CIS FreeIPA Benchmark

This recommendation verifies that password policies enforce complexity and lockout on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check password policy:
ipa pwpolicy-show

# Check global policy:
ipa config-show | grep -iE 'password|lockout|lifetime'

# Configure strong password policy:
ipa pwpolicy-mod --maxlife=90 --minlife=1 \
  --history=12 --minlength=14 \
  --minclasses=4 --maxfail=5 \
  --failinterval=600 --lockouttime=1800

# Create group-specific password policy:
ipa pwpolicy-add admins --priority=10 \
  --maxlife=60 --minlife=1 \
  --history=24 --minlength=16 \
  --minclasses=4 --maxfail=3 \
  --failinterval=300 --lockouttime=3600

This setting ensures that Kerberos ticket lifetimes and encryption are restricted on the FreeIPA identity management server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the FreeIPA identity management server is essential for defense in depth.

# Check Kerberos ticket policy:
ipa krbtpolicy-show

# Check specific user policy:
ipa krbtpolicy-show admin

# List authentication indicators:
ipa config-show | grep -i 'auth indicators'

# Configure Kerberos ticket lifetime restrictions:
ipa krbtpolicy-mod --maxlife=36000 --maxrenew=604800

# Set stricter policy for admins:
ipa krbtpolicy-mod admin --maxlife=14400 --maxrenew=86400

# Require authentication indicators for sensitive services:
ipa service-mod HTTP/web.example.com \
  --auth-ind=otp --auth-ind=pkinit

# Force strong Kerberos encryption:
ipa config-mod --ipaconfigstring='KDC:Disable Last Success' \
  --ipaconfigstring='KDC:Disable Lockout'

This recommendation verifies that OTP two-factor authentication is enabled on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check two-factor authentication:
ipa config-show | grep -i 'auth type'

# List OTP tokens:
ipa otptoken-find

# Check user auth type:
ipa user-show admin --all | grep -i 'auth type'

# Enable OTP two-factor authentication:
ipa config-mod --user-auth-type=otp

# Add TOTP token for user:
ipa otptoken-add --type=totp --owner=admin \
  --algo=sha256 --digits=6 --interval=30

# Enforce OTP for specific users:
ipa user-mod admin --user-auth-type=otp

# Enable RADIUS proxy for external MFA:
ipa radiusproxy-add mfa-server \
  --server=radius.example.com \
  --secret=RADIUS_SHARED_SECRET

This recommendation verifies that HBAC rules restrict service access per host group on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List HBAC rules:
ipa hbacrule-find

# Check specific HBAC rule:
ipa hbacrule-show allow_all

# Test HBAC:
ipa hbactest --user=testuser --host=server1.example.com --service=sshd

# Disable default allow_all HBAC rule:
ipa hbacrule-disable allow_all

# Create targeted HBAC rules:
ipa hbacrule-add sshd_admins \
  --desc='Allow admins SSH access to all hosts'
ipa hbacrule-add-user sshd_admins --groups=admins
ipa hbacrule-add-service sshd_admins --hbacsvcs=sshd
ipa hbacrule-add-host sshd_admins --hostgroups=linux-servers

ipa hbacrule-add web_developers \
  --desc='Allow devs access to web servers'
ipa hbacrule-add-user web_developers --groups=developers
ipa hbacrule-add-service web_developers --hbacsvcs=sshd
ipa hbacrule-add-host web_developers --hostgroups=web-servers

# Test the rule:
ipa hbactest --user=dev1 --host=web1.example.com --service=sshd

This recommendation verifies that sudo rules use command groups with minimal privileges on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List sudo rules:
ipa sudorule-find

# Check specific sudo rule:
ipa sudorule-show admin_sudo

# List sudo commands:
ipa sudocmd-find

# Create granular sudo rules:
# Define allowed commands:
ipa sudocmd-add '/usr/bin/systemctl restart httpd'
ipa sudocmd-add '/usr/bin/systemctl restart nginx'
ipa sudocmdgroup-add web-admin-cmds
ipa sudocmdgroup-add-member web-admin-cmds \
  --sudocmds='/usr/bin/systemctl restart httpd' \
  --sudocmds='/usr/bin/systemctl restart nginx'

# Create sudo rule:
ipa sudorule-add web_admin_sudo \
  --desc='Web admin restart services'
ipa sudorule-add-user web_admin_sudo --groups=web-admins
ipa sudorule-add-host web_admin_sudo --hostgroups=web-servers
ipa sudorule-add-allow-command web_admin_sudo \
  --sudocmdgroups=web-admin-cmds
ipa sudorule-add-option web_admin_sudo --sudooption='!authenticate'

# Remove broad sudo rules:
ipa sudorule-del allow_all_sudo 2>/dev/null

This recommendation verifies that delegated administration uses custom roles and permissions on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check delegation rules:
ipa delegation-find

# Check self-service permissions:
ipa selfservice-find

# Check permission:
ipa permission-find --type=user

# Configure delegation with minimal permissions:
ipa delegation-add 'helpdesk password reset' \
  --group=helpdesk --membergroup=users \
  --attrs=userpassword

# Create custom permission:
ipa permission-add 'Read User Email' \
  --right=read --type=user \
  --attrs=mail

# Create privilege from permissions:
ipa privilege-add 'Helpdesk' \
  --desc='Helpdesk staff privileges'
ipa privilege-add-permission 'Helpdesk' \
  --permissions='Read User Email'

# Create role and assign:
ipa role-add 'Helpdesk Staff' \
  --desc='First-line support'
ipa role-add-privilege 'Helpdesk Staff' \
  --privileges='Helpdesk'
ipa role-add-member 'Helpdesk Staff' \
  --groups=helpdesk

This recommendation verifies that certificate profiles and auto-renewal are configured on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CA configuration:
ipa ca-find
ipa cert-show 1 --out=/dev/null 2>&1

# Check certificate profiles:
ipa certprofile-find

# List issued certificates:
ipa cert-find --sizelimit=10

# Configure certificate authority security:
# Create custom certificate profile:
ipa certprofile-import server-tls \
  --file=/tmp/server-tls.cfg \
  --desc='Server TLS certificate' \
  --store=TRUE

# Issue certificate with proper SAN:
ipa cert-request /tmp/server.csr \
  --principal=HTTP/web.example.com \
  --profile-id=server-tls

# Set certificate auto-renewal:
ipa-getcert request -K HTTP/web.example.com \
  -k /etc/pki/tls/private/web.key \
  -f /etc/pki/tls/certs/web.crt \
  -D web.example.com \
  -N CN=web.example.com

# Monitor certificate status:
ipa-getcert list

This recommendation verifies that CRL distribution and certificate revocation are working on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CRL and OCSP:
curl -s http://ipa.example.com/ipa/crl/MasterCRL.bin | \
  openssl crl -inform DER -noout -text | head -20

# Check OCSP responder:
openssl ocsp -issuer /etc/ipa/ca.crt -cert /tmp/test.crt \
  -url http://ipa.example.com/ca/ocsp

# Ensure CRL distribution and OCSP are working:
# Check CRL update interval:
grep -i crl /var/lib/pki/pki-tomcat/ca/conf/CS.cfg

# Configure CRL update interval:
pkcicfg ca-crl-set --crl-update-interval 240

# Revoke compromised certificate:
ipa cert-revoke SERIAL_NUMBER --revocation-reason=1

# Verify revocation:
ipa cert-show SERIAL_NUMBER | grep -i status

This recommendation verifies that replication topology is redundant and monitored on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check replication topology:
ipa topologysegment-find domain
ipa topologysegment-find ca

# Check replication agreements:
ipa-replica-manage list

# Check replication status:
ipa-replica-manage list -v

# Configure secure replication topology:
# Add replica:
ipa-replica-install --server=ipa-master.example.com \
  --domain=example.com --realm=EXAMPLE.COM \
  --principal=admin --setup-ca --setup-dns \
  --forwarder=8.8.8.8 --no-ntp

# Create topology segment:
ipa topologysegment-add domain \
  --leftnode=ipa1.example.com \
  --rightnode=ipa2.example.com \
  'ipa1-to-ipa2'

# Monitor replication:
ipa-healthcheck --check=ipahealthcheck.ds.replication

This recommendation verifies that DNS zones use DNSSEC and restrict zone transfers on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS configuration:
ipa dnsconfig-show
ipa dnszone-find

# Check DNSSEC:
ipa dnszone-show example.com | grep -i dnssec

# Secure DNS configuration:
# Enable DNSSEC:
ipa dnszone-mod example.com --dnssec=true

# Configure DNS forwarding securely:
ipa dnsconfig-mod --forwarder=1.1.1.1 --forward-policy=first

# Restrict zone transfers:
ipa dnszone-mod example.com \
  --allow-transfer='10.0.0.0/24;127.0.0.1'

# Add reverse zone:
ipa dnszone-add 0.10.in-addr.arpa \
  --name-server=ipa.example.com \
  --admin-email=admin@example.com

This recommendation verifies that ipa-healthcheck runs on an automated schedule on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Run FreeIPA healthcheck:
ipa-healthcheck --failures-only 2>/dev/null | head -30

# Check service status:
ipactl status

# Set up automated healthcheck:
cat > /etc/cron.d/ipa-healthcheck << 'EOF'
0 */6 * * * root /usr/bin/ipa-healthcheck --failures-only \
  --output-type json > /var/log/ipa/healthcheck-$(date +\%Y\%m\%d-\%H).json 2>&1
find /var/log/ipa/healthcheck-*.json -mtime +30 -delete
EOF

# Configure Nagios/Prometheus monitoring:
# Monitor critical services:
# - dirsrv (LDAP)
# - krb5kdc (Kerberos KDC)
# - httpd (Web UI)
# - pki-tomcatd (Dogtag CA)
# - named (DNS)

This recommendation verifies that 389-ds audit logging is enabled and forwarded on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit logging:
grep -i audit /etc/dirsrv/slapd-*/dse.ldif | head -10

# Check access logs:
ls -la /var/log/dirsrv/slapd-*/access*
ls -la /var/log/httpd/error_log

# Configure comprehensive audit logging:
# Enable 389-ds audit logging:
dsconf slapd-EXAMPLE-COM config replace \
  nsslapd-auditlog-logging-enabled=on \
  nsslapd-auditlog=/var/log/dirsrv/slapd-EXAMPLE-COM/audit \
  nsslapd-auditlog-logrotationtime=1 \
  nsslapd-auditlog-logrotationtimeunit=day \
  nsslapd-auditlog-maxlogsperdir=30

# Forward logs to SIEM:
cat > /etc/rsyslog.d/ipa.conf << 'EOF'
module(load="imfile")
input(type="imfile"
      File="/var/log/dirsrv/slapd-*/audit"
      Tag="ipa-audit"
      Severity="info")
*.* @@siem.example.com:514
EOF
systemctl restart rsyslog

This recommendation verifies that automated full and data-only backups are configured on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup status:
ls -la /var/lib/ipa/backup/

# List available backups:
ipa-backup --list 2>/dev/null

# Configure automated FreeIPA backups:
cat > /etc/cron.d/ipa-backup << 'EOF'
0 1 * * * root /usr/sbin/ipa-backup --data --online \
  --log-file=/var/log/ipa/backup.log 2>&1
0 1 * * 0 root /usr/sbin/ipa-backup --log-file=/var/log/ipa/backup-full.log 2>&1
find /var/lib/ipa/backup/ -mtime +30 -exec rm -rf {} +
EOF

# Verify backup integrity:
ipa-restore --data --online --dry-run /var/lib/ipa/backup/latest/

This recommendation verifies that FreeIPA is kept up to date with latest releases on the FreeIPA identity management server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the FreeIPA identity management server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check FreeIPA server version:
ipa --version
rpm -q ipa-server

# Check for available updates:
yum check-update ipa-server 2>/dev/null || dnf check-update ipa-server 2>/dev/null

# Update FreeIPA safely:
# Backup first:
ipa-backup

# Update packages:
dnf update ipa-server ipa-client ipa-server-dns -y

# Run server upgrade:
ipa-server-upgrade

# Verify after upgrade:
ipactl restart
ipactl status
ipa-healthcheck --failures-only

# Update replicas one at a time:
# On each replica:
dnf update ipa-server ipa-client -y
ipa-server-upgrade
ipactl restart