#569 Procedure for Joining Rocky Linux to a FreeIPA Domain in a KVM Environment: monitor and app Edition
Technical Report on Joining the FreeIPA Domain (monitor machine and app machine)
Background
As an internal verification environment, I built a KVM virtual environment on a RHEL9 host and deployed multiple Rocky Linux 9 clone VMs (monitor, freeipa, bastion, app, etc.). So far, I have configured routing for 10.10.0.0/24 and 10.20.0.0/24 on the rocky9 machine acting as a router, and set up the FreeIPA server and DNS server on the freeipa machine. The goal this time is to join the monitor machine (10.10.0.10) and the app machine (10.20.0.10) to the FreeIPA domain LAB.LOCAL and unify the internal DNS/NTP settings.
To ensure beginners can understand, I will explain in detail the verification of the initial state of each machine, necessary configuration changes, domain joining operations, and the problems encountered and their solutions. Note that I am using chrony for NTP settings and have configured the FreeIPA server as the time source according to the Red Hat guide [1].
1. Procedure for joining the monitor machine to the domain
1.1 Verification of initial state
I connected to monitor via virsh console and verified the following.
Item
Verification command
Status
Notes
Hostname
hostnamectl
It was 'monitor' and not an FQDN
Must be changed to an FQDN before joining FreeIPA
Network settings
ip addr, ip route
Two interfaces: 10.10.0.10/24 (enp7s0) and 192.168.122.60/24 (enp1s0) for NAT
The NAT side was the default gateway
DNS/NTP
cat /etc/resolv.conf, cat /etc/chrony.conf
DNS is 192.168.122.1 on the NAT side, NTP is pool 2.rocky.pool.ntp.org
Needs to be changed to reference the FreeIPA server
IPA client
rpm -q ipa-client
Not installed
Installation required
1.2 FQDN setting and /etc/hosts modification
1. Changed to FQDN with hostnamectl set-hostname monitor.lab.local and rebooted to apply.
2. Added the mapping of internal hosts to /etc/hosts, setting 10.10.0.10 monitor.lab.local monitor.
1.3 Network and DNS adjustment
1. Since the NAT side interface was the default gateway, I set enp1s0 to ipv4.never-default yes using NetworkManager.
2. On the internal network interface net10-monitor, I set the gateway to the router 10.10.0.254 and changed the DNS server to the FreeIPA server (10.10.0.2).
3. Downed/upped the interface to rebuild the route. Confirmed with ip route that it becomes default via 10.10.0.254 dev enp7s0.
4. Since /etc/resolv.conf is automatically generated, I configured ipv4.ignore-auto-dns yes to ignore the DNS provided from the NAT side.
1.4 NTP setting change
I edited the chrony configuration file /etc/chrony.conf, commented out the default NTP pool, and added the following [1].
server freeipa.lab.local iburst
I restarted the service and confirmed with chronyc sources that the FreeIPA server is the time source, and with timedatectl that the synchronization status is yes.
1.5 IPA client installation and domain joining
1. Installed necessary packages with sudo dnf install -y ipa-client.
2. Executed ipa-client-install and completed the join by specifying the domain name, server name, and realm name. I proceeded manually because a warning appeared stating that DNS auto-detection failed. I entered the admin account password and enabled automatic home directory creation with the mkhomedir option.
3. Immediately after installation, a message appeared on the client side stating that A/AAAA records or PTR records did not exist in the FreeIPA DNS. After confirming that kinit admin and ipa ping were successful, I configured the DNS settings on the FreeIPA server (described later).
1.6 PTR record registration
Since there was no PTR record in the reverse lookup zone 0.10.10.in-addr.arpa. for monitor, I executed the following on the FreeIPA server to add it.
ipa dnsrecord-add 0.10.10.in-addr.arpa. 10 --ptr-rec monitor.lab.local.
After registration, I confirmed that dig -x 10.10.0.10 +short returned monitor.lab.local.
1.7 Test
· Confirmed connectivity to internal and different segment hosts using getent hosts and ping commands with no issues.
· Confirmed that external domains can be resolved with dig, and HTTPS communication succeeded with curl.
2. Procedure for joining the app machine to the domain
2.1 Checking initial state
Item
Verification command
Status
Hostname
hostnamectl
app (FQDN not set)
IP address
ip addr
10.20.0.10/24 (enp7s0) and 192.168.122.60/24 (enp1s0)
Route
ip route
Default gateway is on the NAT side 192.168.122.1
DNS/NTP
resolv.conf, chrony.conf
DNS is on the NAT side, NTP is rocky.pool.ntp.org
IPA client
rpm -q ipa-client
Not installed
2.2 Modifying network and hostname
1. Set the FQDN with hostnamectl set-hostname app.lab.local and add 10.20.0.10 app.lab.local app to /etc/hosts.
2. Set the NAT-side interface enp1s0 to ipv4.never-default yes and ipv4.ignore-auto-dns yes.
3. Set the gateway to 10.20.0.254, the DNS server to 10.10.0.2 (FreeIPA), and the DNS suffix to lab.local for the internal network net20-app, then restart the interface.
4. Check /etc/resolv.conf and confirm that only nameserver 10.10.0.2 remains.
2.3 Changing NTP settings
Similar to monitor, add server freeipa.lab.local iburst to /etc/chrony.conf and restart chronyd. Confirm synchronization with the FreeIPA server using chronyc sources.
2.4 FreeIPA DNS recursive query settings
In the first attempt, name resolution for external domains (google.com or mirrors.rockylinux.org) from app failed. This is because the default configuration of FreeIPA integrated DNS only allows recursive queries to clients on the same network, and recursive queries from different segments result in REFUSED[2][3]. To resolve this, I created a trusted_network ACL in the BIND configuration of the FreeIPA server and added 10.20.0.0/24.
/etc/named/ipa-options-ext.conf
allow-recursion { trusted_network; };
allow-query-cache { trusted_network; };
/etc/named/ipa-ext.conf
acl "trusted_network" {
localnets;
localhost;
10.10.0.0/24;
10.20.0.0/24;
};
After configuration, restart the named service and confirm that external domains can be resolved from app. This procedure is introduced in the Red Hat Knowledgebase as a solution for recursive query refusal[4].
2.5 Installing and joining ipa-client
1. Install necessary packages with dnf install -y ipa-client. By correcting the DNS forwarder settings, I was able to retrieve packages from external repositories.
2. Execute ipa-client-install and complete the domain join by manually specifying values as with Monitor. I specified --hostname=app.lab.local and --mkhomedir. Since I had already reconfigured Chrony, I selected no.
3. When ipa-client-install completed, a message appeared stating that the A/AAAA records and PTR record for app were missing. The A record was added automatically, but an error occurred because the reverse lookup zone 0.20.10.in-addr.arpa., where the PTR record is registered, had not been created.
2.6 Adding reverse lookup zone and PTR record
1. Create a reverse lookup zone for 10.20.0.0/24 on the FreeIPA server. An absolute name (ending with a dot) must be specified for --name-server.
ipa dnszone-add 0.20.10.in-addr.arpa. --name-server=freeipa.lab.local. --admin-email=hostmaster@lab.local
--admin-email is optional; if not specified, the root account is used[5].
1. After creating the zone, add the PTR record.
ipa dnsrecord-add 0.20.10.in-addr.arpa. 10 --ptr-rec=app.lab.local.
After registration, I confirmed that dig -x 10.20.0.10 +short returned app.lab.local.
2.7 Final check
· kinit admin and ipa ping succeeded, confirming that Kerberos authentication is working.
· Confirmed name resolution and connectivity to each internal host using getent hosts and ping, and curl to external sites also succeeded.
· Domain joining for app was completed just like monitor.
3. Summary of issues and solutions
Issue
Occurrence situation
Solution
NAT interface was set as the default gateway
In the initial state for both monitor/app, enp1s0 (192.168.122.0/24) was the default route, and internal routing did not work.
Enabled ipv4.never-default for the NAT side in NetworkManager and set the gateway for the internal interface to the router (10.10.0.254 / 10.20.0.254) to address this.
FreeIPA DNS refuses recursive queries for external domains
After making the app machine refer to FreeIPA DNS, name resolution for external sites failed, causing dnf to fail.
Added a trusted_network ACL to the BIND configuration of the FreeIPA server and set allow-recursion and allow-query-cache to that ACL[4][3].
Reverse lookup zone does not exist, so PTR record cannot be registered
A warning about a missing PTR record appeared when running ipa-client-install on app. Since the reverse lookup zone did not exist, ipa dnsrecord-add resulted in an error.
Created the reverse lookup zone with the ipa dnszone-add 0.20.10.in-addr.arpa. command and added the PTR record. An absolute name must be specified for --name-server, and --admin-email is optional[5].
4. Summary and Future Outlook
In this task, we confirmed and specifically executed the series of steps required to join the monitor and app machines to the FreeIPA domain LAB.LOCAL. The main points are as follows.
· Preparation of FQDN and /etc/hosts:
A correct FQDN is essential for FreeIPA's Kerberos authentication and DNS integration, so we accurately recorded the short name, FQDN, and IP mappings in /etc/hosts.
· Unification of Network and DNS/NTP:
We set the internal router as the default gateway and unified the DNS server to the FreeIPA server. We also aligned the NTP server with the FreeIPA server using chrony to ensure system time synchronization[1].
· Introduction of IPA Client:
We joined the domain using ipa-client-install, which automated Kerberos authentication and SSSD configuration.
· DNS Recursion Settings and Reverse Zone Management:
To address FreeIPA DNS recursive query restrictions, we modified the BIND ACL settings and added the necessary reverse lookup zones[4][3].
As a result, the monitor/app machines have joined the FreeIPA domain and can now utilize centralized authentication and DNS management. Moving forward, we plan to manage application servers and services in an integrated manner within this domain, and leverage FreeIPA features such as ACLs and automatic certificate distribution as needed.
[1] How to configure chrony as an NTP client or server in Linux
https://www.redhat.com/en/blog/chrony-time-services-linux
[2] [3] [4] FreeIPA (IdM) integrated DNS server denies recursive query from client networks - Red Hat Customer Portal
https://access.redhat.com/solutions/5753431
[5] 17.6. Managing DNS Zone Entries | Identity Management Guide | Red Hat Enterprise Linux | 6 | Red Hat Documentation
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/identity_management_guide/managing-dnszone-entries