How to Install and Configure FreeIPA Client on Ubuntu 20.04

This guide shows how to install and configure a FreeIPA client on Ubuntu 20.04 so Linux hosts can authenticate users centrally with Kerberos, LDAP, and SSSD.

FreeIPA provides centralized identity, policy, and access management. After enrolling a client, user and group information comes from the FreeIPA server, and admins can manage access from one place.

Prerequisites

Before you begin, ensure you have:

Ubuntu 20.04 server or workstation
A reachable FreeIPA server
A user with sudo privileges
Working DNS resolution for the IPA server and client hostname (recommended)
Time synchronization working on both client and IPA server (critical for Kerberos)

1. Update Ubuntu Packages

1
2
sudo apt update
sudo apt upgrade -y

2. Install FreeIPA Client Package

Install the client from Ubuntu repositories:

1
sudo apt install -y freeipa-client

If prompted for Kerberos realm during package install, you can skip and continue. We will configure with ipa-client-install.

Verify installation:

1
apt-cache policy freeipa-client

3. Prepare Hostname, DNS, and Time

Set hostname

Set a fully qualified domain name (FQDN) for the client:

1
sudo hostnamectl set-hostname ubuntu-client.citizix.com

Ensure name resolution

DNS is preferred. If DNS is unavailable, add static entries in /etc/hosts:

1
sudo vim /etc/hosts

Example entries:

1
2
10.2.40.149 ipa.citizix.com
10.2.40.70 ubuntu-client.citizix.com

Validate time sync

Kerberos depends on accurate time. Check NTP status:

1
timedatectl status

If needed, set timezone:

1
sudo timedatectl set-timezone Africa/Nairobi

4. Enroll Ubuntu Client into FreeIPA

Run interactive enrollment:

1
sudo ipa-client-install --server=ipa.citizix.com --domain=ipa.citizix.com

Or run with explicit values and home directory creation:

1
2
3
4
5
6
sudo ipa-client-install \
  --hostname=ubuntu-client.citizix.com \
  --mkhomedir \
  --server=ipa.citizix.com \
  --domain=ipa.citizix.com \
  --realm=IPA.CITIZIX.COM

If enrollment succeeds, you should see output ending with:

SSSD enabled
Client configuration complete.
The ipa-client-install command was successful

If --mkhomedir was not used or you want to ensure it is enabled, configure PAM:

1
2
3
4
5
6
7
8
sudo bash -c 'cat > /usr/share/pam-configs/mkhomedir' <<'EOF'
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF

Then apply PAM settings:

1
sudo pam-auth-update

Ensure activate mkhomedir is selected.

Confirm identity lookup

1
2
getent passwd [email protected]
id [email protected]

`1`	`ssh [email protected]`

On first login, users may be prompted to change password depending on policy.

7. Use FreeIPA CLI from the Client

Obtain a Kerberos ticket:

1
kinit admin

Check ticket details:

1
klist

Test IPA operations from the client, for example adding a user:

1
2
3
4
5
sudo ipa user-add kip \
  --first=Kipkoech \
  --last=Towett \
  --email=[email protected] \
  --password

Verify:

1
ipa user-find kip

8. Enable Passwordless SSH with FreeIPA User Keys

To allow SSH key authentication for IPA users:

Copy your public key (for example ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub).
In FreeIPA Web UI, open the user profile.
Under SSH public keys, add and save the key.
Ensure the target host trusts IPA/SSSD-based SSH key lookup (configured by ipa-client-install).

9. Troubleshooting Common FreeIPA Client Issues

Cannot resolve IPA server

Check DNS: dig ipa.citizix.com +short
Verify /etc/hosts fallback entries if DNS is unavailable

Kerberos errors (clock skew)

Verify time sync on client and server
Check timedatectl status

SSSD not working

Check service status:

1
sudo systemctl status sssd

Inspect logs:

1
sudo journalctl -u sssd -n 100 --no-pager

Enrollment fails

Confirm hostname is FQDN
Confirm realm/domain values are correct
Check connectivity to IPA ports (LDAP/Kerberos/HTTPS)

10. Remove FreeIPA Client from Ubuntu 20.04

To unenroll and clean local FreeIPA client configuration:

1
sudo ipa-client-install --uninstall

You can also disable/remove residual packages if needed:

1
2
sudo apt remove --purge -y freeipa-client sssd
sudo apt autoremove -y

Summary

You now have a fully configured FreeIPA client on Ubuntu 20.04 with centralized identity lookup, Kerberos authentication, optional automatic home directory creation, and IPA CLI administration from the client node.

For production, prioritize reliable DNS, NTP synchronization, and periodic validation of SSSD/Kerberos health across all enrolled hosts.