Following procedure describe enrollment procedure to enroll Linux servers to FreeIPA. Most popular distributions have freeipa-client for them. this procedure designed for SLES, but similar concept should work with other distros.

Preparation:

Install SLES with following modules (or activate mentioned modules)

sle-module-basesystem 
sle-module-containers
PackageHub
sle-module-server-applications
sle-module-python3

Choose system role: minimal.

Use XFS (or other you prefer. do not use btrfs).

Move swap partition to dedicated partition.

Install default applications:

zypper install docker docker-compose iputils vim tcpdump wget sudo yast2-auth-client sssd sssd-ipa krb5-client openldap2-client sssd-ad cyrus-sasl-gssapi

Start docker

systemctl start docker
systemctl enable docker

Enrollment process. IDM server side.

Login to IDM server:

https://linux-idm1.your-domain.ca

Enable Admin user for enrollment process or use another user with enrollment rights for enrollment procedure.

ssh to IDM server:

ssh user@linux-idm1.your-domain.ca

connect to FreeIPA container:

docker exec -it freeipa-server /bin/bash

Obtain FreeIPA user credentials for current session, add new host to IDM, change configuration of host, get Kerberos keys for host.

kinit admin
ipa host-add new-server.your-domain.ca --ip-address=100.100.100.100
ipa host-add-managedby --hosts=linux-idm1.your-domain.ca new-server.your-domain.ca
ipa-getkeytab -s linux-idm1.your-domain.ca -p host/new-server.your-domain.ca.ca -k /data/new_server.krb5.keytab

Login to IDM server.

https://linux-idm1.your-domain.ca

Disable user “Admin”.

Enrollment Process. Client server side.

ssh to server you want to enroll

ssh user@new-server.your-domain.ca

Install default applications:

zypper install docker docker-compose iputils vim tcpdump wget sudo yast2-auth-client sssd sssd-ipa krb5-client openldap2-client sssd-ad cyrus-sasl-gssapi

Copy new_server.krb5.keytab from IDM server and do:

mv ~/new_server.krb5.keytab /etc/krb5.keytab
chown root:root /etc/krb5.keytab
chmod 0600 /etc/krb5.keytab

Install IDM certificate:

mkdir /etc/ipa
wget -O /etc/ipa/ca.crt https://linux-idm1.your-domain.ca/ipa/config/ca.crt --no-check-certificate
cp /etc/ipa/ca.crt /etc/pki/trust/anchors/ipa.crt
update-ca-certificates

Edit /etc/nsswitch.conf. Replace with new values:

passwd:     files sss
shadow:     files sss
group:      files sss
hosts:          files dns
networks:       files dns
services:       files sss
protocols:      files
rpc:            files
ethers:         files
netmasks:       files
netgroup:       files nis sss
publickey:      files
bootparams:     files
automount:      files nis sss
aliases:        files
sudoers:        files sss

Edit /etc/sssd/sssd.conf. Replace with new values:

[sssd]
config_file_version = 2
services = nss, pam, ssh, sudo
domains = your-domain.ca

[nss]
homedir_substring = /home

[pam]

[domain/your-domain.ca]
cache_credentials = True
krb5_store_password_if_offline = True
krb5_realm = YOUR_REALM.YOUR_DOMAIN.CA
ipa_domain = your-domain.ca
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = new-server.your-domain.ca
chpass_provider = ipa
ipa_server = linux-idm1.your-domain.ca
ldap_tls_cacert = /etc/ipa/ca.crt
ldap_user_ssh_public_key = ipaSshPubKey

Edit /etc/krb5.conf Replace with new values:

includedir  /etc/krb5.conf.d

[libdefaults]
default_realm = YOUR_REALM.YOUR_DOMAIN.CA
dns_lookup_realm = false
dns_lookup_kdc = false
rdns = false
dns_canonicalize_hostname = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}

[realms]
LINUX.CC.UREGINA.CA = {
  kdc = linux-idm1.your-domain.ca:88
  master_kdc = linux-idm1.your-domain.ca:88
  admin_server = linux-idm1.your-domain.ca:749
  kpasswd_server = linux-idm1.your-domain.ca:464
  default_domain = your-domain.ca
  pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
  pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}

[domain_realm]
.your-domain.ca = YOUR_REALM.YOUR_DOMAIN.CA
your-domain.ca = YOUR_REALM.YOUR_DOMAIN.CA
.your-realm.your-domain.ca = YOUR_REALM.YOUR_DOMAIN.CA
your-realm.your-domain.ca = YOUR_REALM.YOUR_DOMAIN.CA
new-server.your-domain.ca = YOUR_REALM.YOUR_DOMAIN.CA

[logging]
  kdc = FILE:/var/log/krb5/krb5kdc.log
  admin_server = FILE:/var/log/krb5/kadmind.log
  default = SYSLOG:NOTICE:DAEMON

execute to configure PAM:

pam-config -a --sss

Edit /etc/pam.d/sshd. Add:

session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 

Edit /etc/ssh/sshd_conf. Add or update:

PubkeyAuthentication yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser nobody

Comment out following lines in /etc/sudoers

##Defaults targetpw   # ask for the password of the target user i.e. root
##ALL   ALL=(ALL) ALL   # WARNING! Only use this together with 'Defaults targetpw'!

Restart services

service sshd restart
systemctl enable sssd
systemctl start sssd
systemctl start docker
systemctl enable docker

Try to login from different window. Now it should work. 🙂

Scenario: Customer web-site hit hard by AI bots. Server run Apache. Only one virtual host present. Task is to protect service from AI-bots at the same time allow normal traffic.

Configuration fragment of Apache server:

<VirtualHost *:443>
  ServerName your-great-site.ca
  SSLEngine on
</VirtualHost>

Solution implementation steps:

• Install docker
• Make sure mod_proxy for Apache installed/enabled
• Change Apache configuration to proxy requests to Anubis
• Add Apache configuration to serve as backend for Anubis
• Restart Apache
• Configure Anubis docker container for basic operations
• Start Anubis container

Implementation (following process for SLES. for other Linux distro it is pretty similar with minimal adjustments).

Install docker-compse:

zypper install docker docker-compose -y

Start docker service:

systemctl enable --now docker.service

Create directory structure and docker-file:

mkdir -p /opt/anubis
mkdir -p /opt/anubis/config
touch /opt/anubis/docker-compose.yml
touch /opt/anubis/config/policies.yml

Content of docker-compose.yml:

services:
  anubis:
    image: ghcr.io/techarohq/anubis:latest
    container_name: anubis
    restart: always
    network_mode: "host"
    ports:
      - "127.0.0.1:8923:8923"   # bind only to localhost
    environment:
      # TARGET must point to your internal WordPress Apache backend
      - TARGET=http://127.0.0.1:8023
      - COOKIE_DOMAIN=your-great-site.ca
      - OG_PASSTHROUGH=true
      - OG_EXPIRY_TIME=1h
      - OG_CACHE_CONSIDER_HOST=true
      # Add this to allow your domain
      - REDIRECT_DOMAINS=your-great-site.ca
    volumes:
      - ./config:/data

Content of policies.yml (very basic policy. you can adjust it at your will):

allow:
  - path: '/robots.txt'
  - path_regex: '^/wp-content'
  - path_regex: '^/wp-includes'
  - path_regex: '^/wp-admin/admin-ajax.php'
  - user_agent_regex: 'Googlebot'
  - ip_cidr: '203.0.113.0/24'
challenge:
  - path_regex: '^/wp-admin'
block:
  - path_regex: '^/api/scrape'

Anubis part is done. let`s start container:

docker-compose up -d

Apache preparation.

First check if mod proxy is installed/enabled. ATTN!!!! This is a key point. If no mod proxy installed/working, process will fail.

a2enmod proxy
a2enmod proxy_http
apachectl -M | grep proxy

Modify initial Virtualhost configuration to pass all incoming traffic to Anubis. You should get something like this:

<VirtualHost *:443>
  ServerName your-great-site.ca
  SSLEngine on

  # Preserve original host & IP headers for Anubis
  ProxyPreserveHost On
  RequestHeader set X-Forwarded-Proto "https"
  RequestHeader set X-Forwarded-For %{REMOTE_ADDR}s
  RequestHeader set X-Real-IP %{REMOTE_ADDR}s
  RequestHeader set X-Forwarded-Proto https

  ProxyPass        /  http://127.0.0.1:8923/
  ProxyPassReverse /  http://127.0.0.1:8923/

</VirtualHost>

Create second listener for backend of site. it should be something like this:

Listen 8023

<VirtualHost *:8023>
    ServerName your-great-site-backend.ca

    DocumentRoot /srv/www/htdocs
    <Directory "/srv/www/htdocs">
        Options FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Optional: disable SSL on backend
    SSLEngine off

    ErrorLog /var/log/apache2/wordpress-backend-error.log
    CustomLog /var/log/apache2/wordpress-backend-access.log combined
</VirtualHost>

Check configuration sanity and restart apache

apachectl -t
service httpd stop
service httpd start

Enjoy your server free of unnessessary workload from AI bots!