<div dir="ltr">Hello FreeIPA Devs/Mailing List, We use FreeIPA to great success in several places, but we want to roll it out for us. Thus, we want to ask about best practices for the type of deployment we’re planning. First, FreeIPA is truly awesome, and the glue that holds all these pieces together is really a phenomenal achievement. We want to set up our FreeIPA deployment according to best practices. As it stands today, we want to implement FreeIPA to take over the authentication duties and DNS duties of an infrastructure which we are in the process of rebuilding from scratch, so we’re not worried about retroactively making things work on older systems. This is an important point for us, basically consider that we’re doing everything from scratch, and re-basing off of CentOS 7. (Apologies in advance for the wall-of-text). Who we are:We are a Managed Services Provider with multiple clients, and manage our clients’ systems end-to-end. This enables us to have full control over the infrastructure. Topology:We currently have 3 (where we’ll place FreeIPA at least) datacenter facilities in the USA, and are bringing a 4th DC online in the EU shortly. These datacenters are protected via enterprise-grade hardware firewalls, and we have VPNs across the DCs to allow our various infrastructure pieces to communicate on internal subnets vs across the public WAN. Additionally, we advertise our own IP addresses via BGP. We also have (bind-based) DNS in each DC, but primarily for external purposes. Private:US-EAST: <a href="http://172.29.0.0/19">172.29.0.0/19</a>US-WEST: <a href="http://172.29.32.0/19">172.29.32.0/19</a>US-SOUTH: <a href="http://172.29.64.0/19">172.29.64.0/19</a>EU-WEST: <a href="http://172.29.96.0/19">172.29.96.0/19</a> Public:US-EAST: <a href="http://1.1.1.0/24">1.1.1.0/24</a>US-WEST: <a href="http://1.1.2.0/24">1.1.2.0/24</a>US-SOUTH: <a href="http://1.1.3.0/24">1.1.3.0/24</a>EU-WEST: <a href="http://1.1.4.0/24">1.1.4.0/24</a> Goals:<ol style="margin-top:0pt;margin-bottom:0pt"><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want to have centralized authentication for our entire infrastructure.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want the authentication to be highly available (FreeIPA replicas)</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want to have a drastically improved DNS system that handles both external (domain names) and internal (systems).</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want that DNS system to also be highly available (FreeIPA replicas with bind-ldap as the backend seems to be the best way)</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want to use our own SSL certificates if at all possible (wildcard certificates, letsencrypt, etc)</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We would like to be multi-tenant with domains/realms/whatever so that CLIENT1 can have their authentication of their systems centralized through our FreeIPA. Similar for CLIENT2, CLIENT3, etc. The clients don’t care, so how this is set up is up to us/best practices.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">As part of the multi-tenancy, we don’t want all users to be able to see all users. To be more clear, we want to have 1 FreeIPA infrastructure that can use our domain (let’s call it <a href="http://GREATMSP.COM">GREATMSP.COM</a>), and have systems for CLIENT1 as part of <a href="http://CLIENT1.GREATMSP.COM">CLIENT1.GREATMSP.COM</a> or whatever the best way is. We also want where if they login to FreeIPA, they’ll only see their users/systems.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">If we use <a href="http://GREATMSP.COM">GREATMSP.COM</a> as the domain, we of course want to still have all of our normal DNS records (MX, NS, etc, etc). We’re perfectly good with (and prefer) using the more robust FreeIPA as nameservers for our root domain name.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We would like users to be able to self manage (FreeIPA web ui)</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We plan to have at least 2 x FreeIPA servers in each DC, with the more likely scenario being 4 x in each DC.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We want to use DNSSEC wherever possible. Because security.</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Ideally, can we use the FreeIPA servers as NTP servers?</li></ol> Questions:<ol style="margin-top:0pt;margin-bottom:0pt"><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">What services/ports can we safely expose to the outside world, and what services/ports NEED to be exposed to the outside world for this to work effectively with systems in multiple DCs?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">As part of the above, should authentication only be done across the VPN?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Can we safely use our main domain name (<a href="http://GREATMSP.COM">GREATMSP.COM</a>) as the domain for FreeIPA? As part of this, we have say, <a href="http://TICKETING.GREATMSP.COM">TICKETING.GREATMSP.COM</a> (a web app which will remain the same), and for systems, we might have <a href="http://SSH01.US-EAST.PRODUCTION.GREATMSP.COM">SSH01.US-EAST.PRODUCTION.GREATMSP.COM</a> (or perhaps <a href="http://SSH01.DC.US-EAST.PRODUCTION.GREATMSP.COM">SSH01.DC.US-EAST.PRODUCTION.GREATMSP.COM</a> for the internal, and <a href="http://SSH01.US-EAST.PRODUCTION.GREATMSP.COM">SSH01.US-EAST.PRODUCTION.GREATMSP.COM</a> for the external).</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Can we use this as a more generalized DNS system for other customer domains as opposed to our current bind system? If so, is it as simple as registering all of the FreeIPA servers (replicas) as NS servers with the registrar?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Since we want to be effectively multi-tenant, can we make it so that all authentication from the CLIENT1 infrastructure uses external addresses vs us needing to open holes into our FreeIPA infrastructure via VPN? How safe is/can this be?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">We see some notes about CA-Less being somewhat broken. Is this true?</li></ol> (Things we don’t really need/want to do):<ol style="margin-top:0pt;margin-bottom:0pt"><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Have each Client have their own SSL certs (complete non issue) </li></ol> Things we don’t know we don’t know:<ol style="margin-top:0pt;margin-bottom:0pt"><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Robustness?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Security?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Performance?</li><li dir="ltr" style="list-style-type:decimal;font-size:14.6667px;font-family:Arial;color:rgb(0,0,0);vertical-align:baseline;background-color:transparent">Anything else we haven’t thought of?</li></ol> Any help you can provide would be wonderful. We have attached a proposed diagram of what we're thinking of trying to accomplish. Thanks in advance,Michael<div> </div></div>