On 05/12/2019 18.41, Vinícius Ferrão via FreeIPA-users wrote: > Hello, > > Is it supported to install mod_ssl on the same machine of FreeIPA? I’m asking > this because FreeIPA ships by default mod_nss and this may lead to > conflicting issues inside /etc/httpd/conf.d. For example: > > [root@headnode conf.d]# grep -iR virtualhost > nss.conf:<VirtualHost _default_:443> > nss.conf:</VirtualHost> > ssl.conf:<VirtualHost _default_:443> > ssl.conf:</VirtualHost> > > Both add a default virtual host to 443. > > What’s the correct procedure? Don’t use mod_ssl at all?
We switched from mod_nss to mod_ssl a couple of versions ago. The correct procedure is: Don't install any additional services on a IPA server. For security reasons you shouldn't host other web sites, too. If the IPA server gets compromised, then all your users, computers, and services in your network are compromised, too. Christian -- Christian Heimes Principal Software Engineer, Identity Management and Platform Security Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Laurie Krebs, Michael O'Neill, Thomas Savage
signature.asc
Description: OpenPGP digital signature
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
