======================================================================
ATTENTION - REQUIRED before you run ipa-server-install
======================================================================
>>> Read /usr/local/share/doc/freeipa-server/README.md first,
>>> section "Prerequisites (read this first)".
FreeIPA on FreeBSD uses the MIT Kerberos from ports (security/krb5).
The SASL/GSSAPI plugin that the final "client enrolment" step of
ipa-server-install relies on MUST use that SAME Kerberos - otherwise the
install runs all the way through and then fails at the very end with:
Insufficient access: SASL(-1): generic failure: GSSAPI Error:
... (SPNEGO cannot find mechanisms to negotiate)
or
... Cannot find KDC for realm "EXAMPLE.COM"
By default security/cyrus-sasl2-gssapi is built with GSSAPI_BASE, which
links the BASE-system Kerberos (/usr/lib/libgssapi_krb5) and reads
/etc/krb5.conf - the wrong Kerberos for FreeIPA. You MUST rebuild it with
the GSSAPI_MIT option so it links the ports Kerberos
(/usr/local/lib/libgssapi_krb5) and reads /usr/local/etc/krb5.conf:
* via make.conf (ports / poudriere):
security_cyrus-sasl2-gssapi_SET=GSSAPI_MIT
security_cyrus-sasl2-gssapi_UNSET=GSSAPI_BASE
security_py-gssapi_SET=GSSAPI_MIT
security_py-gssapi_UNSET=GSSAPI_BASE
* or interactively, then rebuild + reinstall the plugin:
make -C /usr/ports/security/cyrus-sasl2-gssapi config
# select GSSAPI_MIT, deselect GSSAPI_BASE
Verify the plugin now links the ports Kerberos:
ldd /usr/local/lib/sasl2/libgssapiv2.so | grep libgssapi_krb5
# MUST show /usr/local/lib/libgssapi_krb5.so
# NOT /usr/lib/libgssapi_krb5.so.*
The Python bindings security/py-gssapi need the same GSSAPI_MIT choice;
ipalib uses them for the kinit during self-enrolment, and with the base
Kerberos the install fails at the very end with "Cannot find KDC".
Note: this is a system-wide choice. All SASL/GSSAPI consumers (SSSD,
OpenLDAP, Postfix, ...) will then use the ports MIT Kerberos - which is
the correct, consistent setup on a host dedicated to FreeIPA.
Full details and the rest of the prerequisites (FQDN, /etc/hosts,
D-Bus/dbus_enable, cloud-init manage_etc_hosts, reboot persistence):
/usr/local/share/doc/freeipa-server/README.md
======================================================================
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
4.13.4
4.13.4
–
FreeBSD 15
4.13.4
4.13.4
–
FreeBSD 14
✗
4.13.4
4.13.4
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
4.13.4
4.13.4
–
FreeBSD 14
4.13.4
4.13.4
4.13.4
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 4.13.4.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request …
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (8)
Jochen Neumeister (joneum) · 4.13.4
net/freeipa-server: Update to 4.13.4
Includes the 4.13.3 release. Adds a mod_reqtimeout slow-read
configuration to ipa.conf, removes the two minute delay from DNA
configuration during installation and updates the WebUI to 0.2.1.
Changes: https://www.freeipa.org/release-notes/4-13-3.html
Changes: https://www.freeipa.org/release-notes/4-13-4.html
Security: 9736fef3-ada6-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
net/freeipa-server: Fix client enrollment paths
ipa-join used the upstream default /etc/ipa/ca.crt, so it could not
build a
TLS context and enrollment stopped at "Unable to determine root DN". The
client port already patches this constant; the server port ships the
same
ipaclient tree and needs it too.
configure_krb5_snippet() copied its snippet into a krb5.conf.d that
nothing
creates, which aborted the install with FileNotFoundError. It now
creates
the directory, which is where FreeIPA points krb5.conf's includedir
anyway.
Reported by: usenix17
https://github.com/joneum/FreeBSD-freeipa-server/issues/3
Sponsored by: Netzkommune GmbH
net/freeipa-server: Respect PREFIX and fix service restarts
The patches hardcoded /usr/local. They now carry %%PREFIX%% for this port's
own files and %%LOCALBASE%% for what other ports install, substituted in
post-patch.
Two restart fixes: the rc script passes --ignore-service-failures on restart
as it already does on start, so one failing service no longer takes the
Directory Server down with it, and FreeBSDService re-checks a service after a
failed rc action instead of trusting a status check that raced the pidfile.
Sponsored by: Netzkommune GmbH
net/freeipa-server: Fix hardcoded paths
ipa-cacert-manage, ipa-getcert and the chrony tools were taken from the
Linux defaults, so they pointed at /usr/sbin, /usr/bin and /etc, where
FreeBSD has nothing. ipa-client-install aborted at the time
synchronisation step for that reason. net/chrony was missing from
RUN_DEPENDS as well.
Reported by: m87carlson (via my private GitHub FreeIPA repository)
Sponsored by: Netzkommune GmbH
net/freeipa-server: Update to 4.13.2
Upstream moved to Codeberg, follow it in MASTER_SITES.
Use the samba framework instead of a hardcoded samba416 dependency [1].
Require sssd2 2.13.1_2 or newer. Earlier revisions leave ${prefix}
unexpanded in SSSDConfig, which makes ipa-server-install fail.
Own the HTTP keytab by www. httpd runs with GSS_USE_PROXY=no and reads
the keytab itself, so a root-owned one left mod_auth_gssapi without
server credentials.
Keep the rc(8) program paths of the Kerberos services in place so a
running kadmind stays visible to rc(8) while it is disabled. Without
them ipactl reported it as stopped and ipactl restart waited forever.
Make the D-Bus system bus a prerequisite of certmonger and oddjobd.
Without it certmonger does not start and oddjobd retries forever, which
stalls the boot before sshd.
Point the ACME configuration templates at the FreeBSD instance path.
Add an UPDATING entry for the Java 21 switch of security/dogtag-pki and
for the ACME paths of already deployed instances.
PR: 297655 [1]
Submitted by: fluffy [1]
Changes: https://www.freeipa.org/release-notes/4-13-2.html
Sponsored by: Netzkommune GmbH
net/freeipa-server: Add New Port
FreeIPA is an integrated identity and authentication solution: an LDAP
directory (389 Directory Server), a Kerberos KDC (MIT krb5), a Dogtag
PKI certificate authority and a web UI/CLI, combined into a single managed
domain, the Free Software counterpart to Active Directory.
This port provides the FreeIPA server on FreeBSD together with the
FreeBSD-specific integration that upstream (Linux/systemd oriented) does
not ship: an ipaplatform "freebsd" backend, rc.d service scripts, and
the glue required to run the whole stack against the ports MIT Kerberos
(security/krb5).
WWW: https://www.freeipa.org/
Sponsored by: Netzkommune GmbH