make more commits :-)
This commit is contained in:
Petar Cubela
356
projects/neosphere/ida/ipa.lab.softbox.net.md
Normal file
356
projects/neosphere/ida/ipa.lab.softbox.net.md
Normal file
@@ -0,0 +1,356 @@
|
||||
## Sources
|
||||
|
||||
- [FreeIPA - Quick Start Guide](https://www.freeipa.org/page/Quick_Start_Guide)
|
||||
- [FreeIPA - Client Config](https://www.freeipa.org/page/ConfiguringFedoraClients)
|
||||
|
||||
## Credentials
|
||||
|
||||
- Directory Manager: '!Aladin123$'
|
||||
- admin: '!aladin123'
|
||||
- root: '!aladin123'
|
||||
|
||||
## OS
|
||||
|
||||
```bash
|
||||
[sbxadmin@ipa ~]$ cat /etc/os-release
|
||||
NAME="Fedora Linux"
|
||||
VERSION="42 (Cloud Edition)"
|
||||
RELEASE_TYPE=stable
|
||||
ID=fedora
|
||||
VERSION_ID=42
|
||||
VERSION_CODENAME=""
|
||||
PLATFORM_ID="platform:f42"
|
||||
PRETTY_NAME="Fedora Linux 42 (Cloud Edition)"
|
||||
ANSI_COLOR="0;38;2;60;110;180"
|
||||
LOGO=fedora-logo-icon
|
||||
CPE_NAME="cpe:/o:fedoraproject:fedora:42"
|
||||
HOME_URL="https://fedoraproject.org/"
|
||||
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f42/"
|
||||
SUPPORT_URL="https://ask.fedoraproject.org/"
|
||||
BUG_REPORT_URL="https://bugzilla.redhat.com/"
|
||||
REDHAT_BUGZILLA_PRODUCT="Fedora"
|
||||
REDHAT_BUGZILLA_PRODUCT_VERSION=42
|
||||
REDHAT_SUPPORT_PRODUCT="Fedora"
|
||||
REDHAT_SUPPORT_PRODUCT_VERSION=42
|
||||
SUPPORT_END=2026-05-13
|
||||
VARIANT="Cloud Edition"
|
||||
VARIANT_ID=cloud
|
||||
```
|
||||
|
||||
## FreeIPA - Base
|
||||
|
||||
```bash
|
||||
The IPA Master Server will be configured with:
|
||||
Hostname: ipa.lab.softbox.net
|
||||
IP address(es): 10.11.12.65
|
||||
Domain name: lab.softbox.net
|
||||
Realm name: LAB.SOFTBOX.NET
|
||||
|
||||
The CA will be configured with:
|
||||
Subject DN: CN=Certificate Authority,O=LAB.SOFTBOX.NET
|
||||
Subject base: O=LAB.SOFTBOX.NET
|
||||
Chaining: self-signed
|
||||
|
||||
BIND DNS server will be configured to serve IPA domain with:
|
||||
Forwarders: 9.9.9.9, 10.11.12.254
|
||||
Forward policy: only
|
||||
Reverse zone(s): No reverse zone
|
||||
```
|
||||
|
||||
## Install Summary
|
||||
|
||||
```bash
|
||||
Invalid IP address fe80::be24:11ff:fede:cb30 for ipa.lab.softbox.net.: cannot use link-local IP address fe80::be24:11ff:fede:cb30
|
||||
Enabling and restarting the IPA service
|
||||
==============================================================================
|
||||
Setup complete
|
||||
|
||||
Next steps:
|
||||
1. You must make sure these network ports are open:
|
||||
TCP Ports:
|
||||
* 80, 443: HTTP/HTTPS
|
||||
* 389, 636: LDAP/LDAPS
|
||||
* 88, 464: kerberos
|
||||
* 53: bind
|
||||
UDP Ports:
|
||||
* 88, 464: kerberos
|
||||
* 53: bind
|
||||
* 123: ntp
|
||||
|
||||
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
|
||||
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
|
||||
and the web user interface.
|
||||
|
||||
Be sure to back up the CA certificates stored in /root/cacert.p12
|
||||
These files are required to create replicas. The password for these
|
||||
files is the Directory Manager password
|
||||
The ipa-server-install command was successful
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## Complete Install log
|
||||
|
||||
```bash
|
||||
The following operations may take some minutes to complete.
|
||||
Please wait until the prompt is returned.
|
||||
|
||||
Adding [10.11.12.65 ipa.lab.softbox.net] to your /etc/hosts file
|
||||
Disabled p11-kit-proxy
|
||||
Synchronizing time
|
||||
No SRV records of NTP servers found and no NTP server or pool address was provided.
|
||||
Using default chrony configuration.
|
||||
Attempting to sync time with chronyc.
|
||||
Time synchronization was successful.
|
||||
Configuring directory server (dirsrv). Estimated time: 30 seconds
|
||||
[1/42]: creating directory server instance
|
||||
Validate installation settings ...
|
||||
Create file system structures ...
|
||||
Perform SELinux labeling ...
|
||||
Create database backend: dc=lab,dc=softbox,dc=net ...
|
||||
Perform post-installation tasks ...
|
||||
[2/42]: adding default schema
|
||||
[3/42]: enabling memberof plugin
|
||||
[4/42]: enabling winsync plugin
|
||||
[5/42]: configure password logging
|
||||
[6/42]: configuring replication version plugin
|
||||
[7/42]: enabling IPA enrollment plugin
|
||||
[8/42]: configuring uniqueness plugin
|
||||
[9/42]: configuring uuid plugin
|
||||
[10/42]: configuring modrdn plugin
|
||||
[11/42]: configuring DNS plugin
|
||||
[12/42]: enabling entryUSN plugin
|
||||
[13/42]: configuring lockout plugin
|
||||
[14/42]: configuring graceperiod plugin
|
||||
[15/42]: configuring topology plugin
|
||||
[16/42]: creating indices
|
||||
[17/42]: enabling referential integrity plugin
|
||||
[18/42]: configuring certmap.conf
|
||||
[19/42]: configure new location for managed entries
|
||||
[20/42]: configure dirsrv ccache and keytab
|
||||
[21/42]: enabling SASL mapping fallback
|
||||
[22/42]: restarting directory server
|
||||
[23/42]: adding sasl mappings to the directory
|
||||
[24/42]: adding default layout
|
||||
[25/42]: adding delegation layout
|
||||
[26/42]: creating container for managed entries
|
||||
[27/42]: configuring user private groups
|
||||
[28/42]: configuring netgroups from hostgroups
|
||||
[29/42]: creating default Sudo bind user
|
||||
[30/42]: creating default Auto Member layout
|
||||
[31/42]: adding range check plugin
|
||||
[32/42]: creating default HBAC rule allow_all
|
||||
[33/42]: adding entries for topology management
|
||||
[34/42]: initializing group membership
|
||||
[35/42]: adding master entry
|
||||
[36/42]: initializing domain level
|
||||
[37/42]: configuring Posix uid/gid generation
|
||||
[38/42]: adding replication acis
|
||||
[39/42]: activating sidgen plugin
|
||||
[40/42]: activating extdom plugin
|
||||
[41/42]: configuring directory to start on boot
|
||||
[42/42]: restarting directory server
|
||||
Done configuring directory server (dirsrv).
|
||||
Configuring Kerberos KDC (krb5kdc)
|
||||
[1/11]: adding kerberos container to the directory
|
||||
[2/11]: configuring KDC
|
||||
[3/11]: initialize kerberos container
|
||||
[4/11]: adding default ACIs
|
||||
[5/11]: creating a keytab for the directory
|
||||
[6/11]: creating a keytab for the machine
|
||||
[7/11]: adding the password extension to the directory
|
||||
[8/11]: creating anonymous principal
|
||||
[9/11]: starting the KDC
|
||||
[10/11]: configuring KDC to start on boot
|
||||
[11/11]: enable PAC ticket signature support
|
||||
Done configuring Kerberos KDC (krb5kdc).
|
||||
Configuring kadmin
|
||||
[1/2]: starting kadmin
|
||||
[2/2]: configuring kadmin to start on boot
|
||||
Done configuring kadmin.
|
||||
Configuring ipa-custodia
|
||||
[1/5]: Making sure custodia container exists
|
||||
[2/5]: Generating ipa-custodia config file
|
||||
[3/5]: Generating ipa-custodia keys
|
||||
[4/5]: starting ipa-custodia
|
||||
[5/5]: configuring ipa-custodia to start on boot
|
||||
Done configuring ipa-custodia.
|
||||
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
|
||||
[1/32]: configuring certificate server instance
|
||||
[2/32]: stopping certificate server instance to update CS.cfg
|
||||
[3/32]: backing up CS.cfg
|
||||
[4/32]: Add ipa-pki-wait-running
|
||||
Set start up timeout of pki-tomcatd service to 90 seconds
|
||||
[5/32]: secure AJP connector
|
||||
[6/32]: reindex attributes
|
||||
[7/32]: exporting Dogtag certificate store pin
|
||||
[8/32]: disabling nonces
|
||||
[9/32]: set up CRL publishing
|
||||
[10/32]: enable PKIX certificate path discovery and validation
|
||||
[11/32]: authorizing RA to modify profiles
|
||||
[12/32]: authorizing RA to manage lightweight CAs
|
||||
[13/32]: Ensure lightweight CAs container exists
|
||||
[14/32]: Enable lightweight CA monitor
|
||||
[15/32]: Ensuring backward compatibility
|
||||
[16/32]: updating IPA configuration
|
||||
[17/32]: starting certificate server instance
|
||||
[18/32]: configure certmonger for renewals
|
||||
[19/32]: requesting RA certificate from CA
|
||||
[20/32]: publishing the CA certificate
|
||||
[21/32]: adding RA agent as a trusted user
|
||||
[22/32]: configure certificate renewals
|
||||
[23/32]: Configure HTTP to proxy connections
|
||||
[24/32]: enabling CA instance
|
||||
[25/32]: importing IPA certificate profiles
|
||||
[26/32]: migrating certificate profiles to LDAP
|
||||
[27/32]: adding default CA ACL
|
||||
[28/32]: adding 'ipa' CA entry
|
||||
[29/32]: Recording random serial number state
|
||||
[30/32]: Recording HSM configuration state
|
||||
[31/32]: configuring certmonger renewal for lightweight CAs
|
||||
[32/32]: deploying ACME service
|
||||
Done configuring certificate server (pki-tomcatd).
|
||||
Configuring directory server (dirsrv)
|
||||
[1/3]: configuring TLS for DS instance
|
||||
[2/3]: adding CA certificate entry
|
||||
[3/3]: restarting directory server
|
||||
Done configuring directory server (dirsrv).
|
||||
Configuring ipa-otpd
|
||||
[1/2]: starting ipa-otpd
|
||||
[2/2]: configuring ipa-otpd to start on boot
|
||||
Done configuring ipa-otpd.
|
||||
Configuring the web interface (httpd)
|
||||
[1/21]: stopping httpd
|
||||
[2/21]: backing up ssl.conf
|
||||
[3/21]: configuring mod_ssl certificate paths
|
||||
[4/21]: setting mod_ssl protocol list
|
||||
[5/21]: configuring mod_ssl log directory
|
||||
[6/21]: disabling mod_ssl OCSP
|
||||
[7/21]: adding URL rewriting rules
|
||||
[8/21]: configuring httpd
|
||||
[9/21]: setting up httpd keytab
|
||||
[10/21]: configuring Gssproxy
|
||||
[11/21]: setting up ssl
|
||||
[12/21]: configure certmonger for renewals
|
||||
[13/21]: publish CA cert
|
||||
[14/21]: clean up any existing httpd ccaches
|
||||
[15/21]: enable ccache sweep
|
||||
[16/21]: configuring SELinux for httpd
|
||||
[17/21]: create KDC proxy config
|
||||
[18/21]: enable KDC proxy
|
||||
[19/21]: starting httpd
|
||||
[20/21]: configuring httpd to start on boot
|
||||
[21/21]: enabling oddjobd
|
||||
Done configuring the web interface (httpd).
|
||||
Configuring Kerberos KDC (krb5kdc)
|
||||
[1/1]: installing X509 Certificate for PKINIT
|
||||
Done configuring Kerberos KDC (krb5kdc).
|
||||
Applying LDAP updates
|
||||
Upgrading IPA:. Estimated time: 1 minute 30 seconds
|
||||
[1/10]: stopping directory server
|
||||
[2/10]: saving configuration
|
||||
[3/10]: disabling listeners
|
||||
[4/10]: enabling DS global lock
|
||||
[5/10]: disabling Schema Compat
|
||||
[6/10]: starting directory server
|
||||
[7/10]: upgrading server
|
||||
[8/10]: stopping directory server
|
||||
[9/10]: restoring configuration
|
||||
[10/10]: starting directory server
|
||||
Done.
|
||||
Restarting the KDC
|
||||
dnssec-validation no
|
||||
Configuring DNS (named)
|
||||
[1/12]: generating rndc key file
|
||||
[2/12]: adding DNS container
|
||||
[3/12]: setting up our zone
|
||||
[4/12]: setting up our own record
|
||||
[5/12]: setting up records for other masters
|
||||
[6/12]: adding NS record to the zones
|
||||
[7/12]: setting up kerberos principal
|
||||
[8/12]: setting up LDAPI autobind
|
||||
[9/12]: setting up named.conf
|
||||
created new /etc/named.conf
|
||||
created named user config '/etc/named/ipa-ext.conf'
|
||||
created named user config '/etc/named/ipa-options-ext.conf'
|
||||
created named user config '/etc/named/ipa-logging-ext.conf'
|
||||
[10/12]: setting up server configuration
|
||||
[11/12]: configuring named to start on boot
|
||||
[12/12]: changing resolv.conf to point to ourselves
|
||||
Done configuring DNS (named).
|
||||
Restarting the web server to pick up resolv.conf changes
|
||||
Configuring DNS key synchronization service (ipa-dnskeysyncd)
|
||||
[1/7]: checking status
|
||||
[2/7]: setting up bind-dyndb-ldap working directory
|
||||
[3/7]: setting up kerberos principal
|
||||
[4/7]: setting up SoftHSM
|
||||
[5/7]: adding DNSSEC containers
|
||||
[6/7]: creating replica keys
|
||||
[7/7]: configuring ipa-dnskeysyncd to start on boot
|
||||
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
|
||||
Restarting ipa-dnskeysyncd
|
||||
Restarting named
|
||||
Updating DNS system records
|
||||
Configuring SID generation
|
||||
[1/8]: adding RID bases
|
||||
[2/8]: creating samba domain object
|
||||
[3/8]: adding admin(group) SIDs
|
||||
[4/8]: updating Kerberos config
|
||||
'dns_lookup_kdc' already set to 'true', nothing to do.
|
||||
[5/8]: activating sidgen task
|
||||
[6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
|
||||
[7/8]: adding fallback group
|
||||
[8/8]: adding SIDs to existing users and groups
|
||||
This step may take considerable amount of time, please wait..
|
||||
Done.
|
||||
Configuring client side components
|
||||
This program will set up IPA client.
|
||||
Version 4.12.2
|
||||
|
||||
Using existing certificate '/etc/ipa/ca.crt'.
|
||||
Client hostname: ipa.lab.softbox.net
|
||||
Realm: LAB.SOFTBOX.NET
|
||||
DNS Domain: lab.softbox.net
|
||||
IPA Server: ipa.lab.softbox.net
|
||||
BaseDN: dc=lab,dc=softbox,dc=net
|
||||
|
||||
Configured /etc/sssd/sssd.conf
|
||||
Systemwide CA database updated.
|
||||
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
|
||||
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
|
||||
SSSD enabled
|
||||
Configured /etc/openldap/ldap.conf
|
||||
Configured /etc/ssh/ssh_config
|
||||
Configured /etc/ssh/sshd_config.d/04-ipa.conf
|
||||
Configuring lab.softbox.net as NIS domain.
|
||||
Client configuration complete.
|
||||
The ipa-client-install command was successful
|
||||
|
||||
Invalid IP address fe80::be24:11ff:fede:cb30 for ipa.lab.softbox.net.: cannot use link-local IP address fe80::be24:11ff:fede:cb30
|
||||
Enabling and restarting the IPA service
|
||||
==============================================================================
|
||||
Setup complete
|
||||
|
||||
Next steps:
|
||||
1. You must make sure these network ports are open:
|
||||
TCP Ports:
|
||||
* 80, 443: HTTP/HTTPS
|
||||
* 389, 636: LDAP/LDAPS
|
||||
* 88, 464: kerberos
|
||||
* 53: bind
|
||||
UDP Ports:
|
||||
* 88, 464: kerberos
|
||||
* 53: bind
|
||||
* 123: ntp
|
||||
|
||||
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
|
||||
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
|
||||
and the web user interface.
|
||||
|
||||
Be sure to back up the CA certificates stored in /root/cacert.p12
|
||||
These files are required to create replicas. The password for these
|
||||
files is the Directory Manager password
|
||||
The ipa-server-install command was successful
|
||||
```
|
||||
Reference in New Issue
Block a user