How to Install and Configure FreeIPA Server on CentOS/RHEL 7
FreeIPA is a free and open source identity management tool and project has been sponsored by Red Hat. FreeIPA manage Linux servers and authenticate, like Microsoft Active Directory and LDAP. In other words you can manage user accounts on Linux system using FreeIPA. Identity Management made easy for the Linux administrator. FreeIPA also provides the services like DNS and PKI.
FreeIPA is based on the following Open Source projects,
- 389 Directory Server(LDAP)
- MIT Kerberos
- Dogtag (Certificate System)
- NTP & DNS
Step 1: Prerequisites
Installation of FreeIPA is simple on a Linux system. But, before starting installation of FreeIPA we need to prepare the server for installation.
Set the Hostname:
First set the FQDN hostname of the server.
# hostnamectl set-hostname srv.techoism.net
# vim /etc/hostname
Add Host Entry:
Add a host entry on the server to resolve system hostname.
# echo "192.168.1.8 srv.techoism.net srv" >> /etc/hosts
Step:2 Install FreeIPA
FreeIPA package is available in default repository. Run the below command to install FreeIPA and its dependencies
# yum install ipa-server ipa-server-dns -y
Step 3: Configure IPA Server
Once the packages has been installed use mention command to setup the FreeIPA on server.
It will prompt couple of things to configure FreeIPA like DNS, Host name, Domain Name and Realm Name.
It will take some time to configure your FreeIPA server and once it has been setup successfully then we will get output something like below.
Note: Sometime you will get the below errors while installing FreeIPA on CentOS 7 server.
[error] CalledProcessError: Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
This is very known issue so to resolve this restart dbus service.
For CentOS/RHEL 6
# service dbus restart
For CentOS/RHEL 7
# systemctl restart dbus
Uninstall FreeIPA using the mention command and then again try to install.
# ipa-server-install –uninstall
Step 4: User’s Home Directory
Run the below command to allow User’s home directory creation automatically after login.
# authconfig --enablemkhomedir --update
Step 5: Configure Firewalld:
If you have firewall service running on server, you need to Open some required ports for FreeIPA services.
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
* 88, 464: kerberos
* 123: ntp
# firewall-cmd --permanent --add-service=ntp
# firewall-cmd --permanent --add-service=http
# firewall-cmd --permanent --add-service=https
# firewall-cmd --permanent --add-service=ldap
# firewall-cmd --permanent --add-service=ldaps
# firewall-cmd --permanent --add-service=kerberos
# firewall-cmd --permanent --add-service=kpasswd
# firewall-cmd --reload
Step:6 Verification FreeIPA
Use the below command to check whether all services of FreeIPA are running or not.
# ipactl status
Step:7 Verify Admin Token
Verify that the Kerberos realm installed correctly by attempting to initialize a Kerberos token for the admin user.
# kinit admin
Step:8 Access FreeIPA
Now you can access the FreeIPA using accessing below URL.
Now you are successfully accessed the FreeIPA.