This guide shows how to install and configure a FreeIPA client so Linux hosts authenticate users centrally with Kerberos, LDAP and SSSD. It covers Ubuntu and Debian (apt) and Rocky Linux, AlmaLinux, RHEL and Fedora (dnf). Only the package install differs; enrollment and everything after it is the same on every distro.
Quick answer. Install the client package, then enroll the host:
# Ubuntu / Debian
sudo apt install -y freeipa-client
# Rocky Linux / AlmaLinux / RHEL 9 and 10
sudo dnf install -y ipa-client
# Rocky Linux / AlmaLinux / RHEL 8
sudo dnf module -y install idm:DL1/client
# Fedora
sudo dnf install -y freeipa-client
sudo ipa-client-install --mkhomedir --server=ipa.citizix.com --domain=ipa.citizix.com
FreeIPA provides centralized identity, policy and access management. After enrolling a client, user and group information comes from the FreeIPA server, and admins can manage access from one place. When you run an ipa management command on the client, it is sent to the server and executed there.
The package names and install commands were checked on Ubuntu 24.04 and 26.04, Debian 13, Rocky Linux 8.10, 9.8 and 10.2, AlmaLinux 10.2 and Fedora 45, which ship FreeIPA client 4.9 (EL 8) and 4.11 to 4.13. Ubuntu 20.04 and 22.04 still carry freeipa-client (4.8 and 4.9) and follow the same steps, but they are past standard support, so use a current LTS for new hosts.
Related Content
- How to Install and Configure FreeIPA on Rocky Linux/CentOS
- How to Manage Users and Groups in FreeIPA Server
- How to Configure FreeIPA Replication on Rocky Linux/Alma Linux
Prerequisites
Before you begin, ensure you have:
- A supported client: Ubuntu 24.04 or 26.04, Debian 13, Rocky Linux or AlmaLinux 8, 9 or 10, RHEL 8, 9 or 10, or a current Fedora release
- A reachable FreeIPA server (see the server guide above)
- A user with
sudoprivileges - Working DNS resolution for the IPA server and client hostname (recommended)
- Time synchronization working on both client and IPA server (critical for Kerberos)
1. Prepare Hostname, DNS, and Time
Set hostname
Set a fully qualified domain name (FQDN) for the client:
sudo hostnamectl set-hostname ipa-client.citizix.com
Ensure name resolution
DNS is preferred. If DNS is unavailable, append static entries to /etc/hosts (use tee -a; plain tee overwrites the file):
echo "10.2.40.149 ipa.citizix.com" | sudo tee -a /etc/hosts
echo "10.2.40.70 ipa-client.citizix.com" | sudo tee -a /etc/hosts
Validate time sync
Kerberos depends on accurate time. Check NTP status:
timedatectl status
If needed, set timezone:
sudo timedatectl set-timezone Africa/Nairobi
2. Install the FreeIPA Client Package
Ubuntu and Debian
Update the system and install the client from the distro repos (on Ubuntu it is in universe):
sudo apt update
sudo apt upgrade -y
sudo apt install -y freeipa-client
If prompted for a Kerberos realm during package install, you can leave it empty and continue. ipa-client-install writes the Kerberos configuration later.
Verify installation:
apt-cache policy freeipa-client
Rocky Linux, AlmaLinux and RHEL 9 and 10
On EL 9 and 10 the client is a regular package in AppStream, so there is no idm module to enable:
sudo dnf upgrade --refresh -y
sudo dnf install -y ipa-client
Confirm the install:
rpm -q ipa-client
Rocky Linux, AlmaLinux and RHEL 8
EL 8 (supported until 2029) ships the client in the idm module. Install the DL1 stream’s client profile, the same stream the FreeIPA server uses on EL 8:
sudo dnf upgrade --refresh -y
sudo dnf module -y install idm:DL1/client
rpm -q ipa-client
Fedora
Fedora ships the same client under the upstream name freeipa-client:
sudo dnf upgrade --refresh -y
sudo dnf install -y freeipa-client
rpm -q freeipa-client
| Distro | Package | Install command |
|---|---|---|
| Ubuntu, Debian | freeipa-client | sudo apt install -y freeipa-client |
| Rocky, Alma, RHEL 9 and 10 | ipa-client | sudo dnf install -y ipa-client |
| Fedora | freeipa-client | sudo dnf install -y freeipa-client |
3. Enroll the Client into FreeIPA
Run interactive enrollment, specifying the FreeIPA server and domain:
sudo ipa-client-install --server=ipa.citizix.com --domain=ipa.citizix.com
Or pass the hostname, realm and home directory creation explicitly:
sudo ipa-client-install \
--hostname=ipa-client.citizix.com \
--mkhomedir \
--server=ipa.citizix.com \
--domain=ipa.citizix.com \
--realm=IPA.CITIZIX.COM
The installer asks you to confirm the values and for the password of a user allowed to enroll hosts (admin). This is my output; you should see something similar:
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Do you want to configure chrony with NTP server or pool address? [no]: no
Client hostname: ipa-client.citizix.com
Realm: IPA.CITIZIX.COM
DNS Domain: ipa.citizix.com
IPA Server: ipa.citizix.com
BaseDN: dc=ipa,dc=citizix,dc=com
Continue to configure the system with these values? [no]: yes
Synchronizing time
...
User authorized to enroll computers: admin
Password for [email protected]:
Successfully retrieved CA cert
...
Enrolled in IPA realm IPA.CITIZIX.COM
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.CITIZIX.COM
...
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config.d/04-ipa.conf
Client configuration complete.
The ipa-client-install command was successful
The “Autodiscovery” prompt appears because --server was given. With working DNS SRV records for the IPA domain you can drop --server and --domain and let the installer discover them.
4. Enable Home Directory Creation on First Login
--mkhomedir already enables this. If you enrolled without it, turn it on afterwards.
On Ubuntu and Debian, the mkhomedir PAM profile ships with the system; enable it:
sudo pam-auth-update --enable mkhomedir
On Rocky, Alma, RHEL and Fedora, enable the authselect feature and the oddjobd service that creates the directories:
sudo authselect enable-feature with-mkhomedir
sudo systemctl enable --now oddjobd
5. Test FreeIPA Login and Identity Resolution
Confirm identity lookup
getent passwd [email protected]
id [email protected]
Test SSH login with an IPA user
If it’s the first time the user logs in, you should see a password change prompt, depending on policy. Otherwise you get a shell:
$ ssh [email protected]
([email protected]) Password:
[etowett@ipa-client ~]$
6. Use the FreeIPA ipa CLI from the Client
You can administer the FreeIPA server from any enrolled client with the ipa command line tool. First, obtain a Kerberos ticket:
$ kinit admin
Password for [email protected]:
Check ticket expiry information with klist:
$ klist
Ticket cache: KCM:1000
Default principal: [email protected]
Valid starting Expires Service principal
11/12/2021 21:27:59 11/13/2021 21:27:47 krbtgt/[email protected]
Test by adding a user account. Run ipa as the user who ran kinit, not with sudo: root has its own ticket cache and would not see your ticket.
$ ipa user-add kip \
--first=Kipkoech \
--last=Towett \
--email=[email protected] \
--password
Password:
Enter Password again to verify:
----------------
Added user "kip"
----------------
User login: kip
First name: Kipkoech
Last name: Towett
Full name: Kipkoech Towett
Home directory: /home/kip
Login shell: /bin/bash
Principal name: [email protected]
Email address: [email protected]
UID: 1063800003
GID: 1063800003
Password: True
Member of groups: ipausers
Kerberos keys available: True
Verify:
$ ipa user-find kip
--------------
1 user matched
--------------
User login: kip
First name: Kipkoech
Last name: Towett
Home directory: /home/kip
Login shell: /bin/bash
Principal name: [email protected]
Email address: [email protected]
UID: 1063800003
GID: 1063800003
Account disabled: False
----------------------------
Number of entries returned 1
----------------------------
7. Enable Passwordless SSH with FreeIPA User Keys
To log in to enrolled hosts without a password, store your public key in FreeIPA:
- Copy your public key (for example
~/.ssh/id_ed25519.pub). - In the FreeIPA Web UI, open the user profile.
- Click Add under SSH public keys, paste the key and save.
Or from the CLI, after kinit:
ipa user-mod etowett --sshpubkey="$(cat ~/.ssh/id_ed25519.pub)"
ipa-client-install configures sshd to look up user keys through SSSD, so the key works on every enrolled host.
8. Troubleshooting Common FreeIPA Client Issues
Cannot resolve IPA server
- Check DNS:
dig ipa.citizix.com +short - Verify
/etc/hostsfallback entries if DNS is unavailable
Kerberos errors (clock skew)
- Verify time sync on client and server
- Check
timedatectl status
SSSD not working
- Check service status:
sudo systemctl status sssd
- Inspect logs:
sudo journalctl -u sssd -n 100 --no-pager
Enrollment fails
- Confirm hostname is FQDN
- Confirm realm/domain values are correct
- Check connectivity to IPA ports (LDAP/Kerberos/HTTPS)
9. Remove the FreeIPA Client
To unenroll the host and restore the local configuration, on any distro:
sudo ipa-client-install --uninstall
Then remove the packages if you no longer need them:
# Ubuntu / Debian
sudo apt remove --purge -y freeipa-client
sudo apt autoremove -y
# Rocky / Alma / RHEL
sudo dnf remove -y ipa-client
# Fedora
sudo dnf remove -y freeipa-client
To remove the host entry from the server as well, run ipa host-del ipa-client.citizix.com from a machine with an admin ticket.
Summary
You now have a FreeIPA client enrolled on Ubuntu, Debian, Rocky Linux, AlmaLinux or Fedora, with centralized identity lookup, Kerberos authentication, home directories created on first login, and IPA CLI administration from the client node. The steps after the package install are the same on every distro.
For production, prioritize reliable DNS, NTP synchronization, and periodic validation of SSSD/Kerberos health across all enrolled hosts.