如何在CENTOS7上安装FreeIPA

郑全

如何在CENTOS7上安装FreeIPA

1.文档编写目的

FreeIPA是一个Linux环境下开源的身份管理系统，它提供了用户管理和身份验证，就跟Microsoft Active Directory或OpenLDAP 一样。FreeIPA集成了Directory Server、Kerberos、PKI、DNS、Certmonger、NTP Server、WebUI、Trusts、Client等组件，也就是说在Hadoop集群要统一用户管理和安全认证一个它就足够了。本篇文章主要介绍如何在Centos7上安装FreeIPA。

·     2.内容概述

1.环境准备

2.FreeIPA安装

3.FreeIPA使用

·     3.测试环境

1.RedHat7.5

2.FreeIPA4.6.4

4.环境准备

1.首先要确保安装FreeIPA服务的服务器主机名为完全限定域名（FQDN），这里使用ipasvr1.sztech.com作为本篇文章教程的FQDN。

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image001.png

在redhat7下可以使用如下命令修改hostname

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image002.png

配置本机HOSTS

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image004.jpg

2.FreeIPA安装需要大量的随机数运行加密操作，需要安装rngd服务防止操作系统的熵值过低

yum install rng-tools.x86_64

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image005.png

启动rngd服务并设置为开机自启动

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image007.jpg

3.FreeIPA依赖需要启用IPv6堆栈,修改/etc/sysctl.conf文件增加如下内容

net.ipv6.conf.lo.disable_ipv6 = 0
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image008.png

执行sysctl-p命令使其生效

安装FreeIPA

1.安装FreeIPA服务依赖包

# yum -y install ipa-server ipa-server-dns bind bind-dyndb-ldap

2.在命令行执行如下命令安装FreeIPA服务

ipa-server-install

[root@ipasrv1 ~]# ipa-server-install

[root@ipasrv1 ~]# ipa-server-install

The log file for this installation can befound in /var/log/ipaserver-install.log

==============================================================================

This program will set up the IPA Server.

This includes:

  *Configure a stand-alone CA (dogtag) for certificate management

  *Configure the Network Time Daemon (ntpd)

  *Create and configure an instance of Directory Server

  *Create and configure a Kerberos Key Distribution Center (KDC)

  *Configure Apache (httpd)

  *Configure the KDC to enable PKINIT

To accept the default shown in brackets,press the Enter key.

WARNING: conflicting time&datesynchronization service 'chronyd' will be disabled

in favor of ntpd

Do you want to configure integrated DNS(BIND)? [no]: yes

Enter the fully qualified domain name ofthe computer

on which you're setting up server software.Using the form

<hostname>.<domainname>

Example: master.example.com.

Server host name [ipasrv1.sztech.com]:

Warning: skipping DNS resolution of hostipasrv1.sztech.com

The domain name has been determined basedon the host name.

Please confirm the domain name[sztech.com]:

The kerberos protocol requires a Realm nameto be defined.

This is typically the domain name convertedto uppercase.

Please provide a realm name [SZTECH.COM]:

Certain directory server operations requirean administrative user.

This user is referred to as the DirectoryManager and has full access

to the Directory for system managementtasks and will be added to the

instance of directory server created forIPA.

The password must be at least 8 characterslong.

Directory Manager password:

Password (confirm):

The IPA server requires an administrativeuser, named 'admin'.

This user is a regular system account usedfor IPA server administration.

IPA admin password:

Password (confirm):

Checking DNS domain sztech.com., pleasewait ...

Do you want to configure DNS forwarders?[yes]:

Following DNS servers are configured in/etc/resolv.conf: 8.8.8.8

Do you want to configure these servers asDNS forwarders? [yes]:

All DNS servers from /etc/resolv.conf wereadded. You can enter additional addresses now:

Enter an IP address for a DNS forwarder, orpress Enter to skip:

Checking DNS forwarders, please wait ...

Do you want to search for missing reversezones? [yes]:

Do you want to create reverse zone for IP192.168.133.130 [yes]:

Please specify the reverse zone name[133.168.192.in-addr.arpa.]:

Using reverse zone(s)133.168.192.in-addr.arpa.

The IPA Master Server will be configuredwith:

Hostname:       ipasrv1.sztech.com

IP address(es): 192.168.133.130

Domain name:    sztech.com

Realm name:     SZTECH.COM

BIND DNS server will be configured to serveIPA domain with:

Forwarders:       8.8.8.8

Forward policy:   only

Reverse zone(s):  133.168.192.in-addr.arpa.

Continue to configure the system with thesevalues? [no]: yes

The following operations may take someminutes to complete.

Please wait until the prompt is returned.

Adding [192.168.133.130 ipasrv1.sztech.com]to your /etc/hosts file

Configuring NTP daemon (ntpd)

[1/4]: stopping ntpd

[2/4]: writing configuration

[3/4]: configuring ntpd to start on boot

[4/4]: starting ntpd

Done configuring NTP daemon (ntpd).

Configuring directory server (dirsrv).Estimated time: 30 seconds

[1/44]: creating directory server instance

[2/44]: enabling ldapi

[3/44]: configure autobind for root

[4/44]: stopping directory server

[5/44]: updating configuration in dse.ldif

[6/44]: starting directory server

[7/44]: adding default schema

[8/44]: enabling memberof plugin

[9/44]: enabling winsync plugin

[10/44]: configuring replication version plugin

[11/44]: enabling IPA enrollment plugin

[12/44]: configuring uniqueness plugin

[13/44]: configuring uuid plugin

[14/44]: configuring modrdn plugin

[15/44]: configuring DNS plugin

[16/44]: enabling entryUSN plugin

[17/44]: configuring lockout plugin

[18/44]: configuring topology plugin

[19/44]: creating indices

[20/44]: enabling referential integrity plugin

[21/44]: configuring certmap.conf

[22/44]: configure new location for managed entries

[23/44]: configure dirsrv ccache

[24/44]: enabling SASL mapping fallback

[25/44]: restarting directory server

[26/44]: adding sasl mappings to the directory

[27/44]: adding default layout

[28/44]: adding delegation layout

[29/44]: creating container for managed entries

[30/44]: configuring user private groups

[31/44]: configuring netgroups from hostgroups

[32/44]: creating default Sudo bind user

[33/44]: creating default Auto Member layout

[34/44]: adding range check plugin

[35/44]: creating default HBAC rule allow_all

[36/44]: adding entries for topology management

[37/44]: initializing group membership

[38/44]: adding master entry

[39/44]: initializing domain level

[40/44]: configuring Posix uid/gid generation

[41/44]: adding replication acis

  [42/44]:activating sidgen plugin

[43/44]: activating extdom plugin

[44/44]: configuring directory to start on boot

Done configuring directory server (dirsrv).

Configuring Kerberos KDC (krb5kdc)

[1/10]: adding kerberos container to the directory

  [2/10]:configuring KDC

[3/10]: initialize kerberos container

[4/10]: adding default ACIs

[5/10]: creating a keytab for the directory

[6/10]: creating a keytab for the machine

[7/10]: adding the password extension to the directory

[8/10]: creating anonymous principal

[9/10]: starting the KDC

[10/10]: configuring KDC to start on boot

Done configuring Kerberos KDC (krb5kdc).

Configuring kadmin

[1/2]: starting kadmin

[2/2]: configuring kadmin to start on boot

Done configuring kadmin.

Configuring ipa-custodia

[1/5]: Making sure custodia container exists

[2/5]: Generating ipa-custodia config file

[3/5]: Generating ipa-custodia keys

[4/5]: starting ipa-custodia

[5/5]: configuring ipa-custodia to start on boot

Done configuring ipa-custodia.

Configuring certificate server(pki-tomcatd). Estimated time: 3 minutes

[1/28]: configuring certificate server instance

[2/28]: exporting Dogtag certificate store pin

[3/28]: stopping certificate server instance to update CS.cfg

[4/28]: backing up CS.cfg

[5/28]: disabling nonces

[6/28]: set up CRL publishing

[7/28]: enable PKIX certificate path discovery and validation

[8/28]: starting certificate server instance

[9/28]: configure certmonger for renewals

[10/28]: requesting RA certificate from CA

[11/28]: setting audit signing renewal to 2years

[12/28]: restarting certificate server

[13/28]: publishing the CA certificate

[14/28]: adding RA agent as a trusted user

[15/28]: authorizing RA to modify profiles

[16/28]: authorizing RA to manage lightweight CAs

[17/28]: Ensure lightweight CAs container exists

[18/28]: configure certificate renewals

[19/28]: configure Server-Cert certificate renewal

[20/28]: Configure HTTP to proxy connections

[21/28]: restarting certificate server

[22/28]: updating IPA configuration

[23/28]: enabling CA instance

[24/28]: migrating certificate profiles to LDAP

[25/28]: importing IPA certificate profiles

[26/28]: adding default CA ACL

[27/28]: adding 'ipa' CA entry

[28/28]: configuring certmonger renewal for lightweight CAs

Done configuring certificate server(pki-tomcatd).

Configuring directory server (dirsrv)

[1/3]: configuring TLS for DS instance

[2/3]: adding CA certificate entry

[3/3]: restarting directory server

Done configuring directory server (dirsrv).

Configuring ipa-otpd

[1/2]: starting ipa-otpd

[2/2]: configuring ipa-otpd to start on boot

Done configuring ipa-otpd.

Configuring the web interface (httpd)

[1/22]: stopping httpd

[2/22]: setting mod_nss port to 443

[3/22]: setting mod_nss cipher suite

[4/22]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2

[5/22]: setting mod_nss password file

[6/22]: enabling mod_nss renegotiate

[7/22]: disabling mod_nss OCSP

  [8/22]:adding URL rewriting rules

[9/22]: configuring httpd

[10/22]: setting up httpd keytab

[11/22]: configuring Gssproxy

[12/22]: setting up ssl

[13/22]: configure certmonger for renewals

[14/22]: importing CA certificates from LDAP

[15/22]: publish CA cert

[16/22]: clean up any existing httpd ccaches

[17/22]: configuring SELinux for httpd

[18/22]: create KDC proxy config

[19/22]: enable KDC proxy

[20/22]: starting httpd

[21/22]: configuring httpd to start on boot

[22/22]: enabling oddjobd

Done configuring the web interface (httpd).

Configuring Kerberos KDC (krb5kdc)

[1/1]: installing X509 Certificate for PKINIT

Done configuring Kerberos KDC (krb5kdc).

Applying LDAP updates

Upgrading IPA:. Estimated time: 1 minute 30seconds

[1/10]: stopping directory server

[2/10]: saving configuration

[3/10]: disabling listeners

[4/10]: enabling DS global lock

[5/10]: disabling Schema Compat

[6/10]: starting directory server

[7/10]: upgrading server

[8/10]: stopping directory server

[9/10]: restoring configuration

[10/10]: starting directory server

Done.

Restarting the KDC

Configuring DNS (named)

[1/12]: generating rndc key file

[2/12]: adding DNS container

[3/12]: setting up our zone

[4/12]: setting up reverse zone

[5/12]: setting up our own record

[6/12]: setting up records for other masters

[7/12]: adding NS record to the zones

[8/12]: setting up kerberos principal

[9/12]: setting up named.conf

[10/12]: setting up server configuration

[11/12]: configuring named to start on boot

[12/12]: changing resolv.conf to point to ourselves

Done configuring DNS (named).

Restarting the web server to pick upresolv.conf changes

Configuring DNS key synchronization service(ipa-dnskeysyncd)

[1/7]: checking status

[2/7]: setting up bind-dyndb-ldap working directory

[3/7]: setting up kerberos principal

[4/7]: setting up SoftHSM

[5/7]: adding DNSSEC containers

[6/7]: creating replica keys

[7/7]: configuring ipa-dnskeysyncd to start on boot

Done configuring DNS key synchronizationservice (ipa-dnskeysyncd).

Restarting ipa-dnskeysyncd

Restarting named

Updating DNS system records

Configuring client side components

Using existing certificate'/etc/ipa/ca.crt'.

Client hostname: ipasrv1.sztech.com

Realm: SZTECH.COM

DNS Domain: sztech.com

IPA Server: ipasrv1.sztech.com

BaseDN: dc=sztech,dc=com

Skipping synchronizing time with NTPserver.

New SSSD config will be created

Configured sudoers in /etc/nsswitch.conf

Configured /etc/sssd/sssd.conf

trying https://ipasrv1.sztech.com/ipa/json

[try 1]: Forwarding 'schema' to json server'https://ipasrv1.sztech.com/ipa/json'

tryinghttps://ipasrv1.sztech.com/ipa/session/json

[try 1]: Forwarding 'ping' to json server'https://ipasrv1.sztech.com/ipa/session/json'

[try 1]: Forwarding 'ca_is_enabled' to jsonserver 'https://ipasrv1.sztech.com/ipa/session/json'

Systemwide CA database updated.

Adding SSH public key from/etc/ssh/ssh_host_rsa_key.pub

Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub

Adding SSH public key from/etc/ssh/ssh_host_ed25519_key.pub

[try 1]: Forwarding 'host_mod' to jsonserver 'https://ipasrv1.sztech.com/ipa/session/json'

SSSD enabled

Configured /etc/openldap/ldap.conf

Configured /etc/ssh/ssh_config

Configured /etc/ssh/sshd_config

Configuring sztech.com as NIS domain.

Client configuration complete.

The ipa-client-install command wassuccessful

==============================================================================

Setup complete

Next steps:

       1. You must make sure these network ports are open:

                TCP Ports:

                  * 80, 443: HTTP/HTTPS

                  * 389, 636: LDAP/LDAPS

                  * 88, 464: kerberos

                  * 53: bind

                UDP Ports:

                  * 88, 464: kerberos

                  * 53: bind

                  * 123: ntp

       2. You can now obtain a kerberos ticket using the command: 'kinit admin'

          This ticket will allow you to use the IPA tools (e.g., ipa user-add)

          and the web user interface.

Be sure to back up the CA certificatesstored in /root/cacert.p12

These files are required to createreplicas. The password for these

files is the Directory Manager password

5.在命令行执行如下命令查看FreeIPA服务状态

[root@ipasrv1 ~]#  ipactl status

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image009.png

ipactl命令可对FreeIPA服务进行启动、停止、重启、查看状态等操作

[root@ipasrv1 ~]# ipactl  --help

Usage: ipactl start|stop|restart|status

      

Options:

  -h,--help            show this help message andexit

  -d,--debug           Display debugginginformation

  -f,--force           Force IPA to start.Combine options --skip-version-

                        check and--ignore-service-failures

--ignore-service-failures

                        If any service startfails, do not rollback the

                        services, continue withthe operation

--skip-version-check  skip versioncheck

FreeIPA使用

1.  在浏览器输入https://ipasrv1.sztech.com进入FreeIPA管理界面

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image011.jpg

默认管理员为admin，密码为安装时命令行设置的。

2.进入管理主界面，可以看到用户列表

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image013.jpg

2.  添加一个测试用户ipaadmin

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image015.jpg

添加成功

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image017.jpg

点击创建的用户名可以进入用户详细属性编辑界面

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image019.jpg

3.  在FreeIPA服务器上查看cdhadmin用户是否已存在

file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image021.jpg

[root@ipasrv1 ~]# getent passwdipaadmin  

ipaadmin:*:63400001:63400001:sztechzheng:/home/ipaadmin:/bin/bash

可以看到通过FreeIPA创建的用户，默认为该用户创建了对应的Kerberos账号，并且用户已同步至OS。

总结

1.FreeIPA服务集成了LDAP及KDC服务，便于统一管理用户信息

2.Fayson安装FreeIPA时直接集成了默认的DNS服务，推荐使用它默认提供的DNS服务，使用外部的DNS服务集成会复杂很多，在集成DNS服务时也可以指定forwarders，将解析转到其它的DNS服务

3.由于FreeIPA运行需要大量的随机数进行加密算法，为防止系统熵值过低可以安装rngd服务

4.FreeIPA需要依赖ipv6的堆栈需要在/etc/sysctl.conf文件中启用ipv6配置