5 ms·

Native FreeBSD Kerberos/LDAP with FreeIPA/IDM

118 points by vermaden 8mo ago

cullumsmith 8mo ago
Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutable... Nowadays an LLM could do it for you at least. At $job we use Linux / sssd, and I always found it super bloated and rather unreliable. It's nice coming home to FreeBSD and old boring stuff like pam_krb5 and nslcd. It just works. The "ipa" command provided by FreeIPA for managing users/groups/etc is super convenient though.
- whalesalad 8mo ago
  Would be highly interested in learning more about this setup particularly the PowerDNS integration.
  - cullumsmith 8mo ago
    PowerDNS is an open-source DNS server that lets you store your DNS configuration in a variety of different backends, one of which is LDAP. For each of my "domain controllers, I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server. The KDC and PowerDNS both get their data from LDAP on 127.0.0.1, and LDAP changes are synchronized between all the nodes. This is convenient because you don't have to synchronize zone files on multiple hosts. I use custom /bin/sh-based config management system, but you can probably get the gist of it here: https://github.com/cullumsmith/infrastructure/blob/master/scripts/hostclass/idm_server/20-powerdns https://github.com/cullumsmith/infrastructure/blob/master/sc... https://github.com/cullumsmith/infrastructure/blob/master/files/usr/local/etc/pdns/pdns.conf.idm_server https://github.com/cullumsmith/infrastructure/blob/master/fi...
    - esseph 8mo ago
      In addition to this, for those of you running Proxmox it has PowerDNS integration.
- xorcist 8mo ago
  I don't think it's exactly the same thing as sssd is primarily a cache. You can use pam_krb5 on Linux too. But can you disconnect your FreeBSD laptop and work as normal from cache? I agree that sssd is quite finicky however, and I'd love a simpler alternative.
  - cullumsmith 8mo ago
    You are correct, sssd has a ton of features (like basically replicating the entire domain locally and caching passwords so you can roam away from your corp network). If you need those things, you need sssd.
    - xorcist 8mo ago
      It is a quite normal need. An always-on laptop that doesn't leave the corporate network is just a stationary computer in inconvenient packaging.
- radarsat1 8mo ago
  > The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations .. As a long time Linux user on personal machines, I found myself for the first time a couple of years ago needing to support a small team and given them all login access to our small cluster. I figured, hey it's annoying to coordinate user ids over these machines, I should just set up OpenLDAP.. little did I know.. honestly I'm pretty handy at dealing with Linux but I was shocked to discover how complicated and annoying it was to set up and use OpenLDAP with NFS automounting home directories. For the first time in my life I was like, "oh this is why people spend years studying system administration.." I did get it working eventually but it was hard to trust it and the configuration GUI was not very good and I never fully got passwd working properly so I had to intervene to help people change their passwords.. in the end we ended up just using manually coordinated local accounts. The whole time I'm just thinking, I must be missing something, it can't be this bad.. I'm still a bit flabbergasted by the experience.
paffdragon 8mo ago
Hah, what a coincidence, just started to look into yesterday how do I setup LDAP/OIDC on FreeBSD and today I was going to try FreeIPA or Keycloak. Thanks for sharing.
- vermaden 8mo ago
  I also covered Keycloak on FreeBSD in the past - here: - https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebsd/ https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebs... Hope that helps. Regards, vermaden
  - paffdragon 8mo ago
    Awesome, it definitely helps. I realized I have your blog already bookmarked, I subscribed to the RSS feed now as well :) I am new to FreeBSD and these kind of practical articles are really helpful. Thank you very much for sharing your knowledge with others.
    - vermaden 8mo ago
      Thanks.
ipython 8mo ago
Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal Better yet you’ll want to encrypt that file in some way when transferring it
- vermaden 8mo ago
  Good point - gonna add a notice about that - thank You.
- vermaden 8mo ago
  I modified the article to copy the keytab using scp(1) instead.
zokier 8mo ago
I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
- ipython 8mo ago
  Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
  - bzzzt 8mo ago
    Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
    - esseph 8mo ago
      > dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.
      - amaccuish 8mo ago
        Jumpcloud is SaaS.
        esseph 8mo ago
        Yes, but it's not Microsoft Active Directory or Entra, which was my point.
      - bzzzt 8mo ago
        Those are all apps running in the cloud. I meant the classic Windows AD company LAN like solutions where the clients, server and network are tightly coupled.
ptx 8mo ago
> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?
- p_ing 8mo ago
  This [0] may provide a hint. Heimdal was developed outside of the US and not subject to export restrictions, unlike MIT. So perhaps in the beginning it wasn’t the package of choice to begin with. And this [1] says for interoperability reasons. [0] https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/share/doc/freebsd/handbook/kerberos5.html https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/... [1] https://freebsdfoundation.org/project/import-mit-kerberos-into-freebsd/ https://freebsdfoundation.org/project/import-mit-kerberos-in...
  - cryptonector 8mo ago
    I don't think that has anything to do with FreeBSD's choice of MIT Kerberos or Heimdal.
    - p_ing 8mo ago
      Well, except the FreeBSD Foundation explicitly says MIT was chosen for interoperability. Are you disputing the FreeBSD Foundation document?
      - cryptonector 8mo ago
        Er, sorry, I meant the whole thing about Heimdal being non-U.S. based.
- cryptonector 8mo ago
  Because we (Heimdal) need to make a release, darn it. I'm going to cut an 8.0 beta within a week or two. Basically, an 8.0 release is super pent up -- years. It's got lots of very necessary stuff, including support for the extended GSS-API "cred store" APIs, which are very handy. Lots of iprop enhancements, "virtual service principal namespaces", "synthetic client principals", lots of PKINIT enhancements, modern public key cryptography (but not PQ), etc. The issue is that the maintainers (myself included) have been busy with other things. But the pressure to do a release has ramped up significantly recently.
deleted 8mo ago
[deleted]
poketdev 8mo ago
[flagged]
blacklion 8mo ago
It is pity, we need Linux to tun open source software like FreeIPA/IDM. I want to deploy domain at my home lab, but there are only FreeBSDs and Windows (client versions, on desktops and laptops)... I don't want to install Linux.
- vermaden 8mo ago
  Me too brother, me too.
  - blacklion 8mo ago
    Next pressure point to install Linux: UniFi controller becomes huge container for Docker, not Java application which can be run anywhere.
sidkshatriya 8mo ago
First, I read (article referred to in blog post): https://blog.hofstede.it/integrating-freebsd-15-with-freeipa-native-kerberos-and-ldap-authentication/ https://blog.hofstede.it/integrating-freebsd-15-with-freeipa... [1] . _Only then_ I read https://vermaden.wordpress.com/2026/02/18/native-freebsd-kerberos-ldap-with-freeipa-idm/ https://vermaden.wordpress.com/2026/02/18/native-freebsd-ker... [2] [1] is more high level. [2] is a bit more detailed.
- vermaden 8mo ago
  I hope I was clear enough that credit for the solution goes to Christian Hofstede-Kuhn (Larvitz). I treat my blog also as a place where I keep and maintain my FreeBSD documentation/information. So there are several motivations for this: - Keep and maintain personal version with more code snippets that I can copy/paste fast. - More detailed commands and outputs. - Some additional improvements that may be useful – like local console login. Hope that helps.
throw0101a 8mo ago
Perhaps worth noting that keytab files often need to be refresh as TGTs expire; handy utility to do that: * https://www.eyrie.org/~eagle/software/kstart/ https://www.eyrie.org/~eagle/software/kstart/ * https://www.freshports.org/security/kstart/ https://www.freshports.org/security/kstart/
- scottylogan 8mo ago
  The keytabs don't need to be refreshed, but the ticket caches - where the TGTs are stored - do.
amaccuish 8mo ago
The FreeIPA documentation could be made a bit clearer, so many "obsolete" pages showing in search. To my question, does anyone know if FreeIPA now supports integration with Samba including password auth for non domain members? Or is it still limited to Kerberos?
- amaccuish 8mo ago
  It does, now running. Glad to be able to replace my Samba4 setup since we're now mostly Mac/Linux only.
beagle3 8mo ago
Is there a simpler system for a small local network? For my home lab use case, it is almost sufficient to rsync /etc/{passwd,group,hosts,…..} - I manually sync them because changes are few and far between. I wanted to set up a central authority - i don’t care about multi master or even resilience to failure in that central authority. But even a small setup is relatively complicated. I remember yp setup in the early ‘90s looked complicated but it is a piece of cake compared to modern systems. They provide a lot, but they don’t scale down - and it feels to me that they are complicated much more than is required for their feature list. Take LDAP, for example - it is only “lightweight” compared to the thing it replaced. But it is ridiculously complicated for what it is. It is designed for a bandwidth-scarce, intermittent connection world; for a modern world, I’d just put it all in an SQLite database and rsync it all over the place (and use remote queries, the replicas only used for offline validation).
- jimmyswimmy 8mo ago
  I would love a simpler system. Everything is pointing me back towards using a Windows server eval instance for this, which feels like a pretty heavy way to manage a bunch of alpine containers. FreeIPA, openLDAP and I think the other one I tried was Keycloak - all were more trouble to configure than they were worth. I'm shocked it never occurred to me to just rsync the passwd files, or SCP them using an update service. Would love a nicer way to manage users across a very small network without needing so much complexity as these other services.
locusofself 8mo ago
8 years ago or so I had a job that necessitated doing a bunch of LDAP integrations and I tried FreeIPA, openLDAP and others. It was such a pain. OpenLDAP (slapd) was actually configured using... LDAP. Yes, you configured an LDAP server using it's own protocol. It was not good. My fading impression of FreeIPA is that it had some nice things going for it, but it wasn't nearly as lightweight or friendly towards automation, it felt more like setting up a windows domain controller and clicking through a webUI to set things up.
- inejge 8mo ago
  > Yes, you configured an LDAP server using it's own protocol. It was not good. It's still possible to configure OpenLDAP via the slapd.conf file. The old roadmap called for ditching configuration file support in 2.5 IIRC, but it proved hugely unpopular so the file works to this day. The new configuration style is mainly useful for live updating of access rules and indexing.

118 points by vermaden 8mo ago

Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutable... Nowadays an LLM could do it for you at least. At $job we use Linux / sssd, and I always found it super bloated and rather unreliable. It's nice coming home to FreeBSD and old boring stuff like pam_krb5 and nslcd. It just works. The "ipa" command provided by FreeIPA for managing users/groups/etc is super convenient though.

whalesalad 8mo ago
Would be highly interested in learning more about this setup particularly the PowerDNS integration.
- cullumsmith 8mo ago
  PowerDNS is an open-source DNS server that lets you store your DNS configuration in a variety of different backends, one of which is LDAP. For each of my "domain controllers, I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server. The KDC and PowerDNS both get their data from LDAP on 127.0.0.1, and LDAP changes are synchronized between all the nodes. This is convenient because you don't have to synchronize zone files on multiple hosts. I use custom /bin/sh-based config management system, but you can probably get the gist of it here: https://github.com/cullumsmith/infrastructure/blob/master/scripts/hostclass/idm_server/20-powerdns https://github.com/cullumsmith/infrastructure/blob/master/sc... https://github.com/cullumsmith/infrastructure/blob/master/files/usr/local/etc/pdns/pdns.conf.idm_server https://github.com/cullumsmith/infrastructure/blob/master/fi...
  - esseph 8mo ago
    In addition to this, for those of you running Proxmox it has PowerDNS integration.
xorcist 8mo ago
I don't think it's exactly the same thing as sssd is primarily a cache. You can use pam_krb5 on Linux too. But can you disconnect your FreeBSD laptop and work as normal from cache? I agree that sssd is quite finicky however, and I'd love a simpler alternative.
- cullumsmith 8mo ago
  You are correct, sssd has a ton of features (like basically replicating the entire domain locally and caching passwords so you can roam away from your corp network). If you need those things, you need sssd.
  - xorcist 8mo ago
    It is a quite normal need. An always-on laptop that doesn't leave the corporate network is just a stationary computer in inconvenient packaging.
radarsat1 8mo ago
> The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations .. As a long time Linux user on personal machines, I found myself for the first time a couple of years ago needing to support a small team and given them all login access to our small cluster. I figured, hey it's annoying to coordinate user ids over these machines, I should just set up OpenLDAP.. little did I know.. honestly I'm pretty handy at dealing with Linux but I was shocked to discover how complicated and annoying it was to set up and use OpenLDAP with NFS automounting home directories. For the first time in my life I was like, "oh this is why people spend years studying system administration.." I did get it working eventually but it was hard to trust it and the configuration GUI was not very good and I never fully got passwd working properly so I had to intervene to help people change their passwords.. in the end we ended up just using manually coordinated local accounts. The whole time I'm just thinking, I must be missing something, it can't be this bad.. I'm still a bit flabbergasted by the experience.

paffdragon 8mo ago

Hah, what a coincidence, just started to look into yesterday how do I setup LDAP/OIDC on FreeBSD and today I was going to try FreeIPA or Keycloak. Thanks for sharing.

vermaden 8mo ago
I also covered Keycloak on FreeBSD in the past - here: - https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebsd/ https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebs... Hope that helps. Regards, vermaden
- paffdragon 8mo ago
  Awesome, it definitely helps. I realized I have your blog already bookmarked, I subscribed to the RSS feed now as well :) I am new to FreeBSD and these kind of practical articles are really helpful. Thank you very much for sharing your knowledge with others.
  - vermaden 8mo ago
    Thanks.

ipython 8mo ago

Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal Better yet you’ll want to encrypt that file in some way when transferring it

vermaden 8mo ago
Good point - gonna add a notice about that - thank You.
vermaden 8mo ago
I modified the article to copy the keytab using scp(1) instead.

zokier 8mo ago

I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.

ipython 8mo ago
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
- bzzzt 8mo ago
  Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
  - esseph 8mo ago
    > dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.
    - amaccuish 8mo ago
      Jumpcloud is SaaS.
      - esseph 8mo ago
        Yes, but it's not Microsoft Active Directory or Entra, which was my point.
    - bzzzt 8mo ago
      Those are all apps running in the cloud. I meant the classic Windows AD company LAN like solutions where the clients, server and network are tightly coupled.

ptx 8mo ago

> this new method is possible to work because FreeBSD switched from Heimdal Kerberos implementation to MIT Kerberos in FreeBSD 15.0-RELEASE … and I am really glad that FreeBSD finally did it. What was the problem with Heimdal? The FreeBSD wiki says they used an old version, but why not upgrade to a newer version of Heimdal instead of switching to an entirely different implementation?

p_ing 8mo ago
This [0] may provide a hint. Heimdal was developed outside of the US and not subject to export restrictions, unlike MIT. So perhaps in the beginning it wasn’t the package of choice to begin with. And this [1] says for interoperability reasons. [0] https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/share/doc/freebsd/handbook/kerberos5.html https://docs-archive.freebsd.org/doc/11.1-RELEASE/usr/local/... [1] https://freebsdfoundation.org/project/import-mit-kerberos-into-freebsd/ https://freebsdfoundation.org/project/import-mit-kerberos-in...
- cryptonector 8mo ago
  I don't think that has anything to do with FreeBSD's choice of MIT Kerberos or Heimdal.
  - p_ing 8mo ago
    Well, except the FreeBSD Foundation explicitly says MIT was chosen for interoperability. Are you disputing the FreeBSD Foundation document?
    - cryptonector 8mo ago
      Er, sorry, I meant the whole thing about Heimdal being non-U.S. based.
cryptonector 8mo ago
Because we (Heimdal) need to make a release, darn it. I'm going to cut an 8.0 beta within a week or two. Basically, an 8.0 release is super pent up -- years. It's got lots of very necessary stuff, including support for the extended GSS-API "cred store" APIs, which are very handy. Lots of iprop enhancements, "virtual service principal namespaces", "synthetic client principals", lots of PKINIT enhancements, modern public key cryptography (but not PQ), etc. The issue is that the maintainers (myself included) have been busy with other things. But the pressure to do a release has ramped up significantly recently.

deleted 8mo ago

[deleted]

poketdev 8mo ago

[flagged]

blacklion 8mo ago

It is pity, we need Linux to tun open source software like FreeIPA/IDM. I want to deploy domain at my home lab, but there are only FreeBSDs and Windows (client versions, on desktops and laptops)... I don't want to install Linux.

vermaden 8mo ago
Me too brother, me too.
- blacklion 8mo ago
  Next pressure point to install Linux: UniFi controller becomes huge container for Docker, not Java application which can be run anywhere.

sidkshatriya 8mo ago

First, I read (article referred to in blog post): https://blog.hofstede.it/integrating-freebsd-15-with-freeipa-native-kerberos-and-ldap-authentication/ https://blog.hofstede.it/integrating-freebsd-15-with-freeipa... [1] . _Only then_ I read https://vermaden.wordpress.com/2026/02/18/native-freebsd-kerberos-ldap-with-freeipa-idm/ https://vermaden.wordpress.com/2026/02/18/native-freebsd-ker... [2] [1] is more high level. [2] is a bit more detailed.

vermaden 8mo ago
I hope I was clear enough that credit for the solution goes to Christian Hofstede-Kuhn (Larvitz). I treat my blog also as a place where I keep and maintain my FreeBSD documentation/information. So there are several motivations for this: - Keep and maintain personal version with more code snippets that I can copy/paste fast. - More detailed commands and outputs. - Some additional improvements that may be useful – like local console login. Hope that helps.

throw0101a 8mo ago

Perhaps worth noting that keytab files often need to be refresh as TGTs expire; handy utility to do that: * https://www.eyrie.org/~eagle/software/kstart/ https://www.eyrie.org/~eagle/software/kstart/ * https://www.freshports.org/security/kstart/ https://www.freshports.org/security/kstart/

scottylogan 8mo ago
The keytabs don't need to be refreshed, but the ticket caches - where the TGTs are stored - do.

amaccuish 8mo ago

The FreeIPA documentation could be made a bit clearer, so many "obsolete" pages showing in search. To my question, does anyone know if FreeIPA now supports integration with Samba including password auth for non domain members? Or is it still limited to Kerberos?

amaccuish 8mo ago
It does, now running. Glad to be able to replace my Samba4 setup since we're now mostly Mac/Linux only.

beagle3 8mo ago

Is there a simpler system for a small local network? For my home lab use case, it is almost sufficient to rsync /etc/{passwd,group,hosts,…..} - I manually sync them because changes are few and far between. I wanted to set up a central authority - i don’t care about multi master or even resilience to failure in that central authority. But even a small setup is relatively complicated. I remember yp setup in the early ‘90s looked complicated but it is a piece of cake compared to modern systems. They provide a lot, but they don’t scale down - and it feels to me that they are complicated much more than is required for their feature list. Take LDAP, for example - it is only “lightweight” compared to the thing it replaced. But it is ridiculously complicated for what it is. It is designed for a bandwidth-scarce, intermittent connection world; for a modern world, I’d just put it all in an SQLite database and rsync it all over the place (and use remote queries, the replicas only used for offline validation).

jimmyswimmy 8mo ago
I would love a simpler system. Everything is pointing me back towards using a Windows server eval instance for this, which feels like a pretty heavy way to manage a bunch of alpine containers. FreeIPA, openLDAP and I think the other one I tried was Keycloak - all were more trouble to configure than they were worth. I'm shocked it never occurred to me to just rsync the passwd files, or SCP them using an update service. Would love a nicer way to manage users across a very small network without needing so much complexity as these other services.

locusofself 8mo ago

8 years ago or so I had a job that necessitated doing a bunch of LDAP integrations and I tried FreeIPA, openLDAP and others. It was such a pain. OpenLDAP (slapd) was actually configured using... LDAP. Yes, you configured an LDAP server using it's own protocol. It was not good. My fading impression of FreeIPA is that it had some nice things going for it, but it wasn't nearly as lightweight or friendly towards automation, it felt more like setting up a windows domain controller and clicking through a webUI to set things up.

inejge 8mo ago
> Yes, you configured an LDAP server using it's own protocol. It was not good. It's still possible to configure OpenLDAP via the slapd.conf file. The old roadmap called for ditching configuration file support in 2.5 IIRC, but it proved hugely unpopular so the file works to this day. The new configuration style is mainly useful for live updating of access rules and indexing.