[Freeipa-users] Setting a new directory manager password

[Steven Jones]

Hi,

No I was confused, I thought you meant there were some function that the DM held that could be delegated.  I expect that the admin user will be deleted as that's an attack vector (however obscure/indirect).

I'm really looking at what is considered good AD security practice and looking to see what is appropriate or equivalent in IPA.


regards

Steven Jones

Technical Specialist - Linux RHCE

Victoria University, Wellington, NZ

0064 4 463 6272

________________________________________
From: Dmitri Pal [dpal at redhat.com]
Sent: Tuesday, 27 March 2012 11:52 a.m.
To: Steven Jones
Cc: freeipa-users at redhat.com
Subject: Re: [Freeipa-users] Setting a new directory manager password

On 03/26/2012 05:36 PM, Steven Jones wrote:
> Hi,
>
> What needs to be delegated?

May be I misread what you trying to accomplish.
Are you talking about DM password or admin account password?

DM password is needed for low level DS operations for example if
something goes wrong.

admin password is need for admin account and since admin account is the
only IPA admin created out of box it is need to do all the IPA
administration. However you can split the administrative capabilities
(delegate) to different low level admins and make admin account not used
or owned by the same person who owns the DM password. How you split the
responsibilities is up to you. How you do it? Via permission, privilege
and role related commands or UI.

> regards
>
> Steven Jones
>
> Technical Specialist - Linux RHCE
>
> Victoria University, Wellington, NZ
>
> 0064 4 463 6272
>
> ________________________________________
> From: freeipa-users-bounces at redhat.com [freeipa-users-bounces at redhat.com] on behalf of Dmitri Pal [dpal at redhat.com]
> Sent: Tuesday, 27 March 2012 10:34 a.m.
> To: freeipa-users at redhat.com
> Subject: Re: [Freeipa-users] Setting a new directory manager password
>
> On 03/26/2012 05:28 PM, Steven Jones wrote:
>> Hi,
>>
>> Our policy is to have the security manager hold the top most password of AD. There is a requirement that we do the same thing for IPA if possible/practical.
>>
>> So, is there any reason apart from resetting the admin password or replication that I would ever need this password in a day to day context?
> As long as you create other administrative accounts and define their
> permissions as more confined you do not need to use this admin account
> other than to perform operations on itself. All other functions can be
> delegated except the DM password of the underlying DS that should be
> used only if you need to do some low level DS operations in case
> something went wrong.
>
>> If not, how would I re-write/change the password?
>>
>> regards
>>
>> Steven Jones
>>
>> Technical Specialist - Linux RHCE
>>
>> Victoria University, Wellington, NZ
>>
>> 0064 4 463 6272
>>
>> _______________________________________________
>> Freeipa-users mailing list
>> Freeipa-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>
> --
> Thank you,
> Dmitri Pal
>
> Sr. Engineering Manager IPA project,
> Red Hat Inc.
>
>
> -------------------------------
> Looking to carve out IT costs?
> www.redhat.com/carveoutcosts/
>
>
>
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users


--
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/