An IdM Replica at Home: Kerberos That Survives a Dead Tunnel

Table of Contents Table of Contents Should You Even Do This? The Starting Point The Real Blocker: A Tunnel That Only Worked One Way A DMZ That Only Exists Inside the Hypervisor Addressing Firewall Rules Test Both Directions Before Installing Anything Detour: Satellite Says 422 Installing the Replica Topology and Locations Why There Is No CA at Home DNS at Home, and Where Locations Stop Helping The Clients The Laptop jump01, the FreeBSD Jump Host app01, a Regular IdM Client Autostart The Test Caveats Conclusion References My identity setup has a single point of failure, and it is not a server. It is a tunnel. The realm IPA.EXAMPLE.COM is served by two Red Hat Identity Management (IdM) servers, idm1 and idm2. Both run on different nodes of a Proxmox VE cluster in a data center. My home network reaches them through a site-to-site WireGuard tunnel between two OPNsense firewalls, one at home and one in the CoLo. A quick note on naming: Red Hat Identity Management (IdM) is Red Hat’s…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town