DNS & Kerberos
DNS & Kerberos Verification
Section titled “DNS & Kerberos Verification”After installing the FreeIPA server, verify that DNS and Kerberos are functioning correctly before attempting to join any clients. These two services form the backbone of FreeIPA, and issues here will cascade into every other failure.
Kerberos Authentication
Section titled “Kerberos Authentication”FreeIPA uses Kerberos for passwordless authentication. This is the core identity mechanism.
Obtain a Kerberos Ticket
Section titled “Obtain a Kerberos Ticket”kinit admin# Enter the admin password you set during installationkinit requests a TGT (Ticket Granting Ticket) from the Kerberos KDC. The TGT acts as your “master pass” for the next 24 hours, allowing you to access any Kerberized service without re-entering your password.
Inspect the Current Ticket
Section titled “Inspect the Current Ticket”klistExpected output:
Ticket cache: KCM:0Default principal: [email protected]
Valid starting Expires Service principal04/18/26 10:00:00 04/19/26 10:00:00 krbtgt/[email protected]| Field | Meaning |
|---|---|
Default principal | The authenticated user |
Valid starting / Expires | Ticket validity window |
Service principal | The service this ticket grants access to |
Destroy the Ticket
Section titled “Destroy the Ticket”kdestroy # Log outklist -l # List all sessionsDNS Verification
Section titled “DNS Verification”FreeIPA’s integrated DNS must be fully functional. Without it, clients cannot discover services or join the domain.
Forward Resolution (Hostname to IP)
Section titled “Forward Resolution (Hostname to IP)”dig @localhost ipa-server.example.internal +short# Should return: 192.168.100.128If the record is missing:
ipa dnsrecord-find example.internal ipa-serveripa dnsrecord-add example.internal ipa-server --a-rec=192.168.100.128Reverse Resolution (IP to Hostname)
Section titled “Reverse Resolution (IP to Hostname)”dig -x 192.168.100.128 @localhost +short# Should return: ipa-server.example.internal.Reverse DNS is used for logging, auditing, and security validations like SSH. Missing reverse records cause connection delays.
If missing:
ipa dnszone-find# Should include 100.168.192.in-addr.arpa
ipa dnsrecord-add 100.168.192.in-addr.arpa 128 --ptr-rec=ipa-server.example.internal.SRV Records (Service Discovery)
Section titled “SRV Records (Service Discovery)”SRV records let clients automatically discover FreeIPA services:
dig SRV _ldap._tcp.example.internal @localhostdig SRV _kerberos._tcp.example.internal @localhostBoth must return results pointing to your FreeIPA server. If SRV records are absent, clients will fail to join the domain.
Quick Health Check
Section titled “Quick Health Check”Run these commands in sequence. All should succeed:
# 1. Kerberoskinit admin && klist && kdestroy
# 2. Forward DNSdig @localhost ipa-server.example.internal +short
# 3. Reverse DNSdig -x 192.168.100.128 @localhost +short
# 4. SRV recordsdig SRV _ldap._tcp.example.internal @localhostdig SRV _kerberos._tcp.example.internal @localhost
# 5. All services runningipactl statusNext Step
Section titled “Next Step”With DNS and Kerberos confirmed working, join your first client to the domain.
Adapted from Dawn’s Blog : FreeIPA Complete Deployment Guide.