We are committed to provide service 24 X 7

Deals, Shopping, Training, Tools
Call To +2348134831925 Email : Info@ownyourlife.com.ng
Category

Cart

Your Cart is Empty

Back To Shop
Payment Details
Sub Total ₦0,00

View cartCheckout

Learn how to – Configure FreeIPA Server Replica on Rocky / AlmaLinux

AlmaLinux LDAP Linux Tutorials Rocky Linux March 9, 2023

Learn how to – Configure FreeIPA Server Replica on Rocky / AlmaLinux.

FreeIPA is an open source, and a free version of RedHat IdM which requires a subscription for support. FreeIPA gives you a unified and centralized management of authentication, policies, identity stores, and authorization policies in a Linux-based domain. By adopting it you’ll experience a significant reduction in the administrative overhead of managing different services individually and using different tools on different machines. With FreeIPA it becomes easy to unify large groups of Linux machines and have a native integration with Active Directory.

As an Administrator tasked with the management of FreeIPA, you can:

  • Maintain system identities in one central place
  • Centrally manage privilege escalation rules
  • Apply policies at the same time uniformly to multiples machines / systems
  • Set different access levels for users by using host-based access control, delegation, and other rules

Prior to creation of this content, we had done other articles on the installation and configuration of FreeIPA server on Rocky / AlmaLinux. See the links shared below.

This guide is to be followed while deploying a replica of your primary FreeIPA server. The requirement is a functional IPA Domain as captured in the articles above. From the perspective of FreeIPA, the domain includes the following types of machines:

  • FreeIPA servers – These work as domain controllers, Replica will be part of this.
  • FreeIPA clients – These are enrolled with the servers. Can be RHEL based, Debian based and other Linux systems.

Step 1: Prepare environment / servers

The server that’s to be configured as FreeIPA replica should first be enrolled on the domain as client. Our setup is based on the following server details.

Server IPv4 Address Hostname Role
172.20.30.252 ipa.home.cloudlabske.io Primary FreeIPA Server
172.20.30.251 ipa02.home.cloudlabske.io FreeIPA Replica Server

Login to FreeIPA server and authenticate as admin

[root@ipa ~]# kinit admin
Password for admin@HOME.CLOUDLABSKE.IO:

[root@ipa ~]# klist
Ticket cache: KCM:0
Default principal: admin@HOME.CLOUDLABSKE.IO

Valid starting       Expires              Service principal
11/10/2022 17:07:17  11/11/2022 16:11:41  krbtgt/HOME.CLOUDLABSKE.IO@HOME.CLOUDLABSKE.IO

Confirm the IP address of the machine to be configured as a FreeIPA replica server.

[root@ipa02 ~]# ip ad
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:15:f0:68 brd ff:ff:ff:ff:ff:ff
    inet 172.20.30.251/24 brd 172.20.30.255 scope global noprefixroute enp1s0
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe15:f068/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

Add DNS entry for FreeIPA Replica server in integrated DNS on FreeIPA Server.

[root@ipa ~]# ipa dnsrecord-add home.cloudlabske.io --a-create-reverse --a-rec 172.20.30.251 ipa02

Step 2: Enroll FreeIPA Replica server as client

Set hostname on FreeIPA replica server machine. Don’t forget to replace ipa02.home.cloudlabske.io with your server domain name.

sudo hostnamectl set-hostname ipa02.home.cloudlabske.io

Check and update DNS server to FreeIPA server address if not set already.

$ sudo vim /etc/resolv.conf
search home.cloudlabske.io
nameserver 172.20.30.252

For permanent settings you can edit network connection using NMCLI.

[root@ipa02 ~]# nmcli connection show
NAME    UUID                                  TYPE      DEVICE
enp1s0  bd009451-539e-41bc-852f-d42ffe33d91c  ethernet  enp1s0

[root@ipa02 ~]# nmcli connection modify enp1s0 ipv4.dns 172.20.30.252

[root@ipa02 ~]# nmcli connection show enp1s0 ipv4.dns|grep ipv4.dns
ipv4.dns:                               172.20.30.252
ipv4.dns-search:                        --
ipv4.dns-options:                       --
ipv4.dns-priority:                      0

Install FreeIPA Client package on the machine.

sudo dnf -y install freeipa-client

Setup FreeIPA Client by running the ipa-client-install commands as shown below. Provide Primary FreeIPA Server FQDN, and base domain name of your FreeIPA domain.

$ sudo ipa-client-install --server=ipa.home.cloudlabske.io --domain home.cloudlabske.io

This program will set up IPA client.
Version 4.9.8

Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Do you want to configure chrony with NTP server or pool address? [no]: yes
Enter NTP source server addresses separated by comma, or press Enter to skip: 172.20.30.1
Enter a NTP source pool address, or press Enter to skip:
Client hostname: ipa02.home.cloudlabske.io
Realm: HOME.CLOUDLABSKE.IO
DNS Domain: home.cloudlabske.io
IPA Server: ipa.home.cloudlabske.io
BaseDN: dc=home,dc=cloudlabske,dc=io
NTP server: 172.20.30.1

Continue to configure the system with these values? [no]: yes
Synchronizing time
Configuration of chrony was changed by installer.
Attempting to sync time with chronyc.
Time synchronization was successful.
User authorized to enroll computers: admin
Password for admin@HOME.CLOUDLABSKE.IO:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=HOME.CLOUDLABSKE.IO
    Issuer:      CN=Certificate Authority,O=HOME.CLOUDLABSKE.IO
    Valid From:  2022-07-27 18:26:13
    Valid Until: 2042-07-27 18:26:13

Enrolled in IPA realm HOME.CLOUDLABSKE.IO
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm HOME.CLOUDLABSKE.IO
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring home.cloudlabske.io as NIS domain.
Client configuration complete.
The ipa-client-install command was successful

Enable automatic creation of home directory on Replica server for newly logged in users.

sudo authselect  enable-feature with-mkhomedir
sudo systemctl enable --now oddjobd.service

Test with a user in FreeIPA domain if they can login to the system.

[root@ipa02 ~]# su - jkmutai
Creating home directory for jkmutai.

[jkmutai@ipa02 ~]$ id
uid=959600003(jkmutai) gid=959600003(jkmutai) groups=959600003(jkmutai),959600000(admins),959600004(sysadmins) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Step 3: Configurations on Primary FreeIPA Server

Login to FreeIPA primary server and allow freeipa-replication service in the firewall.

sudo firewall-cmd --add-service=freeipa-replication --permanent
sudo firewall-cmd --reload

Get Kerberos ticket for command line management.

[root@ipa ~]# kinit admin
Password for admin@HOME.CLOUDLABSKE.IO:

[root@ipa ~]# klist
Ticket cache: KCM:0
Default principal: admin@HOME.CLOUDLABSKE.IO

Valid starting       Expires              Service principal
11/10/2022 17:07:17  11/11/2022 16:11:41  krbtgt/HOME.CLOUDLABSKE.IO@HOME.CLOUDLABSKE.IO

FreeIPA server are placed in ipaservers host group as shown:

$ ipa hostgroup-find ipaservers
-------------------
1 hostgroup matched
-------------------
  Host-group: ipaservers
  Description: IPA server hosts
----------------------------
Number of entries returned 1
----------------------------

Check current list of server which can act as domain controllers.

$ ipa hostgroup-show ipaservers
  Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: ipa.home.cloudlabske.io

We need to add our FreeIPA replication host to the ipaservers host group.

[jkmutai@ipa ~]$  ipa hostgroup-add-member ipaservers --hosts ipa02.home.cloudlabske.io
  Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: ipa.home.cloudlabske.io, ipa02.home.cloudlabske.io
-------------------------
Number of members added 1
-------------------------

Confirm the new host was added successfully. The list will vary depending on your domain name.

[jkmutai@ipa ~]$ ipa hostgroup-show ipaservers
  Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: ipa.home.cloudlabske.io, ipa02.home.cloudlabske.io

Step 4: Configure FreeIPA Replica server

On Replica machine open allow inbound access to all services required to operate FreeIPA server operations.

sudo firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns,ntp,freeipa-replication} --permanent
sudo firewall-cmd --reload

Reset and enable idm:DL1 AppStream module.

sudo  dnf module reset idm
sudo dnf -y install @idm:DL1

Install server package and integrated DNS if you need it.

sudo dnf -y install freeipa-server freeipa-server-dns

Then setup the machine as FreeIPA server by running the commands given.

[root@ipa02 ~]#  ipa-replica-install --setup-ca --setup-dns --no-forwarders
Lookup failed: Preferred host ipa02.home.cloudlabske.io does not provide DNS.
Run connection check to master
Connection check OK
Disabled p11-kit-proxy
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/38]: creating directory server instance
Validate installation settings ...
Create file system structures ...
Perform SELinux labeling ...
Create database backend: dc=home,dc=cloudlabske,dc=io ...
Perform post-installation tasks ...
  [2/38]: tune ldbm plugin
  [3/38]: adding default schema
....
Configuring SID generation
  [1/7]: creating samba domain object
Samba domain object already exists
  [2/7]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [3/7]: adding RID bases
RID bases already set, nothing to do
  [4/7]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [5/7]: activating sidgen task
  [6/7]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [7/7]: adding fallback group
Fallback group already set, nothing to do
Done.
The ipa-replica-install command was successful

Use kinit to obtain and cache Kerberos ticket in the server.

[root@ipa02 ~]# kinit admin
Password for admin@HOME.CLOUDLABSKE.IO:

Cached ticket can be checked using klist command.

[root@ipa02 ~]# klist
Ticket cache: KCM:0
Default principal: admin@HOME.CLOUDLABSKE.IO

Valid starting       Expires              Service principal
11/11/2022 00:11:46  11/11/2022 23:23:58  krbtgt/HOME.CLOUDLABSKE.IO@HOME.CLOUDLABSKE.IO

Conclusion

FreeIPA servers are also FreeIPA clients enrolled with themselves: server machines provide the same functionality as clients. In this article we’ve covered the process of promoting a FreeIPA client to FreeIPA server role. For addition of any other server the same process will apply. In future articles we’ll cover integrations with Active Directory servers for users with Windows Machines in the infrastructure.

Also check:

Tag :

Cart

Your Cart is Empty

Back To Shop
Payment Details
Sub Total ₦0,00

View cartCheckout