Linux - IdM 身份管理伺服器安裝

1
2
3

1. DNS 名稱正反解析 
2. 主機固定 IP 
3. 時間同步

1
2
3
4

[root@utility ~]# host utility.lab.example.com
utility.lab.example.com has address 192.168.50.125
[root@utility ~]# host 192.168.50.125
125.50.168.192.in-addr.arpa domain name pointer utility.lab.example.com.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

[root@utility ~]# systemctl enable --now chronyd
[root@utility ~]# chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* bastion.lab.example.com       3   6     7    63   -127us[ +288us] +/-   22ms
^- 140.137.11.50                 2   6    77    57   -459us[ -459us] +/-   42ms
^- ntp2.ntu.edu.tw               2   6    77    60   +314us[ +314us] +/-   49ms
^- twtpe2-ntp-002.aaplimg.c>     1   6    77    59   +239us[ +239us] +/- 2125us
^- 114-35-131-27.hinet-ip.h>     2   6    77    58  +2128us[+2128us] +/-   32ms

1

yum module enable idm:DL1

1

yum distro-sync

1

yum module install idm:DL1/server

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

[root@utility ~]# ipa-server-install --realm LAB.EXAMPLE.COM --ds-password redhat123 --admin-password redhat123 --unattended

...output omitted...

The IPA Master Server will be configured with:
Hostname:       utility.lab.example.com
IP address(es): 192.168.50.125
Domain name:    lab.example.com
Realm name:     LAB.EXAMPLE.COM

The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=LAB.EXAMPLE.COM
Subject base: O=LAB.EXAMPLE.COM
Chaining:     self-signed

...output omitted...
Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                UDP Ports:
                  * 88, 464: kerberos
                  * 123: ntp

        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
           and the web user interface.

Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful

1
2
3
4
5

[root@utility ~]# firewall-cmd --permanent --add-service freeipa-4
success
firewall-cmd: error: unrecognized arguments: reload
[root@utility ~]# firewall-cmd --reload
success

1
2
3
4
5
6
7
8

[root@utility ~]# kinit admin
Password for [email protected]:
[root@utility ~]# klist
Ticket cache: KCM:0
Default principal: [email protected]

Valid starting       Expires              Service principal
04/02/2023 01:08:13  04/03/2023 00:12:09  krbtgt/[email protected]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

[root@utility ~]# ipa user-add developer --first=dev --last=user --password
Password:
Enter Password again to verify:
----------------------
Added user "developer"
----------------------
  User login: developer
  First name: dev
  Last name: user
  Full name: dev user
  Display name: dev user
  Initials: du
  Home directory: /home/developer
  GECOS: dev user
  Login shell: /bin/sh
  Principal name: [email protected]
  Principal alias: [email protected]
  User password expiration: 20230401170910Z
  Email address: [email protected]
  UID: 857400004
  GID: 857400004
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

[root@utility ~]# ipa user-find rhvm --raw  --all
--------------
1 user matched
--------------
  dn: uid=rhvm,cn=users,cn=accounts,dc=lab,dc=example,dc=com
  uid: rhvm
  givenname: admin
  sn: admin
  cn: admin admin
  initials: aa
  homedirectory: /home/rhvm
  gecos: admin admin
  loginshell: /bin/sh
  krbcanonicalname: [email protected]
  krbprincipalname: [email protected]
  mail: [email protected]
  uidnumber: 857400003
  gidnumber: 857400003
  nsaccountlock: FALSE
  displayName: admin admin
  ipaNTSecurityIdentifier: S-1-5-21-1342798991-565468756-2456127613-1003
  ipaUniqueID: 999d5806-d0af-11ed-a2d8-52540001329e
  krbExtraData: AAKsZChkcm9vdC9hZG1pbkBMQUIuRVhBTVBMRS5DT00A
  krbLastPwdChange: 20230401170652Z
  krbPasswordExpiration: 20230401170652Z
  memberOf: cn=ipausers,cn=groups,cn=accounts,dc=lab,dc=example,dc=com
  mepManagedEntry: cn=rhvm,cn=groups,cn=accounts,dc=lab,dc=example,dc=com
  objectClass: top
  objectClass: person
  objectClass: organizationalperson
  objectClass: inetorgperson
  objectClass: inetuser
  objectClass: posixaccount
  objectClass: krbprincipalaux
  objectClass: krbticketpolicyaux
  objectClass: ipaobject
  objectClass: ipasshuser
  objectClass: ipaSshGroupOfPubKeys
  objectClass: mepOriginEntry
  objectClass: ipantuserattrs
----------------------------
Number of entries returned 1
----------------------------