How to Install and Setup FreeIPA Identity Management Cluster on CentOS 7

Managing user authentication, sudo rules, and host-based access control across hundreds of Linux servers without a centralized directory is a major security and operational bottleneck. FreeIPA (Identity, Policy, Audit) solves this by bundling Red Hat Directory Server (LDAP), MIT Kerberos, Dogtag Certificate System, and BIND DNS into a unified identity management platform.

In this guide, I will walk you through deploying a complete, enterprise-grade multi-master FreeIPA cluster across two data centers (west-dc1 and east-dc1) on CentOS 7, establishing DNS forwarders, managing entropy via rngd, and enrolling client machines.

Prerequisites

You will need four clean CentOS 7 virtual machines with root access, distributed across two distinct network zones.

Cluster Node Inventory

---

Step 1: System Preparation and Entropy Management

Setting up FreeIPA requires substantial entropy for cryptographic key generation. By default, virtual machines exhaust available entropy quickly, which can stall the installation. We will install rngd, a software random number generator daemon, alongside necessary system utilities.

Execute the following on all four nodes:

# Update system and install base utilities
yum update -y
yum install epel-release -y
yum install -y wget mlocate telnet rng-tools tcpdump bind-utils ntp
updatedb

# Enable and start RNG daemon
systemctl enable rngd
systemctl start rngd
systemctl status rngd

Disable SELinux and Conflicting Services

FreeIPA manages its own firewall configurations and NTP services during setup. Disable SELinux, firewalld, and chronyd:

# Disable SELinux
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

# Stop and disable firewalld and chronyd
systemctl stop firewalld && systemctl disable firewalld
systemctl stop chronyd && systemctl disable chronyd

Reboot all virtual machines to apply the baseline configuration:

reboot

---

Step 2: Configure Host Resolution

FreeIPA relies heavily on precise DNS and FQDN resolution. Before installing the server packages, update /etc/hosts on all four nodes:

cat >> /etc/hosts << "EOF"
10.112.7.216 east-dc1-ipa1.induslevel.com
10.112.7.219 east-dc1-ipa2.induslevel.com
10.110.7.216 west-dc1-ipa1.induslevel.com
10.110.7.219 west-dc1-ipa2.induslevel.com
EOF

---

Step 3: Install Primary Master (east-dc1-ipa1)

We begin by establishing the primary root CA and Directory Server instance on east-dc1-ipa1.

Install the FreeIPA server packages:

yum install -y ipa-server ipa-server-dns

Execute the master installation script, enabling integrated BIND DNS:

ipa-server-install --setup-dns

Installation Prompts Summary

• Server host name: east-dc1-ipa1.induslevel.com
• Domain name: induslevel.com
• Realm name: INDUSLEVEL.COM
• Directory Manager password: Provide a strong secret (e.g., Randompassword)
• IPA admin password: Provide a strong secret (e.g., Randompassword)
• Configure DNS forwarders?: yes (enter upstream DNS like 8.8.8.8)

The installation wizard will configure Dogtag CA, Directory Server, Apache web interface, KDC, and BIND DNS. Once completed, verify Kerberos authentication:

kinit admin
ipa user-find admin

---

Step 4: Deploy Replicas across Data Centers

To ensure high availability, we will join the remaining three nodes (east-dc1-ipa2, west-dc1-ipa1, and west-dc1-ipa2) to the primary master as fully functional multi-master replicas.

Execute the following sequence on each replica server:

1. Point DNS to Primary Master

cat > /etc/resolv.conf << "EOF"
# Generated by NetworkManager
search induslevel.com
nameserver 10.112.7.216
nameserver 8.8.8.8
EOF

2. Install Client and Enroll in Hostgroup

yum install -y ipa-client ipa-server ipa-server-dns

ipa-client-install --domain=induslevel.com --realm=INDUSLEVEL.COM --server=east-dc1-ipa1.induslevel.com

Authenticate as administrative user and add the host to the ipaservers group:

kinit admin
ipa hostgroup-add-member ipaservers --hosts west-dc1-ipa1.induslevel.com

3. Promote to Replica Master

Execute the replica promotion command to synchronize directory data, CA certificates, and DNS records:

ipa-replica-install --setup-dns --setup-ca --forwarder=8.8.8.8 --forwarder=8.8.4.4

Once promoted, update the local interface to use the localhost DNS server, and reboot:

nmcli connection modify ens192 ipv4.dns 127.0.0.1
reboot

---

Step 5: Firewall Hardening

If you choose to re-enable firewalld or use external hardware firewalls, ensure the following critical ports are open between all cluster nodes and client subnets:

• TCP Ports: 80, 443 (HTTP/HTTPS), 389, 636 (LDAP/LDAPS), 88, 464 (Kerberos), 53 (DNS)
• UDP Ports: 88, 464 (Kerberos), 53 (DNS), 123 (NTP)

firewall-cmd --permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,464/tcp,53/tcp,88/udp,464/udp,53/udp,123/udp}
firewall-cmd --reload

---

Step 6: Accessing the Web Interface and Client Enrollment

To access the FreeIPA web UI from a workstation, add an entry to your local hosts file pointing to any of the master nodes:

10.112.7.216 freeipa.induslevel.com

Navigate to https://freeipa.induslevel.com/ipa/ui/ and log in using your admin credentials.

Enrolling Linux Clients

To authenticate standard Linux servers against your new FreeIPA cluster, simply install the client package and run the enrollment script:

yum install -y ipa-client

ipa-client-install --domain=induslevel.com --realm=INDUSLEVEL.COM --server=east-dc1-ipa1.induslevel.com --enable-dns-updates --mkhomedir

Your enterprise FreeIPA identity management architecture is now fully distributed, highly available, and ready to manage thousands of users and hosts!

References

• Red Hat IdM Installation and Deployment Guide
• DigitalOcean FreeIPA Authentication Guide