Omar Adan Hassan

Projects

Centralized Linux identity and privileged access

Moving server access from local accounts and shared keys to centrally managed identities, host-based access rules and controlled privilege escalation.

Role
Identity architecture and rollout
Stack
FreeIPA, SSSD, Kerberos, Ansible, OpenSSH

Problem

Access to Linux servers was managed per host with local users and SSH keys. Revoking someone's access meant finding every server they could reach, and there was no single view of who could do what.

Constraints

  • Existing servers had to keep working during migration; no big-bang cutover.
  • Privileged access needed to be auditable without slowing incident response.
  • The identity service itself had to be highly available, since it becomes a dependency for every login.

Decisions

FreeIPA as the central identity provider for Linux
It combines LDAP, Kerberos, host enrollment, sudo rules and host-based access control in one supported system built for Linux fleets.
Host-based access control by group, not by person
Access follows role. Joining or leaving a team changes access everywhere at once.
Centrally managed sudo rules
Privilege escalation is defined once, reviewed, and logged, instead of drifting in local sudoers files.

Architecture

  1. Identity provider

    Replicated FreeIPA servers hold users, groups, host groups, HBAC and sudo rules.

    • FreeIPA
    • LDAP
    • Kerberos

  2. Enrollment

    Servers enrolled with automation so new hosts join the identity domain on first boot.

    • Ansible
    • SSSD

  3. Authentication

    Users log in with their own identity; SSH keys and Kerberos tickets are centrally managed.

    • SSSD
    • OpenSSH

  4. Authorization

    HBAC decides which groups can reach which host groups; sudo rules control elevation.

    • HBAC
    • sudo

  5. Audit

    Authentication and privilege use forwarded to central logging for review.

    • journald
    • central logging
Sanitized identity flow. No real hostnames, realms or network details are shown.

Build notes

Implementation

Rollout went host group by host group. Each group was enrolled, tested with a small set of users, then had local accounts disabled once central login was confirmed. A break-glass procedure was documented and tested before any local access was removed.

Challenges

Availability was the main concern: if identity is down, nobody can log in. Replicas, monitoring of the identity service itself, and SSSD credential caching reduced that risk.

Outcome

Onboarding and offboarding became a group change rather than a server-by-server task. Who can access which systems is now answerable from one place, and privileged actions leave a trail.

What I learned

Identity is foundational. Privileged access management, secrets management and audit all get simpler once every human has exactly one identity.