Login shell: /bin/sh
Principal name: [email protected]
Principal alias: [email protected]
Email address: [email protected]
UID: 1896600003
GID: 1000
Account disabled: False
----------------------------
Number of entries returned 2
----------------------------
[root@idm ~]# id vermaden
uid=1408200003(vermaden) gid=1408200000(admins) groups=1408200000(admins)
[root@idm ~]# ipa dnsrecord-add vercorp.org rhlike --a-rec 10.0.0.41
Record name: rhlike
A record: 10.0.0.41
We are done on the FreeIPA/IDM side.
Linux FreeIPA/IDM Client Setup
We will now continue our work on the Linux client.
client # echo "10.0.0.40 idm.vercorp.org" >> /etc/hosts
client # echo "10.0.0.41 rhlike.vercorp.org" >> /etc/hosts
client # hostnamectl set-hostname rhlike.vercorp.org
client # cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.40 idm.vercorp.org
10.0.0.41 rhlike.vercorp.org
client # ipa-client-install --uninstall
client # ipa-client-install \
--hostname=rhlike.vercorp.org \
--mkhomedir \
--server=idm.vercorp.org \
--domain vercorp.org \
--realm VERCORP.ORG
This program will set up IPA client.
Version 4.9.8
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Do you want to configure chrony with NTP server or pool address? [no]: no
Client hostname: rhlike.vercorp.org
Realm: VERCORP.ORG
DNS Domain: vercorp.org
IPA Server: idm.vercorp.org
BaseDN: dc=vercorp,dc=org
Continue to configure the system with these values? [no]: yes
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Time synchronization was successful.
User authorized to enroll computers: admin
Password for admin@VERCORP.ORG:
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=VERCORP.ORG
Issuer: CN=Certificate Authority,O=VERCORP.ORG
Valid From: 2022-10-18 14:52:50
Valid Until: 2042-10-18 14:52:50
Enrolled in IPA realm VERCORP.ORG
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm VERCORP.ORG
Systemwide CA database updated.
Hostname (rhlike.vercorp.org) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host rhlike.vercorp.org: 10.0.0.41.
Missing reverse record(s) for address(es): 10.0.0.41.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring vercorp.org as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
client # reboot
Now we will test how it goes with login against the FreeIPA/IDM server.
laptop % ssh -l vermaden 10.0.0.41
([email protected]) Password:
([email protected]) Password expired. Change your password now.
Current Password:
([email protected]) New password:
([email protected]) Retype new password:
Last failed login: Wed Oct 19 00:47:57 CEST 2022 from 10.0.0.3 on ssh:notty
There was 1 failed login attempt since the last successful login.
/usr/bin/id: cannot find name for group ID 1000
[vermaden@rhlike ~]$ w
00:48:16 up 29 min, 2 users, load average: 0.22, 0.13, 0.16
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 10.0.0.3 00:40 58.00s 0.03s 0.03s -bash
vermaden pts/1 10.0.0.3 00:48 0.00s 0.02s 0.01s w
[vermaden@rhlike ~]$ sudo su -
[root@rhlike ~]# getent passwd admin
admin:*:1896600000:1896600000:Administrator:/home/admin:/bin/bash
[root@rhlike ~]# getent passwd vermaden
vermaden:*:1896600003:1000:vermaden vermaden:/home/vermaden:/bin/sh
Seems to work at least OK π
I do not have anything more to add to this guide.
If you have – then please let me know in comments π
Regards.
EOF
ππππππππ 