A FreeBSD administrator has detailed a new approach for integrating FreeBSD 15 with FreeIPA using native Kerberos and LDAP authentication. The method, based on Christian Hofstede-Kuhn's work, leverages FreeBSD's switch from Heimdal to MIT Kerberos in version 15.0-RELEASE. This replaces previous complex setups requiring custom ports and multiple daemons.

Previous attempts required compiling custom packages from FreeBSD Ports, using specialized code from developers like Mariusz Zaborski, and managing the complex sssd daemon with dependencies on D-Bus and Python. The new method simplifies this by using MIT Kerberos from FreeBSD 15.0-RELEASE combined with the lightweight nslcd daemon from the nss-pam-ldapd package. While the LGPL21/LGPL3 license is a minor concern, it's negligible when connecting to an entire Linux domain.

The setup involves configuring DNS records, generating keytabs on the FreeIPA server, and installing nss-pam-ldapd with pam_mkhomedir and sudo packages. Configuration files for krb5.conf and nslcd.conf are created, and sshd is modified to support GSSAPI authentication. The result is a streamlined authentication system that works seamlessly with FreeIPA domains, allowing users to SSH into FreeBSD systems using their domain credentials.