Scientific Linux 6
Sponsored Link

IPAサーバー構築2011/11/20

 
各サーバー間でユーザーのアカウント情報を共有できるようにIPAサーバーを構築します。 設定するホストはDNSで正引き/逆引きが正常にできるようにしておいてください。
[1] FreeIPAインストール
[root@master ~]#
vi /etc/hosts
# 自身のIPアドレスとホスト名を登録しておく

10.0.0.100 master.srv.world master
[root@master ~]#
yum -y install ipa-server
[root@master ~]#
ipa-server-install
# セットアップ


The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the FreeIPA Server.

This includes:
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)

To accept the default shown in brackets, press the Enter key.

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.

Server host name [master.srv.world]:
# ホスト名を確認してEnter

The domain name has been calculated based on the host name.
Please confirm the domain name [srv.world]:
# ドメイン名を確認してEnter

The IPA Master Server will be configured with
Hostname:    master.srv.world
IP address:  10.0.0.100
Domain name: srv.world

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [SRV.WORLD]:
# realm名を確認してEnter

Certain directory server operations require an administrative user. This user is referred to as the Directory Manager and has full access to the Directory for system management tasks and will be added to the instance of directory server created for IPA. The password must be at least 8 characters long.
Directory Manager password:
# Directory Manager のパスワード設定

Password (confirm):
# 確認再入力

The IPA server requires an administrative user, named 'admin'. This user is a regular system account used for IPA server administration.
IPA admin password:
# IPA admin のパスワード設定

Password (confirm):
# 確認再入力

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server for the CA: Estimated time 30 seconds
  [1/3]: creating directory server user
  [2/3]: creating directory server instance
  [3/3]: restarting directory server
done configuring pkids.
Configuring certificate server: Estimated time 6 minutes
  [1/17]: creating certificate server user
  [2/17]: creating pki-ca instance
  [3/17]: restarting certificate server
  [4/17]: configuring certificate server instance
  [5/17]: restarting certificate server
  [6/17]: creating CA agent PKCS#12 file in /root
  [7/17]: creating RA agent certificate database
  [8/17]: importing CA chain to RA certificate database
  [9/17]: restarting certificate server
  [10/17]: requesting RA certificate from CA
  [11/17]: issuing RA agent certificate
  [12/17]: adding RA agent as a trusted user
  [13/17]: fixing RA database permissions
  [14/17]: setting up signing cert profile
  [15/17]: set up CRL publishing
  [16/17]: configuring certificate server to start on boot
  [17/17]: restarting certificate server
done configuring pki-cad.
Configuring directory server: Estimated time 1 minute
  [1/32]: creating directory server user
  [2/32]: creating directory server instance
  [3/32]: adding default schema
  [4/32]: enabling memberof plugin
  [5/32]: enabling referential integrity plugin
  [6/32]: enabling winsync plugin
  [7/32]: configuring replication version plugin
  [8/32]: enabling IPA enrollment plugin
  [9/32]: enabling ldapi
  [10/32]: configuring uniqueness plugin
  [11/32]: configuring uuid plugin
  [12/32]: configuring modrdn plugin
  [13/32]: enabling entryUSN plugin
  [14/32]: configuring lockout plugin
  [15/32]: creating indices
  [16/32]: configuring ssl for ds instance
  [17/32]: configuring certmap.conf
  [18/32]: configure autobind for root
  [19/32]: restarting directory server
  [20/32]: adding default layout
  [21/32]: adding delegation layout
  [22/32]: adding replication acis
  [23/32]: configuring user private groups
  [24/32]: configuring netgroups from hostgroups
  [25/32]: creating default Sudo bind user
  [26/32]: creating default HBAC rule allow_all
  [27/32]: initializing group membership
  [28/32]: adding master entry
  [29/32]: configuring Posix uid/gid generation
  [30/32]: enabling compatibility plugin
  [31/32]: tuning directory server
ns-slapd[5174]: segfault at 0 ip 00007f7833d50538 sp 00007f780b1d7090 error 4 in liblinkedattrs-plugin.so[7f7833d4c000+8000]
  [32/32]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC: Estimated time 30 seconds
  [1/14]: setting KDC account password
  [2/14]: adding sasl mappings to the directory
  [3/14]: adding kerberos entries to the DS
  [4/14]: adding default ACIs
  [5/14]: configuring KDC
  [6/14]: adding default keytypes
  [7/14]: adding default password policy
  [8/14]: creating a keytab for the directory
  [9/14]: creating a keytab for the machine
  [10/14]: exporting the kadmin keytab
  [11/14]: adding the password extension to the directory
  [12/14]: adding the kerberos master key to the directory
  [13/14]: starting the KDC
  [14/14]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
  [1/2]: starting ipa_kpasswd
  [2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface: Estimated time 1 minute
  [1/12]: disabling mod_ssl in httpd
  [2/12]: setting mod_nss port to 443
  [3/12]: setting mod_nss password file
  [4/12]: adding URL rewriting rules
  [5/12]: configuring httpd
  [6/12]: setting up ssl
  [7/12]: setting up browser autoconfig
  [8/12]: publish CA cert
  [9/12]: creating a keytab for httpd
  [10/12]: configuring SELinux for httpd
  [11/12]: restarting httpd
  [12/12]: configuring httpd to start on boot
done configuring httpd.
Setting the certificate subject base
restarting certificate server
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Restarting the web server
Sample zone file for bind has been created in /tmp/sample.zone.LZXe4m.db
==============================================================================
Setup complete

Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                UDP Ports:
                  * 88, 464: kerberos
                  * 123: ntp

        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
           and the web user interface.

Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password

[root@master ~]#
chkconfig dirsrv on

[root@master ~]#
chkconfig ipa_kpasswd on

[root@master ~]#
chkconfig kadmin on

[root@master ~]#
chkconfig kprop on

[root@master ~]#
chkconfig krb5kdc on

[root@master ~]#
chkconfig pki-cad on

[root@master ~]#
chkconfig tomcat6 on

[2] Kerberos チケットを取得し、デフォルトシェルを bash に変更しておきます。また ntp の参照先が変更されているので元に戻しておきます。
[root@master ~]#
kinit admin

Password for admin@SRV.WORLD:
# IPA admin パスワード

[root@master ~]#
klist
# 確認

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@SRV.WORLD

Valid starting     Expires            Service principal
11/20/11 02:39:10  11/21/11 02:39:06  krbtgt/SRV.WORLD@SRV.WORLD
[root@master ~]#
ipa config-mod --defaultshell=/bin/bash

  Max. username length: 32
  Home directory base: /home
  Default shell: /bin/bash
  Default users group: ipausers
  Default e-mail domain for new users: srv.world
  Search time limit: 2
  Search size limit: 100
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Migration mode: FALSE
  Certificate Subject base: O=SRV.WORLD

[root@master ~]#
vi /etc/ntp.conf
# 同期をとるサーバーを変更

#
server 0.rhel.pool.ntp.org
#
server 1.rhel.pool.ntp.org
#
server 2.rhel.pool.ntp.org
#
server 127.127.1.0
#
fudge 127.127.1.0 stratum 10
server ntp1.jst.mfeed.ad.jp

server ntp2.jst.mfeed.ad.jp

server ntp3.jst.mfeed.ad.jp
[root@master ~]#
/etc/rc.d/init.d/ntpd restart

Shutting down ntpd:
[ OK ]

Starting ntpd:
[ OK ]

[3] IPAユーザー登録 ( ここで設定したパスワードは初回ログイン時に変更を求められます )
[root@master ~]#
ipa user-add fermi --first=Fermi --last=Cern --password

Password:
# パスワード設定

Enter Password again to verify:
------------------
Added user "fermi"
------------------
  User login: fermi
  First name: Fermi
  Last name: Cern
  Full name: Fermi Cern
  Display name: Fermi Cern
  Initials: FC
  Home directory: /home/fermi
  GECOS field: fermi
  Login shell: /bin/bash
  Kerberos principal: fermi@SRV.WORLD
  UID: 1215600006
  
[root@master ~]#
ipa user-find fermi
# 確認

--------------
1 user matched
--------------
  User login: fermi
  First name: Fermi
  Last name: Cern
  Home directory: /home/fermi
  Login shell: /bin/bash
  Account disabled: False
  Member of groups: ipausers
----------------------------
Number of entries returned 1
----------------------------
[4] ローカルユーザーをIPAに一括登録 ( パスワードは仮パスワードとして、ユーザー名と同一にしておきます )
[root@master ~]#
vi ipauser.sh
# ローカルのGIDが500-999番のユーザーを抽出する
# 一例ですのでご自由に改変してください

#!/bin/bash

for line in `grep "x:[5-9][0-9][0-9]:" /etc/passwd`
do
   USER=`echo $line | cut -d: -f1`
   FIRST=`echo $line | cut -d: -f5 | awk {'print $1'}`
   LAST=`echo $line | cut -d: -f5 | awk {'print $2'}`
   if [ ! "$FIRST" ]
   then
      FIRST=$USER
   fi
   if [ ! "$LAST" ]
   then
      LAST=$USER
   fi
   echo $USER | ipa user-add $USER --first=$FIRST --last=$LAST --password
done
[root@master ~]#
sh ipauser.sh

------------------
Added user "fermi"
------------------
  User login: fermi
  First name: fermi
  Last name: fermi
  Full name: fermi fermi
  Display name: fermi fermi
  Initials: ff
  Home directory: /home/fermi
  GECOS field: fermi
  Login shell: /bin/bash
  Kerberos principal: fermi@SRV.WORLD
  UID: 1583800004
-----------------
Added user "cent"
-----------------
  User login: cent
  First name: cent
  Last name: cent
  Full name: cent cent
  Display name: cent cent
  Initials: cc
  Home directory: /home/cent
  GECOS field: cent
  Login shell: /bin/bash
  Kerberos principal: cent@SRV.WORLD
  UID: 1583800005
-------------------
Added user "fedora"
-------------------
  User login: fedora
  First name: fedora
  Last name: fedora
  Full name: fedora fedora
  Display name: fedora fedora
  Initials: ff
  Home directory: /home/fedora
  GECOS field: fedora
  Login shell: /bin/bash
  Kerberos principal: fedora@SRV.WORLD
  UID: 1583800006
-------------------
Added user "ubuntu"
-------------------
  User login: ubuntu
  First name: ubuntu
  Last name: ubuntu
  Full name: ubuntu ubuntu
  Display name: ubuntu ubuntu
  Initials: uu
  Home directory: /home/ubuntu
  GECOS field: ubuntu
  Login shell: /bin/bash
  Kerberos principal: ubuntu@SRV.WORLD
  UID: 1583800007
-------------------
Added user "debian"
-------------------
  User login: debian
  First name: debian
  Last name: debian
  Full name: debian debian
  Display name: debian debian
  Initials: dd
  Home directory: /home/debian
  GECOS field: debian
  Login shell: /bin/bash
  Kerberos principal: debian@SRV.WORLD
  UID: 1583800008
関連コンテンツ