Setting up a FreeIPA Server and Client

What is FreeIPA

FreeIPA is a free and open source identity management system, it is the upstream open-source project for Red Hat Identity Management.

FreeIPA is the Linux version or implementation of Active Directory, which features the following:

• Integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, SSSD and others.
• Built on top of well known Open Source components and standard protocols.
• Strong focus on ease of management and automation of installation and configuration tasks.
• Full multi master replication for higher redundancy and scalability.
• Extensible management interfaces (CLI, Web UI, XMLRPC and JSONRPC API) and Python SDK.

Before you Begin

This guide assumes:

• Two fully functional Linodes equal to a 2GB Plan or greater must be created using CentOS 7 or later. One will host the FreeIPA server, while the other will host the client.
• You have followed the Getting Started and Securing Your Server guides. One will host the FreeIPA server, while the other will host the client.
• You are familiar with the command line
• FreeIPA requires that the user has possession of their own fully qualified domain name (FQDN) with an active subdomain for both the client and server. Before proceeding, ensure that each Linode has A/AAAA records configured using a Unique Subdomain for both the server and client Linode respectively.
• Set up Reverse DNS for each Linode using their full unique subdomain.

Prepare the Client and Server

First, the FreeIPA Server and Client Linodes must be prepared for the installation. Follow the pre-installation steps below on both the Client and Server Linodes:

1. Set the hostname to match the domain you will be using for the FreeIPA server or client:

   sudo hostname ipa.example.com
   

2. Edit the systems hosts file to reflect the new hostname.

File: /etc/hosts

127.0.0.1 localhost.localdomain localhost
203.0.113.10 server.example.com example-hostname

1. FreeIPA requires access to the following ports for the services listed below:

All of the above ports can be opened using the commands in firewalld cmd list. Type the following command:

firewall-cmd --permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,464/tcp,53/tcp,88/udp,464/udp,53/udp,123/udp}

1. Reload the firewall rules to save and activate them:

   firewall-cmd --reload
   

2. If installing on CentOS 8 or CentOS Stream, the DL1 module stream must be manually installed and synced to be able to install the FreeIPA server and client in a later step:

     dnf module enable idm:DL1
     dnf distro-sync
   

Set Up the FreeIPA Server

On the server Linode, install and set up the FreeIPA server with the following commands:

1. Download the FreeIPA server software:

   yum install ipa-server
   

2. Once the software has been downloaded, begin the installation process by entering the following command:

   sudo ipa-server-install
   

3. Respond to the prompts with your desired FreeIPA configuration. Below are explanations on the configuration options and what options should be entered.

1. The installation process will begin, and you should see every step being outlined in your terminal. This process can take between 3-5 minutes to complete.

2. Once the installation is complete, you will you will be provided with instructions on how to create a Kerberos ticket for the admin user, allowing you to begin working with Kerberos. This can be done by running the following command:

   kinit admin
   

Note

The admin ticket created with kinit admin is set to expire in 24 hours following ticket creation. To re-create another admin ticket, enter kinit admin again at any time.

1. At the prompt, enter the IPA Admin Password to proceed.

2. To view all active Kerberos tickets along with statistics, enter the following command:

   klist
   

3. Create a new user by entering the following command and following the prompts that appear in the terminal:

   ipa user-add --password
   

New users can be created with the above command at any time.

Note

Kerberos tickets associated with these users will expire similarly to admin users. Basic syntax for creating new kerberos tickets is kinit username.

Set up the FreeIPA Client

On the client Linode, install and set up the FreeIPA client with the following commands:

1. Download the FreeIPA client software:

   sudo yum install freeipa-client
   

2. Once the software has been downloaded, begin the installation process by entering the following command:

   sudo ipa-client-install --mkhomedir
   

3. Respond to the prompts with your desired FreeIPA client configuration. Below are explanations on the configuration options and what options should be entered.

FreeIPA is now successfully installed as both a client and server. To confirm this, authenticate to the server as a user created previously by entering the following command to switch to your user:

   su - username

Provided a kerberos ticket has been created for the user using the kinit username command, you will additionally be able to authenticate to any client using kerberos tickets. Enter the following command to open an ssh session from the server Linode to the client to confirm:

   ssh -k user@client.example.com

Kerberos tickets enable you to authenticate to any client using tickets instead of providing credentials. In this case,you will be able to log in to the FreeIPA client via SSH without providing any credentials, as the identity of both hosts has already been validated via FreeIPA and Kerberos.

Next Steps

The kerberos admin server will be freely accessible via it’s domain in a web browser. Credentials created during installation can then be used to log in as the admin user via FreeIPA’s web ui. Enter the admin server domain into your browser and you will see a page similar to the following:

Once logged in, you will have access to many of the tools and utilities available to FreeIPA from the command line directly on a more user friendly web interface.

Note

The steps in this guide rely on a self-signed SSL certificate, and users may see an error message in their web browser claiming that the SSL certificate is not valid. While the self-signed certificate will not be recognized by any certificate authority, it will still provide TLS/SSL encryption. Due to this, the error message can be ignored.

Following installation, users can add additional clients and users, create more fine tuned Kerberos tickets, adjust security policies, and more.

More Information

You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

• FreeIPA Documentation
• Kerberos Homepage