freeipa install
This commit is contained in:
waldek
parent
69a2c25745
commit
328fbdc4c2
Binary file not shown.
|
After Width: | Height: | Size: 106 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 166 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 130 KiB |
|
|
@ -0,0 +1,607 @@
|
|||
# FreeIPA
|
||||
|
||||
[FreeIPA](https://www.freeipa.org/page/Main_Page) is an open source identify management solution.
|
||||
It's a good modern day solution for centralized account management.
|
||||
For this one we'll be installing the server on a Fedora machine.
|
||||
By looking at the installation [requirements](https://www.freeipa.org/page/Quick_Start_Guide#Preparing_a_Platform) we learn that we need a bit more RAM than usual.
|
||||
|
||||
I suggest a machine with:
|
||||
|
||||
* 4GB RAM
|
||||
* min 2 CPU
|
||||
* 10GB disk
|
||||
|
||||
## Server installation
|
||||
|
||||
Do a Fedora installation as you have done before.
|
||||
Your base installation should look like the screenshot below.
|
||||
|
||||
|
||||
|
||||
When looking through the software selection list we can already install freeipa from the start.
|
||||
Tick it, or install it later through `dnf`, your call.
|
||||
Notice the `Network Servers` package and how it *still* includes `nis`?
|
||||
|
||||
|
||||
|
||||
Fedora takes a bit more time to install but once it's done, log in and install your tools of choice.
|
||||
Your Debian skills will go a long way here.
|
||||
|
||||
```bash
|
||||
[waldek@fedora ~]$ sudo dnf install htop tmux vim
|
||||
[sudo] password for waldek:
|
||||
Last metadata expiration check: 0:00:04 ago on Tue 28 Sep 2021 21:12:01 CEST.
|
||||
Dependencies resolved.
|
||||
=======================================================================================================================================
|
||||
Package Architecture Version Repository Size
|
||||
=======================================================================================================================================
|
||||
Installing:
|
||||
htop x86_64 3.0.5-4.fc34 fedora 154 k
|
||||
tmux x86_64 3.1c-2.fc34 fedora 397 k
|
||||
vim-enhanced x86_64 2:8.2.3404-1.fc34 updates 1.8 M
|
||||
Installing dependencies:
|
||||
gpm-libs x86_64 1.20.7-26.fc34 fedora 20 k
|
||||
libsodium x86_64 1.0.18-7.fc34 fedora 165 k
|
||||
vim-common x86_64 2:8.2.3404-1.fc34 updates 6.7 M
|
||||
vim-filesystem noarch 2:8.2.3404-1.fc34 updates 22 k
|
||||
|
||||
Transaction Summary
|
||||
=======================================================================================================================================
|
||||
Install 7 Packages
|
||||
|
||||
Total download size: 9.3 M
|
||||
Installed size: 36 M
|
||||
Is this ok [y/N]: y
|
||||
Downloading Packages:
|
||||
(1/7): gpm-libs-1.20.7-26.fc34.x86_64.rpm 38 kB/s | 20 kB 00:00
|
||||
(2/7): htop-3.0.5-4.fc34.x86_64.rpm 270 kB/s | 154 kB 00:00
|
||||
(3/7): libsodium-1.0.18-7.fc34.x86_64.rpm 262 kB/s | 165 kB 00:00
|
||||
(4/7): tmux-3.1c-2.fc34.x86_64.rpm 996 kB/s | 397 kB 00:00
|
||||
(5/7): vim-filesystem-8.2.3404-1.fc34.noarch.rpm 139 kB/s | 22 kB 00:00
|
||||
(6/7): vim-enhanced-8.2.3404-1.fc34.x86_64.rpm 943 kB/s | 1.8 MB 00:02
|
||||
(7/7): vim-common-8.2.3404-1.fc34.x86_64.rpm 2.2 MB/s | 6.7 MB 00:02
|
||||
---------------------------------------------------------------------------------------------------------------------------------------
|
||||
Total 2.0 MB/s | 9.3 MB 00:04
|
||||
Running transaction check
|
||||
Transaction check succeeded.
|
||||
Running transaction test
|
||||
Transaction test succeeded.
|
||||
Running transaction
|
||||
Preparing : 1/1
|
||||
Installing : vim-filesystem-2:8.2.3404-1.fc34.noarch 1/7
|
||||
Installing : vim-common-2:8.2.3404-1.fc34.x86_64 2/7
|
||||
Installing : libsodium-1.0.18-7.fc34.x86_64 3/7
|
||||
Installing : gpm-libs-1.20.7-26.fc34.x86_64 4/7
|
||||
Installing : vim-enhanced-2:8.2.3404-1.fc34.x86_64 5/7
|
||||
Installing : tmux-3.1c-2.fc34.x86_64 6/7
|
||||
Running scriptlet: tmux-3.1c-2.fc34.x86_64 6/7
|
||||
Installing : htop-3.0.5-4.fc34.x86_64 7/7
|
||||
Running scriptlet: htop-3.0.5-4.fc34.x86_64 7/7
|
||||
Verifying : gpm-libs-1.20.7-26.fc34.x86_64 1/7
|
||||
Verifying : htop-3.0.5-4.fc34.x86_64 2/7
|
||||
Verifying : libsodium-1.0.18-7.fc34.x86_64 3/7
|
||||
Verifying : tmux-3.1c-2.fc34.x86_64 4/7
|
||||
Verifying : vim-common-2:8.2.3404-1.fc34.x86_64 5/7
|
||||
Verifying : vim-enhanced-2:8.2.3404-1.fc34.x86_64 6/7
|
||||
Verifying : vim-filesystem-2:8.2.3404-1.fc34.noarch 7/7
|
||||
|
||||
Installed:
|
||||
gpm-libs-1.20.7-26.fc34.x86_64 htop-3.0.5-4.fc34.x86_64 libsodium-1.0.18-7.fc34.x86_64
|
||||
tmux-3.1c-2.fc34.x86_64 vim-common-2:8.2.3404-1.fc34.x86_64 vim-enhanced-2:8.2.3404-1.fc34.x86_64
|
||||
vim-filesystem-2:8.2.3404-1.fc34.noarch
|
||||
|
||||
Complete!
|
||||
[waldek@fedora ~]$
|
||||
```
|
||||
|
||||
Once this is done we need to set a `hostname` and a FQDN.
|
||||
Most LDAP servers are *very* picky about domains and FQDNs and FreeIPA is no different.
|
||||
It can not have a single top level domain.
|
||||
I advise a reboot once you have set this before continuing the configuration.
|
||||
|
||||
```bash
|
||||
[waldek@ipa ~]$ cat /etc/hostname
|
||||
ipa
|
||||
[waldek@ipa ~]$ cat /etc/hosts
|
||||
192.168.0.69 ipa.corp.lan ipa
|
||||
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||
[waldek@ipa ~]$
|
||||
```
|
||||
|
||||
We can configure the server with a tool called `ipa-server-install` that comes installed with the FreeIPA package.
|
||||
It will run you through some questions but the default values are good for the most part.
|
||||
I'll be adding some arguments to speed things up.
|
||||
The `--mkhomedir -a -p` arguments do the following (in practice you should set proper passwords!):
|
||||
|
||||
```bash
|
||||
--mkhomedir create home directories for users on their first login
|
||||
-p DM_PASSWORD, --ds-password=DM_PASSWORD
|
||||
Directory Manager password
|
||||
-a ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD
|
||||
admin user kerberos password
|
||||
```
|
||||
|
||||
There we go!
|
||||
|
||||
```bash
|
||||
[waldek@ipa ~]$ sudo ipa-server-install --mkhomedir -a 123456789 -p 123456789
|
||||
|
||||
The log file for this installation can be found in /var/log/ipaserver-install.log
|
||||
==============================================================================
|
||||
This program will set up the IPA Server.
|
||||
Version 4.9.6
|
||||
|
||||
This includes:
|
||||
* Configure a stand-alone CA (dogtag) for certificate management
|
||||
* Configure the NTP client (chronyd)
|
||||
* Create and configure an instance of Directory Server
|
||||
* Create and configure a Kerberos Key Distribution Center (KDC)
|
||||
* Configure Apache (httpd)
|
||||
* Configure the KDC to enable PKINIT
|
||||
|
||||
To accept the default shown in brackets, press the Enter key.
|
||||
|
||||
Do you want to configure integrated DNS (BIND)? [no]:
|
||||
|
||||
Enter the fully qualified domain name of the computer
|
||||
on which you're setting up server software. Using the form
|
||||
<hostname>.<domainname>
|
||||
Example: master.example.com.
|
||||
|
||||
|
||||
Server host name [ipa.corp.lan]:
|
||||
|
||||
The domain name has been determined based on the host name.
|
||||
|
||||
Please confirm the domain name [corp.lan]:
|
||||
|
||||
The kerberos protocol requires a Realm name to be defined.
|
||||
This is typically the domain name converted to uppercase.
|
||||
|
||||
Please provide a realm name [CORP.LAN]:
|
||||
Do you want to configure chrony with NTP server or pool address? [no]:
|
||||
|
||||
The IPA Master Server will be configured with:
|
||||
Hostname: ipa.corp.lan
|
||||
IP address(es): 192.168.0.69
|
||||
Domain name: corp.lan
|
||||
Realm name: CORP.LAN
|
||||
|
||||
The CA will be configured with:
|
||||
Subject DN: CN=Certificate Authority,O=CORP.LAN
|
||||
Subject base: O=CORP.LAN
|
||||
Chaining: self-signed
|
||||
|
||||
Continue to configure the system with these values? [no]: yes
|
||||
|
||||
The following operations may take some minutes to complete.
|
||||
Please wait until the prompt is returned.
|
||||
|
||||
Disabled p11-kit-proxy
|
||||
Synchronizing time
|
||||
No SRV records of NTP servers found and no NTP server or pool address was provided.
|
||||
Using default chrony configuration.
|
||||
Attempting to sync time with chronyc.
|
||||
Time synchronization was successful.
|
||||
Configuring directory server (dirsrv). Estimated time: 30 seconds
|
||||
[1/41]: creating directory server instance
|
||||
[2/41]: tune ldbm plugin
|
||||
[3/41]: adding default schema
|
||||
[4/41]: enabling memberof plugin
|
||||
[5/41]: enabling winsync plugin
|
||||
[6/41]: configure password logging
|
||||
[7/41]: configuring replication version plugin
|
||||
[8/41]: enabling IPA enrollment plugin
|
||||
[9/41]: configuring uniqueness plugin
|
||||
[10/41]: configuring uuid plugin
|
||||
[11/41]: configuring modrdn plugin
|
||||
[12/41]: configuring DNS plugin
|
||||
[13/41]: enabling entryUSN plugin
|
||||
[14/41]: configuring lockout plugin
|
||||
[15/41]: configuring topology plugin
|
||||
[16/41]: creating indices
|
||||
[17/41]: enabling referential integrity plugin
|
||||
[18/41]: configuring certmap.conf
|
||||
[19/41]: configure new location for managed entries
|
||||
[20/41]: configure dirsrv ccache and keytab
|
||||
[21/41]: enabling SASL mapping fallback
|
||||
[22/41]: restarting directory server
|
||||
[23/41]: adding sasl mappings to the directory
|
||||
[24/41]: adding default layout
|
||||
[25/41]: adding delegation layout
|
||||
[26/41]: creating container for managed entries
|
||||
[27/41]: configuring user private groups
|
||||
[28/41]: configuring netgroups from hostgroups
|
||||
[29/41]: creating default Sudo bind user
|
||||
[30/41]: creating default Auto Member layout
|
||||
[31/41]: adding range check plugin
|
||||
[32/41]: creating default HBAC rule allow_all
|
||||
[33/41]: adding entries for topology management
|
||||
[34/41]: initializing group membership
|
||||
[35/41]: adding master entry
|
||||
[36/41]: initializing domain level
|
||||
[37/41]: configuring Posix uid/gid generation
|
||||
[38/41]: adding replication acis
|
||||
[39/41]: activating sidgen plugin
|
||||
[40/41]: activating extdom plugin
|
||||
[41/41]: configuring directory to start on boot
|
||||
Done configuring directory server (dirsrv).
|
||||
Configuring Kerberos KDC (krb5kdc)
|
||||
[1/10]: adding kerberos container to the directory
|
||||
[2/10]: configuring KDC
|
||||
[3/10]: initialize kerberos container
|
||||
[4/10]: adding default ACIs
|
||||
[5/10]: creating a keytab for the directory
|
||||
[6/10]: creating a keytab for the machine
|
||||
[7/10]: adding the password extension to the directory
|
||||
[8/10]: creating anonymous principal
|
||||
[9/10]: starting the KDC
|
||||
[10/10]: configuring KDC to start on boot
|
||||
Done configuring Kerberos KDC (krb5kdc).
|
||||
Configuring kadmin
|
||||
[1/2]: starting kadmin
|
||||
[2/2]: configuring kadmin to start on boot
|
||||
Done configuring kadmin.
|
||||
Configuring ipa-custodia
|
||||
[1/5]: Making sure custodia container exists
|
||||
[2/5]: Generating ipa-custodia config file
|
||||
[3/5]: Generating ipa-custodia keys
|
||||
[4/5]: starting ipa-custodia
|
||||
[5/5]: configuring ipa-custodia to start on boot
|
||||
Done configuring ipa-custodia.
|
||||
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
|
||||
[1/28]: configuring certificate server instance
|
||||
[2/28]: stopping certificate server instance to update CS.cfg
|
||||
[3/28]: backing up CS.cfg
|
||||
[4/28]: Add ipa-pki-wait-running
|
||||
[5/28]: secure AJP connector
|
||||
[6/28]: reindex attributes
|
||||
[7/28]: exporting Dogtag certificate store pin
|
||||
[8/28]: disabling nonces
|
||||
[9/28]: set up CRL publishing
|
||||
[10/28]: enable PKIX certificate path discovery and validation
|
||||
[11/28]: authorizing RA to modify profiles
|
||||
[12/28]: authorizing RA to manage lightweight CAs
|
||||
[13/28]: Ensure lightweight CAs container exists
|
||||
[14/28]: starting certificate server instance
|
||||
[15/28]: configure certmonger for renewals
|
||||
[16/28]: requesting RA certificate from CA
|
||||
[17/28]: publishing the CA certificate
|
||||
[18/28]: adding RA agent as a trusted user
|
||||
[19/28]: configure certificate renewals
|
||||
[20/28]: Configure HTTP to proxy connections
|
||||
[21/28]: updating IPA configuration
|
||||
[22/28]: enabling CA instance
|
||||
[23/28]: importing IPA certificate profiles
|
||||
[24/28]: migrating certificate profiles to LDAP
|
||||
[25/28]: adding default CA ACL
|
||||
[26/28]: adding 'ipa' CA entry
|
||||
[27/28]: configuring certmonger renewal for lightweight CAs
|
||||
[28/28]: deploying ACME service
|
||||
Done configuring certificate server (pki-tomcatd).
|
||||
Configuring directory server (dirsrv)
|
||||
[1/3]: configuring TLS for DS instance
|
||||
[2/3]: adding CA certificate entry
|
||||
[3/3]: restarting directory server
|
||||
Done configuring directory server (dirsrv).
|
||||
Configuring ipa-otpd
|
||||
[1/2]: starting ipa-otpd
|
||||
[2/2]: configuring ipa-otpd to start on boot
|
||||
Done configuring ipa-otpd.
|
||||
Configuring the web interface (httpd)
|
||||
[1/21]: stopping httpd
|
||||
[2/21]: backing up ssl.conf
|
||||
[3/21]: disabling nss.conf
|
||||
[4/21]: configuring mod_ssl certificate paths
|
||||
[5/21]: setting mod_ssl protocol list
|
||||
[6/21]: configuring mod_ssl log directory
|
||||
[7/21]: disabling mod_ssl OCSP
|
||||
[8/21]: adding URL rewriting rules
|
||||
[9/21]: configuring httpd
|
||||
[10/21]: setting up httpd keytab
|
||||
[11/21]: configuring Gssproxy
|
||||
[12/21]: setting up ssl
|
||||
[13/21]: configure certmonger for renewals
|
||||
[14/21]: publish CA cert
|
||||
[15/21]: clean up any existing httpd ccaches
|
||||
[16/21]: configuring SELinux for httpd
|
||||
[17/21]: create KDC proxy config
|
||||
[18/21]: enable KDC proxy
|
||||
[19/21]: starting httpd
|
||||
[20/21]: configuring httpd to start on boot
|
||||
[21/21]: enabling oddjobd
|
||||
Done configuring the web interface (httpd).
|
||||
Configuring Kerberos KDC (krb5kdc)
|
||||
[1/1]: installing X509 Certificate for PKINIT
|
||||
Done configuring Kerberos KDC (krb5kdc).
|
||||
Applying LDAP updates
|
||||
Upgrading IPA:. Estimated time: 1 minute 30 seconds
|
||||
[1/10]: stopping directory server
|
||||
[2/10]: saving configuration
|
||||
[3/10]: disabling listeners
|
||||
[4/10]: enabling DS global lock
|
||||
[5/10]: disabling Schema Compat
|
||||
[6/10]: starting directory server
|
||||
[7/10]: upgrading server
|
||||
[8/10]: stopping directory server
|
||||
[9/10]: restoring configuration
|
||||
[10/10]: starting directory server
|
||||
Done.
|
||||
Restarting the KDC
|
||||
Configuring client side components
|
||||
This program will set up IPA client.
|
||||
Version 4.9.6
|
||||
|
||||
Using existing certificate '/etc/ipa/ca.crt'.
|
||||
Client hostname: ipa.corp.lan
|
||||
Realm: CORP.LAN
|
||||
DNS Domain: corp.lan
|
||||
IPA Server: ipa.corp.lan
|
||||
BaseDN: dc=corp,dc=lan
|
||||
|
||||
Configured sudoers in /etc/authselect/user-nsswitch.conf
|
||||
Configured /etc/sssd/sssd.conf
|
||||
Systemwide CA database updated.
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
|
||||
Could not update DNS SSHFP records.
|
||||
SSSD enabled
|
||||
Configured /etc/openldap/ldap.conf
|
||||
Configured /etc/ssh/ssh_config
|
||||
Configured /etc/ssh/sshd_config.d/04-ipa.conf
|
||||
Configuring corp.lan as NIS domain.
|
||||
Client configuration complete.
|
||||
The ipa-client-install command was successful
|
||||
|
||||
Please add records in this file to your DNS system: /tmp/ipa.system.records.o8dlznpf.db
|
||||
==============================================================================
|
||||
Setup complete
|
||||
|
||||
Next steps:
|
||||
1. You must make sure these network ports are open:
|
||||
TCP Ports:
|
||||
* 80, 443: HTTP/HTTPS
|
||||
* 389, 636: LDAP/LDAPS
|
||||
* 88, 464: kerberos
|
||||
UDP Ports:
|
||||
* 88, 464: kerberos
|
||||
* 123: ntp
|
||||
|
||||
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
|
||||
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
|
||||
and the web user interface.
|
||||
|
||||
Be sure to back up the CA certificates stored in /root/cacert.p12
|
||||
These files are required to create replicas. The password for these
|
||||
files is the Directory Manager password
|
||||
The ipa-server-install command was successful
|
||||
[waldek@ipa ~]$
|
||||
```
|
||||
|
||||
Fedora comes with a firewall installed by default so let's open up the ports needed for LDAP and HTTP and make them permanent.
|
||||
|
||||
```bash
|
||||
[waldek@ipa ~]$ sudo firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps --add-service=http --add-service=https --permanent
|
||||
success
|
||||
[waldek@ipa ~]$
|
||||
```
|
||||
|
||||
### Adding users
|
||||
|
||||
#### Command line
|
||||
|
||||
We can add users from the command line with the `ipa` tool.
|
||||
In order to *use* the tool we need to authenticate the shell we're using with Kerberos.
|
||||
|
||||
```bash
|
||||
[waldek@ipa ~]$ kinit admin
|
||||
Password for admin@CORP.LAN:
|
||||
[waldek@ipa ~]$
|
||||
```
|
||||
|
||||
Next we can **add** a user and **set** the password.
|
||||
You must do this in the same shell you authenticated before!
|
||||
|
||||
```bash
|
||||
[waldek@ipa ~]$ ipa user-add
|
||||
First name: david
|
||||
Last name: guy
|
||||
User login [dguy]: david
|
||||
------------------
|
||||
Added user "david"
|
||||
------------------
|
||||
User login: david
|
||||
First name: david
|
||||
Last name: guy
|
||||
Full name: david guy
|
||||
Display name: david guy
|
||||
Initials: dg
|
||||
Home directory: /home/david
|
||||
GECOS: david guy
|
||||
Login shell: /bin/sh
|
||||
Principal name: david@CORP.LAN
|
||||
Principal alias: david@CORP.LAN
|
||||
Email address: david@corp.lan
|
||||
UID: 1715200004
|
||||
GID: 1715200004
|
||||
Password: False
|
||||
Member of groups: ipausers
|
||||
Kerberos keys available: False
|
||||
[waldek@ipa ~]$ ipa passwd david
|
||||
New Password:
|
||||
Enter New Password again to verify:
|
||||
-------------------------------------
|
||||
Changed password for "david@CORP.LAN"
|
||||
-------------------------------------
|
||||
[waldek@ipa ~]$
|
||||
```
|
||||
|
||||
#### Web GUI
|
||||
|
||||
As we had to fix the domain as a two part domain the resolv on our LAN won't work out of the box but you can just add the FreeIPA server to your graphical `/etc/hosts` file.
|
||||
Next you open a browser and navigate to the hostname or IP address of your server.
|
||||
There you log in with the credentials you set during the installation.
|
||||
You'll see a dashboard similar to the one below.
|
||||
|
||||
|
||||
|
||||
## client installation
|
||||
|
||||
### Debian
|
||||
|
||||
We'll need a classic headless Debian server to install the client software on.
|
||||
No real hardware requirements here but keep in mind the **domain** you set your FreeIPA server to!
|
||||
This machine will need to be in the same domain.
|
||||
Once up and running, install your preferred tools and look for the `freeipa-client` package to install.
|
||||
It seems to be missing!
|
||||
We can [find](https://packages.debian.org/buster/freeipa-client) on on the Debian website though?
|
||||
There is a package available for Buster *and* for *Sid* but not for Bullseye.
|
||||
The problem is that it was not ready in time for the release so it got excluded, not that it's incompatible.
|
||||
|
||||
Remember apt pinning?
|
||||
We can use it to include packages from different branches of Debian.
|
||||
Let's add the sources and set up the pinning.
|
||||
|
||||
```bash
|
||||
waldek@ipaclient1:~$ cat /etc/apt/sources.list
|
||||
# deb cdrom:[Debian GNU/Linux 11.0.0 _Bullseye_ - Official amd64 NETINST 20210814-10:07]/ bullseye main
|
||||
|
||||
#deb cdrom:[Debian GNU/Linux 11.0.0 _Bullseye_ - Official amd64 NETINST 20210814-10:07]/ bullseye main
|
||||
|
||||
deb http://deb.debian.org/debian/ bullseye main
|
||||
deb-src http://deb.debian.org/debian/ bullseye main
|
||||
|
||||
deb http://deb.debian.org/debian/ sid main
|
||||
deb-src http://deb.debian.org/debian/ sid main
|
||||
|
||||
deb http://security.debian.org/debian-security bullseye-security main
|
||||
deb-src http://security.debian.org/debian-security bullseye-security main
|
||||
|
||||
# bullseye-updates, to get updates before a point release is made;
|
||||
# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports
|
||||
deb http://deb.debian.org/debian/ bullseye-updates main
|
||||
deb-src http://deb.debian.org/debian/ bullseye-updates main
|
||||
|
||||
# This system was installed using small removable media
|
||||
# (e.g. netinst, live or single CD). The matching "deb cdrom"
|
||||
# entries were disabled at the end of the installation process.
|
||||
# For information about how to configure apt package sources,
|
||||
# see the sources.list(5) manual.
|
||||
waldek@ipaclient1:~$ cat /etc/apt/preferences.d/pinning
|
||||
Package: *
|
||||
Pin: release a=stable
|
||||
Pin-Priority: 700
|
||||
|
||||
Package: *
|
||||
Pin: release a=unstable
|
||||
Pin-Priority: 600
|
||||
waldek@ipaclient1:~$ sudo apt install freeipa-client
|
||||
Reading package lists... Done
|
||||
Building dependency tree... Done
|
||||
Reading state information... Done
|
||||
freeipa-client is already the newest version (4.8.10-2+b1).
|
||||
0 upgraded, 0 newly installed, 0 to remove and 8 not upgraded.
|
||||
waldek@ipaclient1:~$
|
||||
|
||||
```
|
||||
|
||||
We need to add the IP address of our server to out hosts file so our client can contact it.
|
||||
|
||||
```bash
|
||||
waldek@ipaclient1:~$ cat /etc/hosts
|
||||
127.0.0.1 localhost
|
||||
127.0.1.1 ipaclient1.corp.lan ipaclient1
|
||||
192.168.0.69 ipa.corp.lan ipa
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
waldek@ipaclient1:~$
|
||||
```
|
||||
|
||||
Just as with the server, the client comes with a configuration tool as well.
|
||||
For some weird reason Debian does not detect the domain by itself so we can specify it on the command line.
|
||||
Here we also add the `--mkhomedir` argument so each user who logs in, gets his or her own home directory on the local computer.
|
||||
|
||||
```bash
|
||||
waldek@ipaclient1:~$ sudo ipa-client-install --server ipa.corp.lan --domain corp.lan --mkhomedir
|
||||
This program will set up FreeIPA client.
|
||||
Version 4.8.10
|
||||
|
||||
WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd
|
||||
|
||||
Autodiscovery of servers for failover cannot work with this configuration.
|
||||
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
|
||||
Proceed with fixed values and no DNS discovery? [no]: yes
|
||||
Do you want to configure chrony with NTP server or pool address? [no]:
|
||||
Client hostname: ipaclient1.corp.lan
|
||||
Realm: CORP.LAN
|
||||
DNS Domain: corp.lan
|
||||
IPA Server: ipa.corp.lan
|
||||
BaseDN: dc=corp,dc=lan
|
||||
|
||||
Continue to configure the system with these values? [no]: yes
|
||||
Synchronizing time
|
||||
No SRV records of NTP servers found and no NTP server or pool address was provided.
|
||||
Using default chrony configuration.
|
||||
Attempting to sync time with chronyc.
|
||||
Time synchronization was successful.
|
||||
User authorized to enroll computers: admin
|
||||
Password for admin@CORP.LAN:
|
||||
Successfully retrieved CA cert
|
||||
Subject: CN=Certificate Authority,O=CORP.LAN
|
||||
Issuer: CN=Certificate Authority,O=CORP.LAN
|
||||
Valid From: 2021-09-28 19:30:06
|
||||
Valid Until: 2041-09-28 19:30:06
|
||||
|
||||
Enrolled in IPA realm CORP.LAN
|
||||
Created /etc/ipa/default.conf
|
||||
Configured sudoers in /etc/nsswitch.conf
|
||||
Configured /etc/sssd/sssd.conf
|
||||
Configured /etc/krb5.conf for IPA realm CORP.LAN
|
||||
Systemwide CA database updated.
|
||||
Hostname (ipaclient1.corp.lan) does not have A/AAAA record.
|
||||
Failed to update DNS records.
|
||||
Missing A/AAAA record(s) for host ipaclient1.corp.lan: 192.168.0.145.
|
||||
Incorrect reverse record(s):
|
||||
192.168.0.145 is pointing to ipaclient1.lan. instead of ipaclient1.corp.lan.
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
|
||||
Could not update DNS SSHFP records.
|
||||
SSSD enabled
|
||||
Configured /etc/openldap/ldap.conf
|
||||
Configured /etc/ssh/ssh_config
|
||||
Configured /etc/ssh/sshd_config.d/04-ipa.conf
|
||||
Configuring corp.lan as NIS domain.
|
||||
Client configuration complete.
|
||||
The ipa-client-install command was successful
|
||||
waldek@ipaclient1:~$
|
||||
```
|
||||
|
||||
Once this is done we can use the accounts we added to the server, either via the command line or the web interface, to authenticate with on the local machine.
|
||||
|
||||
```bash
|
||||
waldek@ipaclient1:~$ su alice
|
||||
Password:
|
||||
Password expired. Change your password now.
|
||||
Current Password:
|
||||
New password:
|
||||
Retype new password:
|
||||
$ id
|
||||
uid=1715200001(alice) gid=1715200001(alice) groups=1715200001(alice)
|
||||
$ cd
|
||||
$ pwd
|
||||
/home/alice
|
||||
$
|
||||
```
|
||||
|
||||
### Fedora
|
||||
|
||||
TODO in class
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue