This guide shows how to install and configure a FreeIPA client on Ubuntu 20.04 so Linux hosts can authenticate users centrally with Kerberos, LDAP, and SSSD.

FreeIPA provides centralized identity, policy, and access management. After enrolling a client, user and group information comes from the FreeIPA server, and admins can manage access from one place.

Related Content

• How to Manage Users and Groups in FreeIPA Server
• How to Install FreeIPA Client on Rocky Linux/AlmaLinux/CentOS
• How to Install and Configure FreeIPA on Rocky Linux/CentOS
• How to Install FreeIPA Client on Fedora

Prerequisites

Before you begin, ensure you have:

• Ubuntu 20.04 server or workstation
• A reachable FreeIPA server
• A user with sudo privileges
• Working DNS resolution for the IPA server and client hostname (recommended)
• Time synchronization working on both client and IPA server (critical for Kerberos)

1. Update Ubuntu Packages

sudo apt update
sudo apt upgrade -y

2. Install FreeIPA Client Package

Install the client from Ubuntu repositories:

sudo apt install -y freeipa-client

If prompted for Kerberos realm during package install, you can skip and continue. We will configure with ipa-client-install.

Verify installation:

apt-cache policy freeipa-client

3. Prepare Hostname, DNS, and Time

Set hostname

Set a fully qualified domain name (FQDN) for the client:

sudo hostnamectl set-hostname ubuntu-client.citizix.com

Ensure name resolution

DNS is preferred. If DNS is unavailable, add static entries in /etc/hosts:

sudo vim /etc/hosts

Example entries:

10.2.40.149 ipa.citizix.com
10.2.40.70 ubuntu-client.citizix.com

Validate time sync

Kerberos depends on accurate time. Check NTP status:

timedatectl status

If needed, set timezone:

sudo timedatectl set-timezone Africa/Nairobi

4. Enroll Ubuntu Client into FreeIPA

Run interactive enrollment:

sudo ipa-client-install --server=ipa.citizix.com --domain=ipa.citizix.com

Or run with explicit values and home directory creation:

sudo ipa-client-install \
  --hostname=ubuntu-client.citizix.com \
  --mkhomedir \
  --server=ipa.citizix.com \
  --domain=ipa.citizix.com \
  --realm=IPA.CITIZIX.COM

If enrollment succeeds, you should see output ending with:

• SSSD enabled
• Client configuration complete.
• The ipa-client-install command was successful

5. Enable Home Directory Creation on First Login

If --mkhomedir was not used or you want to ensure it is enabled, configure PAM:

sudo bash -c 'cat > /usr/share/pam-configs/mkhomedir' <<'EOF'
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0022 skel=/etc/skel
EOF

Then apply PAM settings:

sudo pam-auth-update

Ensure activate mkhomedir is selected.

6. Test FreeIPA Login and Identity Resolution

Confirm identity lookup

getent passwd [email protected]
id [email protected]

Test SSH login with an IPA user

ssh [email protected]

On first login, users may be prompted to change password depending on policy.

7. Use FreeIPA CLI from the Client

Obtain a Kerberos ticket:

kinit admin

Check ticket details:

klist

Test IPA operations from the client, for example adding a user:

sudo ipa user-add kip \
  --first=Kipkoech \
  --last=Towett \
  --email=[email protected] \
  --password

Verify:

ipa user-find kip

8. Enable Passwordless SSH with FreeIPA User Keys

To allow SSH key authentication for IPA users:

1. Copy your public key (for example ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub).
2. In FreeIPA Web UI, open the user profile.
3. Under SSH public keys, add and save the key.
4. Ensure the target host trusts IPA/SSSD-based SSH key lookup (configured by ipa-client-install).

9. Troubleshooting Common FreeIPA Client Issues

Cannot resolve IPA server

• Check DNS: dig ipa.citizix.com +short
• Verify /etc/hosts fallback entries if DNS is unavailable

Kerberos errors (clock skew)

• Verify time sync on client and server
• Check timedatectl status

SSSD not working

• Check service status:

sudo systemctl status sssd

• Inspect logs:

sudo journalctl -u sssd -n 100 --no-pager

Enrollment fails

• Confirm hostname is FQDN
• Confirm realm/domain values are correct
• Check connectivity to IPA ports (LDAP/Kerberos/HTTPS)

10. Remove FreeIPA Client from Ubuntu 20.04

To unenroll and clean local FreeIPA client configuration:

sudo ipa-client-install --uninstall

You can also disable/remove residual packages if needed:

sudo apt remove --purge -y freeipa-client sssd
sudo apt autoremove -y

Summary

You now have a fully configured FreeIPA client on Ubuntu 20.04 with centralized identity lookup, Kerberos authentication, optional automatic home directory creation, and IPA CLI administration from the client node.

For production, prioritize reliable DNS, NTP synchronization, and periodic validation of SSSD/Kerberos health across all enrolled hosts.