Quick Deployment: Join Domain in 3 Steps
Just finished setting up a CentOS Stream 9 instance and want it to “behave” and accept users from FreeIPA? If your DNS settings are correct, use the commands below. I’ve stripped away the fluff to save you as much time as possible.
# 1. Install necessary client packages
sudo dnf install -y freeipa-client
# 2. Map server IP to hosts file (if internal DNS is not ready)
echo "192.168.1.10 ipaserver.itfromzero.local" | sudo tee -a /etc/hosts
# 3. Proceed to join the domain
sudo ipa-client-install --mkhomedir --no-ntp
After entering the Principal (admin) and Password, if you see the line Client configuration complete, you’ve succeeded. However, real-world deployments in large projects often encounter DNS issues or clock skew. Don’t worry, I’ll guide you through resolving these thoroughly below.
Why Sysadmins are “Addicted” to FreeIPA?
Imagine managing 200 servers. If done manually, creating local users and copying SSH keys for each machine would be a disaster. When an employee leaves, you’d spend the whole morning just revoking access. FreeIPA was born to solve that pain point.
This system combines the power of 389 Directory Server (LDAP), MIT Kerberos (Authentication), and Dogtag (Digital Certificates). When a CentOS 9 server joins FreeIPA, it becomes a link in the security chain. With just one click to disable a user on the Web UI, access to the entire cluster is cut off immediately.
Step 1: Preparation Checklist (Don’t skip this unless you want headaches)
Trust me, 90% of FreeIPA Client installation errors stem from DNS and Time (NTP). Check these two items carefully before running the install command.
Setting up a Standard FQDN Hostname
FreeIPA is extremely allergic to short hostnames like localhost or web-server. You must use a Fully Qualified Domain Name (FQDN).
sudo hostnamectl set-hostname client01.itfromzero.localChecking Domain Name Resolution
The client must find the Server via the domain name. You can edit the /etc/resolv.conf file to point to the IPA Server’s IP to ensure the highest accuracy, or configure a proper internal DNS server.
# Check if the Kerberos record exists
dig -t SRV _kerberos._udp.itfromzero.localSynchronizing Time with Chrony
The Kerberos protocol will refuse authentication if the time between the client and server differs by more than 300 seconds (5 minutes). On CentOS Stream 9, chronyd is the default and most stable choice.
sudo systemctl enable --now chronyd
# Force the system to update the time immediately
sudo chronyc makestepStep 2: Detailed Installation and Configuration
Installing the package on CentOS 9 is quite smooth as the modules are optimized. Once installed, we will use the ipa-client-install command with specific parameters to prevent the system from guessing incorrect information.
sudo dnf install -y freeipa-clientImportant note: I always use the --mkhomedir flag. Without it, domain users logging in won’t have a home directory and will be kicked out immediately with a shell error.
sudo ipa-client-install \
--server=ipaserver.itfromzero.local \
--domain=itfromzero.local \
--mkhomedir \
--no-ntpQuick flag explanation:
--server: Precisely identifies the management server.--domain: Your identity management domain name.--no-ntp: Allows the system to use the existingchrony, avoiding IPA time configuration conflicts.
Step 3: Real-world Verification
Installation complete. Now, let’s test if the server is “ready to go” by obtaining a Kerberos Ticket.
# Try logging in with the IPA admin user
kinit admin
# View the list of currently held tickets
klistIf the screen displays Ticket information along with an expiration date, your server officially belongs to the Domain.
Advanced: Centralized Sudo Rule Management
The real selling point of FreeIPA is the ability to manage sudo permissions remotely. You no longer need to SSH into each machine to edit the /etc/sudoers file. However, for CentOS 9 to understand these rules, you need to configure SSSD slightly.
First, ensure the /etc/nsswitch.conf file contains the line:
sudoers: files sssThen, add the sudo service to the /etc/sssd/sssd.conf file:
[sssd]
services = nss, pam, ssh, sudoFinally, restart the service to apply the changes: sudo systemctl restart sssd.
Troubleshooting: Common Midnight Errors
1. “SASL Bind failed” Error
This error is usually caused by an incorrect password or the admin account being locked. Try kinit admin first to check the account status.
2. Duplicate Certificate Error
If you reinstall a machine with the same hostname, the IPA Server will refuse it. You need to go to the IPA Web UI, find the Host section, delete that machine (Unenroll), and then you can rejoin.
3. User Login Without Home Directory
If you forgot the --mkhomedir flag during installation, use the following command to fix it without starting over:
sudo authselect select sssd with-mkhomedir --forceA Word from the Sysadmin
Deploying FreeIPA on CentOS Stream 9 is actually very smooth thanks to the new generation of SSSD. In projects migrating from version 7 to 9, I’ve noticed LDAP query speeds are about 30% faster and cache hangs are extremely rare. If you’re managing 10 or more servers, set up FreeIPA now for a good night’s sleep, and stop struggling with manual useradd.
