FreeIPA — Integrated Identity

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

• identity
• freeipa
• ipa
• kerberos
• authentication
• sysadmin

• linux

  🪪 FreeIPA Cheatsheet

Description

FreeIPA (Identity, Policy, Authentication) is an integrated identity management solution combining LDAP (389-ds), Kerberos, DNS, NTP, and certificate management with a web UI and CLI. / FreeIPA — интегрированное управление идентичностью: LDAP, Kerberos, DNS, NTP, сертификаты, web UI и CLI.

Common use cases / Типовые сценарии:

• Linux enterprise IdM / Корпоративное управление идентичностью Linux
• Kerberos SSO / Kerberos SSO
• Host-based access control / Доступ на уровне хостов
• Certificate issuance for hosts/services / Выпуск сертификатов для хостов/сервисов

Status: Actively maintained (Red Hat / community). Alternatives: Microsoft AD, OpenLDAP + MIT Kerberos DIY, Keycloak (app-focused IdP). / Статус: активно развивается; альтернативы — AD, OpenLDAP+Kerberos, Keycloak.

Default ports: 80/443 (UI/API), 389/636 (LDAP), 88/464 (Kerberos), 53 (DNS).
Paths: config /etc/ipa/; client /etc/ipa/default.conf.

Cross-reference: OpenLDAP, SSSD, adcli, Keycloak.

Installation

Install FreeIPA server / Установка сервера FreeIPA

# RHEL/Rocky/Alma/Fedora
dnf install ipa-server ipa-server-dns

# DNS-less server
dnf install ipa-server

ipa-server-install --setup-dns \
  --realm=<REALM> \
  --domain=<DOMAIN> \
  --ds-password=<SECRET_KEY> \
  --admin-password=<SECRET_KEY> \
  --mkhomedir

Install FreeIPA client / Установка клиента FreeIPA

dnf install ipa-client
ipa-client-install --domain=<DOMAIN> --realm=<REALM> \
  --server=<IPA_HOST> --principal=admin --password=<SECRET_KEY>

ipa --version

Configuration

Main files / Основные файлы

/etc/ipa/default.conf

/etc/ipa/ca.crt

/var/log/ipaclient.log

/var/log/ipaserver.log

Client config / Конфигурация клиента

/etc/ipa/default.conf

[global]
realm = <REALM>
domain = <DOMAIN>
basedn = dc=<DOMAIN_PART>,dc=<DOMAIN_TLD>
server = <IPA_HOST>
host = <CLIENT_HOST>
xmlrpc_uri = https://<IPA_HOST>/ipa/xmlrpc
ldap_uri = ldap://<IPA_HOST>
enable_ra = True

Core Management

IPA CLI basics / Основы IPA CLI

ipa user-show <USER>
ipa user-add <USER> --first=<FIRST> --last=<LAST>
ipa group-show <GROUP>
ipa host-show <CLIENT_HOST>
ipa service-show HTTP/<HOST>
ipa env
ipa getent user <USER>
ipa getent group <GROUP>

User and group / Пользователь и группа

ipa user-add alice --first=Alice --last=Example --password
ipa group-add sysadmins --desc="System administrators"
ipa group-add-member sysadmins --users=alice
ipa user-mod alice --shell=/bin/bash

HBAC and sudo / HBAC и sudo

ipa hbacrule-add allow_ssh --desc="Allow SSH from jump hosts"
ipa hbacrule-add-host allow_ssh --hosts=<JUMP_HOST>
ipa hbacrule-add-user allow_ssh --users=alice
ipa sudorule-add sysadmins --desc="Sysadmin sudo rules"
ipa sudorule-add-allow-command sysadmins --cmdcat=all
ipa sudorule-add-user sysadmins --groups=sysadmins

Sysadmin Operations

Service control / Управление сервисами

systemctl status ipa
systemctl status krb5kdc
systemctl status kadmin

Logs / Логи

journalctl -u ipa --no-pager -n 50
journalctl -u krb5kdc --no-pager -n 50
tail -f /var/log/ipaserver.log

Logrotate / Ротация логов

/etc/logrotate.d/ipa

/var/log/ipa*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
}

Security

Hardening / Ужесточение

1. Keep realm password and admin password in vault / Храните пароли в vault
2. Restrict HBAC rules per host group / Ограничивайте HBAC по хост-группам
3. Use host-based sudo rules / Используйте host-based sudo
4. Monitor failed Kerberos auth / Мониторьте неудачные Kerberos-auth
5. Back up IPA regularly / Регулярно бэкапьте IPA
6. Keep FreeIPA patched / Обновляйте FreeIPA

ipa env | grep -E 'domain|realm|basedn'

Backup and Restore

Backup / Резервное копирование

ipa-backup --data --logs
# Output under /var/lib/ipa/backup/

Restore / Восстановление

# Only during maintenance window
ipa-restore /var/lib/ipa/backup/<BACKUP_DIR>

[!CAUTION] ipa-restore is destructive and requires downtime. Verify backup integrity first. / ipa-restore деструктивен и требует простоя.

Troubleshooting

kinit admin
ipa env
ipa user-show <USER>
journalctl -u krb5kdc -n 30

Comparison Tables

Identity stacks / Стеки идентичности

Production Runbooks

Runbook: Enroll new client / Присоединение нового клиента

1. Configure DNS to IPA server / Настроить DNS
2. Sync time (chrony/NTP) / Синхронизировать время
3. ipa-client-install with admin principal / Установить клиент
4. Verify ipa env and user lookup / Проверить env и lookup
5. Test SSH: ssh <USER>@<CLIENT_HOST> / Проверить SSH
6. Add client to HBAC/sudo rules if needed / Добавить в HBAC/sudo

Runbook: Password reset for IPA user / Сброс пароля IPA-пользователя

1. ipa user-mod <USER> --password / Сменить пароль
2. Or self-service via web UI / Или self-service через web UI
3. Invalidate old Kerberos tickets if compromised / Инвалидировать тикеты
4. Document change / Задокументировать изменение

Documentation Links

• FreeIPA docs — https://freeipa.org/page/Documentation
• FreeIPA admin guide — https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/identity_management/
• FreeIPA GitHub — https://github.com/freeipa/freeipa
• Kerberos — https://web.mit.edu/kerberos/