Redhat FreeIPA Server 安装服务端和客户端 （实验：VMware环境下）

实验环境：windows7 + vmware 15 + redhat 7
1：准备2台虚拟机：
      虚拟机VMnet8，Subnet IP：192.168.145.0
     

Redhat 7（Server With GUI），1-2G内存
      网络配置如下：
      服务端：ipa.nfs1.example.com   192.168.145.134
      客户端：client.nfs1.example.com   192.168.145.138
     

2：在Windows7的C:\Windows\System32\drivers\etc\hosts中加入：
     192.168.145.134 ipa.nfs1.example.com 
     IPA成功配置后，可以在windows浏览器下操作。
     
========================================================================================
 服务端 客户端都要做的步骤：
[确定iso已经挂载到VMware]，*****将没有注册的redhat 7中将repo 指向DVD*****
#mount　　　　　　　　　　　　　　　　　　　　#检查
#umount /dev/sr0　　　　　　　　　　　　　　　　#卸载iso
#mount /dev/sr0 /mnt                    　　　　　　　　　#挂载iso到mnt
#cd /mnt                           
#rpm --import RPM-GPG-KEY-redhat-release      
#cd Packages/                       
#rpm -ivh createrepo-0.9.9-23.el7.noarch.rpm       
#vi /etc/yum.repos.d/file.repo      　　          　　　　#编辑repo
[DVDRepo]
name=DVD Repository
baseurl=file:///mnt/
enabled=1
gpgcheck=0
:wq
#cd                          
#yum clean all                        　　　　　　　　　　
#yum list all                       　　　　　　　　　　
====================================================================
服务端安装
#yum install ipa-server bind dns-ldap bind-dyndb-ldap
#nmtui                            #依次设置网络
Addresses         192.168.145.134
Gateway         192.168.145.2
DNS servers         192.168.145.2
Search domains         nfs1.example.com
hostname        ipa.nfs1.example.com
exit                            #退出

#vi /etc/resolv.conf

#vi /etc/hosts

#systemctl stop chronyd.service
#systemctl disable chronyd.service
#systemctl restart network

ipa-server-install  --setup-dns                #开始配置IPA（下面是过程主要内容）
**********************************************************************************
Existing BIND configuration detected, overwrite? [no]:yes
Server host name [ipa.nfs1.example.com]: ipa.nfs1.example.com
Please confirm the domain name [nfs1.example.com]:        
Please provide a realm name [NFS1.EXAMPLE.COM]:            
Directory Manager password:                    
IPA admin password:                        
The IPA Master Server will be configured with:
Hostname:      ipa.nfs1.example.com
IP address:    192.168.145.134
Domain name:   nfs1.example.com
Realm name:    NFS1.EXAMPLE.COM
BIND DNS server will be configured to serve IPA domain with:
Forwarders:    8.8.8.8
Reverse zone:  145.168.192.in-addr.arpa.
Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files
Restarting the web server
Setup complete
Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                  * 53: bind
                UDP Ports:
                  * 88, 464: kerberos
                  * 53: bind
                  * 123: ntp

2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
           and the web user interface.

Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password
*****************************************************************************
DM_password 是kerberos的管理员密码
admin_password 是389-ds的管理员密码
按结束语中的要求修改防火墙：

#firewall-cmd --permanent --add-service=http
#firewall-cmd --permanent --add-service=https
#firewall-cmd --permanent --add-service=ldap
#firewall-cmd --permanent --add-service=ldaps
#firewall-cmd --permanent --add-service=kerberos
#firewall-cmd --permanent --add-port=53/tcp
#firewall-cmd --permanent --add-port=53/udp
#firewall-cmd --permanent --add-port=88/udp
#firewall-cmd --permanent --add-port=123/udp
#firewall-cmd --reload
#firewall-cmd --list
#firewall-cmd --list-all

这时可以在Windows下浏览器打开https://ipa.nfs1.example.com

不同浏览器可能略有不同
****************************************************************************************************************************************************************************************************************************
客户端安装
#nmtui
ip:192.168.145.138
gateway:192.168.145.134  （请特别留意此项）
search domain:nfs1.example.com
hostname：  client.nfs1.example.com

#vi /etc/resolv.conf
nameserver 192.168.145.134   （请特别留意此项）

#vi /etc/hosts                        
192.168.145.138 client.nfs1.example.com   （请特别留意此项）

#systemctl restart network

#yum install nss-pam-ldapd pam_krg5 ipa-client
#ipa-client-install                  　　　　#开始配置IPA客户端（下面是过程主要内容）
=======================================================================
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd

Discovery was successful!
Hostname: client.nfs1.example.com
Realm: NFS1.EXAMPLE.COM
DNS Domain: nfs1.example.com
IPA Server: ipa.nfs1.example.com
BaseDN: dc=nfs1,dc=example,dc=com

Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin
Synchronizing time with KDC...
Password for admin@NFS1.EXAMPLE.COM:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=NFS1.EXAMPLE.COM
    Issuer:      CN=Certificate Authority,O=NFS1.EXAMPLE.COM
    Valid From:  Wed Jun 24 03:23:40 2020 UTC
    Valid Until: Sun Jun 24 03:23:40 2040 UTC

Enrolled in IPA realm NFS1.EXAMPLE.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm NFS1.EXAMPLE.COM
trying https://ipa.nfs1.example.com/ipa/xml
Forwarding 'ping' to server 'https://ipa.nfs1.example.com/ipa/xml'
Forwarding 'env' to server 'https://ipa.nfs1.example.com/ipa/xml'
Hostname (client.nfs1.example.com) not found in DNS
DNS server record set to: client.nfs1.example.com -> 192.168.145.138
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Forwarding 'host_mod' to server 'https://ipa.nfs1.example.com/ipa/xml'
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
==========================================================================
systemctl stop chronyd.service
systemctl disable chronyd.service

这时client.nfs1.example.com 成功加入IPA的管理中。

如果在管理器中添加用户，相当于添加了一个域用户。

账户ipa-user可以登入nfs.example.com中所有登记的主机

（终）