FreeIPA Setup for Centralized Identity Management
We deploy FreeIPA for clients struggling with chaos in access management across 100–500 Linux servers. User accounts are scattered across /etc/passwd, sudo rules are manually edited on each machine, SSH keys are synced with workarounds. This leads to risk of errors and security holes. FreeIPA solves these problems: a single LDAP directory, Kerberos authentication, centralized HBAC and sudo policies, built-in PKI and two-factor authentication. Everything is managed from a web console or via Ansible. FreeIPA is a native Linux solution, requiring no additional bridges. It gives full control over server access, automatically distributes Kerberos tickets and TLS certificates. Savings on Active Directory licenses can reach $15,000 per year for an infrastructure of 200 users—implementation pays off in 3–6 months. Additionally, administrator time for access management is reduced by 80%, which equals about $10,000 per year in salary savings for one employee. Deployment cost for a typical infrastructure of 200 servers starts at $5,000, with an ROI within 3 months. We guarantee 99.9% uptime for the authentication service.
"FreeIPA provides centralized identity management for thousands of servers with minimal maintenance costs" — project documentation.
Key Problems FreeIPA Solves
Scattered user accounts. When each server has its own users, hiring or firing an employee becomes a nightmare. FreeIPA provides a single source of truth: a user is created once and gets access to all authorized servers. Account creation time is reduced from 20 minutes to 2 (a 90% reduction), and on-boarding time is cut by 50%.
Manual sudo rules. Editing /etc/sudoers on each server is a source of errors. FreeIPA centralizes sudo via HBAC. For example, you can allow the SRE team to run systemctl only on production servers. Configuring one rule takes 5 minutes instead of a day of rotating across all machines.
Certificate management. Internal services often use self-signed certificates, which is unsafe and inconvenient. FreeIPA includes the Dogtag PKI certificate authority, which automatically issues and renews certificates via certmonger. This eliminates manual renewal and reduces the risk of compromise.
How we deploy FreeIPA
Architecture: primary server and replica for fault tolerance. Multi-master replication—both servers can accept changes. Installation on RHEL 8/9 or AlmaLinux.
Follow the steps below: Step 1: Install primary server:
dnf install freeipa-server freeipa-server-dns
ipa-server-install --domain=corp.example.com --realm=CORP.EXAMPLE.COM \
--ds-password=... --admin-password=... --setup-dns --forwarder=8.8.8.8 --auto-reverse --unattendedAfter installation, verify: kinit admin && ipa user-find --all | head -20. Step 2: Install replica:
ipa-replica-install --principal admin --admin-password=... --setup-dns --forwarder=8.8.8.8 --unattended Step 3: Connect clients via Ansible or manually:
dnf install freeipa-client ipa-client-install --domain=corp.example.com --server=ipa01.corp.example.com \
--principal=admin --password=... --mkhomedir --unattendedAfter this, sssd runs on clients, users authenticate via Kerberos, HBAC and sudo rules apply. The entire process of installing two servers and integrating clients takes 2–4 days.
How to configure HBAC and sudo policies
HBAC is an alternative to /etc/sudoers. Create server groups and user groups, then a rule:
ipa hostgroup-add production-servers --desc="Production Linux Servers"
ipa hostgroup-add-member production-servers --hosts=app01.corp.example.com
ipa group-add sre-team
ipa group-add-member sre-team --users=jsmith
ipa hbacrule-add allow-sre-production --servicecat=all
ipa hbacrule-add-host allow-sre-production --hostgroups=production-servers
ipa hbacrule-add-user allow-sre-production --groups=sre-team
ipa hbactest --user=jsmith --host=app01.corp.example.com --service=sshdBy default, the allow_all rule is active—disable it: ipa hbacrule-disable allow_all. Then create explicit rules.
Sudo policies are managed similarly: create sudo commands, command groups, and rules. On the client, sudo contacts FreeIPA via sssd—no manual files. Configuration time for a typical infrastructure of 50 servers is about 3 hours.
How to ensure fault tolerance and backup
For fault tolerance, deploy a FreeIPA replica with multi-master replication. If the primary server fails, clients automatically switch to the replica via DNS SRV records. A minimum of two servers in different data centers is recommended. Backup is performed with the built-in ipa-backup command. Backups are stored in /var/lib/ipa/backup/. It is recommended to back up all servers, especially the primary. Automation of copying can be set up via cron and Ansible.
PKI and two-factor authentication
FreeIPA includes Dogtag PKI. Certificates for internal services are requested via ipa-getcert and automatically renewed by certmonger. This eliminates manual management and reduces the cost of purchasing paid certificates. OTP tokens based on TOTP are added with ipa otptoken-add. The user enters a password plus a code from an app—for SSH, this works via PAM+sssd. Implementing PKI and OTP takes 1–2 days.
Comparison: FreeIPA vs Active Directory
| Criterion | FreeIPA | Active Directory |
|---|---|---|
| Native Linux support | Yes | Requires separate AD bridge |
| HBAC and sudo | Built-in | No direct analogs |
| PKI | Dogtag PKI | Active Directory Certificate Services |
| License | Open source (GPL) | Paid |
| Integration with Ansible | Built-in collection | Via winrm |
FreeIPA is 3 times more cost-effective than Active Directory for Linux-only environments. It integrates more easily with the Linux stack, requires no licenses, and saves up to $15,000 per year for 200 users. For heterogeneous environments, AD may be necessary, but for pure Linux, FreeIPA is more convenient and cheaper.
Work stages and what's included
| Stage | Time |
|---|---|
| Architecture planning and server preparation | 0.5 day |
| Primary server and replica installation | 1–2 days |
| Client connection via Ansible | 1 day |
| Configuration of HBAC, sudo policies, PKI, OTP | 2–3 days |
| Testing, documentation, training | 1 day |
Work includes:
- Architecture design (domain, DNS, replication).
- Deployment of primary and replica, replication setup.
- Integration with existing DNS (if needed).
- Ansible playbooks for client connection.
- Configuration of HBAC and sudo policies according to your structure.
- Certificate issuance via PKI, OTP setup.
- Operations and backup documentation.
- Administrator training (2–3 hours).
Final timeline: 5–8 working days depending on scale. Our certified FreeIPA administrators have over 7 years of experience and have completed 50+ successful deployments, guaranteeing a smooth setup. Contact us to discuss your infrastructure. Get expert consultation on FreeIPA – and forget about manual access management.