Re: [Freeipa-users] Hardening freeipa on the internet

2014-05-09 Thread Richard Clark
On Fri, Apr 25, 2014 at 10:11:15AM +0200, Martin Kosek wrote: Does anybody know about other precautions that should be made besides standard hardening (SELinux, firewall, log audits)? I've been running IPA on AWS for a while, replicating within regions as well as inter-region and also a

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-30 Thread Martin Kosek
On 04/28/2014 05:16 PM, Simo Sorce wrote: On Mon, 2014-04-28 at 16:11 +0100, Andrew Holway wrote: I realized that you probably want to disable anonymous access to LDAP. It will prevent random strangers to enumerate all users in your database... This sounds like a bug no? anonymous access to

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Petr Spacek
On 25.4.2014 11:00, Petr Spacek wrote: On 25.4.2014 10:11, Martin Kosek wrote: On 04/25/2014 09:50 AM, Andrew Holway wrote: Hello, I am having a think about running freeipa on the open seas for more distributed organisations and would like to understand where the weaknesses might be. I would

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Andrew Holway
I realized that you probably want to disable anonymous access to LDAP. It will prevent random strangers to enumerate all users in your database... This sounds like a bug no? anonymous access to LDAP? -- Petr^2 Spacek ___ Freeipa-users mailing

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-28 Thread Simo Sorce
On Mon, 2014-04-28 at 16:11 +0100, Andrew Holway wrote: I realized that you probably want to disable anonymous access to LDAP. It will prevent random strangers to enumerate all users in your database... This sounds like a bug no? anonymous access to LDAP? Historically many Linux and Unix

Re: [Freeipa-users] Hardening freeipa on the internet

2014-04-25 Thread Martin Kosek
On 04/25/2014 09:50 AM, Andrew Holway wrote: Hello, I am having a think about running freeipa on the open seas for more distributed organisations and would like to understand where the weaknesses might be. I would almost certainly only make the ui unavailable however I am unsure about the