How to Install and Configure FreeIPA Server on CentOS/RHEL 7

FreeIPA is a free and open source identity management tool and project has been sponsored by Red Hat. FreeIPA manage Linux servers and authenticate, like Microsoft Active Directory and LDAP. In other words you can manage user accounts on Linux system using FreeIPA. Identity Management made easy for the Linux administrator. FreeIPA also provides the services like DNS and PKI.

Install FreeIPA

FreeIPA is based on the following Open Source projects,

  • 389 Directory Server(LDAP)
  • MIT Kerberos
  • SSSD
  • Dogtag (Certificate System)
  • NTP & DNS

Step 1: Prerequisites

Installation of FreeIPA is simple on a Linux system. But, before starting installation of FreeIPA we need to prepare the server for installation.

Set the Hostname:

First set the FQDN hostname of the server.

# hostnamectl set-hostname srv.techoism.net

OR

# vim /etc/hostname
srv.techoism.net

Add Host Entry:

Add a host entry on the server to resolve system hostname.

# echo "192.168.1.8 srv.techoism.net srv" >> /etc/hosts

Step:2 Install FreeIPA

FreeIPA package is available in default repository. Run the below command to install FreeIPA and its dependencies

# yum install ipa-server ipa-server-dns -y

Step 3: Configure IPA Server

Once the packages has been installed use mention command to setup the FreeIPA on server.

# ipa-server-install

It will prompt couple of things to configure FreeIPA like DNS, Host name, Domain Name and Realm Name.

FreeIPA Install 1
FreeIPA Install 2
FreeIPA Install 3
FreeIPA Install 4
FreeIPA Install 5

It will take some time to configure your FreeIPA server and once it has been setup successfully then we will get output something like below.

FreeIPA Install 6

Note: Sometime you will get the below errors while installing FreeIPA on CentOS 7 server.

[error] CalledProcessError: Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR Command '/bin/systemctl start certmonger.service' returned non-zero exit status 1
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

This is very known issue so to resolve this restart dbus service.

For CentOS/RHEL 6
# service dbus restart
For CentOS/RHEL 7
# systemctl restart dbus

Uninstall FreeIPA using the mention command and then again try to install.

# ipa-server-install –uninstall

Step 4: User’s Home Directory

Run the below command to allow User’s home directory creation automatically after login.

# authconfig --enablemkhomedir --update

Step 5: Configure Firewalld:

If you have firewall service running on server, you need to Open some required ports for FreeIPA services.

TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
UDP Ports:
* 88, 464: kerberos
* 123: ntp
# firewall-cmd --permanent --add-service=ntp
# firewall-cmd --permanent --add-service=http
# firewall-cmd --permanent --add-service=https
# firewall-cmd --permanent --add-service=ldap
# firewall-cmd --permanent --add-service=ldaps
# firewall-cmd --permanent --add-service=kerberos
# firewall-cmd --permanent --add-service=kpasswd
# firewall-cmd --reload

Step:6 Verification FreeIPA

Use the below command to check whether all services of FreeIPA are running or not.

# ipactl status
FreeIPA Install 7

Step:7 Verify Admin Token

Verify that the Kerberos realm installed correctly by attempting to initialize a Kerberos token for the admin user.

# kinit admin
# klist
FreeIPA Install 8

Step:8 Access FreeIPA

Now you can access the FreeIPA using accessing below URL.

https://Hostname/ipa/ui
OR
https://Server-IP/ipa/ui
FreeIPA Install 9

Now you are successfully accessed the FreeIPA.

FreeIPA Install 10

Reference: https://www.freeipa.org/page/Main_Page

Enjoy it!

Leave a Reply

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.