Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
CentOS 7 is end of life. FreeIPA provides central users, groups, sudo rules, host-based access and Kerberos for Linux. These steps enrol a client running AlmaLinux 9 / Rocky Linux 9 or Ubuntu 24.04 into an existing FreeIPA server.
Before you start
- The client needs a fully qualified hostname (
hostnamectl set-hostname client1.ipa.example.com) and must resolve the IPA server through DNS. - Clocks must be in sync.
Install and enrol
dnf install ipa-client # AlmaLinux / Rocky apt install freeipa-client # Ubuntu ipa-client-install --mkhomedir --domain=ipa.example.com --server=ipa1.ipa.example.com
The installer asks for an IPA admin user (or use a one-time password created for the host). It configures SSSD, Kerberos, time sync and home folder creation.
Test
kinit admin klist id alice ssh alice@client1.ipa.example.com
To remove the client later: ipa-client-install --uninstall.
Troubleshooting
- Cannot find the server: check the DNS records with
dig +short SRV _ldap._tcp.ipa.example.com. - Clock skew too great: synchronise time (
chronyc tracking). - Details of a failed enrolment are in
/var/log/ipaclient-install.log.
