Deploying FreeIPA on a VPS for

Configuration

After successfully installing FreeIPA, it's time for basic configuration. We will create the first user, add a host, and configure a client machine to work with FreeIPA.

1. Creating a New User

For security reasons and daily operations, it is not recommended to use the admin account. We will create a new regular user.

kinit admin # If your Kerberos ticket has expired
ipa user-add user01 --first=User --last=One --password

You will be prompted to enter and confirm the password for user01. After creation, you can reset the password expiration so it doesn't expire immediately (for testing).

ipa user-mod user01 --setattr=krbPasswordExpiration=20300101000000Z

This command will set the password expiration date to January 1, 2030. In a real environment, it's better to use password policies.

2. Adding a Host to FreeIPA

For other Linux servers to authenticate via FreeIPA, they must be registered in the FreeIPA directory.

ipa host-add client01.example.com

Replace client01.example.com with the FQDN of your client machine. Ensure that this machine has an A-record in DNS pointing to its IP address.

3. Configuring the Client Machine (Ubuntu Server 24.04)

To integrate a client machine with FreeIPA, install the freeipa-client package and run the configuration script.

On the client machine, perform the following steps:

sudo apt update && sudo apt upgrade -y
sudo hostnamectl set-hostname client01.example.com
echo "192.168.1.100 ipa.example.com" | sudo tee -a /etc/hosts # Replace the IP address with the IP of your FreeIPA server
echo "nameserver 192.168.1.100" | sudo tee /etc/resolv.conf # Replace the IP address with the IP of your FreeIPA server
sudo apt install freeipa-client -y

Set the hostname, add an entry for the FreeIPA server to /etc/hosts, and configure the DNS server to the IP address of your FreeIPA server. Then install the FreeIPA client package.

Now run the client configuration script:

sudo ipa-client-install --domain=example.com --server=ipa.example.com --realm=EXAMPLE.COM --force-join --mkhomedir -p admin --password  --unattended

Replace example.com, ipa.example.com, EXAMPLE.COM, and <ADMIN_PASSWORD> with your values. The --mkhomedir option creates a home directory for FreeIPA users upon first login. --unattended and -p admin --password allow automating the process if you are confident in the parameters. In interactive mode, the script will prompt for the FreeIPA administrator password.

After completing the client installation on the client machine:

kinit user01

Enter the user01 password. If the Kerberos ticket is successfully obtained, it means the client machine is successfully integrated.

ssh user01@localhost

Attempt to log in to the client machine as user user01. If the login is successful and a home directory was created, the integration was successful.

4. Configuring TLS/HTTPS (FreeIPA CA)

FreeIPA by default uses its built-in Certificate Authority (CA) to issue TLS certificates for its services (web interface, LDAP-S). This means that when accessing the web interface, you will see a self-signed certificate warning until you import the FreeIPA CA root certificate into your OS or browser's trusted stores.

To import the CA certificate (on the client machine or your workstation):

# On your workstation or client machine
# Download the CA certificate from the FreeIPA server
curl -o /tmp/ipa.crt http://ipa.example.com/ipa/config/ca.crt

# Import it into trusted stores (example for Ubuntu/Debian)
sudo cp /tmp/ipa.crt /usr/local/share/ca-certificates/ipa.crt
sudo update-ca-certificates

After this, browsers and other applications on this machine will trust certificates issued by your FreeIPA CA.

Using Caddy/Certbot for other services:

If you want to use FreeIPA for authentication in other web services, and obtain Let's Encrypt certificates for them, you can configure Caddy or Certbot. These tools will work independently of FreeIPA but can use FreeIPA for user authentication.

# Example of Caddy installation on a separate server or proxy
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy -y

Then configure the Caddyfile for your domain, and Caddy will automatically obtain and renew Let's Encrypt certificates.

# Example Caddyfile for proxy_service.example.com
proxy_service.example.com {
    reverse_proxy localhost:8080 # Your service running on port 8080
}

For authentication integration with FreeIPA, your web service must be configured to use LDAP or Kerberos for authentication, pointing to your FreeIPA server.

5. Verifying Functionality

A few commands to check:

# On the FreeIPA server
ipa ping

Should return Ping successful.

curl -v https://ipa.example.com/ipa/ui/

Check the availability of the web interface. Pay attention to the TLS certificate status.

# On the client machine
id user01

Should show information about user user01, including their UID, GID, and groups obtained from FreeIPA.

klist

On the client machine, after kinit user01, it should show an active Kerberos ticket.

Backups and Maintenance

Backup and regular maintenance of FreeIPA are critically important for ensuring the continuity of operations and security of your identity infrastructure.

1. What to Back Up

For FreeIPA, the following components need to be backed up:

• 389 Directory Server Database (LDAP): Contains all information about users, groups, hosts, policies, etc.
• FreeIPA Configuration Files: Kerberos, DNS, CA settings.
• CA Certificates: Keys and certificates issued by your FreeIPA CA.
• BIND (DNS) Configuration: If integrated DNS is used.

Fortunately, FreeIPA provides a built-in backup utility that covers most of these components.

2. Simple Auto-Backup Script

FreeIPA has a built-in command ipa-server-backup that creates a full dump of all necessary data.

#!/bin/bash

BACKUP_DIR="/var/lib/ipa/backup"
DATE=$(date +%Y%m%d%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/ipa_backup_${DATE}.tar.gz"
RETENTION_DAYS=7 # How many days to keep backups

echo "Starting FreeIPA backup to ${BACKUP_FILE}..."

# Create backup directory if it doesn't exist
sudo mkdir -p ${BACKUP_DIR}

# Perform FreeIPA backup
# Use --dir to specify the directory where FreeIPA will save its files
# Then archive this directory
sudo ipa-server-backup --dir /tmp/ipa_backup_temp_dir

if [ $? -eq 0 ]; then
    echo "FreeIPA backup successfully created in temporary directory. Archiving..."
    sudo tar -czf ${BACKUP_FILE} -C /tmp ipa_backup_temp_dir
    if [ $? -eq 0 ]; then
        echo "Backup archive successfully created: ${BACKUP_FILE}"
        sudo rm -rf /tmp/ipa_backup_temp_dir # Remove temporary directory

        # Deleting old backups
        echo "Deleting old backups (older than ${RETENTION_DAYS} days)..."
        sudo find ${BACKUP_DIR} -name "ipa_backup_*.tar.gz" -type f -mtime +${RETENTION_DAYS} -delete
        echo "Old backups deleted."
    else
        echo "Error archiving backup."
        sudo rm -rf /tmp/ipa_backup_temp_dir
        exit 1
    fi
else
    echo "Error executing ipa-server-backup."
    exit 1
fi

echo "Backup completed."

Save this script, for example, as /usr/local/bin/ipa_backup.sh, and make it executable:

sudo chmod +x /usr/local/bin/ipa_backup.sh

Then add it to cron for daily execution (e.g., at 3:00 AM):

sudo crontab -e

Add the following line:

0 3 * * * /usr/local/bin/ipa_backup.sh > /var/log/ipa_backup.log 2>&1

3. Where to Store Backups

Storing backups on the same server as the original data is not reliable. It is recommended to use external storage:

• Cloud S3-compatible storage: Amazon S3, DigitalOcean Spaces, Backblaze B2. Use s3cmd, rclone, or aws cli to upload archives.
• Separate VPS: Allocate a small VPS exclusively for backup storage. Use rsync or scp to transfer files via SSH.
• Local NAS/server: If you have your own hardware.

Example of adding S3 upload to the script (requires aws cli installation and configuration):

# ... (start of script) ...
# After successful archive creation:
if [ $? -eq 0 ]; then
    echo "Backup archive successfully created: ${BACKUP_FILE}"
    sudo rm -rf /tmp/ipa_backup_temp_dir

    echo "Uploading backup to S3..."
    # Make sure AWS CLI is installed and configured (aws configure)
    /usr/local/bin/aws s3 cp ${BACKUP_FILE} s3://your-s3-bucket-name/ipa-backups/

    if [ $? -eq 0 ]; then
        echo "Backup successfully uploaded to S3."
    else
        echo "Error uploading backup to S3."
        # You can add an error notification
    fi

    # ... (deletion of old backups) ...

Always encrypt backups before sending them to external storage, using GPG or other tools.

4. Restoring from Backup

To restore FreeIPA from a backup, the ipa-server-restore command is used. This is typically done on a freshly installed Ubuntu system with the ipa-server package, but without running ipa-server-install.

sudo systemctl stop ipa.service
sudo ipa-server-restore --restore-dir /path/to/your/backup/directory

5. Updates: rolling vs maintenance window

Updating FreeIPA and the underlying OS is an important part of maintenance.

• OS Update: Regularly apply security updates for Ubuntu. Use sudo apt update && sudo apt upgrade -y. For critical systems, it is recommended to test updates on a test server before applying them to production.
• FreeIPA Update: Updates to the ipa-server package usually include FreeIPA updates. After updating FreeIPA packages, it may be necessary to run ipa-server-upgrade.

  
  sudo apt update && sudo apt upgrade -y
  sudo ipa-server-upgrade
              

  This command performs necessary LDAP schema migrations and other FreeIPA component updates.

• Update Strategy:
  • Rolling updates (for replicated environments): If you have multiple FreeIPA servers in replication mode, you can update them one by one, minimizing downtime.
  • Maintenance window (for standalone servers): For a standalone FreeIPA server, plan updates during periods of lowest activity to minimize potential disruptions. Always have a fresh backup before major updates.

Troubleshooting + FAQ

What to do if FreeIPA does not start after a reboot?

First, check the status of core FreeIPA services using sudo ipactl status. If any service is stopped or in a failed state, check the logs: sudo journalctl -xeu [email protected] for LDAP, sudo journalctl -xeu krb5kdc.service for Kerberos, sudo journalctl -xeu named-ipa.service for DNS. Common causes include: issues with DNS resolution of the server's own name, insufficient memory, corrupted LDAP database, or configuration errors.

What is the minimum VPS configuration suitable for FreeIPA?

The minimum recommended configuration for FreeIPA in a test or small environment is 2 CPU cores, 4 GB RAM, and a 50 GB SSD. However, for stable operation and scaling to several hundred users/hosts, it is better to aim for 4 CPU cores, 8 GB RAM, and a 100 GB SSD. This will provide sufficient performance for Kerberos, LDAP, and other FreeIPA services.

What to choose — VPS or dedicated for this task?

The choice between a VPS and a dedicated server depends on the scale and performance requirements. For most small to medium deployments (up to several thousand users/hosts), a VPS with adequate resources will be sufficient and cost-effective. Dedicated servers become necessary for very high loads (tens of thousands of users), specific hardware requirements (e.g., HSM), strict SLAs, or if complete resource isolation and maximum I/O performance are required.

Cannot log in to the FreeIPA web interface. What to check?

Ensure that the HTTPD service is running (sudo systemctl status httpd.service or sudo systemctl status [email protected]). Check that ports 80 and 443 are open in the firewall (sudo ufw status). Clear your browser cache or try a different browser. Make sure you are using the correct server FQDN and that it resolves to the server's IP address. Check web server logs (e.g., /var/log/httpd/error_log).

FreeIPA client cannot connect to the server.

Check DNS resolution on the client: dig ipa.example.com should point to your FreeIPA server's IP address. Ensure that FreeIPA ports are open on the server (53, 80, 443, 389, 636, 88, 464, 123). Check time synchronization between the client and server (Kerberos is very sensitive to this): sudo timedatectl status. Try running ipa-client-install with the --debug option for detailed logs.

How to reset the admin user password in FreeIPA?

If you forgot the admin password, it can be reset via the Directory Manager user. First, obtain a Kerberos ticket for Directory Manager: kinit admin/admin (Directory Manager password). Then reset the admin user's password: ipa user-mod admin --password. You will be prompted to enter a new password. If you also forgot the Directory Manager password, this is more complex and may require direct intervention in the LDAP directory (which is beyond the scope of this guide).

Certificate or TLS issues when accessing FreeIPA.

FreeIPA uses its own CA. Ensure that you have imported the FreeIPA CA root certificate into your operating system's or browser's trusted stores. If this does not help, check the validity of FreeIPA certificates: ipa-getcert list. If certificates have expired, they need to be renewed via ipa-server-certinstall or ipa-certupdate.

Conclusions and Next Steps

Congratulations! You have successfully deployed and configured FreeIPA on your VPS, creating a centralized identity management system. You now have a powerful tool for authenticating users and machines, managing access, and issuing certificates, which significantly simplifies the administration of your Linux infrastructure.

Further steps may include:

• Integration of additional services: Connect your other servers, workstations, and applications to FreeIPA for centralized authentication.
• Access policy configuration: Explore Host-Based Access Control (HBAC) capabilities for fine-tuning who can log in where.
• Deployment of replicas: To enhance fault tolerance and distribute load, consider deploying additional FreeIPA servers in replication mode.
• Monitoring: Set up FreeIPA monitoring using tools like Prometheus/Grafana to track service status and performance.