How do I install and configure FreeIPA Client on CentOS 8 / RHEL 8?. In our last guide, we covered the installation of FreeIPA server on RHEL / CentOS 8. This article will focus on how to Install FreeIPA Client on CentOS 8 / RHEL 8. The FreeIPA Client is installed on machines to be authenticated against FreeIPA Server.
FreeIPA Client integrates with many Linux native services such as:
- SSH – server can keep SSH public keys used by both sshd and ssh
- SUDO – server can provide centralized sudoers to all clients.
- automount – server can keep automount maps consumed by client autofs differentiated by a location.
- SELinux user map – server can keep policies to assign different SELinux user roles to users, based on their group or host group.
These integrations allow a System Administrator to conveniently configure them centrally, on the FreeIPA server. When a management command is executed on the Client machine, the FreeIPA client sends it to the server where it is executed.
Install FreeIPA Client on CentOS 8 / RHEL 8
On RHEL / CentOS 8, FreeIPA client is available as an AppStream module.
$ sudo yum module list idm
Updating Subscription Management repositories.
Updating Subscription Management repositories.
Last metadata expiration check: 0:16:51 ago on Sat 29 Dec 2018 09:52:44 AM EAT.
Red Hat Enterprise Linux 8 for x86_64 - AppStream Beta (RPMs)
Name Stream Profiles Summary
idm DL1 adtrust, client, dns, server, default [d] The Red Hat Enterprise Linux Identity Management system module
idm client [d] default [d] RHEL IdM long term support client module
Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalledFrom the output, you can see we have DL1 and client Streams. For more information about the FreeIPA client stream, run:
sudo yum module info idm:clientInstall FreeIPA client on CentOS / RHEL 8 system by executing the command below in your terminal.
sudo yum -y install @idm:clientCheck version of ipa-client installed.
$ rpm -qi ipa-client
Name : ipa-client
Version : 4.7.1
Release : 1.el8+1957+d517d3b2
Architecture: x86_64
Install Date: Sat 29 Dec 2018 10:00:11 AM EAT
Group : System Environment/Base
Size : 293787
License : GPLv3+
Signature : RSA/SHA256, Tue 23 Oct 2018 09:19:02 AM EAT, Key ID 199e2f91fd431d51
Source RPM : ipa-4.7.1-1.el8+1957+d517d3b2.src.rpm
Build Date : Sun 07 Oct 2018 02:51:43 PM EAT
Build Host : x86-vm-07.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager : Red Hat, Inc. http://bugzilla.redhat.com/bugzilla
Vendor : Red Hat, Inc.
URL : https://www.freeipa.org/
Summary : IPA authentication for use on clients
Description :
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
This package provides command-line tools for IPA administrators.You can do the same for sssd.
$ rpm -qi sssd
Name : sssd
Version : 2.0.0
Release : 21.el8
Architecture: x86_64
Install Date: Wed 26 Dec 2018 10:54:09 AM EAT
Group : Applications/System
Size : 35147
License : GPLv3+
Signature : RSA/SHA256, Tue 16 Oct 2018 06:03:29 PM EAT, Key ID 199e2f91fd431d51
Source RPM : sssd-2.0.0-21.el8.src.rpm
Build Date : Tue 16 Oct 2018 03:25:43 PM EAT
Build Host : x86-vm-02.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager : Red Hat, Inc. http://bugzilla.redhat.com/bugzilla
Vendor : Red Hat, Inc.
URL : https://pagure.io/SSSD/sssd/
Summary : System Security Services Daemon
Description :
Provides a set of daemons to manage access to remote directories and
authentication mechanisms. It provides an NSS and PAM interface toward
the system and a plug-gable back-end system to connect to multiple different
account sources. It is also the basis to provide client auditing and policy
services for projects like FreeIPA.
The sssd sub-package is a meta-package that contains the daemon as well as all
the existing back ends.Configure FreeIPA Client on CentOS 8 / RHEL 8
Once the installation of the FreeIPA Client packages is complete. Add hostname and IP address of your IPA Server to /etc/hosts file if you don’t have a working DNS resolution.
echo "192.168.58.121 ipa.example.com"| sudo tee /etc/hosts
Set your system hostname.
export HNAME="rhel8.example.com"
sudo hostnamectl set-hostname $HNAME --static
sudo hostname $HNAMEFinally, configure the FreeIPA client on your system by running the command below.
sudo ipa-client-install --hostname=rhel8.example.com \
--mkhomedir \
--server=ipa.example.com \
--domain example.com \
--realm EXAMPLE.COMWhere:
- rhel8.example.com – Client host name
- ipa.example.com FreeIPA Server host name
- example.com – Domain name configured in FreeIPA Server
- EXAMPLE.COM – FreeIPA server Kerberos REALM
Your installation should be similar to example below.
This program will set up IPA client.
Version 4.7.1
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Client hostname: rhel8.example.com
Realm: EXAMPLE.COM
DNS Domain: example.com
IPA Server: ipa.example.com
BaseDN: dc=example,dc=com
Continue to configure the system with these values? [no]: yes
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Time synchronization was successful.
User authorized to enroll computers: admin
Password for [email protected]: <admin Password>
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=EXAMPLE.COM
Issuer: CN=Certificate Authority,O=EXAMPLE.COM
Valid From: 2019-03-24 10:12:55
Valid Until: 2038-03-24 10:12:55
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
Systemwide CA database updated.
Hostname (rhel8.local) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host rhel8.local: 192.168.122.198.
Incorrect reverse record(s):
192.168.122.198 is pointing to rhel8.example.com
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring example.com as NIS domain.
Client configuration complete.
The ipa-client-install command was successfulIf you have DNS server, FreeIPA client installer can discover FreeIPA server and pull required installation. The command:
sudo ipa-client-installShould be sufficient to configure client machine.
Enable Creation of home directories on the first Login
If user’s home directory are not created automatically, enable this feature by running the command below.
$ sudo authconfig --enablemkhomedir --update
...
Executing: /usr/bin/authselect check
Executing: /usr/bin/authselect current --raw
Executing: /usr/bin/authselect select sssd with-sudo with-mkhomedir --force
Executing: /usr/bin/systemctl enable oddjobd.service
Executing: /usr/bin/systemctl stop oddjobd.service
Executing: /usr/bin/systemctl start oddjobd.serviceCheck if user’s identification is visible on the server.
$ id josphat
uid=1676000008(josphat) gid=1676000008(josphat) groups=1676000008(josphat),1676000007(wheel-users)Test FreeIPA LDAP user authentication.
$ ssh [email protected]
Password:
Password expired. Change your password now.
Current Password:
New password: <Set new passwoird
Retype new password:
Activate the web console with: systemctl enable --now cockpit.socket
[[email protected] ~]$ id
uid=1201400003(test1) gid=1201400003(test1) groups=1201400003(test1) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023Using FreeIPA ipa Command Line Management Tool
You can administer FreeIPA Server from the client machine using ipa command line tool.
First, obtain a Kerberos ticket.
$ sudo kinit admin
Password for [email protected]: Check ticket expiry information using klist.
$ klist
Ticket cache: KCM:0
Default principal: [email protected]
Valid starting Expires Service principal
03/24/2019 11:48:06 03/25/2019 11:48:04 krbtgt/EXAMPLE.COM@EXAMPLE.COMTest by adding a user account and listing accounts present:
$ sudo ipa user-add test \
--first=Test --last=User \
--email=[email protected] --password
Password:
Enter Password again to verify:
-------------------
Added user "test"
-------------------
User login: test
First name: Test
Last name: User
Full name: Test User
Display name: Test User
Initials: TU
Home directory: /home/test
GECOS: Test User
Login shell: /bin/bash
Principal name: [email protected]
Principal alias: [email protected]
User password expiration: 20190324085532Z
Email address: [email protected]
UID: 1201400001
GID: 1201400001
Password: True
Member of groups: ipausers
Kerberos keys available: TrueVerify.
ipa user-find testEnable Passwordless Authentication using Private Key
If you would like to authenticate to a server without a password, copy your Public key to FreeIPA Server:
Click the Add button under “SSH public keys“, paste your public key into the box and save.
Removing IPA Client from CentOS 8 / RHEL 8 system
Removal of FreeIPA client on CentOS / RHEL 8 can be done by running the command:
$ sudo ipa-client-install --uninstall
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The original nsswitch.conf configuration has been restored.
You may need to restart services or reboot the machine.
Do you want to reboot the machine? [no]:
The ipa-client-install command was successfulConclusion
There you have it. FreeIPA client has been installed and configured on RHEL / CentOS 8 system.
