FreeIPA

A Linux-only lab wants a directory that speaks Kerberos and LDAP without a Windows server in it. Standing FreeIPA up on a Dell Wyse thin client, hardening it before the first client joins, and adding a replica when the only spare host runs Ubuntu.
Title card: Standing Up FreeIPA When Everything in the Lab Is Linux

01Standing Up FreeIPA When Everything in the Lab Is Linux

My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.

Title card: Hardening FreeIPA Before the First Client Joins

02Hardening FreeIPA Before the First Client Joins

The rule a fresh FreeIPA install ships lets every account reach every service on every host, and it is on. That set my order: harden first, enroll second, then argue with each distro about sudo.

Title card: Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu

03Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu

Every login in the house resolved against one thin client, and the only spare machine ran Ubuntu. The second server became a container, and a bad image tag left me a replica that looked healthy.