FreeIPA Installation Guide on CentOS Stream 9: Professional Centralized Identity Management (IdM) – ITFROMZERO

Table of Contents

The Headaches of Manual Account Management

Imagine you are managing a cluster of 20 Linux servers. Every time a new employee joins, you have to SSH into each machine to run useradd and then set a password. This task is not only tedious but also extremely prone to errors. When that employee leaves, auditing and deleting accounts across every node without missing a single spot becomes a real headache.

When CentOS 8 suddenly reached its end-of-life, I had to quickly migrate my entire identity system to CentOS Stream 9. At that time, I faced two choices: pure OpenLDAP or FreeIPA. After over 6 months of running FreeIPA for more than 50 production servers, I’ve concluded: if you want a synchronized Linux management ecosystem, FreeIPA is the most practical choice today.

What is FreeIPA? Why not OpenLDAP?

FreeIPA (Identity, Policy, Audit) is often referred to as the Active Directory of the Linux world. It’s more than just a database for user information. It’s a combination of the “Power Four”:

389 Directory Server: LDAP for data storage.
MIT Kerberos: The heart of the Single Sign-On (SSO) mechanism.
Dogtag Certificate System: Internal Certificate Authority (CA) management.
BIND: A powerful integrated DNS system.

What I appreciate most is the ability to centrally manage sudo rules and SSH keys. Instead of manually copying configuration files, you simply define policies on the Web UI. All changes take effect immediately across all nodes in the system.

Hardware Specifications: Don’t Skimp on RAM

FreeIPA is quite resource-intensive because it runs many services simultaneously. Don’t try to install it on a 1GB RAM VPS; you’ll soon see the OOM Killer paying a visit and crashing the system repeatedly. Here are the hardware specs I recommend:

OS: CentOS Stream 9 (Minimal version).
RAM: Minimum 4GB. If you plan to run both DNS and CA, prioritize 8GB RAM for smooth operation.
CPU: At least 2 Cores.
Network: Static IP is mandatory.
Hostname: Must be a standard FQDN, for example: ipa.lab.itfromzero.com.

Before starting, set the hostname and update the system to avoid package conflicts:

# Set hostname
hostnamectl set-hostname ipa.lab.itfromzero.com

# Update the system to the latest version
dnf update -y

# Add IP to the hosts file to ensure internal resolution
echo "192.168.1.100 ipa.lab.itfromzero.com ipa" >> /etc/hosts

Detailed Installation Steps on CentOS Stream 9

On CentOS Stream 9, FreeIPA is managed as a module. You need to enable the correct module before downloading the installation packages.

Step 1: Enable the IDM Module

By default, CentOS Stream 9 provides the idm:DL1 stream. This is the most stable version for Identity Management.

dnf module enable idm:DL1 -y

Step 2: Install the FreeIPA Server Package

I always recommend installing it with DNS. This automates the creation of necessary SRV records for Kerberos, allowing clients to find the server automatically without extensive manual configuration.

dnf install ipa-server ipa-server-dns -y

Step 3: Initialize the System

This process will be interactive. You need to have your administrative passwords ready.

ipa-server-install --setup-dns

When the script runs, pay attention to the following information:

Server Hostname: Double-check if it is correctly set to ipa.lab.itfromzero.com.
Domain Name: Usually lab.itfromzero.com.
Realm Name: Must be uppercase, for example: LAB.ITFROMZERO.COM. This is a mandatory Kerberos rule.
Directory Manager Password: Used for deep level LDAP backend interventions.
DNS Forwarders: Enter Google’s DNS IP (8.8.8.8) or your ISP’s DNS so the server can access the internet.

The configuration process takes about 5 to 10 minutes. If you see the message “IPA server setup complete”, the system is ready.

Step 4: Open Firewall Ports

Many people forget this step, preventing clients from connecting. FreeIPA requires several ports to function.

firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns,ntp,http,https,kerberos,kpasswd} --permanent
firewall-cmd --reload

Verification and Operation

To verify everything is working, try requesting a Kerberos ticket for the admin user:

kinit admin
# Enter the admin password set in step 3

klist

If the output shows ticket information with a specific expiration time, the authentication system is running correctly. You can try creating a new user quickly via the CLI:

ipa user-add tuananh --first=Tuan --last=Anh --password

Now, access https://ipa.lab.itfromzero.com. The Web UI is very intuitive. From here, you can manage thousands of users with just a few clicks.

3 Hard-Earned Lessons After 6 Months of Production Use

Operating FreeIPA in a production environment is different from a lab. Here are some notes to help you avoid unfortunate incidents:

Never Forget Backups: Use the ipa-backup command daily. Once, I accidentally corrupted the LDAP configuration, and it was this backup file that saved me from a sleepless night of reinstalling everything from scratch.
Time is Golden: Kerberos will reject all login requests if the time difference between the server and client exceeds 300 seconds. Ensure the chronyd service is always running on all machines.
Always Have a Contingency Plan (Replica): Don’t let your system depend on a single server. Set up at least one Replica. If the primary server experiences a hardware failure, your system will continue to function normally.

Conclusion

Deploying FreeIPA on CentOS Stream 9 is a smart move to professionalize your IT infrastructure. Although concepts like Kerberos or LDAP might seem daunting at first, the security benefits and convenience it provides are immense. If you’re tired of manual user management, start installing FreeIPA today.