Requirements and network
Delivery form, host size, hostname and DNS, time sync, ports to open and the control node, to confirm before installing.
This page lists the environment conditions to confirm before installation.
Delivery forms
| Item | Model B: host install | Model A: container appliance |
|---|---|---|
| Deliverable | idmatrix-host-<version>.tar.gz: playbook, console, licence layer, ansible collections, offline RPM repo | Image tarball, compose file, .env sample |
| Runs on | The customer's RHEL, Rocky or AlmaLinux machine or VM | Any Linux host with podman or docker |
| Installed by | ansible from a control node; nothing extra on the target | ./load.sh, then podman-compose up -d; self-configures on first boot |
| Use for | Production. FreeIPA runs natively; KDC, DNS and CA ports and SELinux are the real thing | POC, demos, single-box trials |
Production is always Model B. The rest of this page describes Model B; Model A differences are marked under Configuration.
Target host
| Item | Requirement |
|---|---|
| OS | RHEL, Rocky Linux or AlmaLinux 9 (validated on Rocky 9.8 with FreeIPA 4.13); 8 works. The Debian family is not supported |
| Size | 2 vCPU and 4 GB minimum; 4 vCPU and 8 GB above 100 managed hosts. Keep 20 GB free under /var: directory database, CA, logs and backups all live there |
| State | Clean install that never had FreeIPA, 389-ds or Samba AD. If it did, run ipa-server-install --uninstall -U first, or reinstall the OS |
| SELinux | enforcing. FreeIPA ships its own policy; do not disable it |
| Privileges | The ssh account used by the control node needs NOPASSWD sudo |
Hostname and DNS
FreeIPA is a Kerberos realm; the hostname is the identity and cannot change after install.
| Requirement | Notes |
|---|---|
| FQDN | hostname -f returns an FQDN identical to IPA_HOSTNAME in customer.env |
| Resolution | The FQDN resolves forward and reverse. When IPA manages DNS it creates its own records, but the pre-install check relies on /etc/hosts or the customer DNS |
/etc/hosts | The hostname must not appear on the 127.0.0.1 or ::1 line. The first answer from getent hosts <FQDN> must be the real address. With myhostname in the hosts: line of nsswitch.conf, IPv6 lookups return ::1; remove it |
| Realm and NetBIOS | The realm is the domain in upper case (corp.example becomes CORP.EXAMPLE). The NetBIOS name is at most 15 characters and must differ from the AD domain's NetBIOS name when a trust is planned |
The three DNS layouts are in the quick start. With customer-managed DNS, add the IPA A and PTR records and the _kerberos._tcp and _ldap._tcp SRV records by hand.
Time
Within 5 minutes of the AD domain controller or upstream NTP. On bare metal let IPA manage time (IPA_NO_NTP=false; chrony is installed and pointed upstream). In a VM, use either the hypervisor's time sync or IPA's chrony, not both.
Ports
Inbound to the IPA server:
| Port | Protocol | Service | When |
|---|---|---|---|
| 443, 80 | tcp | Console and API; 80 only redirects | Always |
| 389, 636 | tcp | LDAP, LDAPS | Always |
| 88, 464 | tcp, udp | Kerberos, kpasswd | Always |
| 749 | tcp | kadmin | Always |
| 53 | tcp, udp | DNS | IPA_SETUP_DNS=true |
| 123 | udp | NTP | When clients sync time from IPA |
| 445, 135 | tcp | SMB, RPC endpoint mapper | AD trust |
| 1024 to 1300 | tcp | RPC dynamic ports | AD trust |
IPA_SETUP_FIREWALLD=true opens the first six rows automatically; the two AD trust rows are added by hand. Between two IPA servers (multi-master) everything in the table must be open both ways.
Outbound from the IPA server:
| Target | Port | Purpose | Required |
|---|---|---|---|
| Upstream DNS | 53 | Forward queries outside the domain | When IPA_FORWARDERS is set |
| NTP source | 123 | Time sync | Yes |
| AD domain controllers | 53, 88, 389, 445, 135, 1024 to 1300 | Trust setup and user resolution | AD trust |
license.reallysec.com | 443 | Online licence heartbeat | Online licence mode only. The default offline mode needs nothing |
Control node
| Item | Two boxes (recommended) | All-in-one |
|---|---|---|
| Control node | Any other internal Linux machine, jump host or laptop | The target itself |
| Extra software on the target | None | ansible-core and gettext, installed by bootstrap-controller.sh from the bundled RPMs |
ANSIBLE_CONNECTION | ssh | local |
Two boxes leave no deployment tooling on the production server. All-in-one applies only when the customer cannot provide a second Linux machine.
Clients and browsers
| Item | Notes |
|---|---|
| Console | Reached by FQDN. The factory certificate is issued by the built-in IPA CA; the first browser warning is expected. To remove it, import the IPA CA into the browser trust store or replace the certificate with one from the customer CA (ipa-server-certinstall, outside the standard delivery) |
| Linux clients | Clients joining the domain install ipa-client and need the same forward and reverse resolvable FQDN |
| AD trust | Prerequisites are on AD trust prerequisites |
Quick start
Shortest path from the delivery bundle to a working console. One Rocky or RHEL 9 host, one control node running ansible, one customer.env, one playbook run.
Deploy (Model B)
What the playbook does on the target, where files land, how to verify, how to clean up a failed run, and the handover checklist.