{"id":54,"date":"2025-09-18T07:49:05","date_gmt":"2025-09-18T07:49:05","guid":{"rendered":"https:\/\/ryslab.dev\/?p=53"},"modified":"2025-09-23T03:53:18","modified_gmt":"2025-09-23T03:53:18","slug":"ipa-isnt-just-for-drinking","status":"publish","type":"post","link":"https:\/\/ryslab.dev\/index.php\/2025\/09\/18\/ipa-isnt-just-for-drinking\/","title":{"rendered":"IPA Isn&#8217;t Just for Drinking"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">The Case for Centralized Login and Home Directories.<\/h2>\n\n\n\n<p>Improved workflow: Roaming home folders makes it so much easier to keep on top of everything that we need to do. <\/p>\n\n\n\n<p>Say you downloaded a file on your laptop, but now you&#8217;re at your workstation and your laptop is hibernated in your backpack, but you need the file. Maybe you want to keep all your config file backups in a consistent place so .bak files aren&#8217;t scattered throughout \/etc\/ on every VM that you manage.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DATE=$(date +%F) #%F outputs only the date\ncp \/etc\/fstab \/etc\/fstab.$DATE #old\n\ncp \/etc\/fstab \/home\/ry\/bak\/fstab.server.$DATE #New, centralized method<\/code><\/pre>\n\n\n\n<p>Say you want to be able to access your .zst vzdumps from Proxmox. On your pve node run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mount --bind \/var\/lib\/vz\/dump \/home\/ry\/pve_bak\n\n#This allows any auto home device to access the Proxmox backups.\n#This does NOT create a copy in ~\/pve_bak it just binds the files there<\/code><\/pre>\n\n\n\n<p>SSH keys don&#8217;t need to be added to every machine. Do it once and centralized home takes care of it. .bashrc, .bash_history, etc are all centralized.<\/p>\n\n\n\n<p>Instead of running docker containers in ~\/docker, you can run them in \/opt\/docker, create a syslink and all your scripts still work with the outdated locations.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mv \/home\/$USER\/docker \/opt\/\nchown -R $USER:$USER \/opt\/docker\nln -s \/opt\/docker \/home\/$USER\/docker<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Why IPA? What did Active Directory do to me?<\/h2>\n\n\n\n<p>If you\u2019ve been around enterprise IT, you know the default answer to centralized login is <em>Active Directory<\/em>. But in a Linux-first homelab, <strong>FreeIPA is the better fit<\/strong>. Here\u2019s why:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">FreeIPA vs. Active Directory<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Category<\/th><th>FreeIPA \ud83d\udc27<\/th><th>Active Directory \ud83e\ude9f<\/th><\/tr><\/thead><tbody><tr><td><strong>Cost \/ Licensing<\/strong><\/td><td>100% free &amp; open source<\/td><td>Requires Windows Server licenses + CALs<\/td><\/tr><tr><td><strong>Platform Fit<\/strong><\/td><td>Built for Linux, POSIX-native<\/td><td>Windows-centric; Linux integration is bolted on<\/td><\/tr><tr><td><strong>Management Style<\/strong><\/td><td>CLI + WebUI (lightweight, headless Rocky)<\/td><td>Heavy GUI tooling (RSAT, ADUC, Windows Server Manager)<\/td><\/tr><tr><td><strong>Resource Footprint<\/strong><\/td><td><strong>Runs on a minimal Rocky\/Alma\/RHEL VM<\/strong><\/td><td><strong>Wants a full Windows Server install, often with GUI<\/strong><\/td><\/tr><tr><td><strong>Protocols<\/strong><\/td><td>Kerberos, LDAP, NFSv4 <code>sec=krb5p<\/code>, sudo\/HBAC integration<\/td><td>Kerberos &amp; LDAP, but Linux support often requires schema tweaks or extra daemons<\/td><\/tr><tr><td><strong>Community<\/strong><\/td><td>Transparent, upstream-driven, Linux admins<\/td><td>Closed ecosystem, roadmap controlled by Microsoft<\/td><\/tr><tr><td><strong>Use Case Fit<\/strong><\/td><td>Homelabs, Linux-only shops, small enterprises<\/td><td>Windows-heavy enterprises, Office365\/Exchange integration<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>This homelab is <strong>Linux-exclusive<\/strong>. The only time Windows boots here is for a quick dual-boot gaming session \u2014 everything else runs on Linux servers, laptops, and VMs.<\/p>\n\n\n\n<p>For that reality, Active Directory would just be overhead. FreeIPA integrates natively with NFSv4 roaming homes, Kerberos authentication, SSH, and sudo policies, all without dragging Windows Server into the mix.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How IPA Powers Roaming Homes<\/h2>\n\n\n\n<p>Centralized logins aren\u2019t just about <em>who you are<\/em> \u2014 they\u2019re about <em>what follows you<\/em>. FreeIPA makes this possible by being the glue between <strong>Kerberos authentication<\/strong>, <strong>LDAP user directories<\/strong>, and <strong>NFSv4 with strong encryption (<code>sec=krb5p<\/code>)<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Workflow in Action<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Login Anywhere<\/strong>\n<ul class=\"wp-block-list\">\n<li>You log into your laptop, workstation, or even a VM.<\/li>\n\n\n\n<li>PAM + SSSD talk to FreeIPA \u2192 Kerberos issues you a ticket (<code>kinit<\/code> happens behind the scenes).<\/li>\n\n\n\n<li>Your <code>homeDirectory<\/code> attribute (<code>\/home\/$USER<\/code>) tells the system where to mount your files.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Autofs Mounts Your Home<\/strong>\n<ul class=\"wp-block-list\">\n<li>Autofs sees <code>\/home\/ry<\/code> requested, reaches out to the NFS server.<\/li>\n\n\n\n<li>NFS enforces Kerberos (<code>sec=krb5p<\/code>) \u2192 only valid IPA users with tickets get access.<\/li>\n\n\n\n<li><code>\/srv\/nfs\/home\/ry<\/code> on the server becomes <code>\/home\/ry<\/code> on the client.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Your World Follows You<\/strong>\n<ul class=\"wp-block-list\">\n<li><code>.bashrc<\/code>, <code>.ssh\/authorized_keys<\/code>, <code>.bash_history<\/code> \u2014 all consistent, everywhere.<\/li>\n\n\n\n<li>Proxmox backups appear under <code>~\/pve_bak<\/code> thanks to bind mounts.<\/li>\n\n\n\n<li>Docker workloads live in <code>\/opt\/docker<\/code> but are still accessible as <code>~\/docker<\/code> via symlink.<\/li>\n\n\n\n<li>Config backups are centralized under <code>~\/bak\/<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Why IPA Is the Key<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Kerberos Security<\/strong> \u2192 Passwords aren\u2019t sprayed across the network, only tickets are.<\/li>\n\n\n\n<li><strong>LDAP User Directory<\/strong> \u2192 One place to define users, groups, sudo rules, and HBAC policies.<\/li>\n\n\n\n<li><strong>NFSv4 Integration<\/strong> \u2192 IPA manages service principals for the NFS server so file access is both secure and seamless.<\/li>\n\n\n\n<li><strong>Scalability<\/strong> \u2192 Whether it\u2019s 3 machines or 30, the login flow doesn\u2019t change.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Want to Set This Up Yourself?<\/h3>\n\n\n\n<p>I\u2019ve split the full step-by-step builds into separate guides:<\/p>\n\n\n\n<p>IPA requires Fully Qualified Domain Names (FQDN) with DNS properly configured. I use Pi-Hole to run local DNS on my network. You could also edit \/etc\/hosts or C:\\Windows\\System32\\drivers\\etc\\hosts on Windows.<\/p>\n\n\n\n<p>Configuring IPA Server on Rocky Linux. (IPA is developed and managed by Red Hat so I chose something in the RHEL ecosystem.)<\/p>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Server-1.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of IPA Server.\"><\/object><a id=\"wp-block-file--media-8ff80c04-ac6e-464d-b649-cd521b74cce3\" href=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Server-1.pdf\">IPA Server<\/a><a href=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Server-1.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-8ff80c04-ac6e-464d-b649-cd521b74cce3\">Download<\/a><\/div>\n\n\n\n<p>Configuring FreeIPA + NFS server integration<\/p>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Client-1.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of IPA Client.\"><\/object><a id=\"wp-block-file--media-75e18ad7-4934-4373-8c59-e815276f3c7a\" href=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Client-1.pdf\">IPA Client<\/a><a href=\"https:\/\/ryslab.dev\/wp-content\/uploads\/2025\/09\/IPA-Client-1.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-75e18ad7-4934-4373-8c59-e815276f3c7a\">Download<\/a><\/div>\n\n\n\n<p>These docs cover everything from package installs to <code>\/etc\/krb5.conf<\/code>, <code>\/etc\/auto.master<\/code>, keytab management, and troubleshooting.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>\ud83d\udca1 <strong>In short:<\/strong> FreeIPA is what makes roaming homes <em>secure<\/em>, not just <em>convenient<\/em>. Without IPA, you could mount an NFS share \u2014 but it wouldn\u2019t be tied to your identity, and you\u2019d lose encryption and centralized access control.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Case for Centralized Login and Home Directories. Improved workflow: Roaming home folders makes it so much easier to keep on top of everything that we need to do. Say you downloaded a file on your laptop, but now you&#8217;re at your workstation and your laptop is hibernated in your backpack, but you need the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":63,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-54","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-homelab"],"_links":{"self":[{"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/posts\/54","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/comments?post=54"}],"version-history":[{"count":4,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/posts\/54\/revisions"}],"predecessor-version":[{"id":74,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/posts\/54\/revisions\/74"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/media\/63"}],"wp:attachment":[{"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/media?parent=54"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/categories?post=54"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ryslab.dev\/index.php\/wp-json\/wp\/v2\/tags?post=54"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}