I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm.
Uncategorized
9
Posts
4
Posters
43
Views
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
This looks a lot more useful then what I was able to achieve with my earlier guides.
Thank You a lot for writing it and sharing it with me.
-
This looks a lot more useful then what I was able to achieve with my earlier guides.
Thank You a lot for writing it and sharing it with me.
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
-
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
Still great improvement IMHO.
I really waited for MIT Kerberos implementation to be placed in the FreeBSD Base System instead of Heimdal one and since it finally landed for 15.0 it starts to pay off.
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
-
@marzlberger I highly doubt that this is practical. It might be possible (manually), but there's a lot of dependencies, manual steps and required deep levels of understanding. If you'd want a similar result on FreeBSD, just using an LDAP server and MIT Kerberos would almost guranteed be the better approach.
-
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
By the way ... have You tried if your setup works with Samba? ... or with NFSv4?
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
@Larvitz this looks correct, almost identical to how I've done it at $corp jobs but we didn't use freeIPA
only thing missing is putting the sudo rules in LDAP too -
By the way ... have You tried if your setup works with Samba? ... or with NFSv4?
@vermaden NFSv4 Client with Kerberos works just fine. I just tried it and can mount shares from my kerberized NAS and it’s using the krb auth for authentication. Share mounts cleanly on BSD, uid and gid resolves cleanly, all looking fine.
Haven’t tried NFS server or samba.
-
undefined stefano@mastodon.bsd.cafe shared this topic on
Gli ultimi otto messaggi ricevuti dalla Federazione
-
My youngest dog always walks around the house and back yard like he's ancient. Like, wobbling along like he's in pain, kinda limping. But, when we're on a walk or he's off-lead in the forest, he's like a rocket, absolutely full-tilt 100% of the time, not a care in the world, no think just run. No trace of a limp, seemingly no problems.
I think he's just really lazy when he's somewhere boring? Like a sullen teenager ambling through the halls at school.
-
Al posto di Gassman per interpretare l'avvocato Guerrieri sarebbe stato meglio
-
Point of order.
CAMH in Houston is:
https://en.wikipedia.org/wiki/Contemporary_Arts_Museum_Houston
CAMH in Toronto is:
https://en.wikipedia.org/wiki/Centre_for_Addiction_and_Mental_Health
You were possibly thinking of this other Toronto institution?
-
@marble Bean,
-
@mcc Tbh the bean could be anything and people would still want to come to see it. Weird how that works lol.
-
@mcc
It’s breaking my brain on a budget.
-
@cretinodicrescenzago @enverdemichelis @las_lallero @francommit
Ora che finalmente conosciamo e coltiviamo i kumquat è arrivato finalmente il tempo dello sdoganamento... 😂😂
-
@mcc some bean flicking
