FreeIPA Implementation Document

A step-by-step implementation guide for deploying FreeIPA as the identity,
authentication, and directory backbone of the open-source office estate
defined in the Open-Source Office Environment — Reference Architecture Series.

FreeIPA combines 389 Directory Server (LDAP), MIT Kerberos, Bind DNS,
an integrated Certificate Authority (Dogtag / certmonger), NIS/SSSD and
HBAC + sudo policies into one managed domain. It is the Linux-native
equivalent of Microsoft Active Directory.

Scope. This document covers a two-server, highly-available FreeIPA
realm for a single office (office.local), with Debian 12 (bookworm)
clients joined via realmd/sssd. It lists every input decision you must
make up front, all dependencies, and the concrete commands to install and
verify the domain.

1. Document Control

2. Key Inputs

These are the decisions and values that must be agreed before
installation. Every command downstream references them.

2.1 Naming & realm

2.2 Network topology

2.3 Certificate authority

2.4 DNS policy

2.5 Host / account policy

3. Dependencies

3.1 Platform / OS dependencies

3.2 Infrastructure dependencies

3.3 Soft / organizational dependencies

3.4 Dependency map

chrony / NTP
(mandatory)FreeIPA Server
ipa1 + ipa2Forward+reverse DNS
(static A/PTR)Firewall ports
53/80/88/123/389/443/464/636SSD LVM
4GB+ RAMVaultwarden
for secretsProxmox cluster + PBS
VM + backupKeycloak SSOClient joins via realmd/sssdPostfix/Dovecot LDAP authSamba (optional AD-like shares)HBAC + sudo rules

4. Pre-Installation Checklist

Run through this before ipa-server-install. Each item blocks install if false.

• Two static IPs reserved (ipa1=10.10.10.10, ipa2=10.10.10.11) with matching A and PTR records (or agreement to let FreeIPA create them).
• /etc/hosts on both servers contains only their own FQDN mapped to their primary IP — no stale 127.0.1.1 hostname entries.
• hostnamectl set-hostname ipa1.office.local set on both hosts.
• chrony running and clocks within 1 second of an external source.
• Firewall opened on ports listed in §3.2 on both the host firewall and the network edge.
• Debian 12 fully updated: apt update && apt full-upgrade.
• Directory Manager and admin passwords generated and stored in Vaultwarden.
• DNS domain office.local chosen and not overlapping any external domain you use.
• Proxmox snapshot of both VMs taken.
• Maintenance window booked (30 min for primary, 15 min for replica).

5. Installation: Primary Server (ipa1)

5.1 Install packages

apt update
apt install -y freeipa-server freeipa-server-dns chrony

5.2 Run the installer

ipa-server-install \
  --realm=OFFICE.LOCAL \
  --domain=office.local \
  --ds-password='<DIRECTORY_MANAGER_PASSWORD>' \
  --admin-password='<ADMIN_PASSWORD>' \
  --hostname=ipa1.office.local \
  --ip-address=10.10.10.10 \
  --setup-dns \
  --forwarder=1.1.1.1 \
  --forwarder=9.9.9.9 \
  --reverse-zone=10.10.10.in-addr.arpa. \
  --mkhomedir \
  --no-ntp \
  --unattended

Key flags explained:

5.3 Verify the primary

kinit admin                          # get a Kerberos ticket
ipa ping                             # should return IPA server version
ipa-replica-manage list              # (empty until replica added)
host ipa1.office.local               # resolves via FreeIPA DNS
dig _ldap._tcp.office.local SRV      # SRV record published

5.4 Harden the primary

# Create a named super-admin and disable generic admin for daily use
ipa user-add sysadmin --first=Sys --last=Admin --password
ipa group-add-member admins --users=sysadmin
# Optionally disable generic admin after first named admin verified
ipa user-mod admin --nsaccountlock=TRUE

6. Installation: Replica (ipa2)

A replica provides LDAP/Kerberos/DNS/CA redundancy. Clients configured with
both server IPs keep authenticating if ipa1 fails.

6.1 Prepare the replica host

On ipa1, generate a replica promotion file:

kinit admin
ipa-replica-prepare ipa2.office.local --ip-address=10.10.10.11
# Produces /var/lib/ipa/replica-info-ipa2.office.local.tar.gz
# Copy it to ipa2 (e.g. via scp behind WireGuard).

6.2 Install on the replica

On ipa2:

apt update
apt install -y freeipa-server freeipa-server-dns chrony
# (host name, NTP, firewall per §4 already done)

ipa-replica-install \
  --setup-dns \
  --forwarder=1.1.1.1 \
  --forwarder=9.9.9.9 \
  /root/replica-info-ipa2.office.local.tar.gz \
  --unattended

6.3 Verify replication

ipa-replica-manage list             # shows ipa1 <-> ipa2 agreement
ipa-csreplica-manage list           # CA replication
ipa host-find                        # both servers listed

Delete the replica-info tarball after success: rm /root/replica-info-ipa2.office.local.tar.gz.

7. Client Join (Debian 12 workstation)

7.1 One-time inputs

7.2 Join a client

apt install -y realmd sssd sssd-tools libnss-sss libpam-sss adcli \
  krb5-user oddjob oddjob-mkhomedir packagekit

# Tell realmd where the IPA servers are (via DNS SRV, or explicit):
realm discover office.local

# Join
realm join -v --computer-ou="CN=Computers,DC=office,DC=local" \
  --user=admin office.local

7.3 Post-join configuration

# Use FreeIPA for all lookups
realm permit --all                      # or realm permit --groups <group>
# Enable mkhomedir so first login creates /home/<user>
pam-auth-update --enable mkhomedir
# Confirm
id <someuser>@office.local              # should resolve UID/GID
kinit <someuser>                        # should get a TGT

7.4 SSSD tuning (recommended /etc/sssd/sssd.conf highlights)

[domain/office.local]
ipa_domain = office.local
ipa_server = _srv_, ipa1.office.local, ipa2.office.local
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = true
cache_credentials = true
enumerate = false                       # do not list all users (perf)

8. Policy Configuration

8.1 Password policy

ipa pwpolicy-mod --minlength=14 --maxlife=90 --minlife=1 \
  --history=5 --maxfail=5 --failinterval=60 --lockouttime=600

8.2 HBAC rules (host-based access control)

# Deny all by default
ipa hbacrule-disable allow_all
# Create role rules
ipa hbacrule-add --hostcat=host --usercat=user allow_finance
ipa hbacrule-add-member --hosts=erp1.office.local allow_finance
ipa hbacrule-add-member --groups=finance allow_finance

ipa hbacrule-add --hostcat=host --usercat=user allow_devops
ipa hbacrule-add-member --hosts=git1.office.local allow_devops
ipa hbacrule-add-member --groups=devops allow_devops

8.3 Sudo rules

ipa sudorule-add sysadmin-sudo
ipa sudorule-add-allow-command --commands=ALL sysadmin-sudo
ipa sudorule-add-host --hostcat=all sysadmin-sudo
ipa sudorule-add-user --group=sysadmin sysadmin-sudo

8.4 User lifecycle

9. Backup & Recovery

Keep at least one ipa-backup archive offsite (Borgmatic) — it contains the CA private material; without it the realm cannot be fully recovered.

10. Validation & Acceptance Tests

Run all of these to sign off the implementation.

• kinit admin succeeds on ipa1 and ipa2.
• ipa ping returns from both servers.
• A joined client can kinit a normal user and ssh into another joined host without a password (GSSAPI).
• Disabling ipa1 leaves clients still authenticating via ipa2 (kill the VM, confirm logins).
• HBAC deny_all + a role rule blocks a user from a host they should not reach.
• Sudo rule grants sysadmin group elevated rights only where defined.
• ipa user-disable instantly revokes login across all clients (SSSD cache honored).
• Certificates issued by FreeIPA CA are trusted on a freshly joined client (openssl s_client -connect ipa1:443 validates).
• DNS SRV records _ldap._tcp, _kerberos._tcp, _kpasswd._tcp.office.local resolve.
• ipa-backup runs cleanly and the archive can be restored to a test VM.
• Clock-drift test: stop chrony on a client, skew 6 min, confirm Kerberos login fails (proves NTP dependency).

11. Operational Runbook (excerpt)

12. Rollover to the Rest of the Estate

Once FreeIPA is validated, downstream services consume it:

• Keycloak — LDAP user federation + Kerberos; all web apps inherit identities.
• Postfix/Dovecot — LDAP recipient maps + Dovecot auth_ldap.
• Nextcloud — LDAP/SCIM user backend.
• Samba (optional) — join as an AD-trust peer if Windows guests need shares.
• Ansible — inventory reads FreeIPA host groups; playbooks enforce HBAC/sudo state.

This closes the loop: one directory of truth, one login, one CA, fully open-source.