freeipa

#4599 Point to hardening steps if IPA server is installed on public network
Opened by pspacek. Modified

Open
Close Issue

Installer should detect that IPA server is being installed on public network (address block outside RFC1918 or non-link-local IPv6 address) and scream loudly that admin should harden server configuration.

Not doing so will:

  • allow attackers to use IPA DNS in amplification attacks
  • allow attackers to enumerate all users, groups and other anonymously available data from LDAP
  • violate EC2 Terms of Service

etc.

Some recommendations are captured at:
https://www.redhat.com/archives/freeipa-users/2014-April/msg00243.html

Metadata Update from @pspacek:
- Issue assigned to someone
- Issue set to the milestone: Future Releases
Metadata
None
None
None
Normal
enhancement
Installation
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.