Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a new, small network. About 10 servers at 3 sites with just 3 users total. All are running RHEL 6.1. I was hoping to have centralized user management, especially having a single password to make our lives easier. Easy is the goal here. The three of us are developers without sysadmin skills.

The commercial Red Hat Directory Server was pointed out to me. It looks like it does what I want but it's expensive and is targeted at companies with thousands of servers and users.

I also found IPA, which Red Hat seems to have recently (as of 6.1) integrated as part of their "Enterprise Identity Management Guide" and is available via yum from their repos as ipa-server. I assume this is FreeIPA with the "Free" removed. This product might also do what I want. I get the impression it is newer and without strong commercial support I worry it will just make my life harder in the end.

It seems the old fashioned way to solve this was duct taping some sort of LDAP + PAM + whatever system. That sounds really messy for our small, inexperienced team.

So, the question: can anyone with experience compare and contrast RH Directory Server vs IPA? Is there a clear winner for my situation?

share|improve this question
up vote 5 down vote accepted

IPA is an identity solution stack, of which the following is included:

  • LDAP
  • Kerberos
  • NTP
  • DNS

Red Hat Directory Server is just a LDAP implementation - which, incidentally, is based on Fedora 389 Directory Server, which, in turn, is included in IPA.

Incidentally, IPA in RHEL 6.1 is included as a technology preview. IPA is expected to turn gold and given full support with RHEL 6.2 release.

share|improve this answer
Thanks. Have I overlooked a better alternative, or is the best non-beta solution stitching this stack together myself? I'm tempted to use IPA anyway because that sounds daunting. – RaveTheTadpole Dec 1 '11 at 6:17
If you are not going to use it for evaluation, its fine. In fact, you can try it now by downloading from, since it is essentially the same product. – Rilindo Dec 1 '11 at 13:35
Will this filter into the CentOS 6.2 side, or is it an entitled package? – ewwhite Jan 20 '12 at 17:05
It is in CentOS 6.2. Just look for ipa-server-2.1.3-9.el6.x86_64.rpm in any of your favorite CentOS 6.2 mirrors. – Rilindo Jan 20 '12 at 19:17

I've done an article on how to install FreeIPA if you're still interested in trying it out.

Let me know how it went

share|improve this answer
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. – slm May 5 '13 at 21:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.