<html><head><style type="text/css"></style></head><body><div style="font-size: 13px;color: rgb(0, 0, 0);font-family: arial,sans-serif;">What we do is create a non-posix group in FreeIPA and apply a custom password policy, then join the users to that group. Then login as the service account and reset the account's password to some random string. But if you reset it through the UI, it will set the password to expire in 1 hour. Also, you can "disable" the account from the FreeIPA UI or the command line, which appears to work too. Here is a simple write up of how we setup service accounts in FreeIPA: 1. Login to the FreeIPA UI as a user/admin with priviledges to add groups and password policies. 2. First we will add a group. Click on Identity --> User Groups, then Add Group name: svc_accounts Description: Group used for Service Accounts Group Type: Normal GID: (this will be blanked out) 3. Next, add a new password policy (because you do NOT want to the password on service accounts expiring every 90 days) Policy --> Password Policies, then Add Group: (select svc_accounts from dropdown box) Priority: 1 Then click "Add and Edit", which will allow you more fields to populate. Max lifetime (days): 3650 (which gives you 10 years between password changes) 4. Create a new service user account (we choose to use the prefix "svc_" for any new service accounts) Identity --> Users, then Add User login: svc_testuser First Name: Test Last Name: User New Password: Foobar1 (easy to remember temp password) Verify Password: Foobar1 Click on "Add and Edit", then click on "User Groups", Add Add this user to the "svc_accounts" group. 5. Now login as svc_testuser with temp password "Foobar1". Update the password to some long string of random characters (something you can set and forget). Logout 6. Create any necessary sudo rules that allow regular users to switch to the svc_testuser account. 7. Disable service account: From the FreeIPA UI, Go to Identity --> Users, then click on the svc_testuser user in the list. Then use the "select action" dropdown box to "Disable" the user account, click Apply. 7. Done! -Mike <blockquote style="padding-left: 5px; margin-left: 0px; border-left: #0000ff 2px solid; font-weight: normal; font-style: normal; text-decoration: none; font-size: 10pt; font-family: arial,sans-serif; color: black;">-----Original Message----- From: "Redmond, Stacy" <stacy.redmond@blueshieldca.com> Sent: Dec 10, 2015 1:24 PM To: "freeipa-users@redhat.com" <freeipa-users@redhat.com> Subject: [Freeipa-users] Service Accounts via IPA <zzzhtml xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <zzzhead> <zzzmeta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <zzzmeta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style><ZZZ!-- /* Font Definitions */ @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:"Century Gothic"; panose-1:2 11 5 2 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:ZZZlink, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Century Gothic","sans-serif"; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri","sans-serif";} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><zzz!--[if gte="" mso="" 9]=""><xml> <o:shapedefaults v:ext="edit" spidmax="1026"> </o:shapedefaults></xml><zzz![endif]--><zzz!--[if gte="" mso="" 9]=""><xml> <o:shapelayout v:ext="edit"> <o:idmap v:ext="edit" data="1"> </o:idmap></o:shapelayout></xml><zzz![endif]--> </zzz![endif]--></zzz!--[if></zzz![endif]--></zzz!--[if></zzzmeta></zzzmeta></zzzhead> <zzzbody link="blue" vlink="purple" lang="EN-US"> <div class="WordSection1"> Generally I will lock a service account on linux so that the account cannot login, but users can sudo su – to that user. As I don’t have access to the password field in free ipa, what are my options to set this up as a default for service accounts, or how can I modify individual accounts that need access to a system, but should not be able to login to the system. Any help is appreciated.<o:p></o:p> </div> </zzzbody> </zzzhtml> </freeipa-users@redhat.com></stacy.redmond@blueshieldca.com></blockquote></div></body></html>