How To Configure FreeIPA replication on Ubuntu / CentOS

How can I configure FreeIPA replication?. Do you have a single FreeIPA Server and you are afraid of a single point of failure?. In this post, we will cover complete steps to Configure FreeIPA replication on Ubuntu 18.04, Ubuntu 16.04 and CentOS Servers. When you have FreeIPA replica setup, FreeIPA Clients can continue to authenticate even if a Server is down.

If you’re interested in following this guide along, you should have FreeIPA Server already installed and fully functioning, with test accounts. For installation of FreeIPA Server, we have guides for you:

How to Install FreeIPA Server on Ubuntu

How to install FreeIPA Server on CentOS 7

Install FreeIPA Server on CentOS / RHEL 8

Once you have FreeIPA server installed and configured, there is no other prerequisite required. You can start FreeIPA Replication.

My Lab Setup

I have a Primary FreeIPA server with hostname ipa.computingforgeeks.com, and the replica will be configured on ipa-replica.computingforgeeks.com. The IP addresses for the two servers are as below:

Step 1: Configure DNS local hosts file

On both servers, ensure you have hostnames for each server configured. This is important if you don’t have active DNS service in your Infrastructure.

sudo vim /etc/hosts

Ensure you have lines like below, replace hostnames with your match.

192.168.10.10 ipa.computingforgeeks.com ipa
192.168.10.11 ipa-replica.computingforgeeks.com ipa-replica

Ensure hostname is configured correctly:

sudo hostnamectl set-hostname ipa-replica.computingforgeeks.com

Step 2: Install FreeIPA Client on Replica Server

For installation of FreeIPA Client on both CentOS 7 and Ubuntu servers, refer to our previous guide: How to Configure FreeIPA Client on Ubuntu/ CentOS.

When summarized, the only steps required are:

For CentOS 7

$ sudo yum install ipa-client
$ sudo ipa-client-install --hostname=`hostname -f` \
--mkhomedir \
--server=ipa.computingforgeeks.com \
--domain computingforgeeks.com \
--realm COMPUTINGFORGEEKS.COM

For Ubuntu 18.04 / Ubuntu 16.04:

$ sudo  apt-get install freeipa-client
$ sudo bash -c "cat > /usr/share/pam-configs/mkhomedir" <<EOF
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF

$ sudo pam-auth-update

Step 3: Install FreeIPA Server on Replica

Once FreeIPA server has been installed and configured, next step is to install FreeIPA Server on a replica.

For Ubuntu, use:

sudo apt-get install freeipa-server

For CentOS 7. run:

sudo yum -y install ipa-server

Test by requesting for a Kerberos ticket on the replica:

[root@ipa-replica ~]# kinit admin
Password for [email protected]: 
[root@ipa-replica ~]# klist 
Ticket cache: KEYRING:persistent:0:0
Default principal: [email protected]
Valid starting Expires Service principal
06/30/2018 11:58:58 07/01/2018 11:58:56 krbtgt/[email protected]

Step 4: Add Replica server to the ipaservers group on FreeIPA server

Login to FreeIPA Server and add replica server to the ipaservers group:

[root@ipa ~]# kinit admin
Password for [email protected]

[root@ipa ~]# ipa hostgroup-add-member ipaservers --hosts ipa-replica.computingforgeeks.com
Host-group: ipaservers
Description: IPA server hosts
Member hosts: ipa.computingforgeeks.com, ipa-replica.computingforgeeks.com
-------------------------
Number of members added 1
-------------------------

You can see that we now have two member hosts. ipa & ipa-replica

For CentOS 7 FreeIPA Server, open freeipa-replication on Firewalld if you have active firewalld service:

On IPA server:

sudo firewall-cmd --add-service=freeipa-replication --permanent
sudo firewall-cmd --reload

Step 5: Run ipa-replica-install on the Replica server

To this point, you only have to run  ipa-replica-installcommand on the replica server to sync FreeIPA Server configurations and get the server ready for clients to connect to.

[root@ipa-replica ~]# ipa-replica-install 
WARNING: conflicting time&date synchronization service 'chronyd' will
be disabled in favor of ntpd

Run connection check to master
Connection check OK
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/42]: creating directory server instance
  [2/42]: enabling ldapi
  [3/42]: configure autobind for root
  [4/42]: stopping directory server
  [5/42]: updating configuration in dse.ldif
  [6/42]: starting directory server
  [7/42]: adding default schema
  [8/42]: enabling memberof plugin
  [9/42]: enabling winsync plugin
  [10/42]: configuring replication version plugin
  [11/42]: enabling IPA enrollment plugin
  [12/42]: configuring uniqueness plugin
  [13/42]: configuring uuid plugin
  [14/42]: configuring modrdn plugin
  [15/42]: configuring DNS plugin
  [16/42]: enabling entryUSN plugin
  [17/42]: configuring lockout plugin
  [18/42]: configuring topology plugin
  [19/42]: creating indices
  [20/42]: enabling referential integrity plugin
  [21/42]: configuring certmap.conf
  [22/42]: configure new location for managed entries
  [23/42]: configure dirsrv ccache
  [24/42]: enabling SASL mapping fallback
  [25/42]: restarting directory server
  [26/42]: creating DS keytab
  [27/42]: ignore time skew for initial replication
  [28/42]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded

  [29/42]: prevent time skew after initial replication
  [30/42]: adding sasl mappings to the directory
  [31/42]: updating schema
  [32/42]: setting Auto Member configuration
  [33/42]: enabling S4U2Proxy delegation
  [34/42]: initializing group membership
  [35/42]: adding master entry
  [36/42]: initializing domain level
  [37/42]: configuring Posix uid/gid generation
  [38/42]: adding replication acis
  [39/42]: activating sidgen plugin
  [40/42]: activating extdom plugin
  [41/42]: tuning directory server
  [42/42]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc)
  [1/5]: configuring KDC
  [2/5]: adding the password extension to the directory
  [3/5]: creating anonymous principal
  [4/5]: starting the KDC
  [5/5]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring directory server (dirsrv)
  [1/3]: configuring TLS for DS instance
  [2/3]: importing CA certificates from LDAP
  [3/3]: restarting directory server
Done configuring directory server (dirsrv).
Configuring the web interface (httpd)
  [1/22]: stopping httpd
  [2/22]: setting mod_nss port to 443
  [3/22]: setting mod_nss cipher suite
  [4/22]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
  [5/22]: setting mod_nss password file
  [6/22]: enabling mod_nss renegotiate
  [7/22]: disabling mod_nss OCSP
  [8/22]: adding URL rewriting rules
  [9/22]: configuring httpd
  [10/22]: setting up httpd keytab
  [11/22]: configuring Gssproxy
  [12/22]: setting up ssl
  [13/22]: configure certmonger for renewals
  [14/22]: importing CA certificates from LDAP
  [15/22]: publish CA cert
  [16/22]: clean up any existing httpd ccaches
  [17/22]: configuring SELinux for httpd
  [18/22]: create KDC proxy config
  [19/22]: enable KDC proxy
  [20/22]: starting httpd
  [21/22]: configuring httpd to start on boot
  [22/22]: enabling oddjobd
Done configuring the web interface (httpd).
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring ipa-custodia
  [1/4]: Generating ipa-custodia config file
  [2/4]: Generating ipa-custodia keys
  [3/4]: starting ipa-custodia 
  [4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Configuring certificate server (pki-tomcatd)
  [1/2]: configure certmonger for renewals
  [2/2]: Importing RA key
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc)
  [1/1]: installing X509 Certificate for PKINIT
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/9]: stopping directory server
  [2/9]: saving configuration
  [3/9]: disabling listeners
  [4/9]: enabling DS global lock
  [5/9]: starting directory server
  [6/9]: upgrading server
  [7/9]: stopping directory server
  [8/9]: restoring configuration
  [9/9]: starting directory server
Done.
Restarting the KDC

If the setup was successful, you should not encounter any error.

Configure Firewalld on Replica server ( CentOS 7)

Open IPA Server ports on replica server by running:

sudo firewall-cmd --add-service={ssh,dns,freeipa-ldap,freeipa-ldaps,freeipa-replication} --permanent
sudo firewall-cmd --reload

Step 6: Testing ( Enroll a client on FreeIPA Replica)

Let’s do a testing by configuring a client on to use FreeIPA replica configured.

sudo yum install ipa-client     --> CentOS
sudo apt-get install freeipa-client --> Ubuntu

Configure freeipa client

$ sudo vim /etc/hosts
192.168.10.10 ipa.computingforgeeks.com ipa
192.168.10.11 ipa-replica.computingforgeeks.com ipa-replica

Then runipa-client-install command:

# ipa-client-install --hostname=`hostname -f` \
--mkhomedir --server=ipa-replica.computingforgeeks.com \
--domain computingforgeeks.com --realm COMPUTINGFORGEEKS.COM

Removing FreeIPA replica

To remove FreeIPA, first, uninstall it on the on the server using:

[root@ipa-replica ~]# ipa-server-install --uninstall

Then delete the server from the ipaservers group:

# ipa-replica-manage del ipa-replica.computingforgeeks.com --force
# ipa hostgroup-remove-member ipaservers --hosts ipa-replica.computingforgeeks.com

FreeIPA integration guides:

How to Configure GitLab FreeIPA Authentication

Configure Jenkins FreeIPA Authentication

Harbor registry FreeIPA / LDAP integration