356 lines
12 KiB
Markdown
356 lines
12 KiB
Markdown
## Sources
|
|
|
|
- [FreeIPA - Quick Start Guide](https://www.freeipa.org/page/Quick_Start_Guide)
|
|
- [FreeIPA - Client Config](https://www.freeipa.org/page/ConfiguringFedoraClients)
|
|
|
|
## Credentials
|
|
|
|
- Directory Manager: '!Aladin123$'
|
|
- admin: '!aladin123'
|
|
- root: '!aladin123'
|
|
|
|
## OS
|
|
|
|
```bash
|
|
[sbxadmin@ipa ~]$ cat /etc/os-release
|
|
NAME="Fedora Linux"
|
|
VERSION="42 (Cloud Edition)"
|
|
RELEASE_TYPE=stable
|
|
ID=fedora
|
|
VERSION_ID=42
|
|
VERSION_CODENAME=""
|
|
PLATFORM_ID="platform:f42"
|
|
PRETTY_NAME="Fedora Linux 42 (Cloud Edition)"
|
|
ANSI_COLOR="0;38;2;60;110;180"
|
|
LOGO=fedora-logo-icon
|
|
CPE_NAME="cpe:/o:fedoraproject:fedora:42"
|
|
HOME_URL="https://fedoraproject.org/"
|
|
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f42/"
|
|
SUPPORT_URL="https://ask.fedoraproject.org/"
|
|
BUG_REPORT_URL="https://bugzilla.redhat.com/"
|
|
REDHAT_BUGZILLA_PRODUCT="Fedora"
|
|
REDHAT_BUGZILLA_PRODUCT_VERSION=42
|
|
REDHAT_SUPPORT_PRODUCT="Fedora"
|
|
REDHAT_SUPPORT_PRODUCT_VERSION=42
|
|
SUPPORT_END=2026-05-13
|
|
VARIANT="Cloud Edition"
|
|
VARIANT_ID=cloud
|
|
```
|
|
|
|
## FreeIPA - Base
|
|
|
|
```bash
|
|
The IPA Master Server will be configured with:
|
|
Hostname: ipa.lab.softbox.net
|
|
IP address(es): 10.11.12.65
|
|
Domain name: lab.softbox.net
|
|
Realm name: LAB.SOFTBOX.NET
|
|
|
|
The CA will be configured with:
|
|
Subject DN: CN=Certificate Authority,O=LAB.SOFTBOX.NET
|
|
Subject base: O=LAB.SOFTBOX.NET
|
|
Chaining: self-signed
|
|
|
|
BIND DNS server will be configured to serve IPA domain with:
|
|
Forwarders: 9.9.9.9, 10.11.12.254
|
|
Forward policy: only
|
|
Reverse zone(s): No reverse zone
|
|
```
|
|
|
|
## Install Summary
|
|
|
|
```bash
|
|
Invalid IP address fe80::be24:11ff:fede:cb30 for ipa.lab.softbox.net.: cannot use link-local IP address fe80::be24:11ff:fede:cb30
|
|
Enabling and restarting the IPA service
|
|
==============================================================================
|
|
Setup complete
|
|
|
|
Next steps:
|
|
1. You must make sure these network ports are open:
|
|
TCP Ports:
|
|
* 80, 443: HTTP/HTTPS
|
|
* 389, 636: LDAP/LDAPS
|
|
* 88, 464: kerberos
|
|
* 53: bind
|
|
UDP Ports:
|
|
* 88, 464: kerberos
|
|
* 53: bind
|
|
* 123: ntp
|
|
|
|
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
|
|
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
|
|
and the web user interface.
|
|
|
|
Be sure to back up the CA certificates stored in /root/cacert.p12
|
|
These files are required to create replicas. The password for these
|
|
files is the Directory Manager password
|
|
The ipa-server-install command was successful
|
|
```
|
|
|
|
|
|
|
|
|
|
## Complete Install log
|
|
|
|
```bash
|
|
The following operations may take some minutes to complete.
|
|
Please wait until the prompt is returned.
|
|
|
|
Adding [10.11.12.65 ipa.lab.softbox.net] to your /etc/hosts file
|
|
Disabled p11-kit-proxy
|
|
Synchronizing time
|
|
No SRV records of NTP servers found and no NTP server or pool address was provided.
|
|
Using default chrony configuration.
|
|
Attempting to sync time with chronyc.
|
|
Time synchronization was successful.
|
|
Configuring directory server (dirsrv). Estimated time: 30 seconds
|
|
[1/42]: creating directory server instance
|
|
Validate installation settings ...
|
|
Create file system structures ...
|
|
Perform SELinux labeling ...
|
|
Create database backend: dc=lab,dc=softbox,dc=net ...
|
|
Perform post-installation tasks ...
|
|
[2/42]: adding default schema
|
|
[3/42]: enabling memberof plugin
|
|
[4/42]: enabling winsync plugin
|
|
[5/42]: configure password logging
|
|
[6/42]: configuring replication version plugin
|
|
[7/42]: enabling IPA enrollment plugin
|
|
[8/42]: configuring uniqueness plugin
|
|
[9/42]: configuring uuid plugin
|
|
[10/42]: configuring modrdn plugin
|
|
[11/42]: configuring DNS plugin
|
|
[12/42]: enabling entryUSN plugin
|
|
[13/42]: configuring lockout plugin
|
|
[14/42]: configuring graceperiod plugin
|
|
[15/42]: configuring topology plugin
|
|
[16/42]: creating indices
|
|
[17/42]: enabling referential integrity plugin
|
|
[18/42]: configuring certmap.conf
|
|
[19/42]: configure new location for managed entries
|
|
[20/42]: configure dirsrv ccache and keytab
|
|
[21/42]: enabling SASL mapping fallback
|
|
[22/42]: restarting directory server
|
|
[23/42]: adding sasl mappings to the directory
|
|
[24/42]: adding default layout
|
|
[25/42]: adding delegation layout
|
|
[26/42]: creating container for managed entries
|
|
[27/42]: configuring user private groups
|
|
[28/42]: configuring netgroups from hostgroups
|
|
[29/42]: creating default Sudo bind user
|
|
[30/42]: creating default Auto Member layout
|
|
[31/42]: adding range check plugin
|
|
[32/42]: creating default HBAC rule allow_all
|
|
[33/42]: adding entries for topology management
|
|
[34/42]: initializing group membership
|
|
[35/42]: adding master entry
|
|
[36/42]: initializing domain level
|
|
[37/42]: configuring Posix uid/gid generation
|
|
[38/42]: adding replication acis
|
|
[39/42]: activating sidgen plugin
|
|
[40/42]: activating extdom plugin
|
|
[41/42]: configuring directory to start on boot
|
|
[42/42]: restarting directory server
|
|
Done configuring directory server (dirsrv).
|
|
Configuring Kerberos KDC (krb5kdc)
|
|
[1/11]: adding kerberos container to the directory
|
|
[2/11]: configuring KDC
|
|
[3/11]: initialize kerberos container
|
|
[4/11]: adding default ACIs
|
|
[5/11]: creating a keytab for the directory
|
|
[6/11]: creating a keytab for the machine
|
|
[7/11]: adding the password extension to the directory
|
|
[8/11]: creating anonymous principal
|
|
[9/11]: starting the KDC
|
|
[10/11]: configuring KDC to start on boot
|
|
[11/11]: enable PAC ticket signature support
|
|
Done configuring Kerberos KDC (krb5kdc).
|
|
Configuring kadmin
|
|
[1/2]: starting kadmin
|
|
[2/2]: configuring kadmin to start on boot
|
|
Done configuring kadmin.
|
|
Configuring ipa-custodia
|
|
[1/5]: Making sure custodia container exists
|
|
[2/5]: Generating ipa-custodia config file
|
|
[3/5]: Generating ipa-custodia keys
|
|
[4/5]: starting ipa-custodia
|
|
[5/5]: configuring ipa-custodia to start on boot
|
|
Done configuring ipa-custodia.
|
|
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
|
|
[1/32]: configuring certificate server instance
|
|
[2/32]: stopping certificate server instance to update CS.cfg
|
|
[3/32]: backing up CS.cfg
|
|
[4/32]: Add ipa-pki-wait-running
|
|
Set start up timeout of pki-tomcatd service to 90 seconds
|
|
[5/32]: secure AJP connector
|
|
[6/32]: reindex attributes
|
|
[7/32]: exporting Dogtag certificate store pin
|
|
[8/32]: disabling nonces
|
|
[9/32]: set up CRL publishing
|
|
[10/32]: enable PKIX certificate path discovery and validation
|
|
[11/32]: authorizing RA to modify profiles
|
|
[12/32]: authorizing RA to manage lightweight CAs
|
|
[13/32]: Ensure lightweight CAs container exists
|
|
[14/32]: Enable lightweight CA monitor
|
|
[15/32]: Ensuring backward compatibility
|
|
[16/32]: updating IPA configuration
|
|
[17/32]: starting certificate server instance
|
|
[18/32]: configure certmonger for renewals
|
|
[19/32]: requesting RA certificate from CA
|
|
[20/32]: publishing the CA certificate
|
|
[21/32]: adding RA agent as a trusted user
|
|
[22/32]: configure certificate renewals
|
|
[23/32]: Configure HTTP to proxy connections
|
|
[24/32]: enabling CA instance
|
|
[25/32]: importing IPA certificate profiles
|
|
[26/32]: migrating certificate profiles to LDAP
|
|
[27/32]: adding default CA ACL
|
|
[28/32]: adding 'ipa' CA entry
|
|
[29/32]: Recording random serial number state
|
|
[30/32]: Recording HSM configuration state
|
|
[31/32]: configuring certmonger renewal for lightweight CAs
|
|
[32/32]: deploying ACME service
|
|
Done configuring certificate server (pki-tomcatd).
|
|
Configuring directory server (dirsrv)
|
|
[1/3]: configuring TLS for DS instance
|
|
[2/3]: adding CA certificate entry
|
|
[3/3]: restarting directory server
|
|
Done configuring directory server (dirsrv).
|
|
Configuring ipa-otpd
|
|
[1/2]: starting ipa-otpd
|
|
[2/2]: configuring ipa-otpd to start on boot
|
|
Done configuring ipa-otpd.
|
|
Configuring the web interface (httpd)
|
|
[1/21]: stopping httpd
|
|
[2/21]: backing up ssl.conf
|
|
[3/21]: configuring mod_ssl certificate paths
|
|
[4/21]: setting mod_ssl protocol list
|
|
[5/21]: configuring mod_ssl log directory
|
|
[6/21]: disabling mod_ssl OCSP
|
|
[7/21]: adding URL rewriting rules
|
|
[8/21]: configuring httpd
|
|
[9/21]: setting up httpd keytab
|
|
[10/21]: configuring Gssproxy
|
|
[11/21]: setting up ssl
|
|
[12/21]: configure certmonger for renewals
|
|
[13/21]: publish CA cert
|
|
[14/21]: clean up any existing httpd ccaches
|
|
[15/21]: enable ccache sweep
|
|
[16/21]: configuring SELinux for httpd
|
|
[17/21]: create KDC proxy config
|
|
[18/21]: enable KDC proxy
|
|
[19/21]: starting httpd
|
|
[20/21]: configuring httpd to start on boot
|
|
[21/21]: enabling oddjobd
|
|
Done configuring the web interface (httpd).
|
|
Configuring Kerberos KDC (krb5kdc)
|
|
[1/1]: installing X509 Certificate for PKINIT
|
|
Done configuring Kerberos KDC (krb5kdc).
|
|
Applying LDAP updates
|
|
Upgrading IPA:. Estimated time: 1 minute 30 seconds
|
|
[1/10]: stopping directory server
|
|
[2/10]: saving configuration
|
|
[3/10]: disabling listeners
|
|
[4/10]: enabling DS global lock
|
|
[5/10]: disabling Schema Compat
|
|
[6/10]: starting directory server
|
|
[7/10]: upgrading server
|
|
[8/10]: stopping directory server
|
|
[9/10]: restoring configuration
|
|
[10/10]: starting directory server
|
|
Done.
|
|
Restarting the KDC
|
|
dnssec-validation no
|
|
Configuring DNS (named)
|
|
[1/12]: generating rndc key file
|
|
[2/12]: adding DNS container
|
|
[3/12]: setting up our zone
|
|
[4/12]: setting up our own record
|
|
[5/12]: setting up records for other masters
|
|
[6/12]: adding NS record to the zones
|
|
[7/12]: setting up kerberos principal
|
|
[8/12]: setting up LDAPI autobind
|
|
[9/12]: setting up named.conf
|
|
created new /etc/named.conf
|
|
created named user config '/etc/named/ipa-ext.conf'
|
|
created named user config '/etc/named/ipa-options-ext.conf'
|
|
created named user config '/etc/named/ipa-logging-ext.conf'
|
|
[10/12]: setting up server configuration
|
|
[11/12]: configuring named to start on boot
|
|
[12/12]: changing resolv.conf to point to ourselves
|
|
Done configuring DNS (named).
|
|
Restarting the web server to pick up resolv.conf changes
|
|
Configuring DNS key synchronization service (ipa-dnskeysyncd)
|
|
[1/7]: checking status
|
|
[2/7]: setting up bind-dyndb-ldap working directory
|
|
[3/7]: setting up kerberos principal
|
|
[4/7]: setting up SoftHSM
|
|
[5/7]: adding DNSSEC containers
|
|
[6/7]: creating replica keys
|
|
[7/7]: configuring ipa-dnskeysyncd to start on boot
|
|
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
|
|
Restarting ipa-dnskeysyncd
|
|
Restarting named
|
|
Updating DNS system records
|
|
Configuring SID generation
|
|
[1/8]: adding RID bases
|
|
[2/8]: creating samba domain object
|
|
[3/8]: adding admin(group) SIDs
|
|
[4/8]: updating Kerberos config
|
|
'dns_lookup_kdc' already set to 'true', nothing to do.
|
|
[5/8]: activating sidgen task
|
|
[6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
|
|
[7/8]: adding fallback group
|
|
[8/8]: adding SIDs to existing users and groups
|
|
This step may take considerable amount of time, please wait..
|
|
Done.
|
|
Configuring client side components
|
|
This program will set up IPA client.
|
|
Version 4.12.2
|
|
|
|
Using existing certificate '/etc/ipa/ca.crt'.
|
|
Client hostname: ipa.lab.softbox.net
|
|
Realm: LAB.SOFTBOX.NET
|
|
DNS Domain: lab.softbox.net
|
|
IPA Server: ipa.lab.softbox.net
|
|
BaseDN: dc=lab,dc=softbox,dc=net
|
|
|
|
Configured /etc/sssd/sssd.conf
|
|
Systemwide CA database updated.
|
|
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
|
|
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
|
|
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
|
|
SSSD enabled
|
|
Configured /etc/openldap/ldap.conf
|
|
Configured /etc/ssh/ssh_config
|
|
Configured /etc/ssh/sshd_config.d/04-ipa.conf
|
|
Configuring lab.softbox.net as NIS domain.
|
|
Client configuration complete.
|
|
The ipa-client-install command was successful
|
|
|
|
Invalid IP address fe80::be24:11ff:fede:cb30 for ipa.lab.softbox.net.: cannot use link-local IP address fe80::be24:11ff:fede:cb30
|
|
Enabling and restarting the IPA service
|
|
==============================================================================
|
|
Setup complete
|
|
|
|
Next steps:
|
|
1. You must make sure these network ports are open:
|
|
TCP Ports:
|
|
* 80, 443: HTTP/HTTPS
|
|
* 389, 636: LDAP/LDAPS
|
|
* 88, 464: kerberos
|
|
* 53: bind
|
|
UDP Ports:
|
|
* 88, 464: kerberos
|
|
* 53: bind
|
|
* 123: ntp
|
|
|
|
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
|
|
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
|
|
and the web user interface.
|
|
|
|
Be sure to back up the CA certificates stored in /root/cacert.p12
|
|
These files are required to create replicas. The password for these
|
|
files is the Directory Manager password
|
|
The ipa-server-install command was successful
|
|
``` |