I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm.
Uncategorized
9
Posts
4
Posters
0
Views
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
This looks a lot more useful then what I was able to achieve with my earlier guides.
Thank You a lot for writing it and sharing it with me.
-
This looks a lot more useful then what I was able to achieve with my earlier guides.
Thank You a lot for writing it and sharing it with me.
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
-
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
Still great improvement IMHO.
I really waited for MIT Kerberos implementation to be placed in the FreeBSD Base System instead of Heimdal one and since it finally landed for 15.0 it starts to pay off.
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
-
@marzlberger I highly doubt that this is practical. It might be possible (manually), but there's a lot of dependencies, manual steps and required deep levels of understanding. If you'd want a similar result on FreeBSD, just using an LDAP server and MIT Kerberos would almost guranteed be the better approach.
-
@vermaden I only used native FreeBSD primitives. Native Kerberos, nslcd (from ports/pkg) and openssh.
The only step that can't be done on BSD is the Keytab generation (that needs to be done on linux and then copied over).
It's super robust. I rolled that out on my homelab this weekend 🙂
By the way ... have You tried if your setup works with Samba? ... or with NFSv4?
-
I’ve documented a clean, native way to integrate FreeBSD 15 into a FreeIPA realm. No heavy dependencies, no Python shims, just pure Kerberos (GSSAPI) and nslcd.
We get full SSH SSO, automated home directories, and centralized sudo rules using standard BSD tools. Pure, stateless, and sane.
@Larvitz this looks correct, almost identical to how I've done it at $corp jobs but we didn't use freeIPA
only thing missing is putting the sudo rules in LDAP too -
By the way ... have You tried if your setup works with Samba? ... or with NFSv4?
@vermaden NFSv4 Client with Kerberos works just fine. I just tried it and can mount shares from my kerberized NAS and it’s using the krb auth for authentication. Share mounts cleanly on BSD, uid and gid resolves cleanly, all looking fine.
Haven’t tried NFS server or samba.
-
undefined stefano@mastodon.bsd.cafe shared this topic
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@quinta
Per motivi che meriterebbero un approfondimento, l'opinione pubblica nostrana - operatori e consumatori dell'informazione - preferisce raccontarsi un'Italia e un'Europa deboli, inerti, inconcludenti, passive, destinate alla capitolazione. Dai toni sembra quasi esserci una specie di compiacimento...
-
-
-
-
-
@stefano You too Stefano. #HaveAgreatWeek
-
@randahl Hi Randahl! It's lunch break for me and I was finally ready to watch your video "Why Trump's regime will fall" but I cannot find it on YouTube. The most recent video on your channel is from 3 months ago 😭 Were you censored? Eager to watch your video, now more than ever
-
Tanta roba. Quanto il suo quasi omologo Borja Valero che chiuse la sua carriera nel C.S. Lebowski, praticamente la squadra di un centro sociale fiorentino 🔝🔝🔝. Insulti omofobi contro Borja Iglesias: i tifosi si dipingono le unghie di celeste | Goal.com Italia https://www.goal.com/it/liste/insulti-omofobi-contro-borja-iglesias-i-tifosi-si-dipingono-le-unghie-di-celeste/bltf2250a701979a9e5
