How to Install FreeIPA Identity Management System on Rocky Linux 9

FreeIPA is an open-source identity management solution for Linux/Unix operating systems. It's an upstream project from the RedHat Identity Management System, which provides authentication and authorization solutions for Linux/Unix systems.

FreeIPA is built on top of multiple components, including the Directory Server, DNS, Kerberos, PKI, Certmonger, NTP Server, web administration UI, etc. It provides a centralized source of user credentials and access control. FreeIPA allows administrators to manage identity in a centralized environment easily and provides user monitoring, authentication, and access control.

In this tutorial, you will install and set up FreeIPA on Rocky Linux 9 server. You will install FreeIPA server packages and set up FreeIPA deployment. Then you will also set up a FreeIPA user. In the end, you will also learn how to install and set up the FreeIPA client on the Rocky Linux host and add it to the FreeIPA server.

Prerequisites

To complete this tutorial, you must have the following requirements:

Before you start, you must ensure that you have the following requirements in place:

• Two or more Rocky Linux 9 servers - In this tutorial, you use two Rocky Linux hosts for the FreeIPA server and the FreeIPA client.
• A non-root user with sudo/root administrator privileges.
• SELinux is running in permissive mode.

For this demo, we will use two Rocky Linux 9 servers with the following detail:

Hostname    IP Address      Used as
--------------------------------------------
ipa         192.168.5.25    FreeIPA Server
client      192.168.5.80    FreeIPA Client

When these requirements are ready, you can now start the FreeIPA installation.

Setup FQDN and Timezone

For this tutorial, you will first set up FQDN (Fully Qualified Domain Name) and default timezone on your FreeIPA server.

Enter the following 'hostnamectl' command to set up fqdn on your system. In this example, the FreeIPA server should have fqdn 'ipa.hwdomain.lan'.

sudo hostnamectl set-hostname ipa.hwdomain.lan

Now open the '/etc/hosts' file using the following nano editor command.

sudo nano /etc/hosts

Add the following line to the file and be sure to change the detail hostname, fqdn, and IP address with your FreeIPA server.

# ip - fqdn - hostname
192.168.5.25    ipa.hwdomain.lan    ipa

Save and close the file when finished.

Next, enter the following command to verify the fqdn of your system. Then, ensure that the fqdn is resolved to your internal IP address.

sudo hostname -f
sudo ping -c3 ipa.hwdomain.lan

When successful, you should get that your fqdn is pointed to the internal IP address of your server. In this example, the fqdn 'ipa.hwdomain.lan' is pointed to IP address '192.168.5.25'.

Now enter the following 'timedatectl' command to set up the default timezone for your server. In this example, the time for the FreeIPA server will be 'Europe/Stockholm'.

sudo timedatectl set-timezone Europe/Stockholm

Now enter the following command to set up the '/etc/localtime' file for your server to the proper timezone. The list of timezone files is stored at the '/usr/share/timezone/' directory, you must create a symlink of the proper timezone file to '/etc/localtime'.

sudo unlink /etc/localtime
sudo ln -s /usr/share/timezone/Europe/Stockholm /etc/localtime

With the fqdn and timezone configured, you will next set up the firewalld and open some ports that the FreeIPA server will use.

Setup Firewalld

On RHEL-based distributions, the default firewall software installed is firewalld, and it automatically starts and runs. In this section, you will add FreeIPA service with some additional services such as NTP and DNS to the firewalld.

Enter the following 'firewall-cmd' command to add the FreeIPA, DNS, and NTP to the firewalld. Then, reload the firewalld to apply the changes. An output 'success' confirms that the operation is successful.

sudo firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns,ntp,http,https,kerberos} --permanent
sudo firewall-cmd --reload

Next, run the following command to verify the firewalld status and list of enabled services and ports.

sudo firewall-cmd --list-all

You should receive an output like this - The FreeIPA service, NTP, and DNS added to the firewalld.

Now that you've configured fqdn, timezone, and firewalld, you can start the FreeIPA server installation via the DNF package manager.

Installing and Configuring FreeIPA Server

On the latest Rocky Linux 9, the FreeIPA server is available by default on the 'appstream' repository. So you don't need to add the third-party repository to install the FreeIPA server package.

In this section, you will install the FreeIPA server, then set up an interactive FreeIPA deployment via the command line 'ipa-server-install', which is provided by the FreeIPA package.

Enter the following 'dnf install' command to install the FreeIPA server, FreeIPA DNS, and FreeIPA client packages. When prompted, input y to confirm and press ENTER to proceed.

sudo dnf install freeipa-server freeipa-server-dns freeipa-client

Once FreeIPA is installed, enter the following 'ipa-server-install' command to start the interactive deployment of your FreeIPA server. In this example, you will use the parameter '--setup-dns', which will also install the DNS server on your FreeIPA server.

sudo ipa-server-install --setup-dns

In the following output, you should see the list of tasks that you will be doing to set up and configure the FreeIPA server.

First, the 'ipa-server-install' will verify the fqdn of your system and ensure that your server fqdn is pointed to the proper IP address (via DNS or /etc/hosts). In this example, the fqdn 'ipa.hwdomain.lan' are configured via the /etc/hosts file, so you're ready to go.

For the default domain name and realm name, both will follow the fqdn of the host. So, the fqdn 'ipa.hwdomain.lan' will give you the default domain name 'hwdomain.lan' with the realm name 'HWDOMAIN.LAN'.

Press ENTER to use the default value for the hostname (fqdn), domain name, and realm name.

Now input a new password for the Directory Manager and the IPA admin user. Be sure to use more than 8 characters and a strong password.

Next, you will be asked to set up the default DNS forwarders for your FreeIPA server and set up the reverse DNS (rDNS) of your FreeIPA server IP address. Press ENTER to confirm the default configuration for both settings.

Leave it as default for the NetBIOS domain name configuration and press ENTER. For the NTP settings, input no.

Now review the basic settings of your FreeIPA server, then input 'yes' to confirm and press ENTER to proceed to the installation.

When FreeIPA server installation is successful, you should receive an output such as 'Setup complete - The ipa-server-install command was successful'. You will also see the instruction for the next steps, which is setting up a firewall to open some ports and how to get a Kerberos ticket for an administrator.

With this, you have now finished the basic configuration of the FreeIPA server via 'ipa-server-install'. In the next step, you will authenticate against Kerberos and obtain an admin ticket that allows you to set up FreeIPA from your terminal.

Kerberos Admin Authentication and FreeIPA Web UI Dashboard

After configuring the FreeIPA server via 'ipa-server-install', you will now verify FreeIPA installation by obtaining an admin ticket from Kerberos and logging in to the FreeIPA web administration dashboard.

Enter the following 'kinit' command to authenticate against the Kerberos server via the 'admin' user. When asked for the password, input your IPA admin password.

kinit admin

Now verify the authentication and list of obtained Kerberos tickets by entering the following 'klist' command.

klist

If Kerberos authentication is successful, you should receive an output of the cached ticket for default principal '[email protected]' as the following screenshot.

Next, you will verify the FreeIPA server by visiting the administration dashboard from your local machine. Before you start, open the '/etc/hosts' file on your local computer via the following nano editor command.

sudo nano /etc/hosts

Add the following line to the file and be sure to change the domain name IP address with your FreeIPA server details.

# ip - domain
192.168.5.25  ipa.hwdomain.lan ipa

Save and close the file when finished.

Next, open your web browser and visit the FreeIPA server domain name (i.e: https://ipa.hwdomain.lan/). You should see the FreeIPA login page.

Input the default user admin and your FreeIPA password, then click 'Log in'.

If successful, you should get the FreeIPA web administration dashboard like the following screenshot.

With this in mind, you have now successfully installed and configured the FreeIPA server on Rocky Linux 9. In the next step, you will learn how to manage the FreeIPA server by adding a new user and group via terminal, then add a new Linux host machine using the FreeIPA client package.

Setup First FreeIPA User and Group

In this section, you will learn how to use the 'ipa' command for managing users and groups. You will use the 'ipa' command with different parameters for creating a user, checking a list of users, creating a group, checking the list of groups, and adding a FreeIP user to a specific group. And lastly, you will verify the list of users and groups via the FreeIPA administration dashboard.

Enter the following 'ipa config-mod' command to modify the default shell for FreeIPA users to '/bin/bash'. When executed, this command will also print out other default user settings for FreeIPA.

ipa config-mod --defaultshell=/bin/bash

Below is a similar output that will be printed out to your terminal.

Next, enter the following 'ipa user-add' command to add a new FreeIPA. In this example, you will create a new user 'rocky'. When prompted for a password, input and verify a new password for your user.

ipa user-add rocky --first=Rocky --last=Linux --password

Now verify the details of user 'rocky' by entering the 'ipa user-find' command below. When you see the detailed information about user 'rocky', this means that you've successfully created a FreeIPA user.

ipa user-find rocky

You can also use the 'ipa user-show' command to show details of FreeIPA users.

ipa user-show --raw rocky

Output:

Next, enter the following 'ipa group-add' command to create a new group called 'development'. Then, verify the group 'development by entering the 'ipa group-find' command to ensure that the group is created.

ipa group-add --desc='Development Team' development
ipa group-find development

An output '1 group matched confirms that group 'development' added and available on the FreeIPA server.

Now enter the following 'ipa group-add-member' command to add the FreeIPA user 'rocky' to the group 'development'.

ipa group-add-member --user=rocky development

An output 'Number of members added 1' confirms that the user 'rocky' added to the group 'development'.

Now go back to the FreeIPA administration dashboard, click on the 'Identity' menu, and click on the 'Users' tab. You should now see the new FreeIPA user 'rocky' created and available on the FreeIPA server.

Lastly, click on the 'Groups' tab to verify the list of groups on FreeIPA. The new group 'development' is available on the FreeIPA server. Click on the group 'development' to get details information, and you should see the user 'rocky' added and available in the 'development' group.

At this point, you have now created a FreeIPA user and group from the terminal via the 'ipa' command management tool. Also, you've verified that your user and group are added via the FreeIPA web administration dashboard. In the next step, you will learn how to add a Linux host/machine to the FreeIPA server.

Adding Hosts to FreeIPA Server: Rocky Linux

FreeIPA provides the easiest way for adding a new host to the FreeIPA server, which can be done via the FreeIPA client package that provides the 'ipa-client-install' utility. In this section, you will add a Rocky Linux 9 machine to the FreeIPA server 'ipa.hwdomain.lan'.

Below are the steps you must do to add a new host to the FreeIPA server:

• Add host DNS records from FreeIPA Server
• Set up /etc/hosts file and /etc/resolv.conf file
• Installing FreeIPA client and adding host via 'ipa-client-install'

Now let's start adding the Rocky Linux host to the FreeIPA server.

Add DNS Records

First, you must add the DNS record of your client machine to the FreeIPA server. And this can be done via the 'ipa dnsrecord-add' command that you can execute from the FreeIPA server.

Enter the following 'ipa dnsrecord-add' to