Where Does FreeIPA Store Config and Server Data?
FreeIPA spreads server data across etc config, var lib state, and per-service logs on Linux.
Last updated
FreeIPA is several services wearing one trench coat, and its files scatter accordingly. Server identity and connection defaults sit in /etc/ipa. Databases, certificates, and replication state live under /var/lib across the directory server, CA, and DNS components.
Logs follow the same split, one stream per service rather than a single FreeIPA log. Directory server, web server, certificate system, and Kerberos each write their own. When something breaks, the failing component's log has the answer and the umbrella logs rarely do.
Where FreeIPA stores this, by platform
/etc/ipa/default.conf
Realm, domain, and server connection defaults. Clients carry this file plus sssd.conf and a host keytab; directory data itself stays server-side.
/var/lib/ipa/
Server state: directory databases, PKI data, DNS zones, and install backups. Back this tree up with the service stopped, and keep /etc/ipa alongside it or restores get confusing.
Frequently asked questions
Where do I look when FreeIPA installation fails?
Start with /etc/ipa/default.conf for realm and server names, then /var/log for the failing service. Most install failures name the exact log in their final error lines.
What lives on a FreeIPA client versus the server?
Clients keep config in /etc/ipa and /etc/sssd plus a host keytab, while directory data stays on the server. Re-enrolling a client only needs those local files removed and ipa-client-install rerun.
Notice an outdated path? Let us know.