FreeIPA client installation options
Choosing ipa-client-install options for your estate: home directory creation, DNS updates, unattended installs with explicit domain, server and realm, NTP settings, and cleaning up old LDAP and SSSD configuration.
FreeIPA client enrollment and SSSD
Enrolling Linux machines into FreeIPA and running SSSD on them: install options, bulk enrollment, supported distributions, offline login, SSH keys and re-enrollment.
Enrolling FreeIPA clients at scale with one-time passwords
Enrolling hundreds of hosts without sharing admin credentials: pre-creating hosts with random one-time passwords, kickstart and automation, and ansible-freeipa client roles.
Enrolling FreeIPA clients with PKINIT and host certificates
Using existing host certificates to enroll FreeIPA clients with PKINIT instead of passwords or OTPs, and where this fits in automated provisioning.
FreeIPA clients on Ubuntu and Debian
Enrolling Ubuntu and Debian machines in FreeIPA: what works through SSSD and the client packages, the support position for non-RHEL clients, and testing before rollout.
Offline login with SSSD credential caching
Keeping laptops and remote servers usable when FreeIPA is unreachable: SSSD cached credentials, offline OTP login rules, cache settings, and the security trade-offs of caching.
SSH key management with FreeIPA
Storing user SSH public keys and host keys centrally in FreeIPA, SSSD providing authorized keys and known hosts, removing per-host authorized_keys files, and key rotation.
Re-enrolling and uninstalling FreeIPA clients
Moving a host to a new FreeIPA server or realm, rebuilding a host with the same name, uninstalling the client cleanly, and keytab and certificate cleanup.
FreeIPA client and server version compatibility
Which client OS versions work with current FreeIPA servers, the RHEL 7, 8 and 9 client support statement, and planning client upgrades around server migrations.
