by cullumsmith
3 subcomments
- Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers."
OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database.
The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutable... Nowadays an LLM could do it for you at least.
At $job we use Linux / sssd, and I always found it super bloated and rather unreliable. It's nice coming home to FreeBSD and old boring stuff like pam_krb5 and nslcd. It just works.
The "ipa" command provided by FreeIPA for managing users/groups/etc is super convenient though.
- I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
by sidkshatriya
1 subcomments
- First, I read (article referred to in blog post):
https://blog.hofstede.it/integrating-freebsd-15-with-freeipa... [1] .
_Only then_ I read https://vermaden.wordpress.com/2026/02/18/native-freebsd-ker... [2]
[1] is more high level. [2] is a bit more detailed.
- Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal
Better yet you’ll want to encrypt that file in some way when transferring it
- Is there a simpler system for a small local network? For my home lab use case, it is almost sufficient to rsync /etc/{passwd,group,hosts,…..} - I manually sync them because changes are few and far between.
I wanted to set up a central authority - i don’t care about multi master or even resilience to failure in that central authority.
But even a small setup is relatively complicated. I remember yp setup in the early ‘90s looked complicated but it is a piece of cake compared to modern systems. They provide a lot, but they don’t scale down - and it feels to me that they are complicated much more than is required for their feature list.
Take LDAP, for example - it is only “lightweight” compared to the thing it replaced. But it is ridiculously complicated for what it is. It is designed for a bandwidth-scarce, intermittent connection world; for a modern world, I’d just put it all in an SQLite database and rsync it all over the place (and use remote queries, the replicas only used for offline validation).
by locusofself
1 subcomments
- 8 years ago or so I had a job that necessitated doing a bunch of LDAP integrations and I tried FreeIPA, openLDAP and others. It was such a pain. OpenLDAP (slapd) was actually configured using... LDAP. Yes, you configured an LDAP server using it's own protocol. It was not good. My fading impression of FreeIPA is that it had some nice things going for it, but it wasn't nearly as lightweight or friendly towards automation, it felt more like setting up a windows domain controller and clicking through a webUI to set things up.
by blacklion
1 subcomments
- It is pity, we need Linux to tun open source software like FreeIPA/IDM.
I want to deploy domain at my home lab, but there are only FreeBSDs and Windows (client versions, on desktops and laptops)... I don't want to install Linux.
by paffdragon
1 subcomments
- Hah, what a coincidence, just started to look into yesterday how do I setup LDAP/OIDC on FreeBSD and today I was going to try FreeIPA or Keycloak. Thanks for sharing.
- The FreeIPA documentation could be made a bit clearer, so many "obsolete" pages showing in search.
To my question, does anyone know if FreeIPA now supports integration with Samba including password auth for non domain members? Or is it still limited to Kerberos?
by throw0101a
1 subcomments
- Perhaps worth noting that keytab files often need to be refresh as TGTs expire; handy utility to do that:
* https://www.eyrie.org/~eagle/software/kstart/
* https://www.freshports.org/security/kstart/
- > this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it.
What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?
- [flagged]
Hacker News