Specific hardening jobs on FreeIPA servers and policies: FIPS mode, password quality, LDAP bind rules, inactive accounts and security releases.
Deploying FreeIPA on FIPS-enabled hosts: enabling FIPS before installation, the restricted Kerberos encryption types, every replica in FIPS mode, no conversion of existing deployments, and features such as RADIUS that do not qualify.
Strengthening FreeIPA password rules beyond length and classes: dictionary checks, user name checks, repeated characters and the libpwquality options, and their limits.
Stopping unlimited LDAP authentications with expired passwords in FreeIPA: the password policy grace limit, values of 0 and -1, and the impact on applications that bind over LDAP.
Meeting rules that require disabling unused accounts when FreeIPA does not track successful authentications: what the design proposes, data sources for last login, and scripted reviews.
Tracking and applying FreeIPA security fixes: stabilization releases, recent CVEs fixed in 4.13.4, update order across replicas, and verifying fixes after rollout.
Closing the gap where LDAP binds bypass FreeIPA two-factor authentication: OTP enforcement for LDAP authentication added in 4.12, affected applications, and rollout testing.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.