DefGuard + FreeIPA?

[johnnyutahh]

Does it make sense to integrate DefGuard with a network employing a FreeIPA server?

If so, how? And how "simple" is it to do?

[teon]

defguard should be an easy replacement for most use cases - but we do not have all integrations (which FreeIPA has) covered. What are your typical use cases that you require FreeIPA to cover? If we lack integrations, it will go to our roadmap.

[johnnyutahh]

....and cmdline-oriented functionality. Most all FreeIPA features (that we use, anyway) have a cmdline interface, which use far more often than the GUI (for human-manually-entered commands or scripts).

Does DefGuard offer any cmdline things like this?

[johnnyutahh]

...and we do NOT want to rely on 3rd-party/cloud auth services. Need it to be all self-hosted and "self contained" (within our own network/VPN), if that makes any sense.

[johnnyutahh]

Thanks for your help with this @teon. Any further thoughts on my above questions?

[teon]

Hi @johnnyutahh - sorry for the late reply we were planning and releasing 0.7.1 and new one-line deployment tool/script.

But back to the conversation and your needs:

1. create/delete/edit users

Covered with beautiful UI & secure remote enrolment&onboarding.

2. manage user<->host access rights

ACL/groups & roles are planned in 0.9 release.

But we have simple groups now: all users & admins - which is supported in VPN locations (you can define who has access to the vpn location).

3. support user and host groups
   manage user ssh keys

We have provisioning of Yubico Yubikey security hardware keys with generating and storing keys (public in defguard / private on hardware).

So defguard has user public keys & openldap integration.

Now - SSH access based on pam&ldap is fairly easy (we can add this to documentation).

We also have webhooks & API so we integrate our systems by this functionality as well - for example we have a webhook that if a new ssh key is added to user it adds the key to GitLab.

4. define per-host user sudo privs
   play nicely with nfs-mounted dirs, including /home/

See response to Q.2.

So as you see it's not 1:1 replacement - we have different philosophy - about that I have written some more details here:

https://reddit.com/r/rust/s/szshrUR2Yv

[teon]

Oh and we are planning a CLI client - now it's just webhooks & full API.