Deploy a clean, repeatable FreeIPA environment providing identity, DNS, Kerberos, and CA services for int.riodvr.com. Primary host: ipa2.int.riodvr.com (10.1.215.23).

Install & OS Basics

• Rocky Linux 9.6 (minimal), DHCP reservation → 10.1.215.23
• Hostname: ipa2.int.riodvr.com

Enable SSH password login

Copy/etc/ssh/sshd_configsudo nano /etc/ssh/sshd_config
# Ensure:
PasswordAuthentication yes
PermitRootLogin yes
sudo systemctl restart sshd

Sanity checks

Copyip a
cat /etc/resolv.conf
hostnamectl
cat /etc/hosts
# Expect: 10.1.215.23 ipa2.int.riodvr.com ipa2

Enable IPv6 on loopback

Copysudo sed -i '/disable_ipv6/d' /etc/sysctl.conf
echo 'net.ipv6.conf.all.disable_ipv6 = 0' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 0' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.lo.disable_ipv6 = 0' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
ip -6 addr show lo   # should show ::1/128

Copy/etc/nsswitch.confsudo cp /etc/nsswitch.conf{,.bak}
sudo sed -i 's/^hosts:.*/hosts: files dns/' /etc/nsswitch.conf

Copy/etc/gai.confsudo nano /etc/gai.conf
# Add (top of file is fine):
precedence ::ffff:0:0/96  100

Copyresolvectl flush-caches 2>/dev/null || true
systemctl restart nscd 2>/dev/null || true
systemctl restart sssd 2>/dev/null || true
getent hosts ipa2.int.riodvr.com
# Expect: 10.1.215.23 ipa2.int.riodvr.com ipa2

Copydnf install -y freeipa-server freeipa-server-dns chrony

Copyipa-server-install --setup-dns --mkhomedir \
  --hostname=ipa2.int.riodvr.com \
  --domain=int.riodvr.com \
  --realm=INT.RIODVR.COM \
  --forwarder=10.1.215.1 \
  --forwarder=1.1.1.1 \
  --forwarder=8.8.8.8 \
  --auto-reverse \
  --no-dnssec-validation

Prompts: set Directory Manager password, IPA admin password, NetBIOS name INT, accept default chrony.

Copyipactl status

Copydig +short ipa2.int.riodvr.com @127.0.0.1
dig -x 10.1.215.23 @127.0.0.1

Copyldapsearch -x -H ldap://localhost -b "" -s base namingContexts

Copykdestroy
kinit admin
klist
ipa ping

Copycurl -kI https://ipa2.int.riodvr.com/ipa/ui

1. System → Settings → General → DNS Servers:
   • 10.1.215.23
   • 1.1.1.1
   • 8.8.8.8
2. Ensure the firewall itself uses the DNS forwarder (do not disable it).

Copy# Manual snapshot
ipactl stop
tar czf /root/ipa2-backup-$(date +%F).tar.gz /etc/ipa /var/lib/ipa /etc/dirsrv
ipactl start

Copy/etc/cron.daily/ipa-backup#!/bin/bash
ipactl stop
tar czf /root/ipa2-backup-$(date +%F).tar.gz /etc/ipa /var/lib/ipa /etc/dirsrv
ipactl start
# chmod +x /etc/cron.daily/ipa-backup

1. Provision VM ipa3.int.riodvr.com (10.1.104.x). DNS → 10.1.215.23.
2. Repeat IPv4 preference and nsswitch.conf fix.
3. Install packages:

   Copydnf install -y freeipa-server freeipa-server-dns
   

4. On ipa2:

   Copyipa-replica-prepare ipa3.int.riodvr.com
   

5. On ipa3:

   Copyipa-replica-install --setup-dns --mkhomedir --no-forwarders
   

6. Validate:

   Copyipa-replica-manage list
   ipa dnsserver-find
   

• Add ipa3 (HA DNS/LDAP)
• Join key servers with SSSD
• IPA CA-issued internal TLS certs
• Authoritative zones for all sites
• Optional AD trust (if needed)

• All IPA services RUNNING on ipa2
• Kerberos tickets issuing (admin)
• DNS forward & reverse working
• Web UI reachable
• Backup archive captured
• Ready to build ipa3

© 2025 – FreeIPA Deployment for INT.RIODVR.COM. Generated playbook.