[Freeipa-users] how to make fIPA stick to only...

[Alexander Bokovoy]

On Mon, 04 Jul 2016, lejeczek wrote:
>
>
>On 04/07/16 07:59, Petr Spacek wrote:
>>On 1.7.2016 16:29, lejeczek wrote:
>>>
>>>On 01/07/16 12:41, Petr Vobornik wrote:
>>>>On 06/30/2016 04:56 PM, lejeczek wrote:
>>>>>... its own FQHN and its IP ?
>>>>>
>>>>>hi users,
>>>>>
>>>>>I'm fiddling with rewrites but being an amateur cannot figure it out,
>>>>>it's on a multi/home-IP box. Is it possible?
>>>>>
>>>>>many thanks,
>>>>>
>>>>>L.
>>>>>
>>>>Hi L.
>>>>
>>>>Could you describe your environment and use case in more details. It is
>>>>not clear to me what you are trying to achieve or what doesn't work for you.
>>>>
>>>>Thank you
>>>gee, I though my scenario would be quite common among users,
>>>take a box with more then one net ifs, or even multiple IPs - what would be
>>>nice to have is fIPA webui resides/runs only on that FQHN and that IP to which
>>>hostname resolves. Eg, here is one single system:
>>>box1.my.dom.local 10.10.1.1 (eg, I go to https://10.10.1.1/)
>>>ipa.my.dom.local 10.10.1.2
>>>currently I get fIPA's webui everywhere, but I'd like it to be only at
>>>ipa.my.dom.local 10.10.1.2 (either if I URL via hostname or IP)
>>>I think it would be great to have included (maybe as comments/options) this in
>>>Apache's configs of IPA furure releases, if possible.
>>>Is it possible to construct such rules? Or there is different, simpler way?
>>I'm still trying to understand your use-case. Why exactly you need to limit
>>the web UI to one 'host name' while keeping it on the same box?
>>
>I'm sorry I cannot explain this better, I my mind it's really simple, 
>if I installed an instance of IPA on a ipa.my.dom.local and the system 
>is a multi-homed/IP host I'd like webui to run only on that host/IP
>This should not even be a matter of "image a situation where...." but 
>rather assume that IPA's are deployed on such installations and then - 
>why would fIPA have to monopolize all the IP's/IFs there are?
>Me, I'd like to be able to use httpd under a root of host's other 
>FQHN/IPs with other things.
Your IPA masters hold passwords and keys to your company's
infrastructure. We recommend to avoid sharing the servers used for
running IPA masters with any other applications because any compromise
of those applications can and will be used for taking over your
infrastructure as you have so nicely given the keys to its heart by
co-sharing the same system.

It is up to you on how you make up your system defense. We as FreeIPA
upstream developers put considerate effort in ensuring our default setup
is secure enough to avoid such breaches. If you want to co-locate other
applications, you need to understand what you are doing and how that
affects your security. Effectively, you are on your own on this path.

-- 
/ Alexander Bokovoy