FreeIPA - ArchWiki

# FreeIPA

FreeIPA is an open-source Identity, Policy and Audit (IPA) suite, sponsored by RedHat, which provides services similar to Microsoft's Active Directory

## Configure as IPA client

Make sure your clocks are synchronized. Kerberos will not work otherwise. NTP is reccomended.

Follow the LDAP auth instructions to setup SSSD. Use a SSSD configuration similar to the following, substituting the requisite fields:

    /etc/sssd/sssd.conf

    [sssd]
    config_file_version = 2
    services = nss, pam, sudo
    domains = DOMAIN
    debug_level = 9

    [domain/DOMAIN]
    debug_level = 9
    cache_credentials = true
    krb5_store_password_if_offline = true
    id_provider = ipa
    auth_provider = ipa
    ipa_domain=ipa.domain.com
    ipa_server=controller.domain.com
    ipa_hostname=fqdn.for.machine

Configure pam in similar way to LDAP, replacing `pam_ldap.so` with `pam_sss.so`.

Create an `/etc/krb5.conf` file for your domain:

    /etc/krb5.conf

    [libdefaults]
            default_realm = DOMAIN.COM
            dns_lookup_realm = false
            dns_lookup_kdc = false
            rdns = false
            ticket_lifetime = 24h
            fowardable = yes
            allow_weak_crypto = yes

    [realms]
            DOMAIN.COM = {
                    admin_server = controller.domain.com
                    kdc = controller.domain.com:749
                    default_admin = domain.com
            }

    [domain_realm]
            domain.com = DOMAIN.COM
            .domain.com = DOMAIN.COM

    [logging]
            default = FILE:/var/log/krb5libs.log
            kdc = FILE:/var/log/krb5kdc.log
            admin_server = FILE:/var/log/kadmin.log

Add the client to the IPA server (From Fedora documentation):

1. Login and request and admin session `kinit admin`
2. Create a host entry `ipa host-add --force --ip-address=192.168.166.31 client1.domain.com`
3. Set the client to be managed by IPA `ipa host-add-managedby --hosts=controller.domain.com client1.domain.com`
4. Generate keytab for the client `ipa-getkeytab -s controller.domain.com -p host/client1.domain.com -k /tmp/client1.keytab`

Install the keytab on the client:

    $ scp user@controller.domain.com:/tmp/client1.keytab krb5.keytab
    # mv krb5.ketab /etc/krb5.keytab

Categories:

- Networking
- Security