drg-kerberos.auth.home.lan is the authentication provider and LDAP domain controller of my home network.
Realm name (Kerberos): AUTH.HOME.LAN
DNS domain: auth.home.lan
Primary IPA server (KDC, LDAP, CA, DNS):
Hostname: drg-kerberos.auth.home.lan
IP: 192.168.1.8
IPA server (named) is authoritative for auth.home.lan.
Forwarding rules:
Forward all other DNS requests to Pi-hole (192.168.1.4).
Clients resolve domains via router → IPA DNS → Pi-hole → Internet.
Service discovery (SRV records) exists:
_kerberos._udp.auth.home.lan → KDC
_kpasswd._udp.auth.home.lan → password change service
_ldap._tcp.auth.home.lan → directory server
_kerberos-adm._tcp.auth.home.lan → kadmind
Kerberos tickets issued from: krbtgt/AUTH.HOME.LAN@AUTH.HOME.LAN
Password expiry currently set to IPA defaults (can be tuned with pwpolicy).
julian → Standard IPA user (UID: 1240000003). Migrated old local profile into /home/julian.
ax_julian → IPA admin account. Intended for sudo/root access.
for system Accounts a special Group service-accounts exists.
This group applies special policies:
At least one Fedora client joined with ipa-client-install.
Client /etc/krb5.conf is configured via DNS discovery + IPA join.
Clients automatically join the group workstations to which all users can log on
clients can be administered by users in the workstation-administrators group
sudoing on localhost due to the split of normal and ax_ users, it is recommended to open a shell for admin and then:
ssh ax_julian@localhost
servers have a special host group servers. server-administrators are allowed to log onto this group.
to join a server, you should revoke the workstations group and add the servers group
ipa hostgroup-remove-member workstations --hosts=myserver.auth.home.lan
ipa hostgroup-add-member servers --hosts=myserver.auth.home.lan
auto homedir creation service has to be enabled on each server:
ubuntu
sudo apt update
sudo apt install libpam-mkhomedir
change / add line session required pam_mkhomedir.so skel=/etc/skel umask=0022 to
sudo nano /etc/pam.d/common-session
sudo nano /etc/pam.d/common-session-noninteractive
IPA sudo rules can be managed centrally:
Example rule adminrule → grants all commands to ax_julian.
Required ports are open on the IPA server:
Kerberos: 88/tcp+udp, 464/tcp+udp
LDAP: 389, 636
HTTP/S: 80, 443 (IPA web UI)
DNS: 53/tcp+udp
Services confirmed listening: krb5kdc, kadmind, httpd, named.