Requirements and network
Confirm before installing - delivery form, host size, hostname and DNS, time sync, ports to open, and the control node.
Delivery forms
| Model B: host install | Model A: container appliance | |
|---|---|---|
| Deliverable | idmatrix-host-<version>.tar.gz: playbook, console, licence layer, ansible collections, offline RPM repo | Image tarball, compose file, .env sample |
| Runs on | The customer's RHEL / Rocky / AlmaLinux machine or VM | Any Linux host with podman / docker |
| Installed by | ansible from a control node; nothing extra on the target | ./load.sh, then podman-compose up -d; self-configures on first boot |
| Use for | Production. FreeIPA runs natively; KDC / DNS / CA ports and SELinux are the real thing | POC, demos, single-box trials |
Production is always Model B. The rest of this section describes Model B; Model A differences are marked under Configuration.
Target host
| Item | Requirement |
|---|---|
| OS | RHEL / Rocky Linux / AlmaLinux 9 (validated on Rocky 9.8 with FreeIPA 4.13); 8 works. Debian family is not supported |
| Size | 2 vCPU / 4 GB minimum; 4 vCPU / 8 GB above 100 managed hosts. Keep 20 GB free under /var: directory database, CA, logs and backups all live there |
| State | Clean install; never had FreeIPA / 389-ds / Samba AD. If it did, ipa-server-install --uninstall -U first, or reinstall the OS |
| SELinux | enforcing. FreeIPA ships its own policy; do not disable |
| Privileges | The ssh account used by the control node needs NOPASSWD sudo |
Hostname and DNS
FreeIPA is a Kerberos realm; the hostname is the identity and cannot change after install.
hostname -fmust return an FQDN identical toIPA_HOSTNAMEincustomer.env.- The FQDN must resolve forward and reverse. When IPA manages DNS it creates its own records, but the pre-install check relies on
/etc/hostsor the customer DNS. - The hostname must not appear on the
127.0.0.1or::1line of/etc/hosts. The first answer fromgetent hosts <FQDN>must be the real address. Withmyhostnamein thehosts:line ofnsswitch.conf, IPv6 lookups return::1; remove it. - The realm is the domain in upper case (
corp.examplebecomesCORP.EXAMPLE). The NetBIOS name is at most 15 characters and must differ from the AD domain's NetBIOS name when a trust is planned.
The three DNS layouts are in the quick start. With customer-managed DNS, add the IPA A, PTR and _kerberos._tcp / _ldap._tcp SRV records by hand.
Time
Within 5 minutes of the AD domain controller or upstream NTP. On bare metal let IPA manage time (IPA_NO_NTP=false; chrony is installed and pointed upstream). In a VM, use either the hypervisor's time sync or IPA's chrony, not both.
Ports
Inbound to the IPA server:
| Port | Protocol | Service | When |
|---|---|---|---|
| 443, 80 | tcp | Console and API; 80 only redirects | Always |
| 389, 636 | tcp | LDAP / LDAPS | Always |
| 88, 464 | tcp / udp | Kerberos / kpasswd | Always |
| 749 | tcp | kadmin | Always |
| 53 | tcp / udp | DNS | IPA_SETUP_DNS=true |
| 123 | udp | NTP | When clients sync time from IPA |
| 445, 135 | tcp | SMB / RPC endpoint mapper | AD trust |
| 1024–1300 | tcp | RPC dynamic ports | AD trust |
IPA_SETUP_FIREWALLD=true opens the first six rows automatically; add the two AD trust rows yourself. Between two IPA servers (multi-master) everything in the table must be open both ways.
Outbound from the IPA server:
| Target | Port | Purpose | Required |
|---|---|---|---|
| Upstream DNS | 53 | Forward queries outside the domain | When IPA_FORWARDERS is set |
| NTP source | 123 | Time sync | Yes |
| AD domain controllers | 53, 88, 389, 445, 135, 1024–1300 | Trust setup and user resolution | AD trust |
license.reallysec.com | 443 | Online licence heartbeat | Online licence mode only; the default offline mode needs nothing |
Control node
| Two boxes (recommended) | All-in-one | |
|---|---|---|
| Control node | Any other internal Linux machine, jump host or laptop | The target itself |
| Extra software on the target | None | ansible-core + gettext, installed by bootstrap-controller.sh from the bundled RPMs |
ANSIBLE_CONNECTION | ssh | local |
Two boxes leave no deployment tooling on the production server. Use all-in-one only when the customer cannot provide a second Linux machine.
Clients and browsers
- Reach the console by FQDN. The factory certificate is issued by the built-in IPA CA; the first browser warning is expected. To remove it, import the IPA CA into the browser trust store or replace the certificate with one from the customer CA (
ipa-server-certinstall, outside the standard delivery). - Linux clients joining the domain install
ipa-clientand need the same forward / reverse resolvable FQDN. - AD trust prerequisites have their own page: AD trust prerequisites.
Quick start
Shortest path from the delivery bundle to a working console. One Rocky / RHEL 9 host, one control node running ansible, one customer.env, one playbook run.
Deploy (Model B)
What the playbook does on the target, where things land, how to verify, how to clean up a failed run, and the handover checklist.