IPAサーバー構築2011/11/20 |
|
各サーバー間でユーザーのアカウント情報を共有できるようにIPAサーバーを構築します。
設定するホストはDNSで正引き/逆引きが正常にできるようにしておいてください。
|
|
| [1] | FreeIPAインストール |
|
[root@master ~]#
vi /etc/hosts # 自身のIPアドレスとホスト名を登録しておく 10.0.0.100 master.srv.world master
[root@master ~]#
[root@master ~]# yum -y install ipa-server ipa-server-install # セットアップ The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the FreeIPA Server. This includes: * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) To accept the default shown in brackets, press the Enter key. Enter the fully qualified domain name of the computer on which you're setting up server software. Using the form <hostname>.<domainname> Example: master.example.com.Server host name [master.srv.world]: # ホスト名を確認してEnter
The domain name has been calculated based on the host name.
Please confirm the domain name [srv.world]:
# ドメイン名を確認してEnter The IPA Master Server will be configured with Hostname: master.srv.world IP address: 10.0.0.100 Domain name: srv.world The kerberos protocol requires a Realm name to be defined. This is typically the domain name converted to uppercase.Please provide a realm name [SRV.WORLD]: # realm名を確認してEnter
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.
Directory Manager password:
# Directory Manager のパスワード設定 Password (confirm): # 確認再入力
The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.
IPA admin password:
# IPA admin のパスワード設定 Password (confirm): # 確認再入力
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring ntpd
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
done configuring ntpd.
Configuring directory server for the CA: Estimated time 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
done configuring pkids.
Configuring certificate server: Estimated time 6 minutes
[1/17]: creating certificate server user
[2/17]: creating pki-ca instance
[3/17]: restarting certificate server
[4/17]: configuring certificate server instance
[5/17]: restarting certificate server
[6/17]: creating CA agent PKCS#12 file in /root
[7/17]: creating RA agent certificate database
[8/17]: importing CA chain to RA certificate database
[9/17]: restarting certificate server
[10/17]: requesting RA certificate from CA
[11/17]: issuing RA agent certificate
[12/17]: adding RA agent as a trusted user
[13/17]: fixing RA database permissions
[14/17]: setting up signing cert profile
[15/17]: set up CRL publishing
[16/17]: configuring certificate server to start on boot
[17/17]: restarting certificate server
done configuring pki-cad.
Configuring directory server: Estimated time 1 minute
[1/32]: creating directory server user
[2/32]: creating directory server instance
[3/32]: adding default schema
[4/32]: enabling memberof plugin
[5/32]: enabling referential integrity plugin
[6/32]: enabling winsync plugin
[7/32]: configuring replication version plugin
[8/32]: enabling IPA enrollment plugin
[9/32]: enabling ldapi
[10/32]: configuring uniqueness plugin
[11/32]: configuring uuid plugin
[12/32]: configuring modrdn plugin
[13/32]: enabling entryUSN plugin
[14/32]: configuring lockout plugin
[15/32]: creating indices
[16/32]: configuring ssl for ds instance
[17/32]: configuring certmap.conf
[18/32]: configure autobind for root
[19/32]: restarting directory server
[20/32]: adding default layout
[21/32]: adding delegation layout
[22/32]: adding replication acis
[23/32]: configuring user private groups
[24/32]: configuring netgroups from hostgroups
[25/32]: creating default Sudo bind user
[26/32]: creating default HBAC rule allow_all
[27/32]: initializing group membership
[28/32]: adding master entry
[29/32]: configuring Posix uid/gid generation
[30/32]: enabling compatibility plugin
[31/32]: tuning directory server
ns-slapd[5174]: segfault at 0 ip 00007f7833d50538 sp 00007f780b1d7090 error 4 in liblinkedattrs-plugin.so[7f7833d4c000+8000]
[32/32]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC: Estimated time 30 seconds
[1/14]: setting KDC account password
[2/14]: adding sasl mappings to the directory
[3/14]: adding kerberos entries to the DS
[4/14]: adding default ACIs
[5/14]: configuring KDC
[6/14]: adding default keytypes
[7/14]: adding default password policy
[8/14]: creating a keytab for the directory
[9/14]: creating a keytab for the machine
[10/14]: exporting the kadmin keytab
[11/14]: adding the password extension to the directory
[12/14]: adding the kerberos master key to the directory
[13/14]: starting the KDC
[14/14]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
[1/2]: starting ipa_kpasswd
[2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface: Estimated time 1 minute
[1/12]: disabling mod_ssl in httpd
[2/12]: setting mod_nss port to 443
[3/12]: setting mod_nss password file
[4/12]: adding URL rewriting rules
[5/12]: configuring httpd
[6/12]: setting up ssl
[7/12]: setting up browser autoconfig
[8/12]: publish CA cert
[9/12]: creating a keytab for httpd
[10/12]: configuring SELinux for httpd
[11/12]: restarting httpd
[12/12]: configuring httpd to start on boot
done configuring httpd.
Setting the certificate subject base
restarting certificate server
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the web server
Sample zone file for bind has been created in /tmp/sample.zone.LZXe4m.db
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
UDP Ports:
* 88, 464: kerberos
* 123: ntp
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password
[root@master ~]# chkconfig dirsrv on [root@master ~]# chkconfig ipa_kpasswd on [root@master ~]# chkconfig kadmin on [root@master ~]# chkconfig kprop on [root@master ~]# chkconfig krb5kdc on [root@master ~]# chkconfig pki-cad on [root@master ~]# chkconfig tomcat6 on |
| [2] | Kerberos チケットを取得し、デフォルトシェルを bash に変更しておきます。また ntp の参照先が変更されているので元に戻しておきます。 |
|
[root@master ~]# kinit admin Password for admin@SRV.WORLD: # IPA admin パスワード [root@master ~]# klist # 確認 Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@SRV.WORLD Valid starting Expires Service principal 11/20/11 02:39:10 11/21/11 02:39:06 krbtgt/SRV.WORLD@SRV.WORLD[root@master ~]# ipa config-mod --defaultshell=/bin/bash Max. username length: 32 Home directory base: /home Default shell: /bin/bash Default users group: ipausers Default e-mail domain for new users: srv.world Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Migration mode: FALSE Certificate Subject base: O=SRV.WORLD
[root@master ~]#
vi /etc/ntp.conf # 同期をとるサーバーを変更 # server 0.rhel.pool.ntp.org# server 1.rhel.pool.ntp.org# server 2.rhel.pool.ntp.org# server 127.127.1.0# fudge 127.127.1.0 stratum 10server ntp1.jst.mfeed.ad.jp server ntp2.jst.mfeed.ad.jp server ntp3.jst.mfeed.ad.jp
/etc/rc.d/init.d/ntpd restart Shutting down ntpd: [ OK ] Starting ntpd: [ OK ] |
| [3] | IPAユーザー登録 ( ここで設定したパスワードは初回ログイン時に変更を求められます ) |
|
[root@master ~]# ipa user-add fermi --first=Fermi --last=Cern --password Password: # パスワード設定 Enter Password again to verify: ------------------ Added user "fermi" ------------------ User login: fermi First name: Fermi Last name: Cern Full name: Fermi Cern Display name: Fermi Cern Initials: FC Home directory: /home/fermi GECOS field: fermi Login shell: /bin/bash Kerberos principal: fermi@SRV.WORLD UID: 1215600006[root@master ~]# ipa user-find fermi # 確認 -------------- 1 user matched -------------- User login: fermi First name: Fermi Last name: Cern Home directory: /home/fermi Login shell: /bin/bash Account disabled: False Member of groups: ipausers ---------------------------- Number of entries returned 1 ---------------------------- |
| [4] | ローカルユーザーをIPAに一括登録 ( パスワードは仮パスワードとして、ユーザー名と同一にしておきます ) |
|
[root@master ~]#
vi ipauser.sh
# ローカルのGIDが500-999番のユーザーを抽出する # 一例ですのでご自由に改変してください
#!/bin/bash
for line in `grep "x:[5-9][0-9][0-9]:" /etc/passwd`
do
USER=`echo $line | cut -d: -f1`
FIRST=`echo $line | cut -d: -f5 | awk {'print $1'}`
LAST=`echo $line | cut -d: -f5 | awk {'print $2'}`
if [ ! "$FIRST" ]
then
FIRST=$USER
fi
if [ ! "$LAST" ]
then
LAST=$USER
fi
echo $USER | ipa user-add $USER --first=$FIRST --last=$LAST --password
done
sh ipauser.sh ------------------ Added user "fermi" ------------------ User login: fermi First name: fermi Last name: fermi Full name: fermi fermi Display name: fermi fermi Initials: ff Home directory: /home/fermi GECOS field: fermi Login shell: /bin/bash Kerberos principal: fermi@SRV.WORLD UID: 1583800004 ----------------- Added user "cent" ----------------- User login: cent First name: cent Last name: cent Full name: cent cent Display name: cent cent Initials: cc Home directory: /home/cent GECOS field: cent Login shell: /bin/bash Kerberos principal: cent@SRV.WORLD UID: 1583800005 ------------------- Added user "fedora" ------------------- User login: fedora First name: fedora Last name: fedora Full name: fedora fedora Display name: fedora fedora Initials: ff Home directory: /home/fedora GECOS field: fedora Login shell: /bin/bash Kerberos principal: fedora@SRV.WORLD UID: 1583800006 ------------------- Added user "ubuntu" ------------------- User login: ubuntu First name: ubuntu Last name: ubuntu Full name: ubuntu ubuntu Display name: ubuntu ubuntu Initials: uu Home directory: /home/ubuntu GECOS field: ubuntu Login shell: /bin/bash Kerberos principal: ubuntu@SRV.WORLD UID: 1583800007 ------------------- Added user "debian" ------------------- User login: debian First name: debian Last name: debian Full name: debian debian Display name: debian debian Initials: dd Home directory: /home/debian GECOS field: debian Login shell: /bin/bash Kerberos principal: debian@SRV.WORLD UID: 1583800008 |
| Sponsored Link |