• CentOS安装配置freeIPA

    FreeIPA是Linux开源安全解决方案，提供用户账户管理和集中身份验证。

    FreeIPA在CentOS 7、Fedora和Ubuntu14.04 /16.04上能够非常直接地将计算机添加到您的IPA域中。其他操作系统可以使用SSSD或LDAP对FreeIPA进行身份验证。

    freeIPA的部署：

    1、设置主机名：

    hostnamectl set-hostname ipaserver.changchunhua.cloud

    2、升级软件和系统内核：

    yum update -y

    3、设置防火墙：

    systemctl stop firewalld && systemctl disable firewalld

    4、配置hosts文件：

    1. vim /etc/hosts
    2.  
    3. 192.168.17.120 ipaserver.changchunhua.cloud ipaserver

    5、配置随机数生成器：

    1. yum install -y rng-tools
    2. systemctl start rngd
    3. systemctl enable rngd
    4. systemctl status rngd

    6、安装Bind软件并启动：

    1. yum -y install bind bind-utils bind-dyndb-ldap
    2. systemctl start named
    3. systemctl enable named
    4.  
    5. systemctl status named
    6.  
    7. vim /etc/resolv.conf
    8. nameserver 127.0.0.1

    7、安装ipa-server软件包：

    yum -y install ipa-server ipa-server-dns

    8、配置ipa-server:

    1.  
    2. [root@ipaserver ~]# ipa-server-install --allow-zone-overlap
    3.  
    4. The log file for this installation can be found in /var/log/ipaserver-install.log
    5. ==============================================================================
    6. This program will set up the IPA Server.
    7.  
    8. This includes:
    9.   * Configure a stand-alone CA (dogtag) for certificate management
    10.   * Configure the Network Time Daemon (ntpd)
    11.   * Create and configure an instance of Directory Server
    12.   * Create and configure a Kerberos Key Distribution Center (KDC)
    13.   * Configure Apache (httpd)
    14.   * Configure the KDC to enable PKINIT
    15.  
    16. To accept the default shown in brackets, press the Enter key.
    17.  
    18. Do you want to configure integrated DNS (BIND)? [no]: yes
    19.  
    20. Enter the fully qualified domain name of the computer
    21. on which you're setting up server software. Using the form
    22. .
    23. Example: master.example.com.
    26. Server host name [ipaserver.changchunhua.cloud]:
    28. Warning: skipping DNS resolution of host ipaserver.changchunhua.cloud
    29. The domain name has been determined based on the host name.
    31. Please confirm the domain name [changchunhua.cloud]:
    33. The kerberos protocol requires a Realm name to be defined.
    34. This is typically the domain name converted to uppercase.
    36. Please provide a realm name [CHANGCHUNHUA.CLOUD]:
    37. Certain directory server operations require an administrative user.
    38. This user is referred to as the Directory Manager and has full access
    39. to the Directory for system management tasks and will be added to the
    40. instance of directory server created for IPA.
    41. The password must be at least 8 characters long.
    43. Directory Manager password:
    44. Password (confirm):
    46. The IPA server requires an administrative user, named 'admin'.
    47. This user is a regular system account used for IPA server administration.
    49. IPA admin password:
    50. Password (confirm):
    52. Checking DNS domain changchunhua.cloud., please wait ...
    53. Do you want to configure DNS forwarders? [yes]:
    54. Following DNS servers are configured in /etc/resolv.conf: 127.0.0.1, 8.8.8.8
    55. Do you want to configure these servers as DNS forwarders? [yes]:
    56. All DNS servers from /etc/resolv.conf were added. You can enter additional addresses now:
    57. Enter an IP address for a DNS forwarder, or press Enter to skip:
    58. Checking DNS forwarders, please wait ...
    59. Do you want to search for missing reverse zones? [yes]:
    60. Do you want to create reverse zone for IP 192.168.17.140 [yes]:
    61. Please specify the reverse zone name [17.168.192.in-addr.arpa.]:
    62. Using reverse zone(s) 17.168.192.in-addr.arpa.
    64. The IPA Master Server will be configured with:
    65. Hostname:       ipaserver.changchunhua.cloud
    66. IP address(es): 192.168.17.140
    67. Domain name:    changchunhua.cloud
    68. Realm name:     CHANGCHUNHUA.CLOUD
    70. BIND DNS server will be configured to serve IPA domain with:
    71. Forwarders:       127.0.0.1, 8.8.8.8
    72. Forward policy:   only
    73. Reverse zone(s):  17.168.192.in-addr.arpa.
    75. Continue to configure the system with these values? [no]: yes
    77. The following operations may take some minutes to complete.
    78. Please wait until the prompt is returned.
    80. Configuring NTP daemon (ntpd)
    81.   [1/4]: stopping ntpd
    82.   [2/4]: writing configuration
    83.   [3/4]: configuring ntpd to start on boot
    84.   [4/4]: starting ntpd
    85. Done configuring NTP daemon (ntpd).
    86. Configuring directory server (dirsrv). Estimated time: 30 seconds
    87.   [1/45]: creating directory server instance
    88.   [2/45]: enabling ldapi
    89.   [3/45]: configure autobind for root
    90.   [4/45]: stopping directory server
    91.   [5/45]: updating configuration in dse.ldif
    92.   [6/45]: starting directory server
    93.   [7/45]: adding default schema
    94.   [8/45]: enabling memberof plugin
    95.   [9/45]: enabling winsync plugin
    96.   [10/45]: configure password logging
    97.   [11/45]: configuring replication version plugin
    98.   [12/45]: enabling IPA enrollment plugin
    99.   [13/45]: configuring uniqueness plugin
    100.   [14/45]: configuring uuid plugin
    101.   [15/45]: configuring modrdn plugin
    102.   [16/45]: configuring DNS plugin
    103.   [17/45]: enabling entryUSN plugin
    104.   [18/45]: configuring lockout plugin
    105.   [19/45]: configuring topology plugin
    106.   [20/45]: creating indices
    107.   [21/45]: enabling referential integrity plugin
    108.   [22/45]: configuring certmap.conf
    109.   [23/45]: configure new location for managed entries
    110.   [24/45]: configure dirsrv ccache
    111.   [25/45]: enabling SASL mapping fallback
    112.   [26/45]: restarting directory server
    113.   [27/45]: adding sasl mappings to the directory
    114.   [28/45]: adding default layout
    115.   [29/45]: adding delegation layout
    116.   [30/45]: creating container for managed entries
    117.   [31/45]: configuring user private groups
    118.   [32/45]: configuring netgroups from hostgroups
    119.   [33/45]: creating default Sudo bind user
    120.   [34/45]: creating default Auto Member layout
    121.   [35/45]: adding range check plugin
    122.   [36/45]: creating default HBAC rule allow_all
    123.   [37/45]: adding entries for topology management
    124.   [38/45]: initializing group membership
    125.   [39/45]: adding master entry
    126.   [40/45]: initializing domain level
    127.   [41/45]: configuring Posix uid/gid generation
    128.   [42/45]: adding replication acis
    129.   [43/45]: activating sidgen plugin
    130.   [44/45]: activating extdom plugin
    131.   [45/45]: configuring directory to start on boot
    132. Done configuring directory server (dirsrv).
    133. Configuring Kerberos KDC (krb5kdc)
    134.   [1/10]: adding kerberos container to the directory
    135.   [2/10]: configuring KDC
    136.   [3/10]: initialize kerberos container
    137.   [4/10]: adding default ACIs
    138.   [5/10]: creating a keytab for the directory
    139.   [6/10]: creating a keytab for the machine
    140.   [7/10]: adding the password extension to the directory
    141.   [8/10]: creating anonymous principal
    142.   [9/10]: starting the KDC
    143.   [10/10]: configuring KDC to start on boot
    144. Done configuring Kerberos KDC (krb5kdc).
    145. Configuring kadmin
    146.   [1/2]: starting kadmin
    147.   [2/2]: configuring kadmin to start on boot
    148. Done configuring kadmin.
    149. Configuring ipa-custodia
    150.   [1/5]: Making sure custodia container exists
    151.   [2/5]: Generating ipa-custodia config file
    152.   [3/5]: Generating ipa-custodia keys
    153.   [4/5]: starting ipa-custodia
    154.   [5/5]: configuring ipa-custodia to start on boot
    155. Done configuring ipa-custodia.
    156. Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
    157.   [1/30]: configuring certificate server instance
    158.   [2/30]: secure AJP connector
    159.   [3/30]: reindex attributes
    160.   [4/30]: exporting Dogtag certificate store pin
    161.   [5/30]: stopping certificate server instance to update CS.cfg
    162.   [6/30]: backing up CS.cfg
    163.   [7/30]: disabling nonces
    164.   [8/30]: set up CRL publishing
    165.   [9/30]: enable PKIX certificate path discovery and validation
    166.   [10/30]: starting certificate server instance
    167.   [11/30]: configure certmonger for renewals
    168.   [12/30]: requesting RA certificate from CA
    169.   [13/30]: setting audit signing renewal to 2 years
    170.   [14/30]: restarting certificate server
    171.   [15/30]: publishing the CA certificate
    172.   [16/30]: adding RA agent as a trusted user
    173.   [17/30]: authorizing RA to modify profiles
    174.   [18/30]: authorizing RA to manage lightweight CAs
    175.   [19/30]: Ensure lightweight CAs container exists
    176.   [20/30]: configure certificate renewals
    177.   [21/30]: configure Server-Cert certificate renewal
    178.   [22/30]: Configure HTTP to proxy connections
    179.   [23/30]: restarting certificate server
    180.   [24/30]: updating IPA configuration
    181.   [25/30]: enabling CA instance
    182.   [26/30]: migrating certificate profiles to LDAP
    183.   [27/30]: importing IPA certificate profiles
    184.   [28/30]: adding default CA ACL
    185.   [29/30]: adding 'ipa' CA entry
    186.   [30/30]: configuring certmonger renewal for lightweight CAs
    187. Done configuring certificate server (pki-tomcatd).
    188. Configuring directory server (dirsrv)
    189.   [1/3]: configuring TLS for DS instance
    190.   [2/3]: adding CA certificate entry
    191.   [3/3]: restarting directory server
    192. Done configuring directory server (dirsrv).
    193. Configuring ipa-otpd
    194.   [1/2]: starting ipa-otpd
    195.   [2/2]: configuring ipa-otpd to start on boot
    196. Done configuring ipa-otpd.
    197. Configuring the web interface (httpd)
    198.   [1/22]: stopping httpd
    199.   [2/22]: setting mod_nss port to 443
    200.   [3/22]: setting mod_nss cipher suite
    201.   [4/22]: setting mod_nss protocol list to TLSv1.2
    202.   [5/22]: setting mod_nss password file
    203.   [6/22]: enabling mod_nss renegotiate
    204.   [7/22]: disabling mod_nss OCSP
    205.   [8/22]: adding URL rewriting rules
    206.   [9/22]: configuring httpd
    207.   [10/22]: setting up httpd keytab
    208.   [11/22]: configuring Gssproxy
    209.   [12/22]: setting up ssl
    210.   [13/22]: configure certmonger for renewals
    211.   [14/22]: importing CA certificates from LDAP
    212.   [15/22]: publish CA cert
    213.   [16/22]: clean up any existing httpd ccaches
    214.   [17/22]: configuring SELinux for httpd
    215.   [18/22]: create KDC proxy config
    216.   [19/22]: enable KDC proxy
    217.   [20/22]: starting httpd
    218.   [21/22]: configuring httpd to start on boot
    219.   [22/22]: enabling oddjobd
    220. Done configuring the web interface (httpd).
    221. Configuring Kerberos KDC (krb5kdc)
    222.   [1/1]: installing X509 Certificate for PKINIT
    223. Done configuring Kerberos KDC (krb5kdc).
    224. Applying LDAP updates
    225. Upgrading IPA:. Estimated time: 1 minute 30 seconds
    226.   [1/10]: stopping directory server
    227.   [2/10]: saving configuration
    228.   [3/10]: disabling listeners
    229.   [4/10]: enabling DS global lock
    230.   [5/10]: disabling Schema Compat
    231.   [6/10]: starting directory server
    232.   [7/10]: upgrading server
    233.   [8/10]: stopping directory server
    234.   [9/10]: restoring configuration
    235.   [10/10]: starting directory server
    236. Done.
    237. Restarting the KDC
    238. Configuring DNS (named)
    239.   [1/12]: generating rndc key file
    240.   [2/12]: adding DNS container
    241.   [3/12]: setting up our zone
    242.   [4/12]: setting up reverse zone
    243.   [5/12]: setting up our own record
    244.   [6/12]: setting up records for other masters
    245.   [7/12]: adding NS record to the zones
    246.   [8/12]: setting up kerberos principal
    247.   [9/12]: setting up named.conf
    248.   [10/12]: setting up server configuration
    249.   [11/12]: configuring named to start on boot
    250.   [12/12]: changing resolv.conf to point to ourselves
    251. Done configuring DNS (named).
    252. Restarting the web server to pick up resolv.conf changes
    253. Configuring DNS key synchronization service (ipa-dnskeysyncd)
    254.   [1/7]: checking status
    255.   [2/7]: setting up bind-dyndb-ldap working directory
    256.   [3/7]: setting up kerberos principal
    257.   [4/7]: setting up SoftHSM
    258.   [5/7]: adding DNSSEC containers
    259.   [6/7]: creating replica keys
    260.   [7/7]: configuring ipa-dnskeysyncd to start on boot
    261. Done configuring DNS key synchronization service (ipa-dnskeysyncd).
    262. Restarting ipa-dnskeysyncd
    263. Restarting named
    264. Updating DNS system records
    265. Configuring client side components
    266. Using existing certificate '/etc/ipa/ca.crt'.
    267. Client hostname: ipaserver.changchunhua.cloud
    268. Realm: CHANGCHUNHUA.CLOUD
    269. DNS Domain: changchunhua.cloud
    270. IPA Server: ipaserver.changchunhua.cloud
    271. BaseDN: dc=changchunhua,dc=cloud
    273. Skipping synchronizing time with NTP server.
    274. New SSSD config will be created
    275. Configured sudoers in /etc/nsswitch.conf
    276. Configured /etc/sssd/sssd.conf
    277. trying https://ipaserver.changchunhua.cloud/ipa/json
    278. [try 1]: Forwarding 'schema' to json server 'https://ipaserver.changchunhua.cloud/ipa/json'
    279. trying https://ipaserver.changchunhua.cloud/ipa/session/json
    280. [try 1]: Forwarding 'ping' to json server 'https://ipaserver.changchunhua.cloud/ipa/session/json'
    281. [try 1]: Forwarding 'ca_is_enabled' to json server 'https://ipaserver.changchunhua.cloud/ipa/session/json'
    282. Systemwide CA database updated.
    283. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
    284. Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
    285. Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
    286. [try 1]: Forwarding 'host_mod' to json server 'https://ipaserver.changchunhua.cloud/ipa/session/json'
    287. SSSD enabled
    288. Configured /etc/openldap/ldap.conf
    289. Configured /etc/ssh/ssh_config
    290. Configured /etc/ssh/sshd_config
    291. Configuring changchunhua.cloud as NIS domain.
    292. Client configuration complete.
    293. The ipa-client-install command was successful
    295. ==============================================================================
    296. Setup complete
    298. Next steps:
    299.         1. You must make sure these network ports are open:
    300.                 TCP Ports:
    301.                   * 80, 443: HTTP/HTTPS
    302.                   * 389, 636: LDAP/LDAPS
    303.                   * 88, 464: kerberos
    304.                   * 53: bind
    305.                 UDP Ports:
    306.                   * 88, 464: kerberos
    307.                   * 53: bind
    308.                   * 123: ntp
    310.         2. You can now obtain a kerberos ticket using the command: 'kinit admin'
    311.            This ticket will allow you to use the IPA tools (e.g., ipa user-add)
    312.            and the web user interface.
    314. Be sure to back up the CA certificates stored in /root/cacert.p12
    315. These files are required to create replicas. The password for these
    316. files is the Directory Manager password

    9、验证freeIPA服务功能

    通过尝试为admin用户初始化kerberos令牌来验证Kerberos域是否已正确安装。

    1. [root@vm1 ~]# kinit admin
    2. Password for admin@TMP.GCE.CLOUDERA.COM:
    3.  
    4. [root@ipaserver ~]# klist
    5. Ticket cache: KEYRING:persistent:0:0
    6. Default principal: admin@CHANGCHUNHUA.CLOUD
    7.  
    8. Valid starting       Expires              Service principal
    9. 11/12/2022 02:32:36  11/13/2022 02:32:33  krbtgt/CHANGCHUNHUA.CLOUD@CHANGCHUNHUA.CLOUD
    10.

    10、验证IPA服务器是否正常运行

    1. [root@ipaserver ~]# ipa user-find admin
    2. --------------
    3. 1 user matched
    4. --------------
    5.   User login: admin
    6.   Last name: Administrator
    7.   Home directory: /home/admin
    8.   Login shell: /bin/bash
    9.   Principal alias: admin@CHANGCHUNHUA.CLOUD
    10.   UID: 229800000
    11.   GID: 229800000
    12.   Account disabled: False
    13. ----------------------------
    14. Number of entries returned 1
    15. ----------------------------
    16.

     然后我这边通过浏览器访问https://ipaserver.changchunhua.cloud/ipa/ui出现问题。

    这个问题，我估计是什么DNS的问题。更新了电脑上的DNS的配置。

    然后就能看到这个页面了。

    通过ping命令，可以解析成功。 

    使用admin的账号和配置的密码登录： 

    11、查看IPA组件状态：

    1. [root@ipaserver ~]# ipactl status
    2. Directory Service: RUNNING
    3. krb5kdc Service: RUNNING
    4. kadmin Service: RUNNING
    5. named Service: RUNNING
    6. httpd Service: RUNNING
    7. ipa-custodia Service: RUNNING
    8. ntpd Service: RUNNING
    9. pki-tomcatd Service: RUNNING
    10. ipa-otpd Service: RUNNING
    11. ipa-dnskeysyncd Service: RUNNING
    12. ipa: INFO: The ipactl command was successful
    1. [root@ipaserver ~]# ipactl --help
    2. Usage: ipactl start|stop|restart|status
    3.  
    4.  
    5. Options:
    6.   -h, --help            show this help message and exit
    7.   -d, --debug           Display debugging information
    8.   -f, --force           Force IPA to start. Combine options --skip-version-
    9.                         check and --ignore-service-failures
    10.   --ignore-service-failures
    11.                         If any service start fails, do not rollback the
    12.                         services, continue with the operation
    13.   --skip-version-check  skip version check

    2023年3月6日：

    然后我这边再试着按照docker的方式来部署freeIPA：

    1. docker run --rm --name freeipa -ti \
    2. --read-only \
    3. --sysctl net.ipv6.conf.all.disable_ipv6=0 \
    4. -h ipaserver.changchunhua.cloud \
    5. -p 443:443 -p 8009:389 \
    6. -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
    7. -v /data/webapps/ipa:/data:Z \
    8. freeipa/freeipa-server:centos-8-stream

     

  • 相关阅读:
    QT实现凸凹边形等距缩放
    字符串拼接re.sub()用法
    PHP GC回收机制详解
    GPT引领前沿与应用突破之GPT4科研实践技术与AI绘图
    第六届“中国法研杯”司法人工智能挑战赛
    SpringCloudGateway--Sentinel限流、熔断降级
    python中，axis=0，axis=1，axis=2的理解【对于按待定轴求和，axis=‘x’的理解】
    2022年最新前端面试题
    【华为账号服务】【FAQ】Account Kit常见咨询合集--获取帐号个人信息相关问题
    CesiumJS 源码杂谈 - 从光到 Uniform
  • 原文地址：https://blog.csdn.net/chang_chunhua/article/details/127777052