{"id":26055,"date":"2024-03-20T03:19:07","date_gmt":"2024-03-20T03:19:07","guid":{"rendered":"https:\/\/green.cloud\/docs\/docs\/greencloud-documents\/linux-operating-systems\/how-to-install-and-configure-freeipa-server-on-ubuntu-20-04\/"},"modified":"2026-01-19T00:45:48","modified_gmt":"2026-01-19T00:45:48","slug":"how-to-install-and-configure-freeipa-server-on-ubuntu-20-04","status":"publish","type":"docs","link":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/","title":{"rendered":"How to install FreeIPA Server on AlmaLinux 9"},"content":{"rendered":"<p>In this article, we discuss in detail the installation and configuration of the FreeIPA Server on the Rocky Linux 9 \/ AlmaLinux 9 system. FreeIPA is a popular and widely used identity management solution useful in managing user authentication, creation and enforcement of policies, identity stores, and authorization policies in a Linux domain. FreeIPA aims at eliminating the overhead for Linux Administrators working in medium to large-scale Linux-powered infrastructures.<\/p>\n<p><strong><em>Some of the advanced features of FreeIPA are:<\/em><\/strong><span id=\"ezoic-pub-ad-placeholder-165\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<ul>\n<li>Support for large groups of Linux machines<\/li>\n<li>Has native integration with Windows Active Directory<\/li>\n<li>Advanced features of Linux operating system environments<\/li>\n<li>Full multi-master replication for higher redundancy and scalability<\/li>\n<li>Provision of extensible management interfaces (Web UI, CLI, XMLRPC, and JSON-RPC API) and Python SDK<\/li>\n<\/ul>\n<h4 class=\"wp-block-heading\"><em><strong>Key Benefits of using FreeIPA:<\/strong><\/em><\/h4>\n<ul>\n<li><strong>Central Authentication Management<\/strong>\u00a0\u2013 Centralized management of users, machines, and services within large Linux\/Unix enterprise environments.<span id=\"ezoic-pub-ad-placeholder-709\" class=\"ezoic-autoinsert-ad\" data-method=\"ai-placeholders\" data-ezoic-video-excluded=\"1\"><\/span><\/li>\n<li><strong>Fine-grained Access Control<\/strong>: Provides a clear method of defining access control policies to govern user identities and delegation of administrative tasks.<\/li>\n<li><strong>One Time Password (OTP)<\/strong>: Provides a popular method for achieving two-factor authentication (2FA).<\/li>\n<li><strong>Direct Connect to Active Directory<\/strong>: You can retrieve information from Active Directory (AD) and join a domain or realm in a standard way.<\/li>\n<li><strong>Active Directory Cross-Realm Trust<\/strong>: As a System Administrator, you can establish cross-forest Kerberos trusts with Microsoft Active Directory. This allows external Active Directory (AD) users convenient access to resources in the Identity Management domain.<\/li>\n<li><strong>Integrated Public Key Infrastructure (PKI) Service<\/strong>: This provides PKI services that sign and publish certificates for hosts and services, Certificate Revocation List (CRL) and OCSP services for software validating the published certificate, and an API to request, show, and find certificates.<\/li>\n<\/ul>\n<p><iframe title=\"How to install and configure the FreeIPA Server on AlmaLinux 9 | VPS Tutorial\" width=\"1170\" height=\"658\" src=\"https:\/\/www.youtube.com\/embed\/1BxYn0rJTWQ?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<h2 class=\"wp-block-heading\">Install FreeIPA Server on Rocky Linux 9 \/ AlmaLinux 9<\/h2>\n<p>Ensure this installation is done on a freshly installed Rocky Linux 9 \/ AlmaLinux 9 system since IPA services ports could conflict with other Linux services.<\/p>\n<h3 class=\"wp-block-heading\">1: Update system, set hostname<\/h3>\n<p>Update your Rocky Linux \/ AlmaLinux 9 server:<span id=\"ezoic-pub-ad-placeholder-173\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<pre class=\"wp-block-code\"><code>dnf -y update\r\nreboot<\/code><\/pre>\n<p>Once rebooted, set the correct system hostname.<\/p>\n<pre class=\"wp-block-code\"><code>hostnamectl set-hostname <mark class=\"has-inline-color has-vivid-cyan-blue-color\">greencloud.example.com<\/mark><\/code><\/pre>\n<div id=\"ez-video-wrap-ez-3998\" class=\"ez-video-wrap\">\n<div class=\"ez-video-center\">\n<div class=\"ez-video-content-wrap\">\n<p>The host name must be a fully qualified domain name, such as<strong>\u00a0ipa.example.com.<\/strong> Once set also configure the system timezone to match your region:<\/p>\n<\/div>\n<\/div>\n<\/div>\n<pre class=\"wp-block-code\"><code>timedatectl set-timezone <mark class=\"has-inline-color has-vivid-purple-color\">Africa\/Nairobi<\/mark><\/code><\/pre>\n<p>Confirm your timezone settings:<\/p>\n<pre class=\"wp-block-code\"><code>$ <mark class=\"has-inline-color has-pale-pink-color\">timedatectl<\/mark><\/code><\/pre>\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" rel=\"follow\" data-wpel-link=\"internal\"><img decoding=\"async\" class=\"wp-image-53816 entered lazyloaded\" src=\"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_1-4.png\" data-lazy-sizes=\"(max-width: 783px) 100vw, 783px\" data-lazy-src=\"\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" data-ll-status=\"loaded\" \/><\/a><br \/>\n2: Check FreeIPA server installation pre-reqs<\/h3>\n<p>Key FreeIPA server components are:<\/p>\n<ul>\n<li><strong>MIT Kerberos KDC<\/strong>\u00a0\u2013 Provides Single-Sign-on authentication solution<\/li>\n<li><strong>389 Directory Server<\/strong>\u00a0\u2013 Main data store and provides a full multi-master LDAPv3 directory infrastructure.<\/li>\n<li><strong>ISC Bind DNS server\u00a0<\/strong>\u2013 Bind is the default Domain name resolution service in FreeIPA.<\/li>\n<li><strong>Dogtag Certificate System<\/strong>\u00a0\u2013 This component provides CA &amp; RA used for certificate management functions.<\/li>\n<li><strong>NTP Server<\/strong> \u2013 For time synchronization across a fleet of nodes joined to the domain<\/li>\n<li><strong>Web UI \/ CLI Interface<\/strong>\u2013 Used to centrally manage access control, the delegation of administrative tasks, and other network administration tasks.<\/li>\n<\/ul>\n<p>Minimum hardware requirements when installing FreeIPA Server on Rocky Linux 9 \/ AlmaLinux 9:<\/p>\n<ul>\n<li><strong>4GB<\/strong>\u00a0RAM<\/li>\n<li><strong>2 vCPUs<\/strong><\/li>\n<li><em>FQDN<\/em> \u2013 It must be resolvable from the DNS server configured in the system<\/li>\n<li>Minimum of\u00a0<strong>10 GB<\/strong>\u00a0Disk space availability<\/li>\n<\/ul>\n<p>Use the commands shared below to check CPU, Memory, and disk space on your Rocky Linux 9 \/ AlmaLinux 9 instance.<\/p>\n<pre class=\"wp-block-code\"><code><em><mark class=\"has-inline-color has-vivid-purple-color\"># CPU Cores\r\n<\/mark><\/em>$ <mark class=\"has-inline-color has-pale-pink-color\">grep -c ^processor \/proc\/cpuinfo<\/mark>\r\n4\r\n\r\n<em><mark class=\"has-inline-color has-vivid-purple-color\"># Memory check\r\n<\/mark><\/em>$ <mark class=\"has-inline-color has-pale-pink-color\">free -h<\/mark>\r\n\r\n<em><mark class=\"has-inline-color has-vivid-purple-color\"># Disk space\r\n<\/mark><\/em>$ lsblk  -fp<\/code><\/pre>\n<p>Add FreeIPA Server IP address and its DNS name inside the\u00a0<code>\/etc\/hosts<\/code>\u00a0file:<\/p>\n<pre class=\"wp-block-code\"><code>$ <mark class=\"has-inline-color has-pale-pink-color\">nano \/etc\/hosts<\/mark>\r\n<mark class=\"has-inline-color has-vivid-cyan-blue-color\">IP_server greencloud.example.com \r\nIP_client green1.example.com<\/mark><\/code><\/pre>\n<p>Validate your IP settings:<\/p>\n<pre class=\"wp-block-code\"><code>$ <mark class=\"has-inline-color has-pale-pink-color\">hostname --ip-address<\/mark><\/code><\/pre>\n<p>Verify the reverse DNS configuration (PTR records) is set correctly in your DNS Server using the <em>dig<\/em>\u00a0command:<span id=\"ezoic-pub-ad-placeholder-169\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<pre class=\"wp-block-code\"><code>$ dig +short -x &lt;ServerIPAddress&gt;<\/code><\/pre>\n<h3 class=\"wp-block-heading\">3: Install and Configure the FreeIPA server<\/h3>\n<p>Next, we install FreeIPA packages on the Rocky Linux 9 \/ AlmaLinux 9 server. No extra RPM repository is required, all the packages and dependencies are available in default OS default repositories.<\/p>\n<p>Install all FreeIPA server and client packages with the following commands:<\/p>\n<pre class=\"wp-block-code\"><code>dnf -y install freeipa-server freeipa-server-dns freeipa-client<\/code><\/pre>\n<h4 class=\"wp-block-heading\">Run the FreeIPA server installer<\/h4>\n<p>FreeIPA server configuration is done using the <code>ipa-server-install<\/code>\u00a0command line tool. The installer script will create a log file at\u00a0<em>\/var\/log\/ipaserver-install.log<\/em>:<span id=\"ezoic-pub-ad-placeholder-186\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<pre class=\"wp-block-code\"><code>ipa-server-install<\/code><\/pre>\n<p>The script prompts for several required settings and offers recommended default values in brackets.<\/p>\n<ul>\n<li>To accept a default value, press\u00a0<strong>Enter<\/strong>.<\/li>\n<li>To provide a custom value, enter the required value.<span id=\"ezoic-pub-ad-placeholder-711\" class=\"ezoic-autoinsert-ad\" data-method=\"ai-placeholders\" data-ezoic-video-excluded=\"1\"><\/span><\/li>\n<\/ul>\n<p>See below for complete prompts you\u2019ll get during installation and expected responses:<\/p>\n<pre class=\"wp-block-code\"><code>$ <mark class=\"has-inline-color has-pale-pink-color\"> ipa-server-install<\/mark>\r\n\r\nThe log file for this installation can be found in \/var\/log\/ipaserver-install.log\r\n==============================================================================\r\nThis program will set up the IPA Server.\r\nVersion 4.10.2\r\n\r\nThis includes:\r\n  * Configure a stand-alone CA (dogtag) for certificate management\r\n  * Configure the NTP client (chronyd)\r\n  * Create and configure an instance of Directory Server\r\n  * Create and configure a Kerberos Key Distribution Center (KDC)\r\n  * Configure Apache (httpd)\r\n  * Configure SID generation\r\n  * Configure the KDC to enable PKINIT\r\n\r\nTo accept the default shown in brackets, press the Enter key.\r\n\r\nDo you want to configure integrated DNS (BIND)? [no]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">press enter<\/mark>\r\n\r\nEnter the fully qualified domain name of the computer\r\non which you're setting up server software. Using the form\r\n&lt;hostname&gt;.&lt;domainname&gt;\r\nExample: master.example.com.\r\n\r\nServer host name [greencloud.example.com]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">press enter<\/mark><mark class=\"has-inline-color has-vivid-purple-color\">\r\n<\/mark>\r\nThe domain name has been determined based on the host name.\r\n\r\nPlease confirm the domain name [example.com]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">press enter<\/mark>\r\n\r\nThe kerberos protocol requires a Realm name to be defined.\r\nThis is typically the domain name converted to uppercase.\r\n\r\nPlease provide a realm name [EXAMPLE.COM]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">press enter<\/mark>\r\nCertain directory server operations require an administrative user.\r\nThis user is referred to as the Directory Manager and has full access\r\nto the Directory for system management tasks and will be added to the\r\ninstance of directory server created for IPA.\r\nThe password must be at least 8 characters long.\r\n\r\nDirectory Manager password: <mark class=\"has-inline-color has-vivid-cyan-blue-color\">&lt;Directory-Manager-Password&gt;<\/mark>\r\nPassword (confirm): <mark class=\"has-inline-color has-vivid-cyan-blue-color\">&lt;Confirm-Directory-Manager-Password&gt;<\/mark>\r\n\r\nThe IPA server requires an administrative user, named 'admin'.\r\nThis user is a regular system account used for IPA server administration.\r\n\r\nIPA admin password:\r\nPassword (confirm):\r\n\r\nDo you want to configure chrony with NTP server or pool address? [no]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">press enter<\/mark>\r\n\r\nThe IPA Master Server will be configured with:\r\nHostname:       <mark class=\"has-inline-color has-vivid-purple-color\">greencloud.example.com<\/mark>\r\nIP address(es): <mark class=\"has-inline-color has-vivid-purple-color\">IP_server<\/mark>\r\nDomain name:   <mark class=\"has-inline-color has-vivid-purple-color\"> example.com<\/mark>\r\nRealm name:     <mark class=\"has-inline-color has-vivid-purple-color\">EXAMPLE.COM<\/mark>\r\n\r\nThe CA will be configured with:\r\nSubject DN:   CN=Certificate Authority,O=EXAMPLE.COM\r\nSubject base: O=EXAMPLE.COM\r\nChaining:     self-signed\r\n\r\nContinue to configure the system with these values? [no]: <mark class=\"has-inline-color has-luminous-vivid-orange-color\">yes<\/mark>\r\n\r\nThe following operations may take some minutes to complete.\r\nPlease wait until the prompt is returned.\r\n\r\nDisabled p11-kit-proxy\r\nSynchronizing time\r\nConfiguration of chrony was changed by installer.\r\nAttempting to sync time with chronyc.\r\nProcess chronyc waitsync failed to sync time!\r\nUnable to sync time with chrony server, assuming the time is in sync. Please check that 123 UDP port is opened, and any time server is on network.\r\nWarning: IPA was unable to sync time with chrony!\r\n         Time synchronization is required for IPA to work correctly\r\nConfiguring directory server (dirsrv). Estimated time: 30 seconds\r\n  [1\/41]: creating directory server instance\r\n  [2\/41]: tune ldbm plugin\r\n.....<\/code><\/pre>\n<p>If your FreeIPA server installation on Rocky Linux 9 \/ AlmaLinux 9 was successful, expect output similar to this:<\/p>\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" rel=\"follow\" data-wpel-link=\"internal\"><img decoding=\"async\" class=\"wp-image-53816 entered lazyloaded\" src=\"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_2-4.png\" data-lazy-sizes=\"(max-width: 783px) 100vw, 783px\" data-lazy-src=\"\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" data-ll-status=\"loaded\" \/><\/a><\/h3>\n<h4 class=\"wp-block-heading\">Open FreeIPA service ports on the firewall<\/h4>\n<p>A list of FreeIPA service ports is as listed in the following table:<\/p>\n<figure class=\"wp-block-image size-large\">\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" rel=\"follow\" data-wpel-link=\"internal\"><img decoding=\"async\" class=\"wp-image-53816 entered lazyloaded\" src=\"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_3-4.png\" data-lazy-sizes=\"(max-width: 783px) 100vw, 783px\" data-lazy-src=\"\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" data-ll-status=\"loaded\" \/><\/a><\/h3>\n<\/figure>\n<p>Let\u2019s open the ports on the firewall using\u00a0<code>firewall-cmd<\/code>:<\/p>\n<pre class=\"wp-block-code\"><code>firewall-cmd --add-service={dns,ntp,freeipa-ldap,freeipa-ldaps} --permanent\r\nfirewall-cmd --add-port={80,443,389,636,88,46,53}\/tcp --permanent\r\nfirewall-cmd --add-port={88,464,123}\/udp --permanent<\/code><\/pre>\n<p>Then reload firewall configuration for the change to take effect immediately:<\/p>\n<pre class=\"wp-block-code\"><code>firewall-cmd --reload<\/code><\/pre>\n<p>List allowed services on the firewall:<\/p>\n<pre class=\"wp-block-code\"><code>$ <mark class=\"has-inline-color has-pale-pink-color\">[root@ipa ~]# firewall-cmd --list-all<\/mark>\r\npublic \r\n  target: default\r\n  icmp-block-inversion: no\r\n  interfaces: \r\n  sources:\r\n  services: cockpit dhcpv6-client <em><mark class=\"has-inline-color has-vivid-purple-color\">dns freeipa-ldap freeipa-ldaps ntp<\/mark><\/em> ssh\r\n  ....<\/code><\/pre>\n<h3 class=\"wp-block-heading\">4: Access FreeIPA Management Dashboard<\/h3>\n<p>After installation, the FreeIPA Server web-based administration console can be accessed using the server hostname on https:<\/p>\n<pre class=\"wp-block-code\"><code>https:\/\/<em>greencloud.example.com<\/em><\/code><\/pre>\n<p>Ignore the SSL warning by clicking \u201c<strong>Advanced<\/strong>\u201d &gt; \u201c<strong>Proceed to ipa.example.com (unsafe)<\/strong>\u201c<span id=\"ezoic-pub-ad-placeholder-188\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<p>Login with the admin username and password set during installation.<\/p>\n<figure class=\"wp-block-image size-large\">\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" rel=\"follow\" data-wpel-link=\"internal\"><img decoding=\"async\" class=\"wp-image-53816 entered lazyloaded\" src=\"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_4-5.png\" data-lazy-sizes=\"(max-width: 783px) 100vw, 783px\" data-lazy-src=\"\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" data-ll-status=\"loaded\" \/><\/a><\/h3>\n<\/figure>\n<p>Upon successful login you\u2019re presented with an interface that has such the look:<\/p>\n<figure class=\"wp-block-image size-large\">\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" rel=\"follow\" data-wpel-link=\"internal\"><img decoding=\"async\" class=\"wp-image-53816 entered lazyloaded\" src=\"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_5-3.png\" data-lazy-sizes=\"(max-width: 783px) 100vw, 783px\" data-lazy-src=\"\/tutorials\/wp-content\/uploads\/sites\/2\/2019\/02\/The-package-and-list-of-dependencies-of-the-NetworkManager-tui.webp\" data-ll-status=\"loaded\" \/><\/a><\/h3>\n<\/figure>\n<h3 class=\"wp-block-heading\">5: Manage FreeIPA using the CLI Interface<\/h3>\n<p>The\u00a0<strong><em>ipa<\/em><\/strong> command can be used to perform all FreeIPA server operations. But first, get the admin user Kerberos ticket:<\/p>\n<pre class=\"wp-block-code\"><code>$<mark class=\"has-inline-color has-pale-pink-color\"> kinit admin<\/mark>\r\nPassword for admin@EXAMPLE.COM:<\/code><\/pre>\n<p>The time validity of the assigned ticket can be checked using <code>klist<\/code>:<\/p>\n<pre class=\"wp-block-code\"><code>$<mark class=\"has-inline-color has-pale-pink-color\"> klist<\/mark>\r\nTicket cache: KCM:0\r\nDefault principal: admin@EXAMPLE.COM\r\n\r\nValid starting       Expires                    Service principal\r\n03\/22\/24 05:10:14    03\/23\/24 04:27:26          krbtgt\/EXAMPLE.COM@EXAMPLE.COM<\/code><\/pre>\n<div id=\"ez-video-wrap-ez-3998\" class=\"ez-video-wrap\">\n<div class=\"ez-video-center\">\n<div class=\"ez-video-content-wrap\">\n<div id=\"floating-placeholder-ez-3998\" class=\"floating-placeholder\">This is what PROGRAMMING is | What is programming | Programming Tips<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Set the user\u2019s default shell to <code>\/bin\/bash<\/code>.<span id=\"ezoic-pub-ad-placeholder-189\" class=\"ezoic-adpicker-ad\" data-ezoic-video-excluded=\"1\"><\/span><\/p>\n<pre class=\"wp-block-code\"><code>$<mark class=\"has-inline-color has-pale-pink-color\"> ipa config-mod --defaultshell=\/bin\/bash <\/mark>\r\n   Maximum username length: 32\r\n   Home directory base: \/home\r\n   Default shell: <strong>\/bin\/bash<\/strong>\r\n   Default users group: ipausers\r\n   Default e-mail domain: example.com\r\n   Search time limit: 2\r\n   Search size limit: 100\r\n   User search fields: uid,givenname,sn,telephonenumber,ou,title\r\n   Group search fields: cn,description\r\n   Enable migration mode: FALSE\r\n   Certificate Subject base: O=EXAMPLE.COM\r\n   Password Expiration Notification (days): 4\r\n   Password plugin features: AllowNThash, KDC:Disable Last Success\r\n   SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023\r\n   Default SELinux user: unconfined_u:s0-s0:c0.c1023\r\n   Default PAC types: MS-PAC, nfs:NONE\r\n   IPA masters: greencloud.example.com\r\n   IPA CA servers: greencloud.example.com\r\n   IPA CA renewal master: greencloud.example.com\r\n   IPA master capable of PKINIT: greencloud.example.com<\/code><\/pre>\n<p>Test by adding a user account and listing accounts present:<\/p>\n<pre class=\"wp-block-code\"><code>$<mark class=\"has-inline-color has-pale-pink-color\"> ipa user-add test  --first=Test --last=User --email=test@example.com --password<\/mark>\r\n\r\nPassword: \r\nEnter Password again to verify: \r\n-------------------\r\n Added user \"test\"\r\n-------------------\r\n   User login: test\r\n   First name: Test\r\n   Last name: User\r\n   Full name: Test User\r\n   Display name: Test User\r\n   Initials: TU\r\n   Home directory: \/home\/test\r\n   GECOS: Test User\r\n   Login shell: \/bin\/bash\r\n   Principal name: test@EXAMPLE.COM\r\n   Principal alias: test@EXAMPLE.COM\r\n   User password expiration: 20210802153038Z\r\n   Email address: test@example.com\r\n   UID: 933400003\r\n   GID: 933400003\r\n   Password: True\r\n   Member of groups: ipausers\r\n   Kerberos keys available: True<\/code><\/pre>\n<p>To list user accounts added, run:<\/p>\n<pre class=\"wp-block-code\"><code>$<mark class=\"has-inline-color has-pale-pink-color\"> ipa user-find<\/mark>\r\n---------------\r\n2 users matched\r\n---------------\r\n  User login: admin\r\n  Last name: Administrator\r\n  Home directory: \/home\/admin\r\n  Login shell: \/bin\/bash\r\n  Principal alias: admin@EXAMPLE.COM\r\n  UID: 1201400000\r\n  GID: 1201400000\r\n  Account disabled: False\r\n\r\n  User login: test\r\n  First name: Test\r\n  Last name: User\r\n  Home directory: \/home\/test\r\n  Login shell: \/bin\/bash\r\n  Principal name: test@EXAMPLE.COM\r\n  Principal alias: test@EXAMPLE.COM\r\n  Email address: test@example.com\r\n  UID: 1201400001\r\n  GID: 1201400001\r\n  Account disabled: False\r\n----------------------------\r\nNumber of entries returned 2\r\n----------------------------<\/code><\/pre>\n<h3 class=\"wp-block-heading\"><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>In this article, we discuss in detail the installation and configuration of the FreeIPA Server on the Rocky Linux 9 \/ AlmaLinux 9 system. FreeIPA is a popular and widely used identity management solution useful in managing user authentication, creation and enforcement of policies, identity stores, and authorization policies in a Linux domain. FreeIPA aims [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":0,"parent":17817,"menu_order":553,"comment_status":"closed","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-26055","docs","type-docs","status-publish","hentry","no-post-thumbnail"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation\" \/>\n<meta property=\"og:description\" content=\"In this article, we discuss in detail the installation and configuration of the FreeIPA Server on the Rocky Linux 9 \/ AlmaLinux 9 system. FreeIPA is a popular and widely used identity management solution useful in managing user authentication, creation and enforcement of policies, identity stores, and authorization policies in a Linux domain. FreeIPA aims [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/\" \/>\n<meta property=\"og:site_name\" content=\"GreenCloud Documentation\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-19T00:45:48+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/\",\"url\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/\",\"name\":\"How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/green.cloud\\\/docs\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/Screenshot_1-4.png\",\"datePublished\":\"2024-03-20T03:19:07+00:00\",\"dateModified\":\"2026-01-19T00:45:48+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/how-to-install-freeipa-server-on-almalinux-9\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/green.cloud\\\/docs\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GreenCloud Documents\",\"item\":\"https:\\\/\\\/green.cloud\\\/docs\\\/docs\\\/greencloud-documents\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Linux Operating Systems\",\"item\":\"https:\\\/\\\/green.cloud\\\/docs\\\/linux-operating-systems\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"How to install FreeIPA Server on AlmaLinux 9\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/green.cloud\\\/docs\\\/#website\",\"url\":\"https:\\\/\\\/green.cloud\\\/docs\\\/\",\"name\":\"GreenCloud Documentation\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/green.cloud\\\/docs\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/","og_locale":"en_US","og_type":"article","og_title":"How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation","og_description":"In this article, we discuss in detail the installation and configuration of the FreeIPA Server on the Rocky Linux 9 \/ AlmaLinux 9 system. FreeIPA is a popular and widely used identity management solution useful in managing user authentication, creation and enforcement of policies, identity stores, and authorization policies in a Linux domain. FreeIPA aims [&hellip;]","og_url":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/","og_site_name":"GreenCloud Documentation","article_modified_time":"2026-01-19T00:45:48+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/","url":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/","name":"How to install FreeIPA Server on AlmaLinux 9 - GreenCloud Documentation","isPartOf":{"@id":"https:\/\/green.cloud\/docs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/#primaryimage"},"image":{"@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/#primaryimage"},"thumbnailUrl":"https:\/\/green.cloud\/docs\/wp-content\/uploads\/2024\/03\/Screenshot_1-4.png","datePublished":"2024-03-20T03:19:07+00:00","dateModified":"2026-01-19T00:45:48+00:00","breadcrumb":{"@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/green.cloud\/docs\/how-to-install-freeipa-server-on-almalinux-9\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/green.cloud\/docs\/"},{"@type":"ListItem","position":2,"name":"GreenCloud Documents","item":"https:\/\/green.cloud\/docs\/docs\/greencloud-documents\/"},{"@type":"ListItem","position":3,"name":"Linux Operating Systems","item":"https:\/\/green.cloud\/docs\/linux-operating-systems\/"},{"@type":"ListItem","position":4,"name":"How to install FreeIPA Server on AlmaLinux 9"}]},{"@type":"WebSite","@id":"https:\/\/green.cloud\/docs\/#website","url":"https:\/\/green.cloud\/docs\/","name":"GreenCloud Documentation","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/green.cloud\/docs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/docs\/26055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/comments?post=26055"}],"version-history":[{"count":22,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/docs\/26055\/revisions"}],"predecessor-version":[{"id":27307,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/docs\/26055\/revisions\/27307"}],"up":[{"embeddable":true,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/docs\/17817"}],"wp:attachment":[{"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/media?parent=26055"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/green.cloud\/docs\/wp-json\/wp\/v2\/doc_tag?post=26055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}