1) 安装IPA及确认DNS解析
# 有DNS则不需要安装ipa-server-dns软件
[root@node1 ~]# yum install ipa-server ipa-server-dns -y
[root@node1 ~]# nslookup node1 # 确保DNS解析正常
Server: 192.168.10.11
Address: 192.168.10.11#53
Name: node1.1000cc.net
Address: 192.168.10.11
2) 配置IPA Server
# 如果没有DNS则使用IPA SERVER自带的DNS
[root@node1 ~]# echo '192.168.10.11 node1.1000cc.net node1' >> /etc/hosts
[root@node1 ~]# ipa-server-install --setup-dns
# 如果有DNS，则直接配置
[root@node1 ~]# ipa-server-install
......
......
# 是否配置IPA集成的DNS服务
Do you want to configure integrated DNS (BIND)? [no]: # 回车
# 确认IPA Server的FQDN
Server host name [node1.1000cc.net]: # 回车
# 验证Domain Name
Please confirm the domain name [1000cc.net]: # 回车
# 验证Realm Name
Please provide a realm name [1000CC.NET]: # 回车
# 设置目录服务的管理员密码
Directory Manager password: # 设定密码
Password (confirm):
# 设定IPA管理员密码
IPA admin password: # 设定密码
Password (confirm):
# 保存设置配置
Continue to configure the system with these values? [no]:yes
......
......
Please add records in this file to your DNS system: /tmp/ipa.system.records.qI3wFs.db
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
UDP Ports:
* 88, 464: kerberos
* 123: ntp
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
3) 初始化IPA
[root@node1 ~]# kinit admin
Password for admin@1000CC.NET: # 输入IPA管理员密码
[root@node1 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@1000CC.NET
Valid starting Expires Service principal
01/30/2020 21:11:01 01/31/2020 21:10:33 krbtgt/1000CC.NET@1000CC.NET
# 设定IPA SHELL
[root@node1 ~]# ipa config-mod --defaultshell=/bin/bash
Maximum username length: 32
Home directory base: /home
Default shell: /bin/bash
Default users group: ipausers
Default e-mail domain: 1000cc.net
Search time limit: 2
Search size limit: 100
User search fields: uid,givenname,sn,telephonenumber,ou,title
Group search fields: cn,description
Enable migration mode: FALSE
Certificate Subject base: O=1000CC.NET
Password Expiration Notification (days): 4
Password plugin features: AllowNThash, KDC:Disable Last Success
SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
Default SELinux user: unconfined_u:s0-s0:c0.c1023
Default PAC types: MS-PAC, nfs:NONE
IPA masters: node1.1000cc.net
IPA master capable of PKINIT: node1.1000cc.net
IPA CA servers: node1.1000cc.net
IPA NTP servers: node1.1000cc.net
IPA CA renewal master: node1.1000cc.net
# 设定防火墙规则
[root@node1 ~]# firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns,ntp} --permanent
success
[root@node1 ~]# firewall-cmd --reload
success
|
