标签：linux
The directory servers supported for use with Red Hat Enterprise Virtualization 3.3 are:
From this article,you‘ll learn following:
Install IPA packages on master and slave
[root@ipa ~]# yum -y install ipa-server bind bind-dyndb-ldap firefox xorg-x11-xauth [root@slave ~]# yum -y install ipa-server bind bind-dyndb-ldap firefox xorg-x11-xauth
Configure master IPA server
[root@ipa ~]# ipa-server-install --setup-dns --forwarder=172.16.255.10
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure DNS (bind)
To accept the default shown in brackets, press the Enter key.
Existing BIND configuration detected, overwrite? [no]: yes
Enter the fully qualified domain name of the computer
on which you‘re setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.
Server host name [ipa.xzxj.edu.cn]:
Warning: skipping DNS resolution of host ipa.xzxj.edu.cn
The domain name has been determined based on the host name.
Please confirm the domain name [xzxj.edu.cn]:
The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Please provide a realm name [XZXJ.EDU.CN]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.
Directory Manager password:
Password (confirm):
The IPA server requires an administrative user, named ‘admin‘.
This user is a regular system account used for IPA server administration.
IPA admin password:
Password (confirm):
Do you want to configure the reverse zone? [yes]:
Please specify the reverse zone name [255.16.172.in-addr.arpa.]:
Using reverse zone 255.16.172.in-addr.arpa.
The IPA Master Server will be configured with:
Hostname: ipa.xzxj.edu.cn
IP address: 172.16.255.16
Domain name: xzxj.edu.cn
Realm name: XZXJ.EDU.CN
BIND DNS server will be configured to serve IPA domain with:
Forwarders: 172.16.255.10
Reverse zone: 255.16.172.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 seconds
[1/3]: creating directory server user
[2/3]: creating directory server instance
[3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds
[1/21]: creating certificate server user
[2/21]: creating pki-ca instance
[3/21]: configuring certificate server instance
[4/21]: disabling nonces
[5/21]: creating CA agent PKCS#12 file in /root
[6/21]: creating RA agent certificate database
[7/21]: importing CA chain to RA certificate database
[8/21]: fixing RA database permissions
[9/21]: setting up signing cert profile
[10/21]: set up CRL publishing
[11/21]: set certificate subject base
[12/21]: enabling Subject Key Identifier
[13/21]: setting audit signing renewal to 2 years
[14/21]: configuring certificate server to start on boot
[15/21]: restarting certificate server
[16/21]: requesting RA certificate from CA
[17/21]: issuing RA agent certificate
[18/21]: adding RA agent as a trusted user
[19/21]: configure certificate renewals
[20/21]: configure Server-Cert certificate renewal
[21/21]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Configuring directory server (dirsrv): Estimated time 1 minute
[1/38]: creating directory server user
[2/38]: creating directory server instance
[3/38]: adding default schema
[4/38]: enabling memberof plugin
[5/38]: enabling winsync plugin
[6/38]: configuring replication version plugin
[7/38]: enabling IPA enrollment plugin
[8/38]: enabling ldapi
[9/38]: disabling betxn plugins
[10/38]: configuring uniqueness plugin
[11/38]: configuring uuid plugin
[12/38]: configuring modrdn plugin
[13/38]: enabling entryUSN plugin
[14/38]: configuring lockout plugin
[15/38]: creating indices
[16/38]: enabling referential integrity plugin
[17/38]: configuring ssl for ds instance
[18/38]: configuring certmap.conf
[19/38]: configure autobind for root
[20/38]: configure new location for managed entries
[21/38]: restarting directory server
[22/38]: adding default layout
[23/38]: adding delegation layout
[24/38]: adding replication acis
[25/38]: creating container for managed entries
[26/38]: configuring user private groups
[27/38]: configuring netgroups from hostgroups
[28/38]: creating default Sudo bind user
[29/38]: creating default Auto Member layout
[30/38]: adding range check plugin
[31/38]: creating default HBAC rule allow_all
[32/38]: Upload CA cert to the directory
[33/38]: initializing group membership
[34/38]: adding master entry
[35/38]: configuring Posix uid/gid generation
[36/38]: enabling compatibility plugin
[37/38]: tuning directory server
[38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
[1/10]: adding sasl mappings to the directory
[2/10]: adding kerberos container to the directory
[3/10]: configuring KDC
[4/10]: initialize kerberos container
[5/10]: adding default ACIs
[6/10]: creating a keytab for the directory
[7/10]: creating a keytab for the machine
[8/10]: adding the password extension to the directory
[9/10]: starting the KDC
[10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
[1/2]: starting kadmin
[2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
[1/2]: starting ipa_memcached
[2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd): Estimated time 1 minute
[1/13]: setting mod_nss port to 443
[2/13]: setting mod_nss password file
[3/13]: enabling mod_nss renegotiate
[4/13]: adding URL rewriting rules
[5/13]: configuring httpd
[6/13]: setting up ssl
[7/13]: setting up browser autoconfig
[8/13]: publish CA cert
[9/13]: creating a keytab for httpd
[10/13]: clean up any existing httpd ccache
[11/13]: configuring SELinux for httpd
[12/13]: restarting httpd
[13/13]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Configuring DNS (named)
[1/9]: adding DNS container
[2/9]: setting up our zone
[3/9]: setting up reverse zone
[4/9]: setting up our own record
[5/9]: setting up kerberos principal
[6/9]: setting up named.conf
[7/9]: restarting named
[8/9]: configuring named to start on boot
[9/9]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Global DNS configuration in LDAP server is empty
You can use ‘dnsconfig-mod‘ command to set global DNS options that
would override settings in local named.conf files
Restarting the web server
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
* 53: bind
UDP Ports:
* 88, 464: kerberos
* 53: bind
* 123: ntp
2. You can now obtain a kerberos ticket using the command: ‘kinit admin‘
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager passwordAfter configure,you need to get a kerberos ticket:
[root@ipa ~]# kinit admin Password for admin@XZXJ.EDU.CN: [root@ipa ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@XZXJ.EDU.CN Valid starting Expires Service principal 05/17/14 12:18:59 05/18/14 12:18:56 krbtgt/XZXJ.EDU.CN@XZXJ.EDU.CN
Setting up a replica
[root@ipa ~]# ipa-replica-prepare slave.xzxj.edu.cn Directory Manager (existing master) password:******** Preparing replica for slave.xzxj.edu.cn from ipa.xzxj.edu.cn Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-slave.xzxj.edu.cn.gpg [root@ipa ~]# scp /var/lib/ipa/replica-info-slave.xzxj.edu.cn.gpg slave:/root
Configure slave IPA server
[root@slave ~]# ipa-replica-install --setup-dns --forwarder=172.16.255.10 replica-info-slave.xzxj.edu.cn.gpg Directory Manager (existing master) password:******* Run connection check to master Check connection from replica to remote master ‘ipa.xzxj.edu.cn‘: Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master admin@XZXJ.EDU.CN password: Execute check on remote master Check connection from master to remote replica ‘slave.xzxj.edu.cn‘: Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): OK Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK Connection from master to replica is OK. Connection check OK Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration [3/4]: configuring ntpd to start on boot [4/4]: starting ntpd Done configuring NTP daemon (ntpd). Configuring directory server (dirsrv): Estimated time 1 minute [1/31]: creating directory server user [2/31]: creating directory server instance [3/31]: adding default schema [4/31]: enabling memberof plugin [5/31]: enabling winsync plugin [6/31]: configuring replication version plugin [7/31]: enabling IPA enrollment plugin [8/31]: enabling ldapi [9/31]: disabling betxn plugins [10/31]: configuring uniqueness plugin [11/31]: configuring uuid plugin [12/31]: configuring modrdn plugin [13/31]: enabling entryUSN plugin [14/31]: configuring lockout plugin [15/31]: creating indices [16/31]: enabling referential integrity plugin [17/31]: configuring ssl for ds instance [18/31]: configuring certmap.conf [19/31]: configure autobind for root [20/31]: configure new location for managed entries [21/31]: restarting directory server [22/31]: setting up initial replication Starting replication, please wait until this has completed. Update in progress Update in progress Update in progress Update in progress Update succeeded [23/31]: adding replication acis [24/31]: setting Auto Member configuration [25/31]: enabling S4U2Proxy delegation [26/31]: initializing group membership [27/31]: adding master entry [28/31]: configuring Posix uid/gid generation [29/31]: enabling compatibility plugin [30/31]: tuning directory server [31/31]: configuring directory to start on boot Done configuring directory server (dirsrv). Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds [1/9]: adding sasl mappings to the directory [2/9]: writing stash file from DS [3/9]: configuring KDC [4/9]: creating a keytab for the directory [5/9]: creating a keytab for the machine [6/9]: adding the password extension to the directory [7/9]: enable GSSAPI for replication [8/9]: starting the KDC [9/9]: configuring KDC to start on boot Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring ipa_memcached [1/2]: starting ipa_memcached [2/2]: configuring ipa_memcached to start on boot Done configuring ipa_memcached. Configuring the web interface (httpd): Estimated time 1 minute [1/12]: setting mod_nss port to 443 [2/12]: setting mod_nss password file [3/12]: enabling mod_nss renegotiate [4/12]: adding URL rewriting rules [5/12]: configuring httpd [6/12]: setting up ssl [7/12]: publish CA cert [8/12]: creating a keytab for httpd [9/12]: clean up any existing httpd ccache [10/12]: configuring SELinux for httpd [11/12]: restarting httpd [12/12]: configuring httpd to start on boot Done configuring the web interface (httpd). Applying LDAP updates Restarting the directory server Restarting the KDC Using reverse zone 255.16.172.in-addr.arpa. Configuring DNS (named) [1/8]: adding NS record to the zone [2/8]: setting up reverse zone [3/8]: setting up our own record [4/8]: setting up kerberos principal [5/8]: setting up named.conf [6/8]: restarting named [7/8]: configuring named to start on boot [8/8]: changing resolv.conf to point to ourselves Done configuring DNS (named). Global DNS configuration in LDAP server is empty You can use ‘dnsconfig-mod‘ command to set global DNS options that would override settings in local named.conf files Restarting the web server //Get a Kerberos ticket [root@slave ~]# kinit admin Password for admin@XZXJ.EDU.CN: [root@slave ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@XZXJ.EDU.CN Valid starting Expires Service principal 05/17/14 15:20:06 05/18/14 15:20:03 krbtgt/XZXJ.EDU.CN@XZXJ.EDU.CN
Some adjustment
Unfortunately the default shell for new users is /bin/sh, which should probably be changed.
[root@slave ~]# ipa config-mod --defaultshell=/bin/bash Maximum username length: 32 Home directory base: /home Default shell: /bin/bash Default users group: ipausers Default e-mail domain: xzxj.edu.cn Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=XZXJ.EDU.CN Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC
Testing the replication
Login in to ipa.xzxj.edu.cn and add a new user:
[root@ipa ~]# ipa user-add candon First name: aaaa Last name: bb ------------------- Added user "candon" ------------------- User login: candon First name: jacky Last name: lee Full name: jacky lee Display name: jacky lee Initials: jl Home directory: /home/candon GECOS field: jacky lee Login shell: /bin/bash Kerberos principal: candon@XZXJ.EDU.CN Email address: candon@xzxj.edu.cn UID: 1229200001 GID: 1229200001 Password: False Kerberos keys available: False [root@ipa named]# ipa passwd candon New Password: Enter New Password again to verify: ----------------------------------------- Changed password for "candon@XZXJ.EDU.CN" -----------------------------------------
Now,you can check if the user is really available on both servers by following a ldapsearch command:
[root@slave ~]# ldapsearch -x -b "dc=xzxj,dc=edu,dc=cn" uid=candon
Set up a IPA client
[root@TestOS01 ~]# yum install ipa-client
[root@TestOS01 ~]# ipa-client-install -p admin
DNS domain ‘xzxj.edu.cn‘ is not configured for automatic KDC address lookup.
KDC address will be set to fixed value.
Discovery was successful!
Hostname: testos01.xzxj.edu.cn
Realm: XZXJ.EDU.CN
DNS Domain: xzxj.edu.cn
IPA Server: ipa.xzxj.edu.cn
BaseDN: dc=xzxj,dc=edu,dc=cn
Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...
Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
Password for admin@XZXJ.EDU.CN:
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=XZXJ.EDU.CN
Issuer: CN=Certificate Authority,O=XZXJ.EDU.CN
Valid From: Fri May 16 20:13:21 2014 UTC
Valid Until: Tue May 16 20:13:21 2034 UTC
Enrolled in IPA realm XZXJ.EDU.CN
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm XZXJ.EDU.CN
trying https://ipa.xzxj.edu.cn/ipa/xml
Forwarding ‘env‘ to server u‘https://ipa.xzxj.edu.cn/ipa/xml‘
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub
Forwarding ‘host_mod‘ to server u‘https://ipa.xzxj.edu.cn/ipa/xml‘
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.Test Testing the login
[root@ipa ~]# ssh 172.16.255.151 -l candon candon@172.16.255.151‘s password: Password expired. Change your password now. Kickstarted on 2014-05-01 WARNING: Your password has expired. You must change your password now and login again! Changing password for user candon. Current Password: New password: Retype new password: passwd: all authentication tokens updated successfully. [root@ipa ~]# ssh 172.16.255.151 -l candon candon@172.16.255.151‘s password: -bash-4.1$
Configure RHEVM by redhat-manage-domains command
[root@rhevm ~]# rhevm-manage-domains -action=add -addPermissions -domain=xzxj.edu.cn -user=admin -interactive -provider=IPA Enter password: Successfully added domain xzxj.edu.cn. oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart). Manage Domains completed successfully [root@rhevm ~]# service ovirt-engine restart Stopping oVirt Engine: [ OK ] Starting oVirt Engine: [ OK ]
Lists the current configuration
[root@rhevm ~]# rhevm-manage-domains -action=list
Domain: xzxj.edu.cn
User name: admin@XZXJ.EDU.CN
Manage Domains completed successfullyLogin in rhevm web interface by user admin@xzxj.edu.cn
本文出自 “candon123” 博客，谢绝转载！
Setup RHEVM Identity Management With IPA,布布扣,bubuko.com
Setup RHEVM Identity Management With IPA
标签：linux
原文地址：http://candon123.blog.51cto.com/704299/1412911
