FreeIPA – Using FreeIPA Solely as an LDAP Server

freeipa

I want to try setup FreeIPA in my home lab, but I do not want any more additonal stuff like, Certificates and DNS. I just want the IPA to work as a LDAP server.

Does the FreeIPA installation support such feature, so I can disable these functionalities?

Best Answer

No it does not. You can look at 389-ds which is the directory server FreeIPA is using. It has own setup tooling that makes configuring it easy these days. See https://www.port389.org/docs/389ds/howto/quickstart.html for more details.

Related Solutions

Ssl – freeipa ssl ldap and round robin dns

You should issue new certificates with subjectAlternitiveNames and point the dns record for that name at a load balancer.

A) Turning off certificate checking does open you up to MITM. The advantage is that an encrypted channel can't be passively eaves dropped. It's more work to MITM an encrypted channel, but it's not much more. If you're not high value and don't operate across Wireless or open internet (as opposed to a VPN link), then turning off the certificate checking isn't very risky, but don't to it. Doing things the right way is just about as easy.
B) Yes, the servers will need an subjectAlternitiveName or (and don't do this) a wildcard subjectName. However, FreeIPA does its own PublicKeyInfrastucture (PKI), which is to say you have your own self-signed Certificate Authority (CA), rather than a collect of self-signed certificates. This means that you only need to generate and replace the certificates for the FreeIPA servers (the ones used by LDAP). The CA certificate used for signing (that's the cert that's deployed across all your machines) stays the same, so there's no need to touch any other machines. Also, you don't need the servers private keys, just the public certificates.
C) See the top, A and B are justification.

Ldap – Configuring Synology NAS as freeIPA client

Clients (especially MS) look up DNS for LDAP. DNS must have a srv for LDAP.

dig [@ns] _ldap._tcp.example.com srv

might reveal if it has one. If the NAS still can't find it, adding an MS-specific one might help, like

_ldap._tcp.dc._msdcs.example.com. <ttl> IN SRV <prio> <weight> 389 freeipa.example.com.

and

freeipa.example.com. <ttl> IN A <ip address>

Best Answer

Related Solutions

Ssl – freeipa ssl ldap and round robin dns

Ldap – Configuring Synology NAS as freeIPA client

Related Topic