IPA Server configuration with IdM Replicas
Master Server Hostname & IP :- node1.example.com (172.66.249.5)
Replica Server Hostname & IP:- node2.example.com (172.66.249.8)
[root@node1 ~]# ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:0C:29:6C:C7:7A
inet addr:172.66.249.5 Bcast:172.66.255.255 Mask:255.255.0.0
inet6 addr: fec0::ffff:20c:29ff:fe6c:c77a/64 Scope:Site
inet6 addr: fe80::20c:29ff:fe6c:c77a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:12158 errors:0 dropped:0 overruns:0 frame:0
TX packets:9580 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2254233 (2.1 MiB) TX bytes:8164560 (7.7 MiB)
[root@node1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.66.249.5 node1.example.com node1
172.66.249.8 node2.example.com node2
{NOTE:- LDAP port no is 389, LDAPS port no is 636 }
Enable firewall to allow access to port 389:-
[root@node1 ~]#iptables -A INPUT -p tcp --dport 389 -j ACCEPT
HTTP/HTTPS
80, 443
TCP
LDAP/LDAPS
389, 636
TCP
Kerberos
88, 464
TCP and UDP
DNS
53
TCP and UDP
NTP
123
UDP
Dogtag Certificate System - LDAP
7389
TCP
Disable off the NetworkManager service in the start list and stop the NetworkManager service:-
[root@node1 ~]# chkconfig NetworkManager off
[root@node1 ~]#service NetworkManager stop
Installing the IdM Server Packages:-
[root@node1 ~]# yum install ipa-server bind bind-dyndb-ldap -y
Run the ipa-server-install script:-
{Note:- Directory Manager password:- ibmserver123; admin password:- ibmserveradmin123}
[root@node1 ~]# ipa-server-install
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create a nd configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
To accept the default shown in brackets, press the Enter key.
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.
Server host name [node1.example.com]:
The domain name has been determined based on the host name.
Please confirm the domain name [example.com]:
The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Please provide a realm name [EXAMPLE.COM]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.
Directory Manager password:
Password (confirm):
The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.
IPA admin password:
Password (confirm):
The IPA Master Server will be configured with:
Hostname: node1.example.com
IP address: 172.66.249.5
Domain name: example.com
Realm name: EXAMPLE.COM
Continue to configure the system with these values? [no]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 minutes 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 33 minutes 30 seconds
[1/21]: creating certificate server user
[2/21]: creating pki-ca instance
[3/21]: configuring certificate server instance
[4/21]: disabling nonces
[5/21]: creating CA agent PKCS#12 file in /root
[6/21]: creating RA agent certificate database
[7/21]: importing CA chain to RA certificate database
[8/21]: fixing RA database permissions
[9/21]: setting up signing cert profile
[10/21]: set up CRL publishing
[11/21]: set certificate subject base
[12/21]: enabling Subject Key Identifier
[13/21]: setting audit signing renewal to 2 years
[14/21]: configuring certificate server to start on boot
[15/21]: restarting certificate server
[16/21]: requesting RA certificate from CA
[17/21]: issuing RA agent certificate
[18/21]: adding RA agent as a trusted user
[19/21]: configure certificate renewals
[20/21]: configure Server-Cert certificate renewal
[21/21]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Configuring directory server (dirsrv): Estimated time 31 minutes
[1/38]: creating directory server user
[2/38]: creating directory server instance
[3/38]: adding default schema
[4/38]: enabling memberof plugin
[5/38]: enabling winsync plugin
[6/38]: configuring replication version plugin
[7/38]: enabling IPA enrollment plugin
[8/38]: enabling ldapi
[9/38]: disabling betxn plugins
[10/38]: configuring uniqueness plugin
[11/38]: configuring uuid plugin
[12/38]: configuring modrdn plugin
[13/38]: enabling entryUSN plugin
[14/38]: configuring lockout plugin
[15/38]: creating indices
[16/38]: enabling referential integrity plugin
[17/38]: configuring ssl for ds instance
[18/38]: configuring certmap.conf
[19/38]: configure autobind for root
[20/38]: configure new location for managed entries
[21/38]: restarting directory server
[22/38]: adding default layout
[23/38]: adding delegation layout
[24/38]: adding replication acis
[25/38]: creating container for managed entries
[26/38]: configuring user private groups
[27/38]: configuring netgroups from hostgroups
[28/38]: creating default Sudo bind user
[29/38]: creating default Auto Member layout
[30/38]: adding range check plugin
[31/38]: creating default HBAC rule allow_all
[32/38]: Upload CA cert to the directory
[33/38]: initializing group membership
[34/38]: adding master entry
[35/38]: configuring Posix uid/gid generation
[36/38]: enabling compatibility plugin
[37/38]: tuning directory server
[38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 minutes 30 seconds
[1/10]: adding sasl mappings to the directory
[2/10]: adding kerberos container to the directory
[3/10]: configuring KDC
[4/10]: initialize kerberos container
[5/10]: adding default ACIs
[6/10]: creating a keytab for the directory
[7/10]: creating a keytab for the machine
[8/10]: adding the password extension to the directory
[9/10]: starting the KDC
[10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
[1/2]: starting ipa_memcached
[2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd): Estimated time 31 minutes
[1/14]: setting mod_nss port to 443
[2/14]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
[3/14]: setting mod_nss password file
[4/14]: enabling mod_nss renegotiate
[5/14]: adding URL rewriting rules
[6/14]: configuring httpd
[7/14]: setting up ssl
[8/14]: setting up browser autoconfig
[9/14]: publish CA cert
[10/14]: creating a keytab for httpd
[11/14]: clean up any existing httpd ccache
[12/14]: configuring SELinux for httpd
[13/14]: restarting httpd
[14/14]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Sample zone file for bind has been created in /tmp/sample.zone.hakfEa.db
Restarting the web server
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
UDP Ports:
* 88, 464: kerberos
* 123: ntp
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password
Restart the SSH service to retrieve the Kerberos principal and to refresh the name server switch (NSS) configuration file:-
[root@node1 ~]# service sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
Authenticate to the Kerberos realm using the admin user's credentials to ensure that the user is properly configured and the Kerberos realm is accessible
[root@node1 ~]# kinit admin
Password for admin@EXAMPLE.COM:
Test the IdM configuration by running a command like ipa user-find
[root@node1 ~]# ipa user-find admin
--------------
1 user matched
--------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
UID: 1914800000
GID: 1914800000
Account disabled: False
Password: True
Kerberos keys available: True
----------------------------
Number of entries returned 1
----------------------------
Add New User Accounts in IPA Server:-
[root@node1 ~]# ipa user-add mango --first=ARCH --last=Linux --password
Password:
Enter Password again to verify:
------------------
Added user "mango"
------------------
User login: mango
First name: ARCH
Last name: Linux
Full name: ARCH Linux
Display name: ARCH Linux
Initials: AL
Home directory: /home/mango
GECOS field: ARCH Linux
Login shell: /bin/sh
Kerberos principal: mango@EXAMPLE.COM
Email address: mango@example.com
UID: 1914800003
GID: 1914800003
Password: True
Kerberos keys available: True
[root@node1 ~]# ipa user-add jhon --first=jhon --last=corner --password
Password:
Enter Password again to verify:
-----------------
Added user "jhon"
-----------------
User login: jhon
First name: jhon
Last name: corner
Full name: jhon corner
Display name: jhon corner
Initials: jc
Home directory: /home/jhon
GECOS field: jhon corner
Login shell: /bin/sh
Kerberos principal: jhon@EXAMPLE.COM
Email address: jhon@example.com
UID: 1914800004
GID: 1914800004
Password: True
Kerberos keys available: True
Delete a IPA user:-
[root@node1 ~]# ipa user-del jhon
-------------------
Deleted user "jhon"
-------------------
Replica server configuration:
[root@node2 ~]# yum install ipa-server bind bind-dyndb-ld
Creating the Replica server
On the master server create a replica information file, This contains realm and configuration information taken from the master server which will be used to configure the replica server.
[root@node1 ~]# ipa-replica-prepare node2.example.com
Directory Manager (existing master) password:
Preparing replica for node2.example.com from node1.example.com
Creating SSL certificate for the Directory Server
Creating SSL certificate for the dogtag Directory Server
Creating SSL certificate for the Web Server
Exporting RA certificate
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-node2.example.com.gpg
Copy the replica information file to the replica server:-
[root@node1 ~]# scp /var/lib/ipa/replica-info-node2.example.com.gpg root@node2:/var/lib/ipa/
On the replica server, run the replica installation script:-
[root@node2 ~]# ipa-replica-install --setup-ca /var/lib/ipa/replica-info-node2.example.com.gpg
Directory Manager (existing master) password:
Run connection check to master
Check connection from replica to remote master 'node1.example.com':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos Kpasswd: TCP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
PKI-CA: Directory Service port (7389): OK
The following list of ports use UDP protocol and would need to be
checked manually:
Kerberos KDC: UDP (88): SKIPPED
Kerberos Kpasswd: UDP (464): SKIPPED
Connection from replica to master is OK.
Start listening on required ports for remote master check
Get credentials to log in to remote master
admin@EXAMPLE.COM password:
Execute check on remote master
Check connection from master to remote replica 'node2.example.com':
Directory Service: Unsecure port (389): OK
Directory Service: Secure port (636): OK
Kerberos KDC: TCP (88): OK
Kerberos KDC: UDP (88): OK
Kerberos Kpasswd: TCP (464): OK
Kerberos Kpasswd: UDP (464): OK
HTTP Server: Unsecure port (80): OK
HTTP Server: Secure port (443): OK
PKI-CA: Directory Service port (7389): OK
Connection from master to replica is OK.
Connection check OK
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 minutes 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 33 minutes 30 seconds
[1/17]: creating certificate server user
[2/17]: creating pki-ca instance
[3/17]: configuring certificate server instance
[4/17]: disabling nonces
[5/17]: creating RA agent certificate database
[6/17]: importing CA chain to RA certificate database
[7/17]: fixing RA database permissions
[8/17]: setting up signing cert profile
[9/17]: set up CRL publishing
[10/17]: set certificate subject base
[11/17]: enabling Subject Key Identifier
[12/17]: setting audit signing renewal to 2 years
[13/17]: configuring certificate server to start on boot
[14/17]: configure certmonger for renewals
[15/17]: configure clone certificate renewals
[16/17]: configure Server-Cert certificate renewal
[17/17]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Restarting the directory and certificate servers
Configuring directory server (dirsrv): Estimated time 31 minutes
[1/31]: creating directory server user
[2/31]: creating directory server instance
[3/31]: adding default schema
[4/31]: enabling memberof plugin
[5/31]: enabling winsync plugin
[6/31]: configuring replication version plugin
[7/31]: enabling IPA enrollment plugin
[8/31]: enabling ldapi
[9/31]: disabling betxn plugins
[10/31]: configuring uniqueness plugin
[11/31]: configuring uuid plugin
[12/31]: configuring modrdn plugin
[13/31]: enabling entryUSN plugin
[14/31]: configuring lockout plugin
[15/31]: creating indices
[16/31]: enabling referential integrity plugin
[17/31]: configuring ssl for ds instance
[18/31]: configuring certmap.conf
[19/31]: configure autobind for root
[20/31]: configure new location for managed entries
[21/31]: restarting directory server
[22/31]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress
Update in progress
Update in progress
Update succeeded
[23/31]: adding replication acis
[24/31]: setting Auto Member configuration
[25/31]: enabling S4U2Proxy delegation
[26/31]: initializing group membership
[27/31]: adding master entry
[28/31]: configuring Posix uid/gid generation
[29/31]: enabling compatibility plugin
[30/31]: tuning directory server
[31/31]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 minutes 30 seconds
[1/9]: adding sasl mappings to the directory
[2/9]: writing stash file from DS
[3/9]: configuring KDC
[4/9]: creating a keytab for the directory
[5/9]: creating a keytab for the machine
[6/9]: adding the password extension to the directory
[7/9]: enable GSSAPI for replication
[8/9]: starting the KDC
[9/9]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
[1/2]: starting ipa_memcached
[2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd): Estimated time 31 minutes
[1/13]: setting mod_nss port to 443
[2/13]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
[3/13]: setting mod_nss password file
[4/13]: enabling mod_nss renegotiate
[5/13]: adding URL rewriting rules
[6/13]: configuring httpd
[7/13]: setting up ssl
[8/13]: publish CA cert
[9/13]: creating a keytab for httpd
[10/13]: clean up any existing httpd ccache
[11/13]: configuring SELinux for httpd
[12/13]: restarting httpd
[13/13]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the web server
[root@node2 ~]# kinit admin
Password for admin@EXAMPLE.COM:
[root@node2 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@EXAMPLE.COM
Valid starting Expires Service principal
09/04/15 10:49:48 09/05/15 10:49:39 krbtgt/EXAMPLE.COM@EXAMPLE.COM
09/04/15 10:50:15 09/05/15 10:49:39 HTTP/node2.example.com@EXAMPLE.COM
[root@node2 ~]# /etc/init.d/ipa status
Directory Service: RUNNING
KDC Service: RUNNING
KPASSWD Service: RUNNING
MEMCACHE Service: RUNNING
HTTP Service: RUNNING
CA Service: RUNNING
[root@node2 ~]# ipa user-find admin
--------------
1 user matched
--------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
UID: 1914800000
GID: 1914800000
Account disabled: False
Password: True
Kerberos keys available: True
----------------------------
Number of entries returned 1
[root@node2 ~]# ipa user-find mango
--------------
1 user matched
--------------
User login: mango
First name: ARCH
Last name: Linux
Home directory: /home/mango
Login shell: /bin/sh
Email address: mango@example.com
UID: 1914800003
GID: 1914800003
Account disabled: False
Password: True
Kerberos keys available: True
----------------------------
Number of entries returned 1
IPA Server Web Management Console:-
access to web browser please hit this URL "https://(FreeIPA server's hostname or IP address)/"
No comments:
Post a Comment