Archived
beatzaplentyandClaude Sonnet 4.6
761fe9e194
- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs) - cloud-init nameserver and nmcli DNS during install use .254 (gateway) since IPA isn't running yet at that point - --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone) - Remove Step 7 (Pi-hole DNS forwarding config) from install.md - Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh - Update CLAUDE.md section count and freeipa/ guidance entry - Update freeipa/README.md IP and DNS forwarding description Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
89 lines
2.4 KiB
Markdown
89 lines
2.4 KiB
Markdown
# FreeIPA — domain-controller.sweet.home
|
|
|
|
FreeIPA 4.x identity management server providing Kerberos, LDAP, and
|
|
integrated DNS for the `sweet.home` LAN. Runs on Rocky Linux 9 in a
|
|
Proxmox VM (VMID 108 on `pve1.sweet.home`).
|
|
|
|
## Quick status
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Host | `domain-controller.sweet.home` |
|
|
| IP | `192.168.2.253` (static) |
|
|
| Realm | `SWEET.HOME` |
|
|
| Domain | `sweet.home` |
|
|
| IPA version | 4.13.x (Rocky Linux 9) |
|
|
| Web UI | `https://domain-controller.sweet.home/ipa/ui/` |
|
|
| VMID | 108 on `pve1.sweet.home` |
|
|
| OS | Rocky Linux 9 (GenericCloud image) |
|
|
|
|
## What it provides
|
|
|
|
- **Kerberos KDC** — SSO tickets for the `SWEET.HOME` realm
|
|
- **LDAP directory** — centralised user/group/host store (389-ds)
|
|
- **Integrated DNS** — authoritative for `sweet.home` and primary LAN
|
|
resolver for all hosts, forwarding everything else to the LAN gateway
|
|
- **CA** — self-signed CA issuing certs for IPA services
|
|
- **Web UI** — at `https://domain-controller.sweet.home/ipa/ui/`
|
|
|
|
## First-time use
|
|
|
|
```bash
|
|
# SSH to the server
|
|
ssh wayne@domain-controller
|
|
|
|
# Get a Kerberos ticket as admin
|
|
kinit admin
|
|
|
|
# List IPA users
|
|
ipa user-find
|
|
|
|
# Add a user
|
|
ipa user-add jdoe --first=John --last=Doe --password
|
|
|
|
# Check service health
|
|
ipactl status
|
|
```
|
|
|
|
## Credentials
|
|
|
|
The `admin` Kerberos password and Directory Manager password were
|
|
generated at install time. They are **not stored in this repo** — keep
|
|
them in your password manager.
|
|
|
|
- **admin** — used for day-to-day IPA management (`kinit admin`)
|
|
- **Directory Manager** — low-level LDAP root, rarely needed
|
|
|
|
To reset the admin password (requires being logged in as admin):
|
|
```bash
|
|
kinit admin
|
|
ipa passwd admin
|
|
```
|
|
|
|
## Ports required (firewalld)
|
|
|
|
FreeIPA's firewalld config is applied by `ipa-server-install` automatically.
|
|
The following ports must be reachable from LAN clients:
|
|
|
|
| Port | Proto | Service |
|
|
|------|-------|---------|
|
|
| 80 | TCP | HTTP (redirect to HTTPS) |
|
|
| 443 | TCP | HTTPS / Web UI |
|
|
| 389 | TCP | LDAP |
|
|
| 636 | TCP | LDAPS |
|
|
| 88 | TCP+UDP | Kerberos |
|
|
| 464 | TCP+UDP | Kerberos password change |
|
|
| 53 | TCP+UDP | DNS |
|
|
|
|
## Reproducing this setup
|
|
|
|
See `docs/install.md` for the full step-by-step install procedure,
|
|
or run `scripts/install.sh` on a fresh Rocky Linux 9 VM with the
|
|
correct hostname and IP already set.
|
|
|
|
## Backup
|
|
|
|
The CA certificates (required for replicas) are at `/root/cacert.p12`
|
|
on the server, encrypted with the Directory Manager password.
|
|
Back these up to a secure location.
|