as of September 22, 2025
I. Install Fedora Server
At first boot of the ISO, select „Install Fedora 42"
LOCALIZATION:
Keyboard: German
Language Support: English (United States)
Time & Date: Europe/Berlin ++ Automatic date & time
SOFTWARE:
Installation Source: Auto-detected source
Software Selection: Fedora Server Edition - No additional Software
SYSTEM:
Installation: QEMU HARDDISK ++ Storage Configuration: Automatic
NETWORK:
Network & Host Name: Ethernet: IP:172.16.Netzstandard.1/24 DNS:172.16.X.254 ++ Hostname: ipa.>>SCHOOL ABBREVIATION<<.md-schule.de
USER SETTINGS:
Root Account: enable give strong password ++ don't Allow root SSH login with password
CREATE USER: adminuser "netop" with strong password
click „Begin Installation"
click „Reboot System"
*if changed, don't forget to reset the boot order in Proxmox
II. Install FreeIPA Server
sudo dnf install freeipa-server -y && sudo dnf install freeipa-server-dns -y
sudo ipa-server-install:
Do you want to configure integrated DNS (BIND)? [no]: yes
Server host name [ipa.>>SCHOOL ABBREVIATION<<.md-schule.de]: >>enter<<
Please confirm the domain name [>>SCHOOL ABBREVIATION<<.md-schule.de]: >>enter<<
Please provide a realm name [>>SCHOOL ABBREVIATION<<.md-schule.de]: >>enter<<
Directory Manager password: choose strong password
IPA admin password: choose strong password
Do you want to configure DNS forwarders? [yes]: >>enter<< (firewall should be automatically detected)
Do you want to configure these servers as DNS forwarders? [yes]: >>enter<<
Enter an IP address for a DNS forwarder, or press Enter to skip: >>enter<<
Do you want to search for missing reverse zones? [yes]: no
NetBIOS domain name [>>SCHOOL ABBREVIATION<<]: >>enter<<
Do you want to configure chrony with NTP server or pool address? [no]: >>enter<<
Continue to configure the system with these values? [no]: yes
III. Open Firewall Ports
Adding following services: HTTP; HTTPS; LDAP; LDAPS; Kerberos; BIND; NTP
TCP:
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --permanent --add-port=389/tcp
sudo firewall-cmd --permanent --add-port=636/tcp
sudo firewall-cmd --permanent --add-port=88/tcp
sudo firewall-cmd --permanent --add-port=464/tcp
sudo firewall-cmd --permanent --add-port=53/tcp
UDP:
sudo firewall-cmd --permanent --add-port=88/udp
sudo firewall-cmd --permanent --add-port=464/udp
sudo firewall-cmd --permanent --add-port=53/udp
sudo firewall-cmd --permanent --add-port=123/udp
sudo firewall-cmd --reload
IV. Allow DNS Queries
sudo su
vim /etc/named/ipa-ext.conf
add follwing lines (Pay attention to the indentations):
acl "trusted_network" {
localnets;
localhost;
10.4.0.0/16;
};
vim /etc/named/ipa-options-ext.conf
add follwing lines (Pay attention to the indentations):
allow-recursion { trusted_network; };
allow-query-cache { trusted_network; };
You can now log in to the WebGUI over the ip/fqdn of the server.
⚠️Note: The password of the ipa admin expires from time to time, keep in mind when you change it to update the entry in vaultwarden. The script for creating the users is currently located in /home/netop/