Linux Domain Identity, Authentication, and Policy Guide Red Hat Enterprise Linux 7 Using Red Hat Identity Management in Linux environments Florian Delehaye Red Hat Customer Content Services fdelehay@redhat.com Marc Muehlfeld Red Hat Customer Content Services Filip Hanzelka Red Hat Customer Content Services Lucie Manaskova Red Hat Customer Content Services Aneta Steflova Petrova Red Hat Customer Content Services Tomas Capek Red Hat Customer Content Services Ella Deon Ballard Red Hat Customer Content Services

Commands:
lookup_family_order = ipv4_only
hostname server.example.com
ip addr show 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:1a:4a:10:4e:33 brd ff:ff:ff:ff:ff:ff inet 192.0.2.1 /24 brd 192.0.2.255 scope global dynamic eth0 valid_lft 106694sec preferred_lft 106694sec inet6 2001:DB8::1111 /32 scope global dynamic valid_lft 2591521sec preferred_lft 604321sec inet6 fe80::56ee:75ff:fe2b:def6/64 scope link valid_lft forever preferred_lft forever
dig +short server.example.com A 192.0.2.1
dig +short server.example.com AAAA 2001:DB8::1111
dig +short -x 192.0.2.1 server.example.com
dig +short -x 2001:DB8::1111 server.example.com
dig +dnssec @ IP_address_of_the_DNS_forwarder . SOA
;; ->>HEADER<<- opcode: QUERY, status: NOERROR , id: 48655 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; ANSWER SECTION: . 31679 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2015100701 1800 900 604800 86400 . 31679 IN RRSIG SOA 8 0 86400 20151017170000 20151007160000 62530 . GNVz7SQs [...]
127.0.0.1 localhost.localdomain localhost ::1 localhost6.localdomain6 localhost6 192.0.2.1 server.example.com server 2001:DB8::1111 server.example.com server
systemctl status firewalld.service
systemctl start firewalld.service systemctl enable firewalld.service
firewall-cmd --permanent --add-port={80/tcp,443/tcp, list_of_ports }
firewall-cmd --permanent --add-service={freeipa-ldap, list_of_services }
firewall-cmd --reload
firewall-cmd --runtime-to-permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,88/udp,464/tcp,464/udp,53/tcp,53/udp,123/udp}
yum install ipa-server
yum install ipa-server ipa-server-dns
dig @ IP_address +norecurse +short ipa.example.com. NS
acl authorized { 192.0.2.0/24 ; 198.51.100.0/24 ; }; options { allow-query { any; }; allow-recursion { authorized ; }; };
ipa-server-install --auto-reverse --allow-zone-overlap
ipa-server-install
Do you want to configure integrated DNS (BIND)? [no]: yes
Server host name [server.example.com]: Please confirm the domain name [example.com]: Please provide a realm name [EXAMPLE.COM]:
Directory Manager password: IPA admin password:
Do you want to configure DNS forwarders? [yes]:
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
kinit admin
ipa user-find admin -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 939000000 GID: 939000000 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 1 ----------------------------
ipa-server-install
Do you want to configure integrated DNS (BIND)? [no]:
Server host name [server.example.com]: Please confirm the domain name [example.com]: Please provide a realm name [EXAMPLE.COM]:
Directory Manager password: IPA admin password:
Continue to configure the system with these values? [no]: yes
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
kinit admin
ipa user-find admin -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 939000000 GID: 939000000 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 1 ----------------------------
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/8]: creating certificate server user [2/8]: configuring certificate server instance The next step is to get /root/ipa.csr signed by your CA and re-run /sbin/ipa-server-install as: /sbin/ipa-server-install --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate
ipa-server-install --external-cert-file= /tmp/servercert20110601.pem --external-cert-file= /tmp/cacert.pem
ipa : CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/ configuration_file ' returned non-zero exit status 1 Configuration of CA failed
ipa-server-install --http-cert-file /tmp/server.crt --http-cert-file /tmp/server.key --http-pin secret --dirsrv-cert-file /tmp/server.crt --dirsrv-cert-file /tmp/server.key --dirsrv-pin secret --ca-cert-file ca.crt
ipa-server-install --realm EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
kinit admin
ipa user-find admin -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 939000000 GID: 939000000 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 1 ----------------------------
ipa server-del server.example.com
ipa-server-install --uninstall
ipactl stop
yum install ipa-client
Client hostname: client.example.com Realm: EXAMPLE.COM DNS Domain: example.com IPA Server: server.example.com BaseDN: dc=example,dc=com Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: admin Password for admin@EXAMPLE.COM
Client configuration complete.
kinit admin
ipa host-add client.example.com --random -------------------------------------------------- Added host "client.example.com" -------------------------------------------------- Host name: client.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: server.example.com
ipa-client-install --password 'W5YpARl=7M.n' --domain example.com --server server.example.com --unattended
kinit admin
ipa host-add client.example.com --password= secret
%packages @ X Window System @ Desktop @ Sound and Video ipa-client
%post --log=/root/ks-post.log Generate SSH keys to ensure that ipa-client-install uploads them to the IdM server /usr/sbin/sshd-keygen Run the client install script /usr/sbin/ipa-client-install --hostname= client.example.com --domain= EXAMPLE.COM --enable-dns-updates --mkhomedir -w secret --realm= EXAMPLE.COM --server= server.example.com
env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null getcert list env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null ipa-client-install
BASE dc=example,dc=com URI ldap://ldap.example.com #URI ldaps://server.example.com # modified by IPA #BASE dc=ipa,dc=example,dc=com # modified by IPA
[user@client ~]USD id admin uid=1254400000(admin) gid=1254400000(admins) groups=1254400000(admins)
ipa-client-install --uninstall
ipa-client-install --force-join
User authorized to enroll computers: admin Password for admin@EXAMPLE.COM
ipa-client-install --keytab /tmp/krb5.keytab
ipa service-find client.example.com
ipa hostgroup-find client.example.com
ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM
ipa host-del client.example.com
ipa service-add service_name/new_host_name
kinit admin
ipa-replica-install --principal admin --admin-password admin_password
ipa-replica-install --principal admin --admin-password admin_password
kinit admin
ipa hostgroup-add-member ipaservers --hosts client.example.com Host-group: ipaservers Description: IPA server hosts Member hosts: server.example.com, client.example.com ------------------------- Number of members added 1 -------------------------
ipa-replica-install
kinit admin
ipa host-add client.example.com --random -------------------------------------------------- Added host "client.example.com" -------------------------------------------------- Host name: client.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: server.example.com
ipa hostgroup-add-member ipaservers --hosts client.example.com Host-group: ipaservers Description: IPA server hosts Member hosts: server.example.com, client.example.com ------------------------- Number of members added 1 -------------------------
ipa-replica-install --password ' W5YpARl=7M.n '
ipa-replica-install --setup-dns --forwarder 192.0.2.1
DOMAIN= example.com NAMESERVER= replica
for i in _ldap._tcp _kerberos._tcp _kerberos._udp _kerberos-master._tcp _kerberos-master._udp _ntp._udp ; do dig @USD{NAMESERVER} USD{i}.USD{DOMAIN} srv +nocmd +noquestion +nocomments +nostats +noaa +noadditional +noauthority done | egrep "^_" _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server1.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server2.example.com. _kerberos._tcp.example.com. 86400 IN SRV 0 100 88 server1.example.com.
ipa-replica-install --setup-ca
ipa-replica-install --dirsrv-cert-file /tmp/server.crt --dirsrv-cert-file /tmp/server.key --dirsrv-pin secret --http-cert-file /tmp/server.crt --http-cert-file /tmp/server.key --http-pin secret
[admin@server1 ~]USD ipa user-add test_user --first= Test --last= User
[admin@server2 ~]USD ipa user-show test_user
ipactl start
ipactl stop
ipactl restart
[local_user@server ~]USD kinit Password for local_user@EXAMPLE.COM:
[local_user@server ~]USD kinit admin Password for admin@EXAMPLE.COM:
klist Ticket cache: KEYRING:persistent:0:0 Default principal: user_A@EXAMPLE.COM Valid starting Expires Service principal 11/10/2015 08:35:45 11/10/2015 18:35:45 krbtgt/EXAMPLE.COM@EXAMPLE.COM
ipa user-add user_name
ipa help topics automember Auto Membership Rule. automount Automount caacl Manage CA ACL rules.
ipa help automember Auto Membership Rule. Bring clarity to the membership of hosts and users by configuring inclusive or exclusive regex patterns, you can automatically assign a new entries into a group or hostgroup based upon attribute information. EXAMPLES: Add the initial group or hostgroup: ipa hostgroup-add --desc="Web Servers" webservers ipa group-add --desc="Developers" devel
ipa help commands automember-add Add an automember rule. automember-add-condition Add conditions to an automember rule.
ipa automember-add --help Usage: ipa [global-options] automember-add AUTOMEMBER-RULE [options] Add an automember rule. Options: -h, --help show this help message and exit --desc=STR A description of this auto member rule
ipaUserSearchFields: uid,givenname,sn,telephonenumber,ou,title
ipa permission-add --permissions=read --permissions=write --permissions=delete
ipa permission-add --permissions={read,write,delete}
ipa certprofile-show certificate_profile --out= exported\*profile.cfg
ipa user-find --------------- 4 users matched ---------------
ipa group-find keyword ---------------- 2 groups matched ----------------
ipa group-find --user= user_name
ipa group-find --no-user= user_name
ipa host-show server.example.com Host name: server.example.com Principal name: host/server.example.com@EXAMPLE.COM
ipa config-mod --searchrecordslimit=500 --searchtimelimit=5
ipa user-find --sizelimit=200 --timelimit=120
https://server.example.com
[admin@server ~]USD ipa idoverrideuser-add 'Default Trust View' ad_user@ad.example.com
ipa-client-install --configure-firefox
scp /etc/krb5.conf root@ externalmachine.example.com :/etc/krb5_ipa.conf
export KRB5_CONFIG=/etc/krb5_ipa.conf
ipa topologysuffix-find --------------------------- 2 topology suffixes matched --------------------------- Suffix name: ca Managed LDAP suffix DN: o=ipaca Suffix name: domain Managed LDAP suffix DN: dc=example,dc=com ---------------------------- Number of entries returned 2 ----------------------------
ipa topologysegment-find Suffix name: domain ----------------- 1 segment matched ----------------- Segment name: server1.example.com-to-server2.example.com Left node: server1.example.com Right node: server2.example.com Connectivity: both ---------------------------- Number of entries returned 1 ----------------------------
ipa topologysegment-show Suffix name: domain Segment name: server1.example.com-to-server2.example.com Segment name: server1.example.com-to-server2.example.com Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa help topology
ipa topologysuffix-show --help
ipa topologysegment-add Suffix name: domain Left node: server1.example.com Right node: server2.example.com Segment name [server1.example.com-to-server2.example.com]: new_segment --------------------------- Added segment "new_segment" --------------------------- Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa topologysegment-show Suffix name: domain Segment name: new_segment Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa topologysegment-find Suffix name: domain ------------------ 8 segments matched ------------------ Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both ---------------------------- Number of entries returned 8 ----------------------------
ipa topologysegment-del Suffix name: domain Segment name: new_segment ----------------------------- Deleted segment "new_segment" -----------------------------
ipa topologysegment-find Suffix name: domain ------------------ 7 segments matched ------------------ Segment name: server2.example.com-to-server3.example.com Left node: server2.example.com Right node: server3.example.com Connectivity: both ---------------------------- Number of entries returned 7 ----------------------------
ipa server-del Server name: server1.example.com Removing server1.example.com from replication topology, please wait ipa: ERROR: Server removal aborted: Removal of 'server1.example.com' leads to disconnected topology in suffix 'domain': Topology does not allow server server2.example.com to replicate with servers: server3.example.com server4.example.com
[user@server2 ~]USD ipa server-del Server name: server1.example.com Removing server1.example.com from replication topology, please wait ---------------------------------------------------------- Deleted IPA server "server1.example.com" ----------------------------------------------------------
ipa server-install --uninstall
ipa config-show IPA masters: server1.example.com, server2.example.com, server3.example.com IPA CA servers: server1.example.com, server2.example.com IPA NTP servers: server1.example.com, server2.example.com, server3.example.com IPA CA renewal master: server1.example.com
ipa server-show Server name: server.example.com Enabled server roles: CA server, DNS server, NTP server, KRA server
ipa server-find --servrole "CA server" --------------------- 2 IPA servers matched --------------------- Server name: server1.example.com Server name: server2.example.com ---------------------------- Number of entries returned 2 ----------------------------
ipa config-mod --ca-renewal-master-server new_ca_renewal_master.example.com IPA masters: old_ca_renewal_master.example.com, new_ca_renewal_master.example.com IPA CA servers: old_ca_renewal_master.example.com, new_ca_renewal_master.example.com IPA NTP servers: old_ca_renewal_master.example.com, new_ca_renewal_master.example.com IPA CA renewal master: new_ca_renewal_master.example.com
ipa-crlgen-manage status CRL generation: enabled
ipa-crlgen-manage disable
ipa-crlgen-manage enable
ipa server-state replica.idm.example.com --state=hidden
ipa server-state replica.idm.example.com --state=enabled
kinit admin
ipa domainlevel-get ----------------------- Current domain level: 0 -----------------------
kinit admin
ipa domainlevel-set 1 ----------------------- Current domain level: 1 -----------------------
yum update ipa-*
NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2
systemctl restart httpd.service
getcert list -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca" | grep post-save post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
yum update ipa-*
scp /usr/share/ipa/copy-schema-to-ca.py root@rhel6:/root/
python copy-schema-to-ca.py ipa : INFO Installed /etc/dirsrv/slapd-PKI-IPA//schema/60kerberos.ldif [... output truncated ...] ipa : INFO Schema updated successfully
ipa-replica-prepare rhel7.example.com --ip-address 192.0.2.1 Directory Manager (existing master) password: Preparing replica for rhel7.example.com from rhel6.example.com [... output truncated ...] The ipa-replica-prepare command was successful
scp /var/lib/ipa/replica-info-replica.example.com.gpg root@rhel7:/var/lib/ipa/
+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha
ipa-replica-install /var/lib/ipa/replica-info-rhel7.example.com.gpg --setup-ca --ip-address 192.0.2.1 --setup-dns --forwarder 192.0.2.20 Directory Manager (existing master) password: Checking DNS forwarders, please wait Run connection check to master [... output truncated ...] Client configuration complete.
ipactl status Directory Service: RUNNING [... output truncated ...] ipa: INFO: The ipactl command was successful
[root@rhel7 ~]USD kinit admin [root@rhel7 ~]USD ipa-csreplica-manage list rhel6.example.com: master rhel7.example.com: master
ipa-csreplica-manage list --verbose rhel7.example.com rhel7.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2017-02-13 13:55:13+00:00
getcert stop-tracking -d /var/lib/pki-ca/alias -n "auditSigningCert cert-pki-ca" Request "20201127184547" removed. getcert stop-tracking -d /var/lib/pki-ca/alias -n "ocspSigningCert cert-pki-ca" Request "20201127184548" removed. getcert stop-tracking -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca" Request "20201127184549" removed. getcert stop-tracking -d /etc/httpd/alias -n ipaCert Request "20201127184550" removed.
cp /usr/share/ipa/ca_renewal /var/lib/certmonger/cas/ chmod 0600 /var/lib/certmonger/cas/ca_renewal
restorecon /var/lib/certmonger/cas/ca_renewal
service certmonger restart
getcert list-cas CA 'dogtag-ipa- retrieve -agent-submit': is-default: no ca-type: EXTERNAL helper-location: /usr/libexec/certmonger/dogtag-ipa-retrieve-agent-submit
grep internal= /var/lib/pki-ca/conf/password.conf
getcert start-tracking -c dogtag-ipa-retrieve-agent-submit -d /var/lib/pki-ca/alias -n "auditSigningCert cert-pki-ca" -B /usr/lib64/ipa/certmonger/stop_pkicad -C '/usr/lib64/ipa/certmonger/restart_pkicad "auditSigningCert cert-pki-ca"' -T "auditSigningCert cert-pki-ca" -P database_pin New tracking request "20201127184743" added. getcert start-tracking -c dogtag-ipa-retrieve-agent-submit -d /var/lib/pki-ca/alias -n "ocspSigningCert cert-pki-ca" -B /usr/lib64/ipa/certmonger/stop_pkicad -C '/usr/lib64/ipa/certmonger/restart_pkicad "ocspSigningCert cert-pki-ca"' -T "ocspSigningCert cert-pki-ca" -P database_pin New tracking request "20201127184744" added. getcert start-tracking -c dogtag-ipa-retrieve-agent-submit -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca" -B /usr/lib64/ipa/certmonger/stop_pkicad -C '/usr/lib64/ipa/certmonger/restart_pkicad "subsystemCert cert-pki-ca"' -T "subsystemCert cert-pki-ca" -P database_pin New tracking request "20201127184745" added. getcert start-tracking -c dogtag-ipa-retrieve-agent-submit -d /etc/httpd/alias -n ipaCert -C /usr/lib64/ipa/certmonger/restart_httpd -T ipaCert -p /etc/httpd/alias/pwdfile.txt New tracking request "20201127184746" added.
service pki-cad stop
ca.crl.MasterCRL.enableCRLCache= false ca.crl.MasterCRL.enableCRLUpdates= false
service pki-cad start
RewriteRule ^/ipa/crl/MasterCRL.bin https://rhel6.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
service httpd restart
ipactl stop Stopping CA Service Stopping pki-ca: [ OK ] Stopping HTTP Service Stopping httpd: [ OK ] Stopping MEMCACHE Service Stopping ipa_memcached: [ OK ] Stopping DNS Service Stopping named: . [ OK ] Stopping KPASSWD Service Stopping Kerberos 5 Admin Server: [ OK ] Stopping KDC Service Stopping Kerberos 5 KDC: [ OK ] Stopping Directory Service Shutting down dirsrv: EXAMPLE-COM... [ OK ] PKI-IPA... [ OK ]
mkdir -p /home/idm/backup/
chown root:root /home/idm/backup/ chmod 700 /home/idm/backup/
mv /var/lib/ipa/backup/* /home/idm/backup/
rm -rf /var/lib/ipa/backup/
ln -s /home/idm/backup/ /var/lib/ipa/backup/
mkdir -p /home/idm/backup/
chown root:root /home/idm/backup/ chmod 700 /home/idm/backup/
mv /var/lib/ipa/backup/* /home/idm/backup/
mount -o bind /home/idm/backup/ /var/lib/ipa/backup/
/home/idm/backup/ /var/lib/ipa/backup/ none bind 0 0
TMPDIR= /path/to/backup ipa-backup
cat >keygen <<EOF > %echo Generating a standard key > Key-Type: RSA > Key-Length:2048 > Name-Real: IPA Backup > Name-Comment: IPA Backup > Name-Email: root@example.com > Expire-Date: 0 > %pubring /root/backup.pub > %secring /root/backup.sec > %commit > %echo done > EOF
gpg --batch --gen-key keygen gpg --no-default-keyring --secret-keyring /root/backup.sec --keyring /root/backup.pub --list-secret-keys
ipa-backup --gpg --gpg-keyring=/root/backup
/usr/share/ipa/html /root/.pki /etc/pki-ca /etc/pki/pki-tomcat /etc/sysconfig/pki /etc/httpd/alias /var/lib/pki /var/lib/pki-ca /var/lib/ipa/sysrestore /var/lib/ipa-client/sysrestore /var/lib/ipa/dnssec /var/lib/sss/pubconf/krb5.include.d/ /var/lib/authconfig/last /var/lib/certmonger /var/lib/ipa /var/run/dirsrv /var/lock/dirsrv
/etc/named.conf /etc/named.keytab /etc/resolv.conf /etc/sysconfig/pki-ca /etc/sysconfig/pki-tomcat /etc/sysconfig/dirsrv /etc/sysconfig/ntpd /etc/sysconfig/krb5kdc /etc/sysconfig/pki/ca/pki-ca /etc/sysconfig/ipa-dnskeysyncd /etc/sysconfig/ipa-ods-exporter /etc/sysconfig/named /etc/sysconfig/ods /etc/sysconfig/authconfig /etc/ipa/nssdb/pwdfile.txt /etc/pki/ca-trust/source/ipa.p11-kit /etc/pki/ca-trust/source/anchors/ipa-ca.crt /etc/nsswitch.conf /etc/krb5.keytab /etc/sssd/sssd.conf /etc/openldap/ldap.conf /etc/security/limits.conf /etc/httpd/conf/password.conf /etc/httpd/conf/ipa.keytab /etc/httpd/conf.d/ipa-pki-proxy.conf /etc/httpd/conf.d/ipa-rewrite.conf /etc/httpd/conf.d/nss.conf /etc/httpd/conf.d/ipa.conf /etc/ssh/sshd_config /etc/ssh/ssh_config /etc/krb5.conf /etc/ipa/ca.crt /etc/ipa/default.conf /etc/dirsrv/ds.keytab /etc/ntp.conf /etc/samba/smb.conf /etc/samba/samba.keytab /root/ca-agent.p12 /root/cacert.p12 /var/kerberos/krb5kdc/kdc.conf /etc/systemd/system/multi-user.target.wants/ipa.service /etc/systemd/system/multi-user.target.wants/sssd.service /etc/systemd/system/multi-user.target.wants/certmonger.service /etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd@pki-tomcat.service /var/run/ipa/services.list /etc/opendnssec/conf.xml /etc/opendnssec/kasp.xml /etc/ipa/dnssec/softhsm2.conf /etc/ipa/dnssec/softhsm_pin_so /etc/ipa/dnssec/ipa-ods-exporter.keytab /etc/ipa/dnssec/ipa-dnskeysyncd.keytab /etc/idm/nssdb/cert8.db /etc/idm/nssdb/key3.db /etc/idm/nssdb/secmod.db /etc/ipa/nssdb/cert8.db /etc/ipa/nssdb/key3.db /etc/ipa/nssdb/secmod.db
/var/log/pki-ca /var/log/pki/ /var/log/dirsrv/slapd-PKI-IPA /var/log/httpd /var/log/ipaserver-install.log /var/log/kadmind.log /var/log/pki-ca-install.log /var/log/messages /var/log/ipaclient-install.log /var/log/secure /var/log/ipaserver-uninstall.log /var/log/pki-ca-uninstall.log /var/log/ipaclient-uninstall.log /var/named/data/named.run
ipa-restore /path/to/backup
ipa-restore --instance=IPA-REALM /path/to/backup
systemctl stop sssd
find /var/lib/sss/ ! -type d | xargs rm -f
systemctl start sssd
ipa-restore --gpg-keyring=/root/backup /path/to/backup
[jsmith@server ~]USD ipa selfservice-add "Users can manage their own name details" --permissions=write --attrs=givenname --attrs=displayname --attrs=title --attrs=initials ----------------------------------------------------------- Added selfservice "Users can manage their own name details" ----------------------------------------------------------- Self-service name: Users can manage their own name details Permissions: write Attributes: givenname, displayname, title, initials
[jsmith@server ~]USD ipa selfservice-mod "Users can manage their own name details" --attrs=givenname --attrs=displayname --attrs=title --attrs=initials --attrs=surname -------------------------------------------------------------- Modified selfservice "Users can manage their own name details" -------------------------------------------------------------- Self-service name: Users can manage their own name details Permissions: write Attributes: givenname, displayname, title, initials
ipa delegation-add "basic manager attrs" --attrs=manager --attrs=title --attrs=employeetype --attrs=employeenumber --group=engineering_managers --membergroup=engineering -------------------------------------- Added delegation "basic manager attrs" -------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber Member user group: engineering User group: engineering_managers
[jsmith@server ~]USD ipa delegation-mod "basic manager attrs" --attrs=manager --attrs=title --attrs=employeetype --attrs=employeenumber --attrs=displayname ----------------------------------------- Modified delegation "basic manager attrs" ----------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber, displayname Member user group: engineering User group: engineering_managers
kinit admin ipa role-add --desc="User Administrator" useradmin ------------------------ Added role "useradmin" ------------------------ Role name: useradmin Description: User Administrator
ipa role-add-privilege --privileges="User Administrators" useradmin Role name: useradmin Description: User Administrator Privileges: user administrators ---------------------------- Number of privileges added 1 ----------------------------
ipa role-add-member --groups=useradmins useradmin Role name: useradmin Description: User Administrator Member groups: useradmins Privileges: user administrators ------------------------- Number of members added 1 -------------------------
cn=automount,dc=example,dc=com
(!(objectclass=posixgroup))
uid=*,cn=users,cn=accounts,dc=com
ipa permission-add "dns admin permission"
--bindtype=all
--permissions=read --permissions=write --permissions={read,write}
--attrs=description --attrs=automountKey --attrs={description,automountKey}
ipa permission-add "manage service" --permissions=all --type=service --attrs=krbprincipalkey --attrs=krbprincipalname --attrs=managedby
ipa permission-add "manage automount locations" --subtree="ldap://ldap.example.com:389/cn=automount,dc=example,dc=com" --permissions=write --attrs=automountmapname --attrs=automountkey --attrs=automountInformation
ipa permission-add "manage Windows groups" --filter="(!(objectclass=posixgroup))" --permissions=write --attrs=description
ipa permission-add ManageHost --permissions="write" --subtree=cn=computers,cn=accounts,dc=testrelm,dc=com --attr=nshostlocation --memberof=admins
ipa permission-mod 'System: Modify Users' --type=group ipa: ERROR: invalid 'ipapermlocation': not modifiable on managed permissions
ipa permission-mod 'System: Modify Users' --excludedattrs=gecos ------------------------------------------ Modified permission "System: Modify Users"
[jsmith@server ~]USD ipa privilege-add "managing filesystems" --desc="for filesystems"
[jsmith@server ~]USD ipa privilege-add-permission "managing filesystems" --permissions="managing automount" --permissions="managing ftp services"
authconfig --enablemkhomedir --update
ipa automountlocation-add userdirs Location: userdirs
ipa automountkey-add userdirs auto.direct --key=/share --info="-ro,soft, server.example.com:/home/share" Key: /share Mount information: -ro,soft, server.example.com:/home/share
ipa user-add First name: first_name Last name: last_name User login [default_login]: custom_login
ipa stageuser-add stage_user_login --first= first_name --last= last_name --email= email_address
'(?!^[0-9]+USD)^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*[a-zA-Z0-9_.USD-]?USD'
ipa config-mod --maxusername=64 Maximum username length: 64
ipa user-find --------------- 23 users matched --------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 1453200000 GID: 1453200000 Account disabled: False Password: True Kerberos keys available: True User login: user
ipa user-find --title= user_title --------------- 2 users matched --------------- User login: user Job Title: Title User login: user2 Job Title: Title
ipa user-find user --------------- 3 users matched --------------- User login: user User login: user2 User login: user3
ipa user-show user_login User login: user_login First name: first_name Last name: last_name
ipa stageuser-activate user_login ------------------------- Stage user user_login activated -------------------------
ipa user-del user_login -------------------- Deleted user "user3" --------------------
ipa user-del --preserve user_login -------------------- Deleted user "user_login" --------------------
ipa stageuser-del user_login -------------------------- Deleted stage user "user_login" --------------------------
ipa user-del --continue user1 user2 user3
ipa user-undel user_login ------------------------------ Undeleted user account "user_login" ------------------------------
ipa user-stage user_login ------------------------------ Staged user account "user_login" ------------------------------
ipa user-mod user_login --title= new_title
ipa user-mod user --addattr=mobile= new_mobile_number -------------------- Modified user "user" -------------------- User login: user Mobile Telephone Number: mobile_number, new_mobile_number
ipa user-mod user --addattr=mobile= mobile_number_1 --addattr=mobile= mobile_number_2
ipa user-mod user --email= email@example.com ipa user-mod user --addattr=mail= another_email@example.com
ipa user-find User login: user First name: User Last name: User Home directory: /home/user Login shell: /bin/sh UID: 1453200009 GID: 1453200009 Account disabled: True Password: False Kerberos keys available: False
ipa user-disable user_login ---------------------------- Disabled user account "user_login" ----------------------------
ipa user-enable user_login ---------------------------- Enabled user account "user_login" ----------------------------
kinit admin
ipa role-add --desc "Responsible for provisioning stage users" "System Provisioning" -------------------------------- Added role "System Provisioning" -------------------------------- Role name: System Provisioning Description: Responsible for provisioning stage users
ipa role-add-privilege "System Provisioning" --privileges="Stage User Provisioning" Role name: System Provisioning Description: Responsible for provisioning stage users Privileges: Stage User Provisioning ---------------------------- Number of privileges added 1 ----------------------------
ipa user-add stage_user_admin --password First name: first_name Last name: last_name Password: Enter password again to verify:
ipa role-add-member "System Provisioning" --users=stage_user_admin Role name: System Provisioning Description: Responsible for provisioning stage users Member users: stage_user_admin Privileges: Stage User Provisioning ------------------------- Number of members added 1 -------------------------
ipa role-show "System Provisioning" -------------- 1 role matched -------------- Role name: System provisioning Description: Responsible for provisioning stage users Member users: stage_user_admin Privileges: Stage User Provisioning ---------------------------- Number of entries returned 1 ----------------------------
kinit stage_user_admin Password for stage_user_admin@EXAMPLE.COM: Password expired. You must change it now. Enter new password: Enter it again:
klist Ticket cache: KEYRING:persistent:0:krb_ccache_xIlCQDW Default principal: stage_user_admin@EXAMPLE.COM Valid starting Expires Service principal 02/25/2016 11:42:20 02/26/2016 11:42:20 krbtgt/EXAMPLE.COM
ipa stageuser-add stage_user First name: first_name Last name: last_name ipa: ERROR: stage_user: stage user not found
ipa stageuser-show stage_user ipa: ERROR: stage_user: stage user not found
kinit admin Password for admin@EXAMPLE.COM: ipa stageuser-show stage_user User login: stage_user First name: Stage Last name: User
ipa user-add provisionator --first=provisioning --last=account --password
ipa role-add --desc "Responsible for provisioning stage users" "System Provisioning"
ipa role-add-privilege "System Provisioning" --privileges="Stage User Provisioning"
ipa role-add-member --users=provisionator "System Provisioning"
ipa user-add activator --first=activation --last=account --password
ipa role-add-member --users=activator "User Administrator"
ipa group-add service-accounts
ipa pwpolicy-add service-accounts --maxlife=10000 --minlife=0 --history=0 --minclasses=4 --minlength=20 --priority=1 --maxfail=0 --failinterval=1 --lockouttime=0
ipa group-add-member service-accounts --users={provisionator,activator}
kpasswd provisionator kpasswd activator
ipa-getkeytab -s example.com -p "activator" -k /etc/krb5.ipa-activation.keytab
#!/bin/bash kinit -k -i activator ipa stageuser-find --all --raw | grep " uid:" | cut -d ":" -f 2 | while read uid; do ipa stageuser-activate USD{uid}; done
chmod 755 /usr/local/sbin/ipa-activate-all chown root:root /usr/local/sbin/ipa-activate-all
[Unit] Description=Scan IdM every minute for any stage users that must be activated [Service] Environment=KRB5_CLIENT_KTNAME=/etc/krb5.ipa-activation.keytab Environment=KRB5CCNAME=FILE:/tmp/krb5cc_ipa-activate-all ExecStart=/usr/local/sbin/ipa-activate-all
[Unit] Description=Scan IdM every minute for any stage users that must be activated [Timer] OnBootSec=15min OnUnitActiveSec=1min [Install] WantedBy=multi-user.target
systemctl enable ipa-activate-all.timer
dn: uid= user_login ,cn=staged users,cn=accounts,cn=provisioning,dc= example ,dc=com changetype: add objectClass: top objectClass: inetorgperson uid: user_login sn: surname givenName: first_name cn: full_name
dn: uid= user_login ,cn=staged users,cn=accounts,cn=provisioning,dc= example ,dc=com changetype: add objectClass: top objectClass: person objectClass: inetorgperson objectClass: organizationalperson objectClass: posixaccount uid: user_login uidNumber: UID_number gidNumber: GID_number sn: surname givenName: first_name cn: full_name homeDirectory: /home/ user_login
ldapsearch -LLL -x -D "uid= user_allowed_to_read ,cn=users,cn=accounts,dc=example, dc=com" -w " password " -H ldap:// server.example.com -b "cn=users, cn=accounts, dc=example, dc=com" uid= user_login
dn: distinguished_name changetype: modify replace: attribute_to_modify attribute_to_modify: new_value
dn: distinguished_name changetype: modify replace: nsAccountLock nsAccountLock: TRUE
dn: distinguished_name changetype: modify replace: nsAccountLock nsAccountLock: FALSE
dn: distinguished_name changetype: modrdn newrdn: uid= user_login deleteoldrdn: 0 newsuperior: cn=deleted users,cn=accounts,cn=provisioning,dc=example
dn: cn= group_distinguished_name ,cn=groups,cn=accounts,dc=example,dc=com changetype: add objectClass: top objectClass: ipaobject objectClass: ipausergroup objectClass: groupofnames objectClass: nestedgroup objectClass: posixgroup cn: group_name gidNumber: GID_number
ldapsearch -YGSSAPI -H ldap:// server.example.com -b "cn=groups,cn=accounts,dc=example,dc=com" "cn= group_name "
dn: group_distinguished_name changetype: delete
dn: group_distinguished_name changetype: modify add: member member: uid= user_login ,cn=users,cn=accounts,dc=example,dc=com
dn: distinguished_name changetype: modify delete: member member: uid= user_login ,cn=users,cn=accounts,dc=example,dc=com
ldapmodify -Y GSSAPI SASL/GSSAPI authentication started SASL username: admin@EXAMPLE SASL SSF: 56 SASL data security layer installed. dn: uid=stageuser,cn=staged users,cn=accounts,cn=provisioning,dc=example changetype: add objectClass: top objectClass: inetorgperson cn: Stage sn: User adding new entry "uid=stageuser,cn=staged users,cn=accounts,cn=provisioning,dc=example"
ipa stageuser-show stageuser --all --raw dn: uid=stageuser,cn=staged users,cn=accounts,cn=provisioning,dc=example uid: stageuser sn: User cn: Stage has_password: FALSE has_keytab: FALSE nsaccountlock: TRUE objectClass: top objectClass: inetorgperson objectClass: organizationalPerson objectClass: person
ldapmodify -Y GSSAPI SASL/GSSAPI authentication started SASL username: admin@EXAMPLE SASL SSF: 56 SASL data security layer installed. dn: uid=user1,cn=users,cn=accounts,dc=example changetype: modrdn newrdn: uid=user1 deleteoldrdn: 0 newsuperior: cn=deleted users,cn=accounts,cn=provisioning,dc=example modifying rdn of entry "uid=user1,cn=users,cn=accounts,dc=example"
ipa user-find --preserved=true --------------- 1 user matched --------------- User login: user1 First name: first_name Last name: last_name ---------------------------- Number of entries returned 1 ----------------------------
ipa host-add client1.example.com
ipa host-add --force --ip-address=192.168.166.31 client1.example.com
ipa host-add --force client1.example.com
ipa host-del --updatedns client1.example.com
[jsmith@ipaserver ~]USD kinit admin [jsmith@ipaserver ~]USD ipa host-disable server.example.com
ipa-getkeytab -s server.example.com -p host/client.example.com -k /etc/krb5.keytab -D "cn=directory manager" -w password
host.example.com,1.2.3.4 ssh-rsa AAA...ZZZ==
"ssh-rsa ABCD1234...== ipaclient.example.com"
ssh-rsa AAA...ZZZ== host.example.com,1.2.3.4
server.example.com,1.2.3.4 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApvjBvSFSkTU0WQW4eOweeo0DZZ08F9Ud21xlLy6FOhzwpXFGIyxvXZ52+siHBHbbqGL5+14N7UvElruyslIHx9LYUR/pPKSMXCGyboLy5aTNl5OQ5EHwrhVnFDIKXkvp45945R7SKYCUtRumm0Iw6wq0XD4o+ILeVbV3wmcB1bXs36ZvC/M6riefn9PcJmh6vNCvIsbMY6S+FhkWUTTiOXJjUDYRLlwM273FfWhzHK+SSQXeBp/zIn1gFvJhSZMRi9HZpDoqxLbBB9QIdIw6U4MIjNmKsSI/ASpkFm2GuQ7ZK9KuMItY2AoCuIRmRAdF8iYNHBTXNfFurGogXwRDjQ==
[jsmith@server ~]USD ssh-keygen -t rsa -C "server.example.com,1.2.3.4" Generating public/private rsa key pair. Enter file in which to save the key (/home/jsmith/.ssh/id_rsa): /home/jsmith/.ssh/host_keys Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/jsmith/.ssh/host_keys. Your public key has been saved in /home/jsmith/.ssh/host_keys.pub. The key fingerprint is: SHA256:GAUIDVVEgly7rs1lTWP6oguHz8BKvyZkpqCqVSsmi7c server.example.com The key's randomart image is: +--[ RSA 2048]----+ | .. | | .+| | o .* | | o . .. *| | S + . o+| | E . .. .| | . = . o | | o . ..o| | .....| +-----------------+
[jsmith@server ~]USD cat /home/jsmith/.ssh/host_keys.pub ssh-rsa AAAAB3NzaC1yc2E...tJG1PK2Mq++wQ== server.example.com,1.2.3.4
[jsmith@server ~]USD ipa host-mod --sshpubkey="ssh-rsa RjlzYQo==" --updatedns host1.example.com
--sshpubkey="RjlzYQo==" --sshpubkey="ZEt0TAo=="
[jsmith@server ~]USD kinit admin [jsmith@server ~]USD ipa host-mod --sshpubkey= --updatedns host1.example.com
cn=server,ou=ethers,dc=example,dc=com
[jsmith@server ~]USD kinit admin [jsmith@server ~]USD ipa host-mod --macaddress=12:34:56:78:9A:BC server.example.com
ethers: ldap
getent ethers server.example.com
ipa group-show group_A Member users: user_1 Member groups: group_B Indirect Member users: user_2
ipa group-find --private ---------------- 2 groups matched ---------------- Group name: user1 Description: User private group for user1 GID: 830400006 Group name: user2 Description: User private group for user2 GID: 830400004 ---------------------------- Number of entries returned 2 ----------------------------
kinit admin
ipa group-add group_name ----------------------- Added group "group_name" ------------------------
kinit admin
ipa group-del group_name -------------------------- Deleted group "group_name" --------------------------
sss_cache -n host_group_name
ipa group-add-member group_name --users= user1 --users= user2 --groups= group1
ipa group-add-member group_name --external=' AD_DOMAIN \ ad_user ' ipa group-add-member group_name --external=' ad_user @ AD_DOMAIN ' ipa group-add-member group_name --external=' ad_user @ AD_DOMAIN.EXAMPLE.COM '
ipa group-remove-member group_name --users= user1 --users= user2 --groups= group1
kinit admin
ipa-managed-entries --list
ipa-managed-entries -e "UPG Definition" disable Disabling Plugin
systemctl restart dirsrv.target
ipa config-mod --usersearch="uid,givenname,sn,telephonenumber,ou,title" ipa config-mod --groupsearch="cn,description"
ipa automember-add Automember Rule: user_group Grouping Type: group -------------------------------- Added automember rule "user_group" -------------------------------- Automember Rule: user_group
ipa automember-add-condition Automember Rule: user_group Attribute Key: uid Grouping Type: group [Inclusive Regex]: .* [Exclusive Regex]: ---------------------------------- Added condition(s) to "user_group" ---------------------------------- Automember Rule: user_group Inclusive Regex: uid=.* ---------------------------- Number of conditions added 1 ----------------------------
ipa automember-add Automember Rule: all_hosts Grouping Type: hostgroup ------------------------------------- Added automember rule "all_hosts" ------------------------------------- Automember Rule: all_hosts
ipa automember-add-condition Automember Rule: all_hosts Attribute Key: fqdn Grouping Type: hostgroup [Inclusive Regex]: .* [Exclusive Regex]: --------------------------------- Added condition(s) to "all_hosts" --------------------------------- Automember Rule: all_hosts Inclusive Regex: fqdn=.* ---------------------------- Number of conditions added 1 ----------------------------
ipa automember-add Automember Rule: ad_users Grouping Type: group ------------------------------------- Added automember rule "ad_users" ------------------------------------- Automember Rule: ad_users
ipa automember-add-condition Automember Rule: ad_users Attribute Key: objectclass Grouping Type: group [Inclusive Regex]: ntUser [Exclusive Regex]: ------------------------------------- Added condition(s) to "ad_users" ------------------------------------- Automember Rule: ad_users Inclusive Regex: objectclass=ntUser ---------------------------- Number of conditions added 1 ----------------------------
ipa automember-rebuild --type=group -------------------------------------------------------- Automember rebuild task finished. Processed (9) entries. --------------------------------------------------------
ipa automember-rebuild --users= user1 --users= user2 -------------------------------------------------------- Automember rebuild task finished. Processed (2) entries. --------------------------------------------------------
ipa automember-default-group-set Default (fallback) Group: default_user_group Grouping Type: group --------------------------------------------------- Set default (fallback) group for automember "default_user_group" --------------------------------------------------- Default (fallback) Group: cn=default_user_group,cn=groups,cn=accounts,dc=example,dc=com
ipa automember-default-group-show Grouping Type: group Default (fallback) Group: cn=default_user_group,cn=groups,cn=accounts,dc=example,dc=com
ipa-replica-manage dnarange-show masterA.example.com: 1001-1500 masterB.example.com: 1501-2000 masterC.example.com: No range set ipa-replica-manage dnarange-show masterA.example.com masterA.example.com: 1001-1500
ipa-replica-manage dnanextrange-show masterA.example.com: 1001-1500 masterB.example.com: No on-deck range set masterC.example.com: No on-deck range set ipa-replica-manage dnanextrange-show masterA.example.com masterA.example.com: 1001-1500
ipa-replica-manage dnarange-set masterA.example.com 1250-1499
ipa-replica-manage dnanextrange-set masterB.example.com 1001-5000
sss_cache -u user
[bjensen@server ~]USD ipa config-mod --userobjectclasses= {top,person,organizationalperson,inetorgperson,inetuser,posixaccount,krbprincipalaux,krbticketpolicyaux,ipaobject,ipasshuser, employeeinfo }
set -o braceexpand
[bjensen@server ~]USD ipa config-mod --groupobjectclasses= {top,groupofnames,nestedgroup,ipausergroup,ipaobject,ipasshuser, employeegroup }
[bjensen@server ~]USD kinit admin [bjensen@server ~]USD ipa config-show --all dn: cn=ipaConfig,cn=etc,dc=example,dc=com Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: example.com Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=EXAMPLE.COM Default group objectclasses: top, groupofnames, nestedgroup, ipausergroup, ipaobject Default user objectclasses: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser Password Expiration Notification (days): 4 Password plugin features: AllowNThash SELinux user map order: guest_u:s0USDxguest_u:s0USDuser_u:s0USDstaff_u:s0-s0:c0.c1023USDunconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE cn: ipaConfig objectclass: nsContainer, top, ipaGuiConfig, ipaConfigObject
# ipa-getkeytab -s ipaserver.example.com -p HTTP/server.example.com -k /etc/httpd/conf/krb5.keytab -e aes256-cts
ipa service-add serviceName/hostname
ipa service-add HTTP/server.example.com ------------------------------------------------------- Added service "HTTP/server.example.com@EXAMPLE.COM" ------------------------------------------------------- Principal: HTTP/server.example.com@EXAMPLE.COM Managed by: ipaserver.example.com
ipa-getkeytab -s server.example.com -p HTTP/server.example.com -k /etc/httpd/conf/krb5.keytab -e aes256-cts
ipa-getkeytab -s kdc.example.com -p HTTP/server.example.com -k /etc/httpd/conf/krb5.keytab -e aes256-cts
kinit admin
ipa dnsrecord-add idm.example.com cluster --a-rec={192.0.2.40,192.0.2.41} Record name: cluster A record: 192.0.2.40, 192.0.2.41
ipa host-add cluster.idm.example.com ------------------------------------ Added host "cluster.idm.example.com" ------------------------------------ Host name: cluster.idm.example.com Principal name: host/cluster.idm.example.com@IDM.EXAMPLE.COM Password: False Keytab: False Managed by: cluster.idm.example.com
ipa service-add HTTP/cluster.idm.example.com ------------------------------------------------------------ Added service "HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM" ------------------------------------------------------------ Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM Managed by: cluster.idm.example.com
ipa service-allow-retrieve-keytab HTTP/cluster.idm.example.com --hosts={node01.idm.example.com,node02.idm.example.com} Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM Managed by: cluster.idm.example.com Hosts allowed to retrieve keytab: node01.idm.example.com, node02.idm.example.com ------------------------- Number of members added 2 -------------------------
ipa service-allow-create-keytab HTTP/cluster.idm.example.com --hosts=node01.idm.example.com Principal: HTTP/cluster.idm.example.com@IDM.EXAMPLE.COM Managed by: cluster.idm.example.com Hosts allowed to retrieve keytab: node01.idm.example.com, node02.idm.example.com Hosts allowed to create keytab: node01.idm.example.com ------------------------- Number of members added 1 -------------------------
kinit -kt /etc/krb5.keytab
ipa-getkeytab -s ipaserver.idm.example.com -p HTTP/cluster.idm.example.com -k /tmp/client.keytab
ipa-getkeytab -r -s ipaserver.idm.example.com -p HTTP/cluster.idm.example.com -k /tmp/client.keytab
[jsmith@ipaserver ~]USD kinit admin [jsmith@ipaserver ~]USD ipa service-disable HTTP/server.example.com
ipa-getkeytab -s ipaserver.example.com -p HTTP/server.example.com -k /etc/httpd/conf/krb5.keytab -e aes256-cts
ipa service-add-host principal --hosts= hostname
ipa service-add HTTP/web.example.com ipa service-add-host HTTP/web.example.com --hosts=client1.example.com
kinit -kt /etc/krb5.keytab host/client1.example.com ipa-getkeytab -s server.example.com -k /tmp/test.keytab -p HTTP/web.example.com Keytab successfully retrieved and stored in: /tmp/test.keytab
kinit -kt /etc/krb5.keytab host/client1.example.com openssl req -newkey rsa:2048 -subj '/CN=web.example.com/O=EXAMPLE.COM' -keyout /etc/pki/tls/web.key -out /tmp/web.csr -nodes Generating a 2048 bit RSA private key .............................................................+++ ............................................................................................+++ Writing new private key to '/etc/pki/tls/private/web.key'
ipa cert-request --principal=HTTP/web.example.com web.csr Certificate: MIICETCCAXqgA...[snip] Subject: CN=web.example.com,O=EXAMPLE.COM Issuer: CN=EXAMPLE.COM Certificate Authority Not Before: Tue Feb 08 18:51:51 2011 UTC Not After: Mon Feb 08 18:51:51 2016 UTC Serial number: 1005
kinit admin
ipa host-add-managedby client2.example.com --hosts=client1.example.com
kinit -kt /etc/krb5.keytab host/client1.example.com
ipa-getkeytab -s server.example.com -k /tmp/client2.keytab -p host/client2.example.com Keytab successfully retrieved and stored in: /tmp/client2.keytab
kinit -kt /etc/krb5.keytab host/ipa.example.com@EXAMPLE.COM
kinit -kt /etc/httpd/conf/krb5.keytab HTTP/ipa.example.com@EXAMPLE.COM
ipa help idviews
ipa idview-add --help
kinit admin
ipa idview-add example_for_host1 --------------------------- Added ID View "example_for_host1" --------------------------- ID View Name: example_for_host1
ipa idoverrideuser-add example_for_host1 user --sshpubkey=" ssh-rsa AAAAB3NzaC1yrRqFE...gWRL71/miPIZ user@example.com " ----------------------------- Added User ID override "user" ----------------------------- Anchor to override: user SSH public key: ssh-rsa AAAB3NzaC1yrRqFE...gWRL71/miPIZ user@example.com
ipa idoverrideuser-add-cert example_for_host1 user --certificate="MIIEATCC..."
ipa idview-apply example_for_host1 --hosts=host1.example.com ----------------------------- Applied ID View "example_for_host1" ----------------------------- hosts: host1.example.com --------------------------------------------- Number of hosts the ID View was applied to: 1 ---------------------------------------------
ipa service-mod service/ipa.example.com@EXAMPLE.COM --ok-as-delegate= 1
ipa service-mod test/ipa.example.com@EXAMPLE.COM --requires-pre-auth= 0
kvno test/ipa.example.com@EXAMPLE.COM klist -f Ticket cache: KEYRING:persistent:0:0 Default principal: admin@EXAMPLE.COM Valid starting Expires Service principal 02/19/2014 09:59:02 02/20/2014 08:21:33 test/ipa/example.com@EXAMPLE.COM Flags: FAT O
kadmin.local kadmin.local: getprinc test/ipa.example.com Principal: test/ipa.example.com@EXAMPLE.COM Expiration date: [never] Attributes: REQUIRES_PRE_AUTH OK_AS_DELEGATE OK_TO_AUTH_AS_DELEGATE Policy: [none]
ipa user-add-principal user useralias -------------------------------- Added new aliases to user "user" -------------------------------- User login: user Principal alias: user@IDM.EXAMPLE.COM, useralias@IDM.EXAMPLE.COM
kinit -C useralias Password for user@IDM.EXAMPLE.COM:
ipa user-remove-principal user useralias -------------------------------- Removed aliases from user "user" -------------------------------- User login: user Principal alias: user@IDM.EXAMPLE.COM
ipa user-show user User login: user Principal name: user@IDM.EXAMPLE.COM ipa user-remove-principal user user ipa: ERROR: invalid 'krbprincipalname': at least one value equal to the canonical principal name must be present
ipa: ERROR: The realm for the principal does not match the realm for this IPA server
ipa user-add-principal user user\\@example.com -------------------------------- Added new aliases to user "user" -------------------------------- User login: user Principal alias: user@IDM.EXAMPLE.COM, user\@example.com@IDM.EXAMPLE.COM
kinit -E user@example.com Password for user\@example.com@IDM.EXAMPLE.COM:
ipa user-remove-principal user user\\@example.com -------------------------------- Removed aliases from user "user" -------------------------------- User login: user Principal alias: user@IDM.EXAMPLE.COM
( host.example.com ,, nisdomain.example.com ) (-, user , nisdomain.example.com )
dn: ipaUniqueID=d4453480-cc53-11dd-ad8b-0800200c9a66,cn=ng,cn=alt, cn: netgroup1 memberHost: fqdn=host1.example.com,cn=computers,cn=accounts, memberHost: cn=VirtGuests,cn=hostgroups,cn=accounts, memberUser: cn=demo,cn=users,cn=accounts, memberUser: cn=Engineering,cn=groups,cn=accounts, nisDomainName: nisdomain.example.com
ipa netgroup-show netgroup1 Netgroup name: netgroup1 Description: my netgroup NIS domain name: nisdomain.example.com Member Host: VirtGuests Member Host: host1.example.com Member User: demo Member User: Engineering
ipa-nis-manage enable ipa-compat-manage enable
ldapmodify -x -D 'cn=directory manager' -W dn: cn=NIS Server,cn=plugins,cn=config changetype: modify add: nsslapd-pluginarg0 nsslapd-pluginarg0: 514
systemctl enable rpcbind.service systemctl start rpcbind.service
systemctl restart dirsrv.target
ipa netgroup-add --desc="Netgroup description" --nisdomain="example.com" example-netgroup
ipa netgroup-add-member --users= user_name --groups= group_name --hosts= host_name --hostgroups= host_group_name --netgroups= netgroup_name group_nameame
ipa netgroup-add-member --users={user1;user2,user3} --groups={group1,group2} example-group
ldapadd -h server.example.com -x -D "cn=Directory Manager" -W dn: nis-domain=example.com+nis-map=auto.example,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: example.com nis-map: auto.example nis-filter: (objectclass=automount) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} nis-base: automountmapname=auto.example,cn=default,cn=automount,dc=example,dc=com
ypcat -k -d example.com -h server.example.com auto.example
yum install yp-tools -y
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 passwd > /dev/shm/nis-map.passwd 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.passwd) ; do IFS=' ' username=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key uid=USD(echo USDline | cut -f3 -d:) gid=USD(echo USDline | cut -f4 -d:) gecos=USD(echo USDline | cut -f5 -d:) homedir=USD(echo USDline | cut -f6 -d:) shell=USD(echo USDline | cut -f7 -d:) # Now create this entry echo passw0rd1 | ipa user-add USDusername --first=NIS --last=USER --password --gidnumber=USDgid --uid=USDuid --gecos="USDgecos" --homedir=USDhomedir --shell=USDshell ipa user-show USDusername done
kinit admin
sh /root/nis-users.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 group > /dev/shm/nis-map.group 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.group); do IFS=' ' groupname=USD(echo USDline | cut -f1 -d:) # Not collecting encrypted password because we need cleartext password # to create kerberos key gid=USD(echo USDline | cut -f3 -d:) members=USD(echo USDline | cut -f4 -d:) # Now create this entry ipa group-add USDgroupname --desc=NIS_GROUP_USDgroupname --gid=USDgid if [ -n "USDmembers" ]; then ipa group-add-member USDgroupname --users={USDmembers} fi ipa group-show USDgroupname done
kinit admin
sh /root/nis-groups.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -d USD1 -h USD2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.hosts); do IFS=' ' ipaddress=USD(echo USDline | awk '{print USD1}') hostname=USD(echo USDline | awk '{print USD2}') master=USD(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/) domain=USD(ipa env domain | tr -d '[:space:]' | cut -f2 -d:) if [ USD(echo USDhostname | grep "\." |wc -l) -eq 0 ] ; then hostname=USD(echo USDhostname.USDdomain) fi zone=USD(echo USDhostname | cut -f2- -d.) if [ USD(ipa dnszone-show USDzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add --name-server=USDmaster --admin-email=root.USDmaster fi ptrzone=USD(echo USDipaddress | awk -F. '{print USD3 "." USD2 "." USD1 ".in-addr.arpa."}') if [ USD(ipa dnszone-show USDptrzone 2>/dev/null | wc -l) -eq 0 ] ; then ipa dnszone-add USDptrzone --name-server=USDmaster --admin-email=root.USDmaster fi # Now create this entry ipa host-add USDhostname --ip-address=USDipaddress ipa host-show USDhostname done
kinit admin
sh /root/nis-hosts.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is the NIS domain, USD2 is the NIS master server ypcat -k -d USD1 -h USD2 netgroup > /dev/shm/nis-map.netgroup 2>&1 IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.netgroup); do IFS=' ' netgroupname=USD(echo USDline | awk '{print USD1}') triples=USD(echo USDline | sed "s/^USDnetgroupname //") echo "ipa netgroup-add USDnetgroupname --desc=NIS_NG_USDnetgroupname" if [ USD(echo USDline | grep "(," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --hostcat=all" fi if [ USD(echo USDline | grep ",," | wc -l) -gt 0 ]; then echo "ipa netgroup-mod USDnetgroupname --usercat=all" fi for triple in USDtriples; do triple=USD(echo USDtriple | sed -e 's/-//g' -e 's/(//' -e 's/)//') if [ USD(echo USDtriple | grep ",.*," | wc -l) -gt 0 ]; then hostname=USD(echo USDtriple | cut -f1 -d,) username=USD(echo USDtriple | cut -f2 -d,) domain=USD(echo USDtriple | cut -f3 -d,) hosts=""; users=""; doms=""; [ -n "USDhostname" ] && hosts="--hosts=USDhostname" [ -n "USDusername" ] && users="--users=USDusername" [ -n "USDdomain" ] && doms="--nisdomain=USDdomain" echo "ipa netgroup-add-member USDnetgroup USDhosts USDusers USDdoms" else netgroup=USDtriple echo "ipa netgroup-add USDnetgroup --desc=NIS_NG_USDnetgroup" fi done done
kinit admin
sh /root/nis-netgroups.sh nisdomain nis-master.example.com
#!/bin/sh USD1 is for the automount entry in ipa ipa automountlocation-add USD1 USD2 is the NIS domain, USD3 is the NIS master server, USD4 is the map name ypcat -k -d USD2 -h USD3 USD4 > /dev/shm/nis-map.USD4 2>&1 ipa automountmap-add USD1 USD4 basedn=USD(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=USD2+nis-map=USD4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: USD2 nis-map: USD4 nis-base: automountmapname=USD4,cn=USD1,cn=automount,USDbasedn nis-filter: (objectclass=*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF ldapadd -x -h USD3 -D "cn=Directory Manager" -W -f /tmp/amap.ldif IFS=USD'\n' for line in USD(cat /dev/shm/nis-map.USD4); do IFS=" " key=USD(echo "USDline" | awk '{print USD1}') info=USD(echo "USDline" | sed -e "s#^USDkey[ \t]*##") ipa automountkey-add nis USD4 --key="USDkey" --info="USDinfo" done
kinit admin
sh /root/nis-automounts.sh location nisdomain nis-master.example.com map_name
ldapmodify -D "cn=Directory Manager" -W -p 389 -h ipaserver.example.com -x dn: cn=config changetype: modify replace: passwordStorageScheme passwordStorageScheme: crypt
ipa user-mod user --password Password: Enter Password again to verify: -------------------- Modified user "user" --------------------
ldapmodify -x -D "cn=Directory Manager" -W -h ldap.example.com -p 389 dn: cn=ipa_pwd_extop,cn=plugins,cn=config changetype: modify add: passSyncManagersDNs passSyncManagersDNs: uid=admin,cn=users,cn=accounts,dc=example,dc=com
ipa user-unlock user ----------------------- Unlocked account "user" -----------------------
ipa user-status user ----------------------- Account disabled: False ----------------------- Server: example.com Failed logins: 8 Last successful authentication: 20160229080309Z Last failed authentication: 20160229080317Z Time now: 2016-02-29T08:04:46Z ---------------------------- Number of entries returned 1 ----------------------------
ipa config-show | grep "Password plugin features" Password plugin features: AllowNThash , KDC:Disable Last Success
ipa config-mod --ipaconfigstring='AllowNThash'
ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
ipactl restart
First Factor: Second Factor (optional):
First factor: static_password Second factor: one-time_password
First factor: static_password Second factor: one-time_password
[Service] Environment=OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW=1
systemctl daemon-reload
systemctl start radiusd
ipa config-mod --user-auth-type=otp
ipa config-mod --user-auth-type=otp --user-auth-type=disabled
ipa user-mod user --user-auth-type=otp
ipa config-mod --user-auth-type=otp --user-auth-type=password
ipa otptoken-add ------------------ Added OTP token "" ------------------ Unique ID: 7060091b-4e40-47fd-8354-cb32fecd548a Type: TOTP
ipa otptoken-add-yubikey --slot=2
ipa otptoken-add --owner=user ------------------ Added OTP token "" ------------------ Unique ID: 5303baa8-08f9-464e-a74d-3b38de1c041d Type: TOTP
ipa otptoken-add-yubikey --owner=user
[otp] DEFAULT = { timeout = 120 }
systemctl restart krb5kdc
ipa user-mod --user-auth-type=password --user-auth-type=otp user_name
ipa otptoken-add --desc=" New Token "
ipa otptoken-find -------------------- 2 OTP tokens matched -------------------- Unique ID: 4ce8ec29-0bf7-4100-ab6d-5d26697f0d8f Type: TOTP Description: New Token Owner: user Unique ID: e1e9e1ef-172c-4fa9-b637-6b017ce79315 Type: TOTP Description: Old Token Owner: user ---------------------------- Number of entries returned 2 ----------------------------
# ipa otptoken-del e1e9e1ef-172c-4fa9-b637-6b017ce79315 -------------------------------------------------------- Deleted OTP token " e1e9e1ef-172c-4fa9-b637-6b017ce79315 " --------------------------------------------------------
ipa user-mod --user-auth-type=otp user_name
ipa host-mod server.example.com --auth-ind=otp --------------------------------------------------------- Modified host "server.example.com" --------------------------------------------------------- Host name: server.example.com Authentication Indicators: otp
pkinit_indicator = indicator
systemctl restart krb5kdc
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMM4xPu54Kf2dx7C4Ta2F7vnIzuL1i6P21TTKniSkjFuA+r qW06588e7v14Im4VejwnNk352gp49A62qSVOzp8IKA9xdtyRmHYCTUvmkcyspZvFRI713zfRKQVFyJOqHmW/m dCmak7QBxYou2ELSPhH3pe8MYTQIulKDSu5Zbsrqedg1VGkSJxf7mDnCSPNWWzAY9AFB9Lmd2m2xZmNgVAQEQ nZXNMaIlroLD/51rmMSkJGHGb1O68kEq9Z client.example.com
ssh-keygen -t rsa -C user@example.com Generating public/private rsa key pair. Enter file in which to save the key (/home/user/.ssh/id_rsa): Created directory '/home/user/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/user/.ssh/id_rsa. Your public key has been saved in /home/user/.ssh/id_rsa.pub. The key fingerprint is: SHA256:GAUIDVVEgly7rs1lTWP6oguHz8BKvyZkpqCqVSsmi7c user@example.com The key's randomart image is: +--[ RSA 2048]----+ | | | + . | | + = . | | = + | | . E S.. | | . . .o | | . . . oo. | | . o . +.+o | | o .o..o+o | +-----------------+
ipa user-mod user --sshpubkey=" ssh-rsa AAAAB3Nza...SNc5dv== client.example.com "
--sshpubkey="AAAAB3Nza...SNc5dv==" --sshpubkey="RjlzYQo...ZEt0TAo="
ipa user-mod user --sshpubkey="USD(cat ~/.ssh/id_rsa.pub)" --sshpubkey="USD(cat ~/.ssh/id_rsa2.pub)"
ipa user-mod user --sshpubkey=
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys AuthorizedKeysCommandUser user
certutil -L -d /etc/pki/nssdb/ -h all Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI my_certificate CT,C,C
certutil -L -d /etc/pki/nssdb/ -n ' my_certificate ' -r | base64 -w 0 > user.crt
ipa certmaprule-add simple_rule --matchrule '<ISSUER>CN=Smart Card CA,O=EXAMPLE.ORG' --maprule '(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})'
openssl x509 -noout -issuer -in idm_user.crt -nameopt RFC2253 issuer=CN=Certificate Authority,O=REALM.EXAMPLE.COM
# openssl x509 -noout -issuer -in ad_user.crt -nameopt RFC2253 issuer=CN=AD-WIN2012R2-CA,DC=AD,DC=EXAMPLE,DC=COM
ipa certmaprule-add simple_rule --matchrule '<ISSUER>CN= AD-WIN2012R2-CA,DC=AD,DC=EXAMPLE,DC=COM ' --maprule '(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})'
(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})
<ISSUER>CN=Smart Card CA,O=EXAMPLE.ORG
systemctl restart sssd
kinit admin
ipa certmaprule-add rule_name --matchrule '<ISSUER>CN=Smart Card CA,O=EXAMPLE.ORG' --maprule '(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})' ------------------------------------------------------- Added Certificate Identity Mapping Rule "rule_name" ------------------------------------------------------- Rule name: rule_name Mapping rule: (ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=Smart Card CA,O=EXAMPLE.ORG Enabled: TRUE
systemctl restart sssd
[root@server ~]# cat idm_user_certificate.pem -----BEGIN CERTIFICATE----- MIIFFTCCA/2gAwIBAgIBEjANBgkqhkiG9w0BAQsFADA6MRgwFgYDVQQKDA9JRE0u RVhBTVBMRS5DT00xHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0x ODA5MDIxODE1MzlaFw0yMDA5MDIxODE1MzlaMCwxGDAWBgNVBAoMD0lETS5FWEFN [...output truncated...]
sss_cache -u user_name
ipa certmap-match idm_user_cert.pem -------------- 1 user matched -------------- Domain: IDM.EXAMPLE.COM User logins: idm_user ---------------------------- Number of entries returned 1 ----------------------------
kinit admin
CERT=`cat idm_user_cert.pem | tail -n +2 | head -n -1 | tr -d '\r\n'\` ipa user-add-certmapdata idm_user --certificate USDCERT
ipa user-add-certmapdata idm_user --subject " O=EXAMPLE.ORG,CN=test " --issuer " CN=Smart Card CA,O=EXAMPLE.ORG " -------------------------------------------- Added certificate mappings to user " idm_user " -------------------------------------------- User login: idm_user Certificate mapping data: X509:<I>O=EXAMPLE.ORG,CN=Smart Card CA<S>CN=test,O=EXAMPLE.ORG
sss_cache -u user_name
ipa certmap-match idm_user_cert.pem -------------- 1 user matched -------------- Domain: IDM.EXAMPLE.COM User logins: idm_user ---------------------------- Number of entries returned 1 ----------------------------
(userCertificate;binary={cert!bin})
<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
systemctl restart sssd
kinit admin
ipa certmaprule-add simpleADrule --matchrule '<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' --maprule '(userCertificate;binary={cert!bin})' --domain ad.example.com ------------------------------------------------------- Added Certificate Identity Mapping Rule "simpleADrule" ------------------------------------------------------- Rule name: simpleADrule Mapping rule: (userCertificate;binary={cert!bin}) Matching rule: <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com Domain name: ad.example.com Enabled: TRUE
systemctl restart sssd
(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})
<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
ad.example.com
systemctl restart sssd
kinit admin
ipa certmaprule-add ad_configured_for_mapping_rule --matchrule '<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' --maprule '(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})' --domain=ad.example.com ------------------------------------------------------- Added Certificate Identity Mapping Rule "ad_configured_for_mapping_rule" ------------------------------------------------------- Rule name: ad_configured_for_mapping_rule Mapping rule: (altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500}) Matching rule: <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com Domain name: ad.example.com Enabled: TRUE
systemctl restart sssd
ldapsearch -o ldif-wrap=no -LLL -h adserver.ad.example.com -p 389 -D cn=Administrator,cn=users,dc=ad,dc=example,dc=com -W -b cn=users,dc=ad,dc=example,dc=com "(cn=ad_user)" altSecurityIdentities Enter LDAP Password: dn: CN=ad_user,CN=Users,DC=ad,DC=example,DC=com altSecurityIdentities: X509:<I>DC=com,DC=example,DC=ad,CN=AD-ROOT-CA<S>DC=com,DC=example,DC=ad,CN=Users,CN=ad_user
(userCertificate;binary={cert!bin})
<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
systemctl restart sssd
kinit admin
ipa certmaprule-add simpleADrule --matchrule '<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' --maprule '(userCertificate;binary={cert!bin})' --domain ad.example.com ------------------------------------------------------- Added Certificate Identity Mapping Rule "simpleADrule" ------------------------------------------------------- Rule name: simpleADrule Mapping rule: (userCertificate;binary={cert!bin}) Matching rule: <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com Domain name: ad.example.com Enabled: TRUE
systemctl restart sssd
sss_cache -u ad_user@ad.example.com
ipa certmap-match ad_user_cert.pem -------------- 1 user matched -------------- Domain: AD.EXAMPLE.COM User logins: ad_user@ad.example.com ---------------------------- Number of entries returned 1 ----------------------------
kinit admin
CERT=`cat ad_user_cert.pem | tail -n +2 | head -n -1 | tr -d '\r\n'\` ipa idoverrideuser-add-cert ad_user@ad.example.com --certificate USDCERT
sss_cache -u ad_user@ad.example.com
ipa certmap-match ad_user_cert.pem -------------- 1 user matched -------------- Domain: AD.EXAMPLE.COM User logins: ad_user@ad.example.com ---------------------------- Number of entries returned 1 ----------------------------
ipa certmaprule-add ad_cert_for_ipa_and_ad_users \ --maprule='(|(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500}))' \ --matchrule='<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' \ --domain=ad.example.com
ipa certmaprule-add ipa_cert_for_ad_users --maprule='(|(userCertificate;binary={cert!bin})(ipacertmapdata=X509:<I>{issuer_dn!nss_x500}<S>{subject_dn!nss_x500})(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500}))' --matchrule='<ISSUER>CN=Certificate Authority,O=REALM.EXAMPLE.COM' --domain=idm.example.com --domain=ad.example.com
ipa-advise config-client-for-smart-card-auth > client_smart_card_script.sh
chmod +x client_smart_card_script.sh
./client_smart_card_script.sh CA_cert.pem
ipa-cacert-manage -n "SmartCard CA" -t CT,C,C install ca.pem ipa-certupdate
systemctl restart httpd
client login: idm_user PIN for PIV Card Holder pin (PIV_II) for user idm_user@idm.example.com:
ssh -I /usr/lib64/opensc-pkcs11.so -l idm_user server.idm.example.com Enter PIN for 'PIV_II (PIV Card Holder pin)': Last login: Thu Apr 6 12:49:32 2017 from 10.36.116.42
ssh -I /usr/lib64/opensc-pkcs11.so -l ad_user@ad.example.com server.idm.example.com Enter PIN for 'PIV_II (PIV Card Holder pin)': Last login: Thu Apr 6 12:49:32 2017 from 10.36.116.42
id uid=1928200001(idm_user) gid=1928200001(idm_user) groups=1928200001(idm_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
id uid=1171201116(ad_user@ad.example.com) gid=1171201116(ad_user@ad.example.com) groups=1171201116(ad_user@ad.example.com),1171200513(domain users@ad.example.com) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
kinit admin Password for admin@IDM.EXAMPLE.COM:
ipa certmapconfig-mod --promptusername=TRUE Prompt for the username: TRUE
ipa-advise config-client-for-smart-card-auth > client_smart_card_script.sh
chmod +x client_smart_card_script.sh
./client_smart_card_script.sh CA_cert.pem
ipa-cacert-manage -n "SmartCard CA" -t CT,C,C install ca.pem ipa-certupdate
systemctl restart httpd
kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' idm_user
[libdefaults] [... file truncated ...] pkinit_eku_checking = kpServerAuth pkinit_kdc_hostname = adserver.ad.domain.com
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc] "UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Kerberos\Parameters] "UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors"=dword:00000001
kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' ad_user@AD.DOMAIN.COM
ipa-advise config-server-for-smart-card-auth > server_smart_card_script.sh
chmod +x server_smart_card_script.sh
ipa-cacert-manage -n "SmartCard CA" -t CT,C,C install ca.pem ipa-certupdate
systemctl restart httpd systemctl restart krb5kdc
NSSRenegotiation NSSRequireSafeNegotiation on
#! /usr/bin/env python def application(environ, start_response): status = '200 OK' response_body = """ <!DOCTYPE html> <html> <head> <title>Login</title> </head> <body> <form action='/app' method='get'> Username: <input type='text' name='username'> <input type='submit' value='Login with certificate'> </form> </body> </html> """ response_headers = [ ('Content-Type', 'text/html'), ('Content-Length', str(len(response_body))) ] start_response(status, response_headers) return [response_body]
#! /usr/bin/env python def application(environ, start_response): try: user = environ['REMOTE_USER'] except KeyError: status = '400 Bad Request' response_body = 'Login failed.\n' else: status = '200 OK' response_body = 'Login succeeded. Username: {}\n'.format(user) response_headers = [ ('Content-Type', 'text/plain'), ('Content-Length', str(len(response_body))) ] start_response(status, response_headers) return [response_body]
<IfModule !lookup_identity_module> LoadModule lookup_identity_module modules/mod_lookup_identity.so </IfModule> WSGIScriptAlias /login /var/www/app/login.py WSGIScriptAlias /app /var/www/app/protected.py <Location "/app"> NSSVerifyClient require NSSUserName SSL_CLIENT_CERT LookupUserByCertificate On LookupUserByCertificateParamName "username" </Location>
ipa host-mod host_name --auth-ind= indicator
ipa service-mod service / host_name --auth-ind= indicator
ipa host-mod host.idm.example.com --auth-ind=pkinit
mkdir ~/certdb/
certutil -N -d ~/certdb/
certutil -R -d ~/certdb/ -a -g 4096 -s " CN=server.example.com,O=EXAMPLE.COM " -8 server.example.com > certificate_request.csr
otherName= 1.3.6.1.4.1.311.20.2.3 ;UTF8: test2/server.example.com@EXAMPLE.COM DNS.1 = server.example.com
openssl req -new -newkey rsa: 2048 -keyout test2service.key -sha256 -nodes -out certificate_request.csr -config openssl.conf
ipa cert-request certificate_request.csr --principal= host/server.example.com
ipa cert-revoke 1032 --revocation-reason=1
ipa cert-remove-hold 1032
ipa user-add-cert user --certificate= MIQTPrajQAwg
ipa user-add-cert user --certificate="USD(openssl x509 -outform der -in user_cert.pem | base64 -w 0)"
ipa cert-find ----------------------- 10 certificates matched ----------------------- Serial number (hex): 0x1 Serial number: 1 Status: VALID Subject: CN=Certificate Authority,O=EXAMPLE.COM ----------------------------- Number of entries returned 10 -----------------------------
ipa cert-find --issuedon-from=2020-01-07 --issuedon-to=2020-02-07
ipa cert-show 132 Serial number: 132 Certificate: MIIDtzCCAp+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMR8wHQYDVQQKExZMQUIu LxIQjrEFtJmoBGb/TWRlwGEWy1ayr4iTEf1ayZ+RGNylLalEAtk9RLjEjg== Subject: CN=Certificate Authority,O=EXAMPLE.COM Issuer: CN=Certificate Authority,O=EXAMPLE.COM Not Before: Sun Jun 08 05:51:11 2014 UTC Not After: Thu Jun 08 05:51:11 2034 UTC Serial number (hex): 0x132 Serial number: 132
ipa user-show user User login: user Certificate: MIICfzCCAWcCAQA
ipa cert-show certificate_serial_number --out= path_to_file
ipa certprofile Manage Certificate Profiles EXAMPLES: Import a profile that will not store issued certificates: ipa certprofile-import ShortLivedUserCert --file UserCert.profile --desc "User Certificates" --store=false Delete a certificate profile: ipa certprofile-del ShortLivedUserCert
ipa certprofile-mod --help Usage: ipa [global-options] certprofile-mod ID [options] Modify Certificate Profile configuration. Options: -h, --help show this help message and exit --desc=STR Brief description of this profile --store=BOOL Whether to store certs issued using this profile
ipa certprofile-import Profile ID: smime Profile description: S/MIME certificates Store issued certificates [True]: TRUE Filename of a raw profile. The XML format is not supported.: smime.cfg ------------------------ Imported profile "smime" ------------------------ Profile ID: smime Profile description: S/MIME certificates Store issued certificates: TRUE
ipa certprofile-import --file= smime.cfg
ipa certprofile-show caIPAserviceCert --out= file_name
ipa certprofile-find ------------------ 3 profiles matched ------------------ Profile ID: caIPAserviceCert Profile description: Standard profile for network services Store issued certificates: TRUE Profile ID: IECUserRoles
ipa certprofile-show profile_ID Profile ID: profile_ID Profile description: S/MIME certificates Store issued certificates: TRUE
ipa certprofile-mod profile_ID --desc="New description" --store=False ------------------------------------ Modified Certificate Profile "profile_ID" ------------------------------------ Profile ID: profile_ID Profile description: New description Store issued certificates: FALSE
ipa certprofile-mod profile_ID --file= new_configuration.cfg
ipa certprofile-del profile_ID ----------------------- Deleted profile "profile_ID" -----------------------
ipa caacl Manage CA ACL rules. EXAMPLES: Create a CA ACL "test" that grants all users access to the "UserCert" profile: ipa caacl-add test --usercat=all ipa caacl-add-profile test --certprofiles UserCert Display the properties of a named CA ACL: ipa caacl-show test Create a CA ACL to let user "alice" use the "DNP3" profile on "DNP3-CA": ipa caacl-add alice_dnp3 ipa caacl-add-ca alice_dnp3 --cas DNP3-CA ipa caacl-add-profile alice_dnp3 --certprofiles DNP3 ipa caacl-add-user alice_dnp3 --user=alice
ipa caacl-mod --help Usage: ipa [global-options] caacl-mod NAME [options] Modify a CA ACL. Options: -h, --help show this help message and exit --desc=STR Description --cacat=['all'] CA category the ACL applies to --profilecat=['all'] Profile category the ACL applies to
ipa caacl-add ACL name: smime_acl ------------------------ Added CA ACL "smime_acl" ------------------------ ACL name: smime_acl Enabled: TRUE
ipa caacl-add ca_acl_name --usercat=all
ipa cert-request CSR-FILE --principal user --profile-id profile_id ipa: ERROR Insufficient access: Principal 'user' is not permitted to use CA '.' with profile 'profile_id' for certificate issuance.
ipa caacl-find ----------------- 2 CA ACLs matched ----------------- ACL name: hosts_services_caIPAserviceCert Enabled: TRUE
ipa caacl-show ca_acl_name ACL name: ca_acl_name Enabled: TRUE Host category: all
ipa caacl-mod ca_acl_name --desc="New description" --profilecat=all --------------------------- Modified CA ACL "ca_acl_name" --------------------------- ACL name: smime_acl Description: New description Enabled: TRUE Profile category: all
ipa caacl-disable ca_acl_name --------------------------- Disabled CA ACL "ca_acl_name" ---------------------------
ipa caacl-enable ca_acl_name --------------------------- Enabled CA ACL "ca_acl_name" ---------------------------
ipa caacl-del ca_acl_name
ipa caacl-add-user ca_acl_name --groups= group_name
ipa caacl-add-user ca_acl_name --users= user_name ipa: ERROR: users cannot be added when user category='all'
ipa cert-request CSR-FILE --principal user --profile-id profile_id ipa: ERROR Insufficient access: Principal 'user' is not permitted to use CA '.' with profile 'profile_id' for certificate issuance.
ipa caacl-add-user --help
ipa certprofile-import certificate_profile --file= certificate_profile.cfg --store=True
ipa caacl-add users_certificate_profile --usercat=all
ipa caacl-add-profile users_certificate_profile --certprofiles= certificate_profile
openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout private.key -out cert.csr -subj '/CN= user '
ipa cert-request cert.csr --principal= user --profile-id= certificate_profile
ipa user-show user User login: user Certificate: MIICfzCCAWcCAQA
ipa certprofile-import certificate_profile --file= certificate_profile.txt --store=True
ipa vault-show my_vault Vault name: my_vault Type: standard Owner users: user Vault user: user
ipa-kra-install
ipa help vault
ipa vault-add --help
ipa vault-show user_vault --user user
[admin@server ~]USD ipa vault-show user_vault ipa: ERROR: user_vault: vault not found
kinit user
ipa vault-add my_vault --type standard ---------------------- Added vault "my_vault" ---------------------- Vault name: my_vault Type: standard Owner users: user Vault user: user
ipa vault-archive my_vault --in secret.txt ----------------------------------- Archived data into vault "my_vault" -----------------------------------
kinit user
ipa vault-retrieve my_vault --out secret_exported.txt -------------------------------------- Retrieved data from vault "my_vault" --------------------------------------
kinit admin
ipa vault-add http_password --type standard --------------------------- Added vault "http_password" --------------------------- Vault name: http_password Type: standard Owner users: admin Vault user: admin
ipa vault-archive http_password --in password.txt ---------------------------------------- Archived data into vault "http_password" ----------------------------------------
kinit admin
openssl genrsa -out service-private.pem 2048 Generating RSA private key, 2048 bit long modulus .+++ ...........................................+++ e is 65537 (0x10001)
openssl rsa -in service-private.pem -out service-public.pem -pubout writing RSA key
ipa vault-add password_vault --service HTTP/server.example.com --type asymmetric --public-key-file service-public.pem ---------------------------- Added vault "password_vault" ---------------------------- Vault name: password_vault Type: asymmetric Public key: LS0tLS1C...S0tLS0tCg== Owner users: admin Vault service: HTTP/server.example.com@EXAMPLE.COM
ipa vault-retrieve http_password --out password.txt ----------------------------------------- Retrieved data from vault "http_password" -----------------------------------------
ipa vault-archive password_vault --service HTTP/server.example.com --in password.txt ----------------------------------- Archived data into vault "password_vault" -----------------------------------
kinit admin
kinit HTTP/server.example.com -k -t /etc/httpd/conf/ipa.keytab
ipa vault-retrieve password_vault --service HTTP/server.example.com --private-key-file service-private.pem --out password.txt ------------------------------------ Retrieved data from vault "password_vault" ------------------------------------
ipa vault-archive http_password --in new_password.txt ---------------------------------------- Archived data into vault "http_password" ----------------------------------------
ipa vault-retrieve http_password --out password.txt ----------------------------------------- Retrieved data from vault "http_password" -----------------------------------------
ipa vault-archive password_vault --service HTTP/server.example.com --in password.txt ----------------------------------- Archived data into vault "password_vault" -----------------------------------
kinit admin
ipa vault-add shared_vault --shared --type standard --------------------------- Added vault "shared_vault" --------------------------- Vault name: shared_vault Type: standard Owner users: admin Shared vault: True
ipa vault-archive shared_vault --shared --in secret.txt ----------------------------------- Archived data into vault "shared_vault" -----------------------------------
ipa vault-add-member shared_vault --shared --users={user1,user2} Vault name: shared_vault Type: standard Owner users: admin Shared vault: True Member users: user1, user2 ------------------------- Number of members added 2 -------------------------
kinit user1
ipa vault-retrieve shared_vault --shared --out secret_exported.txt ----------------------------------------- Retrieved data from vault "shared_vault" -----------------------------------------
ipa vault-mod --change-password Vault name: example_symmetric_vault Password: old_password New password: new_password Enter New password again to verify: new_password ----------------------- Modified vault " example_symmetric_vault " ----------------------- Vault name: example_symmetric_vault Type: symmetric Salt: dT+M+4ik/ltgnpstmCG1sw== Owner users: admin Vault user: admin
ipa vault-mod example_asymmetric_vault --private-key-file= old_private_key.pem --public-key-file= new_public_key.pem ------------------------------- Modified vault " example_assymmetric_vault " ------------------------------- Vault name: example_assymmetric_vault Typ: asymmetric Public key: Owner users: admin Vault user: admin
ipa ca-add vpn-ca --subject=" CN=VPN,O=IDM.EXAMPLE.COM " ------------------- Created CA "vpn-ca" ------------------- Name: vpn-ca Authority ID: ba83f324-5e50-4114-b109-acca05d6f1dc Subject DN: CN=VPN,O=IDM.EXAMPLE.COM Issuer DN: CN=Certificate Authority,O=IDM.EXAMPLE.COM
certutil -d /etc/pki/pki-tomcat/alias/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu caSigningCert cert-pki-ca ba83f324-5e50-4114-b109-acca05d6f1dc u,u,u ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u
ipa ca-del vpn-ca ------------------- Deleted CA "vpn-ca" -------------------
ipa-certupdate trying https://idmserver.idm.example.com/ipa/json Forwarding 'schema' to json server 'https://idmserver.idm.example.com/ipa/json' trying https://idmserver.idm.example.com/ipa/json Forwarding 'ca_is_enabled' to json server 'https://idmserver.idm.example.com/ipa/json' Forwarding 'ca_find/1' to json server 'https://idmserver.idm.example.com/ipa/json' Systemwide CA database updated. Systemwide CA database updated. The ipa-certupdate command was successful
Certificate named "NSS Certificate DB" in token "auditSigningCert cert-pki-ca" in database "/var/lib/pki-ca/alias" renew success
certmonger: Certificate named "NSS Certificate DB" in token "auditSigningCert cert-pki-ca" in database "/var/lib/pki-ca/alias" will not be valid after 20160204065136.
certutil -L -d /etc/pki/pki-tomcat/alias
ipa-cacert-manage renew --external-cert-file= /tmp/servercert20110601.pem --external-cert-file= /tmp/cacert.pem
certutil -L -d /etc/pki/pki-tomcat/alias/
ipa-cert-fix The following certificates will be renewed: Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 13 Expires: 2019-05-12 05:55:47 Enter "yes" to proceed:
Enter "yes" to proceed: yes Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca1.example.com,O=EXAMPLE.COM 201905222205 Serial: 268369925 Expires: 2021-08-14 02:19:33 Becoming renewal master. The ipa-cert-fix command was successful
ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
ipactl restart --force
getcert list | egrep '^Request|status:|subject:' Request ID '20190522120745': status: MONITORING subject: CN=IPA RA,O=EXAMPLE.COM 201905222205 Request ID '20190522120834': status: MONITORING subject: CN=Certificate Authority,O=EXAMPLE.COM 201905222205
Request ID '20190522120835': status: CA_UNREACHABLE subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205
ipa-cert-fix Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM Serial: 3 Expires: 2019-05-11 12:07:11 Enter "yes" to proceed: yes Proceeding. Renewed Dogtag sslserver certificate: Subject: CN=ca2.example.com,O=EXAMPLE.COM 201905222205 Serial: 15 Expires: 2019-08-14 04:25:05 The ipa-cert-fix command was successful
ipa-cacert-manage install /etc/group/cert.pem
NSSEnforceValidCerts off
systemctl restart httpd.service
ldapsearch -h server.example.com -p 389 -D "cn=directory manager" -w secret -LLL -b cn=config -s base "(objectclass=*)" nsslapd-validate-cert dn: cn=config nsslapd-validate-cert: warn
ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: cn=config changetype: modify replace: nsslapd-validate-cert nsslapd-validate-cert: warn
systemctl restart dirsrv.target
ipa-server-certinstall --http --dirsrv ssl.key ssl.crt
systemctl restart httpd.service
systemctl restart dirsrv@ REALM .service
certutil -L -d /etc/httpd/alias
certutil -L -d /etc/dirsrv/slapd- REALM /
systemctl stop pki-tomcatd@pki-tomcat.service
ca.crl.MasterCRL.autoUpdateInterval=60
systemctl start pki-tomcatd@pki-tomcat.service
[root@ipa-server ~] ipa-ca-install
[root@ipa-server ~] ipa-ca-install --external-ca
ipa-ca-install --external-cert-file=/root/ master .crt --external-cert-file=/root/ca.crt
openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout new.key -out new.csr -subj '/CN= idmserver.idm.example.com ,O= IDM.EXAMPLE.COM '
ipa-server-certinstall -w --pin= password new.key new.crt
ipa-server-certinstall -d --pin= password new.key new.cert
ipa pkinit-status Server name: server1.example.com PKINIT status: enabled [...output truncated...] Server name: server2.example.com PKINIT status: disabled [...output truncated...]
ipa-pkinit-manage status PKINIT is enabled The ipa-pkinit-manage command was successful
ipa config-show Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers [...output truncated...] IPA masters capable of PKINIT: server1.example.com [...output truncated...]
kinit admin Password for admin@IPA.TEST: ipa pkinit-status --server=server.idm.example.com ---------------- 1 server matched ---------------- Server name: server.idm.example.com PKINIT status: enabled ---------------------------- Number of entries returned 1 ----------------------------
ipa pkinit-status --server server.idm.example.com ----------------- 0 servers matched ----------------- ---------------------------- Number of entries returned 0 ----------------------------
ipa-cacert-manage install -t CT,C,C ca.pem
ipa-certupdate
ipa-cacert-manage list CN=CA,O=Example Organization The ipa-cacert-manage command was successful
ipa-server-certinstall --kdc kdc.pem kdc.key systemctl restart krb5kdc.service
ipa pkinit-status Server name: server1.example.com PKINIT status: enabled [...output truncated...] Server name: server2.example.com PKINIT status: disabled [...output truncated...]
ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successful
ipa pwpolicy-mod --minclasses= 1
ipa pwpolicy-add Group: group_name Priority: priority_level
ipa pwpolicy-find
ipa pwpolicy-mod --minlength=10
ipa pwpolicy-mod group_name --minlength=10
ipa pwpolicy-show
ipa pwpolicy-show group_name
ipa user-mod user_name --password-expiration='2016-02-03 20:37:34Z'
ldapmodify -D "cn=Directory Manager" -w secret -h server.example.com -p 389 -vv dn: uid= user_name ,cn=users,cn=accounts,dc= example ,dc= com changetype: modify replace: krbPasswordExpiration krbPasswordExpiration: 20160203203734Z
kinit user_name -l 90000
ipa krbtpolicy-mod --maxlife= 80000 Max life: 80000 Max renew: 604800
ipa krbtpolicy-mod admin --maxlife= 160000 Max life: 80000 Max renew: 604800
ldapsearch -x -b "cn=computers,cn=accounts,dc=example,dc=com" "(&(krblastpwdchange>=20160101000000)(krblastpwdchange<=20161231235959))" dn krbprincipalname
ldapsearch -x -b "cn=services,cn=accounts,dc=example,dc=com" "(&(krblastpwdchange>=20160101000000)(krblastpwdchange<=20161231235959))" dn krbprincipalname
ipa-getkeytab -p host/ client.example.com@EXAMPLE.COM -s server.example.com -k /etc/krb5.keytab
ipa-getkeytab -p HTTP/ client.example.com@EXAMPLE.COM -s server.example.com -k /etc/httpd/conf/ipa.keytab
klist -kt /etc/krb5.keytab Keytab: WRFILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 1 06/09/16 05:58:47 host/client.example.com@EXAMPLE.COM(aes256-cts-hmac-sha1-96) 2 06/09/16 11:23:01 host/client.example.com@EXAMPLE.COM(aes256-cts-hmac-sha1-96) 1 03/09/16 13:57:16 krbtgt/EXAMPLE.COM@EXAMPLE.COM(aes256-cts-hmac-sha1-96) 1 03/09/16 13:57:16 HTTP/server.example.com@EXAMPLE.COM(aes256-cts-hmac-sha1-96) 1 03/09/16 13:57:16 ldap/server.example.com@EXAMPLE.COM(aes256-cts-hmac-sha1-96)
chown apache /etc/httpd/conf/ipa.keytab
chmod 0600 /etc/httpd/conf/ipa.keytab
ipa-rmkeytab --realm EXAMPLE.COM --keytab /etc/krb5.keytab
ipa-rmkeytab --principal ldap/client.example.com --keytab /etc/krb5.keytab
ipa sudorule-add-option sudo_rule_name Sudo Option: first_option ipa sudorule-add-option sudo_rule_name Sudo Option: second_option
ipa sudorule-add-option sudo_rule_name Sudo Option: env_keep="COLORS DISPLAY EDITOR HOSTNAME HISTSIZE INPUTRC KDEDIR LESSSECURE LS_COLORS MAIL PATH PS1 PS2 XAUTHORITY"
sudoers: files sss
vim /etc/nsswitch.conf sudoers: files sss
vim /etc/sssd/sssd.conf [sssd] config_file_version = 2 services = nss, pam, sudo domains = IPADOMAIN
systemctl enable rhel-domainname.service
nisdomainname example.com
echo "NISDOMAIN= example.com " >> /etc/sysconfig/network
systemctl restart rhel-domainname.service
[domain/ IPADOMAIN ] debug_level = 6 .
ipa sudocmd-add /usr/bin/less --desc="For reading log files" ---------------------------------- Added sudo command "/usr/bin/less" ---------------------------------- sudo Command: /usr/bin/less Description: For reading log files
ipa sudocmdgroup-add files --desc="File editing commands" ----------------------------------- Added sudo command group "files" ----------------------------------- sudo Command Group: files Description: File editing commands
ipa sudocmdgroup-add-member files --sudocmds "/usr/bin/vim" sudo Command Group: files Description: File editing commands Member sudo commands: /usr/bin/vim ------------------------- Number of members added 1 -------------------------
ipa sudorule-add files-commands -------------------------------- Added Sudo Rule "files-commands" -------------------------------- Rule name: files-commands Enabled: TRUE
ipa sudocmd-mod /usr/bin/less --desc="For reading log files" ------------------------------------- Modified Sudo Command "/usr/bin/less" ------------------------------------- Sudo Command: /usr/bin/less Description: For reading log files Sudo Command Groups: files
ipa sudorule-mod sudo_rule_name --desc=" sudo_rule_description "
ipa sudorule-mod sudo_rule_name --order= 3
ipa sudorule-mod sudo_rule --usercat=all
ipa sudorule-add-option files-commands Sudo Option: !authenticate --------------------------------------------------------- Added option "!authenticate" to Sudo Rule "files-commands" ---------------------------------------------------------
ipa sudorule-remove-option files-commands Sudo Option: authenticate ------------------------------------------------------------- Removed option "authenticate" from Sudo Rule "files-commands" -------------------------------------------------------------
ipa sudorule-add-user files-commands --users=user --groups=user_group ------------------------- Number of members added 2 -------------------------
ipa sudorule-remove-user files-commands [member user]: user [member group]: --------------------------- Number of members removed 1 ---------------------------
ipa sudorule-add-host files-commands --hosts=example.com --hostgroups=host_group ------------------------- Number of members added 2 -------------------------
ipa sudorule-remove-host files-commands [member host]: example.com [member host group]: --------------------------- Number of members removed 1 ---------------------------
ipa sudorule-add-allow-command files-commands --sudocmds=/usr/bin/less --sudocmdgroups=files ------------------------- Number of members added 2 -------------------------
ipa sudorule-remove-allow-command files-commands [member sudo command]: /usr/bin/less [member sudo command group]: --------------------------- Number of members removed 1 ---------------------------
ipa sudorule-add-runasuser files-commands --users=user RunAs Users: user
kinit admin Password for admin@EXAMPLE.COM:
ipa sudorule-add new_sudo_rule --desc="Rule for user_group" --------------------------------- Added Sudo Rule "new_sudo_rule" --------------------------------- Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE
ipa sudorule-add-user new_sudo_rule --groups=user_group Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE User Groups: user_group ------------------------- Number of members added 1 -------------------------
ipa sudorule-add-host new_sudo_rule --hostgroups=host_group Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE User Groups: user_group Host Groups: host_group ------------------------- Number of members added 1 -------------------------
ipa sudorule-mod new_sudo_rule --cmdcat=all ------------------------------ Modified Sudo Rule "new_sudo_rule" ------------------------------ Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE Command category: all User Groups: user_group Host Groups: host_group
ipa sudorule-add-option new_sudo_rule Sudo Option: !authenticate ----------------------------------------------------- Added option "!authenticate" to Sudo Rule "new_sudo_rule" ----------------------------------------------------- Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE Command category: all User Groups: user_group Host Groups: host_group Sudo Option: !authenticate
ipa sudorule-show new_sudo_rule Rule name: new_sudo_rule Description: Rule for user_group Enabled: TRUE Command category: all User Groups: user_group Host Groups: host_group Sudo Option: !authenticate
ipa sudocmd-show /usr/bin/less Sudo Command: /usr/bin/less Description: For reading log files. Sudo Command Groups: files
ipa sudorule-disable sudo_rule_name ----------------------------------- Disabled Sudo Rule "sudo_rule_name" -----------------------------------
ipa sudorule-enable sudo_rule_name ----------------------------------- Enabled Sudo Rule "sudo_rule_name" -----------------------------------
ipa hbacrule-add Rule name: rule_name --------------------------- Added HBAC rule "rule_name" --------------------------- Rule name: rule_name Enabled: TRUE
ipa hbacrule-add-user Rule name: rule_name [member user]: [member group]: group_name Rule name: rule_name Enabled: TRUE User Groups: group_name ------------------------- Number of members added 1 -------------------------
ipa hbacrule-add-user rule_name --users= user1 --users= user2 --users= user3 Rule name: rule_name Enabled: TRUE Users: user1, user2, user3 ------------------------- Number of members added 3 -------------------------
ipa hbacrule-mod rule_name --usercat=all ------------------------------ Modified HBAC rule "rule_name" ------------------------------ Rule name: rule_name User category: all Enabled: TRUE
ipa hbacrule-add-host Rule name: rule_name [member host]: host.example.com [member host group]: Rule name: rule_name Enabled: TRUE Hosts: host.example.com ------------------------- Number of members added 1 -------------------------
ipa hbacrule-add-host rule_name --hosts= host1 --hosts= host2 --hosts= host3 Rule name: rule_name Enabled: TRUE Hosts: host1, host2, host3 ------------------------- Number of members added 3 -------------------------
ipa hbacrule-mod rule_name --hostcat=all ------------------------------ Modified HBAC rule "rule_name" ------------------------------ Rule name: rule_name Host category: all Enabled: TRUE
ipa hbacrule-add-service Rule name: rule_name [member HBAC service]: ftp [member HBAC service group]: Rule name: rule_name Enabled: TRUE Services: ftp ------------------------- Number of members added 1 -------------------------
ipa hbacrule-add-service rule_name --hbacsvcs= su --hbacsvcs= sudo Rule name: rule_name Enabled: TRUE Services: su, sudo ------------------------- Number of members added 2 -------------------------
ipa hbacrule-mod rule_name --servicecat=all ------------------------------ Modified HBAC rule "rule_name" ------------------------------ Rule name: rule_name Service category: all Enabled: TRUE
ipa hbactest User name: user1 Target host: example.com Service: sudo --------------------- Access granted: False --------------------- Not matched rules: rule1
ipa hbactest --user= user1 --host= example.com --service= sudo --rules= rule1 --------------------- Access granted: False --------------------- Not matched rules: rule1
ipa hbactest --user= user1 --host= example.com --service= sudo --rules= rule1 --rules= rule2 -------------------- Access granted: True -------------------- Matched rules: rule2 Not matched rules: rule1
ipa hbacrule-disable allow_all ------------------------------ Disabled HBAC rule "allow_all" ------------------------------
ipa hbacsvc-add tftp ------------------------- Added HBAC service "tftp" ------------------------- Service name: tftp
ipa hbacsvcgroup-add Service group name: login -------------------------------- Added HBAC service group "login" -------------------------------- Service group name: login
ipa hbacsvcgroup-add-member Service group name: login [member HBAC service]: sshd Service group name: login Member HBAC service: sshd ------------------------- Number of members added 1 -------------------------
semanage user -l Labelling MLS/ MLS/ SELinux User Prefix MCS Level MCS Range SELinux Roles guest_u user s0 s0 guest_r root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r sysadm_u user s0 s0-s0:c0.c1023 sysadm_r system_u user s0 s0-s0:c0.c1023 system_r unconfined_r unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r user_u user s0 s0 user_r xguest_u user s0 s0 xguest_r
SELinux_user:MLS[:MCS]
[user1]@server ~]USD ipa config-show SELinux user map order: guest_u:s0USDxguest_u:s0USDuser_u:s0USDstaff_u:s0-s0:c0.c1023USDunconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023
[user1@server ~]USD ipa config-mod --ipaselinuxusermaporder="unconfined_u:s0-s0:c0.c1023USDguest_u:s0USDxguest_u:s0USDuser_u:s0-s0:c0.c1023USDstaff_u:s0-s0:c0.c1023"
[user1@server ~]USD ipa config-mod --ipaselinuxusermapdefault="guest_u:s0"
[user1@server ~]USD ipa selinuxusermap-add --selinuxuser="xguest_u:s0" selinux1 [user1@server ~]USD ipa selinuxusermap-add-user --users=user1 --users=user2 --users=user3 selinux1 [user1@server ~]USD ipa selinuxusermap-add-host --hosts=server.example.com --hosts=test.example.com selinux1
[user1@server ~]USD ipa selinuxusermap-add --hbacrule=webserver --selinuxuser="xguest_u:s0" selinux1
[user1@server ~]USD ipa selinuxusermap-add-user --users=user1 selinux1
[user1@server ~]USD ipa selinuxusermap-remove-user --users=user2 selinux1
dn: idnsname=client1,idnsname=example.com.,cn=dns,dc=idm,dc=example,dc=com objectclass: top objectclass: idnsrecord idnsname: client1 Arecord: 192.0.2.1 Arecord: 192.0.2.2 Arecord: 192.0.2.3 AAAArecord: 2001:DB8::ABCD
ipa dnszone-add newserver.example.com
ipa dnszone-del server.example.com
[user@server ~]USD ipa dnszone-mod --allow-transfer="192.0.2.1;198.51.100.1;203.0.113.1" example.com
dig @ipa-server zone_name AXFR
host -t MX mail.example.com. mail.example.com mail is handled by 10 server.example.com. host -t MX demo.example.com. demo.example.com. has no MX record. host -t A mail.example.com. mail.example.com has no A record host -t A demo.example.com. random.example.com has address 192.168.1.1
ipa dnsrecord-add zone_name record_name -- record_type_option=data
ipa dnsrecord-add example.com www --a-rec 192.0.2.123
ipa dnsrecord-add example.com "*" --a-rec 192.0.2.123
ipa dnsrecord-mod example.com www --a-rec 192.0.2.123 --a-ip-address 192.0.2.1
ipa dnsrecord-add example.com www --aaaa-rec 2001:db8::1231:5675
ipa dnsrecord-add server.example.com _ldap._tcp --srv-rec="0 51 389 server1.example.com." ipa dnsrecord-add server.example.com _ldap._tcp --srv-rec="1 49 389 server2.example.com."
ipa dnsrecord-add reverseNetworkIpAddress hostIpAddress --ptr-rec FQDN
ipa dnsrecord-add 2.0.192.in-addr.arpa 4 --ptr-rec server4.example.com.
ipa dnsrecord-add 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 1.1.1.0.0.0.0.0.0.0.0.0.0.0.0 --ptr-rec server2.example.com.
ipa dnsrecord-del example.com www --a-rec 192.0.2.1
[user@server ~]USD ipa dnszone-disable zone.example.com ----------------------------------------- Disabled DNS zone "example.com" -----------------------------------------
[user@server ~]USD ipa dnszone-mod server.example.com --dynamic-update=TRUE
ipa-client-install --enable-dns-updates
vim /etc/sssd/sssd.conf
[domain/ipa.example.com]
dyndns_update = true
dyndns_ttl = 2400
ipa dnszone-mod idm.example.com. --dynamic-update=TRUE
ipa dnszone-mod idm.example.com. --update-policy='grant IDM.EXAMPLE.COM krb5-self * A; grant IDM.EXAMPLE.COM krb5-self * AAAA; grant IDM.EXAMPLE.COM krb5-self * SSHFP;'
ipa dnszone-mod idm.example.com. --allow-sync-ptr=True
ipa dnszone-mod 2.0.192.in-addr.arpa. --dynamic-update=TRUE
ipa dnsconfig-mod --allow-sync-ptr=true
dyndb "ipa" "/usr/lib64/bind/ldap.so" { sync_ptr yes; };
ipactl restart
ipa dnszone-mod zone.example.com --update-policy "grant EXAMPLE.COM krb5-self * A; grant EXAMPLE.COM krb5-self * AAAA; grant EXAMPLE.COM krb5-self * SSHFP;"
ipa dnsrecord-add idm.example.com. sub_zone1 --ns-rec= 192.0.2.1
ipa dnsforwardzone-add sub_zone1 .idm.example.com. --forwarder 192.0.2.1
[user@server ~]USD ipa dnsconfig-mod --forwarder=192.0.2.254 Global forwarders: 192.0.2.254
ipa dnsforwardzone-add --help
[user@server ~]USD ipa dnsforwardzone-add zone.test. --forwarder=172.16.0.1 --forwarder=172.16.0.2 --forward-policy=first Zone name: zone.test. Zone forwarders: 172.16.0.1, 172.16.0.2 Forward policy: first
[user@server ~]USD ipa dnsforwardzone-mod zone.test. --forwarder=172.16.0.3 Zone name: zone.test. Zone forwarders: 172.16.0.3 Forward policy: first
[user@server ~]USD ipa dnsforwardzone-mod zone.test. --forward-policy=only Zone name: zone.test. Zone forwarders: 172.16.0.3 Forward policy: only
[user@server ~]USD ipa dnsforwardzone-show zone.test. Zone name: zone.test. Zone forwarders: 172.16.0.5 Forward policy: first
[user@server ~]USD ipa dnsforwardzone-find zone.test. Zone name: zone.test. Zone forwarders: 172.16.0.3 Forward policy: first ---------------------------- Number of entries returned 1 ----------------------------
[user@server ~]USD ipa dnsforwardzone-del zone.test. ---------------------------- Deleted forward DNS zone "zone.test." ----------------------------
[user@server ~]USD ipa dnsforwardzone-enable zone.test. ---------------------------- Enabled forward DNS zone "zone.test." ----------------------------
[user@server ~]USD ipa dnsforwardzone-disable zone.test. ---------------------------- Disabled forward DNS zone "zone.test." ----------------------------
[user@server ~]USD ipa dnsforwardzone-add-permission zone.test. --------------------------------------------------------- Added system permission "Manage DNS zone zone.test." --------------------------------------------------------- Manage DNS zone zone.test.
[user@server ~]USD ipa dnsforwardzone-remove-permission zone.test. --------------------------------------------------------- Removed system permission "Manage DNS zone zone.test." --------------------------------------------------------- Manage DNS zone zone.test.
[user@server]USD ipa dnszone-add 2.0.192.in-addr.arpa.
[user@server ~]USD ipa dnszone-add --name-from-ip= 192.0.2.0/24
[user@server ~]USD ipa dnszone-mod --allow-query=192.0.2.0/24;2001:DB8::/32;203.0.113.1 example.com
dig -t SRV +short _kerberos._tcp.idm.example.com 0 100 88 idmserver-01.idm.example.com. 0 100 88 idmserver-02.idm.example.com.
dig -t SRV +short _kerberos._tcp.idm.example.com _kerberos._tcp.germany._locations.idm.example.com. 0 100 88 idmserver-01.idm.example.com. 50 100 88 idmserver-02.idm.example.com.
ipa location-add germany ---------------------------- Added IPA location "germany" ---------------------------- Location name: germany
systemctl restart named-pkcs11
ipa location-find ----------------------- 2 IPA locations matched ----------------------- Location name: australia Location name: germany ----------------------------- Number of entries returned: 2 -----------------------------
ipa server-mod idmserver-01.idm.example.com --location=germany ipa: WARNING: Service named-pkcs11.service requires restart on IPA server idmserver-01.idm.example.com to apply configuration changes. -------------------------------------------------- Modified IPA server "idmserver-01.idm.example.com" -------------------------------------------------- Servername: idmserver-01.idm.example.com Min domain level: 0 Max domain level: 1 Location: germany Enabled server roles: DNS server, NTP server
systemctl restart named-pkcs11
nameserver 10.10.0.1 nameserver 10.10.0.2
nameserver 10.50.0.1 nameserver 10.50.0.3
nameserver 10.30.0.1
nameserver 10.30.0.1
ipa dns-update-system-records --dry-run IPA DNS records: _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com. _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 ipa.example.com. [... output truncated ...]
ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate IPA DNS records: _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com. _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 ipa.example.com. [... output truncated ...]
cat dns_records_file.nsupdate zone example.com. server 192.0.2.1 ; IPA DNS records update delete _kerberos-master._tcp.example.com. SRV update add _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com. [... output truncated ...]
nsupdate -k tsig_key.file dns_records_file.nsupdate
nsupdate -y algorithm:keyname:secret dns_records_file.nsupdate
kinit principal_allowed_to_update_records @ REALM nsupdate -g dns_records_file.nsupdate
search example.com ; the IdM server nameserver 192.0.2.1 ; backup DNS servers nameserver 198.51.100.1 nameserver 198.51.100.2
dn: automountmapname=auto.master,cn=default,cn=automount,dc=example,dc=com objectClass: automountMap objectClass: top automountMapName: auto.master
ipa-client-automount Searching for IPA server IPA server: DNS discovery Location: default Continue to configure the system with these values? [no]: yes Configured /etc/nsswitch.conf Configured /etc/sysconfig/nfs Configured /etc/idmapd.conf Started rpcidmapd Started rpcgssd Restarting sssd, waiting for it to become available. Started autofs
ipa-client-automount --server=ipaserver.example.com --location=boston
autofs_provider = ipa ipa_automount_location = default
automount: sss files
ipa-client-automount --no-sssd
# Other common LDAP naming # MAP_OBJECT_CLASS="automountMap" ENTRY_OBJECT_CLASS="automount" MAP_ATTRIBUTE="automountMapName" ENTRY_ATTRIBUTE="automountKey" VALUE_ATTRIBUTE="automountInformation"
LDAP_URI="ldap:///dc=example,dc=com"
LDAP_URI="ldap://ipa.example.com" SEARCH_BASE="cn= location ,cn=automount,dc=example,dc=com"
<autofs_ldap_sasl_conf usetls="no" tlsrequired="no" authrequired="yes" authtype="GSSAPI" clientprinc="host/server.example.com@EXAMPLE.COM" />
vim /etc/sssd/sssd.conf
[sssd] services = nss,pam, autofs
[nss] [pam] [sudo] [autofs] [ssh] [pac]
[domain/EXAMPLE] ldap_search_base = "dc=example,dc=com" ldap_autofs_search_base = "ou=automount,dc=example,dc=com"
systemctl restart sssd.service
automount: sss files
systemctl restart autofs.service
ls /home/ userName
automount -f -d
NFS_CLIENT_VERSMAX=3
ldapclient -v manual -a authenticationMethod=none -a defaultSearchBase=dc=example,dc=com -a defaultServerList=ipa.example.com -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=example,dc=com -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=example,dc=com -a serviceSearchDescriptor=auto_master:automountMapName=auto.master,cn= location ,cn=automount,dc=example,dc=com?one -a serviceSearchDescriptor=auto_home:automountMapName=auto_home,cn= location ,cn=automount,dc=example,dc=com?one -a objectClassMap=shadow:shadowAccount=posixAccount -a searchTimelimit=15 -a bindTimeLimit=5
svcadm enable svc:/system/filesystem/autofs
ldapclient -l auto_master dn: automountkey=/home,automountmapname=auto.master,cn= location ,cn=automount,dc=example,dc=com objectClass: automount objectClass: top automountKey: /home automountInformation: auto.home
ls /home/ userName
ldapmodify -x -D "cn=directory manager" -w password -h ipaserver.example.com -p 389 dn: cn= REALM_NAME ,cn=kerberos,dc=example,dc=com changetype: modify add: krbSupportedEncSaltTypes krbSupportedEncSaltTypes: des-cbc-crc:normal - add: krbSupportedEncSaltTypes krbSupportedEncSaltTypes: des-cbc-crc:special - add: krbDefaultEncSaltTypes krbDefaultEncSaltTypes: des-cbc-crc:special
allow_weak_crypto = true
kinit admin
ipa service-add nfs/ nfs-server.example.com
ipa-getkeytab -s ipaserver.example.com -p nfs/ nfs-server.example.com -k /etc/krb5.keytab
ipa service-show nfs/nfs-server.example.com Principal name: nfs/nfs-server.example.com@IDM.EXAMPLE.COM Principal alias: nfs/nfs-server.example.com@IDM.EXAMPLE.COM Keytab: True Managed by: nfs-server.example.com
yum install nfs-utils
[root@nfs-server ~] ipa-client-automount Searching for IPA server IPA server: DNS discovery Location: default Continue to configure the system with these values? [no]: yes Configured /etc/sysconfig/nfs Configured /etc/idmapd.conf Started rpcidmapd Started rpcgssd Restarting sssd, waiting for it to become available. Started autofs
systemctl enable nfs-idmapd
/export *( rw ,sec=krb5:krb5i:krb5p) /home *( rw ,sec=krb5:krb5i:krb5p)
exportfs -rav
allow_weak_crypto = true
yum install nfs-utils
kinit admin
[root@nfs-client ~] ipa-client-automount Searching for IPA server IPA server: DNS discovery Location: default Continue to configure the system with these values? [no]: yes Configured /etc/sysconfig/nfs Configured /etc/idmapd.conf Started rpcidmapd Started rpcgssd Restarting sssd, waiting for it to become available. Started autofs
systemctl enable rpc-gssd.service systemctl enable rpcbind.service
nfs-server.example.com:/export /mnt nfs4 sec=krb5p,rw nfs-server.example.com:/home /home nfs4 sec=krb5p,rw
mkdir -p /mnt/ mkdir -p /home
mount /mnt/ mount /home
[domain/EXAMPLE.COM] krb5_renewable_lifetime = 50d krb5_renew_interval = 3600
systemctl restart sssd
ipa automountlocation-add location
ipa automountlocation-add raleigh ---------------------------------- Added automount location "raleigh" ---------------------------------- Location: raleigh
ipa automountlocation-tofiles raleigh /etc/auto.master: /- /etc/auto.direct --------------------------- /etc/auto.direct:
--------------------------- /etc/auto.direct: /shared/man server.example.com:/shared/man
ipa automountkey-add raleigh auto.direct --key=/share --info="ro,soft,ipaserver.example.com:/home/share" Key: /share Mount information: ro,soft,ipaserver.example.com:/home/share
ldapclient -a serviceSearchDescriptor=auto_direct:automountMapName=auto.direct,cn= location ,cn=automount,dc=example,dc=com?one
--------------------------- /etc/auto.share: man ipa.example.com:/docs/man ---------------------------
ipa automountmap-add-indirect location mapName --mount= directory [--parentmap= mapName ]
ipa automountmap-add-indirect raleigh auto.share --mount=/share -------------------------------- Added automount map "auto.share" --------------------------------
ipa automountkey-add raleigh auto.share --key=docs --info="ipa.example.com:/export/docs" ------------------------- Added automount key "docs" ------------------------- Key: docs Mount information: ipa.example.com:/export/docs
ipa automountlocation-tofiles raleigh /etc/auto.master: /- /etc/auto.direct /share /etc/auto.share --------------------------- /etc/auto.direct: --------------------------- /etc/auto.share: man ipa.example.com:/export/docs
ldapclient -a serviceSearchDescriptor=auto_share:automountMapName=auto.share,cn= location ,cn=automount,dc=example,dc=com?one
ipa automountlocation-import location map_file [--continuous]
ipa automountlocation-import raleigh /etc/custom.map
NSSProtocol TLSv1.2 NSSCipherSuite +ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha,+rsa_aes_128_sha,+rsa_aes_256_sha
sed -i 's/^NSSProtocol .*/NSSProtocol TLSv1.2/' /etc/httpd/conf.d/nss.conf sed -i 's/^NSSCipherSuite .*/NSSCipherSuite +ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha,+rsa_aes_128_sha,+rsa_aes_256_sha/' /etc/httpd/conf.d/nss.conf
systemctl restart httpd
ldapmodify -h localhost -p 389 -D 'cn=directory manager' -W << EOF dn: cn=encryption,cn=config changeType: modify replace: sslVersionMin sslVersionMin: TLS1.2 EOF
systemctl restart dirsrv@ EXAMPLE-COM .service
systemctl stop dirsrv@ EXAMPLE-COM .service
sslVersionMin: TLS1.2
systemctl start dirsrv@ EXAMPLE-COM .service
sslVersionRangeStream="tls1_2:tls1_2" sslVersionRangeDatagram="tls1_2:tls1_2"
sed -i 's/tls1_[01]:tls1_2/tls1_2:tls1_2/g' /etc/pki/pki-tomcat/server.xml
systemctl restart pki-tomcatd@pki-tomcat.service
ldapmodify -x -D "cn=Directory Manager" -W -h server.example.com -p 389 -ZZ Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-allow-anonymous-access nsslapd-allow-anonymous-access: rootdse modifying entry "cn=config"
systemctl restart dirsrv.target
ldapsearch -D "cn=directory manager" -w secret -b "cn=config,cn=ldbm database,cn=plugins,cn=config" nsslapd-dbcachesize nsslapd-db-locks nsslapd-dbcachesize: 10000000 nsslapd-db-locks: 50000
ldapsearch -D "cn=directory manager" -w secret -b "cn=userRoot,cn=ldbm database,cn=plugins,cn=config" nsslapd-cachememsize nsslapd-dncachememsize nsslapd-cachememsize: 10485760 nsslapd-dncachememsize: 10485760
dn: cn=config,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsslapd-dbcachesize nsslapd-dbcachesize: db_cache_size_in_bytes
ldapmodify -D "cn=directory manager" -w secret -x dn: cn=config,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsslapd-dbcachesize nsslapd-dbcachesize: 200000000
modifying entry "cn=config,cn=ldbm database,cn=plugins,cn=config"
dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsslapd-cachememsize nsslapd-cachememsize: entry_cache_size_in_bytes
grep '^dn: ' ldif_file | sed 's/^dn: //' | wc -l 92200
grep '^dn: ' ldif_file | sed 's/^dn: //' | wc -c 9802460
dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: modify Replace: nsslapd-dncachememsize Nsslapd-dncachememsize: dn_cache_size
dn: cn=MemberOf Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off
dn: cn=Schema Compatibility,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off
dn: cn=Content Synchronization,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off
dn: cn=Retro Changelog Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: off
ipactl stop
dn: cn=config,cn=ldbm database,cn=plugins,cn=config nsslapd-db-locks: db_lock_number
systemctl start dirsrv.target
ldapadd -D " binddn " -y password_file -f ldif_file
dn: cn=MemberOf Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on
systemctl restart dirsrv.target
fixup-memberof.pl -D "cn=directory manager" -j password_file -Z server_id -b " suffix " -f "(objectClass=*)" -P LDAP
dn: cn=Schema Compatibility,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on
dn: cn=Content Synchronization,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on
dn: cn=Retro Changelog Plugin,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on
dn: cn=config,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsslapd-dbcachesize nsslapd-dbcachesize: backup_db_cache_size dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: modify Replace: nsslapd-dncachememsize Nsslapd-dncachememsize: backup_dn_cache_size - replace: nsslapd-cachememsize nsslapd-cachememsize: backup_entry_cache_size
systemctl stop dirsrv.target
dn: cn=config,cn=ldbm database,cn=plugins,cn=config nsslapd-db-locks: backup_db_lock_number
ipactl start
https://ipaserver.example.com/ipa/migration
[jsmith@server ~]USD kinit Password for jsmith@EXAMPLE.COM: Password expired. You must change it now. Enter new password: Enter it again:
ldapmodify -x -D 'cn=directory manager' -w password -h ipaserver.example.com -p 389 dn: cn=config changetype: modify replace: nsslapd-sasl-max-buffer-size nsslapd-sasl-max-buffer-size: 4194304 modifying entry "cn=config"
ulimit -u 4096
ipa migrate-ds ldap://ldap.example.com:389
ipa migrate-ds --user-container=ou=employees --group-container="ou=employee groups" ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee ldap://ldap.example.com:389
ipa migrate-ds --group-objectclass=groupOfNames --group-objectclass=groupOfUniqueNames ldap://ldap.example.com:389
ipa migrate-ds --exclude-groups="Golfers Group" --exclude-users=jsmith --exclude-users=bjensen ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee --exclude-users=jsmith --exclude-users=bjensen --exclude-users=mreynolds ldap://ldap.example.com:389
ipa migrate-ds --user-ignore-attribute=userCertificate --user-ignore-objectclass=strongAuthenticationUser --group-ignore-objectclass=groupOfCertificates ldap://ldap.example.com:389
ipa migrate-ds --schema=RFC2307 ldap://ldap.example.com:389
ipa user-add TEST_USER
ipa user-show --all TEST_USER
ipa-compat-manage disable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=TRUE
ipa migrate-ds ldap://ldap.example.com:389
ipa-compat-manage enable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=FALSE
ipa-client-install --enable-dns-update
https:// ipaserver.example.com /ipa/migration
[user@server ~]USD ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'cn=users,cn=accounts,dc=example,dc=com' '(&(!(krbprincipalkey=*))(userpassword=*))' uid
ipa migrate-ds --ca-cert-file= /etc/ipa/remote.crt ldaps:// ldap.example.com :636
KRB5_TRACE=/dev/stdout ipa cert-find
systemctl restart httpd.service
KRB5_TRACE=/dev/stdout kinit admin
host client_fully_qualified_domain_name
host server_fully_qualified_domain_name
host server_IP_address
server.example.com.
systemctl status krb5kdc # systemctl status dirsrv.target
ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful
dig -t TXT _kerberos. ipa.example.com USD dig -t SRV _kerberos._udp. ipa.example.com USD dig -t SRV _kerberos._tcp. ipa.example.com
; <<>> DiG 9.11.0-P2-RedHat-9.11.0-6.P2.fc25 <<>> -t SRV _kerberos._tcp.ipa.server.example ;; global options: +cmd ;; connection timed out; no servers could be reached
systemctl status httpd.service # systemctl status dirsrv@ IPA-EXAMPLE-COM .service
systemctl restart httpd
klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 01/10/2017 14:54:39 ldap/server.example.com@EXAMPLE.COM 2 01/10/2017 14:54:39 ldap/server.example.com@EXAMPLE.COM [... output truncated ...]
kinit admin USD kvno ldap/ server.example.com@EXAMPLE.COM
getcert list Number of certificates and requests being tracked: 8. [... output truncated ...] Request ID '20170421124617': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-EXAMPLE-COM/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=ipa.example.com,O=IPA.EXAMPLE.COM expires: 2019-04-22 12:46:17 UTC [... output truncated ...] Request ID '20170421130535': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=ipa.example.com,O=IPA.EXAMPLE.COM expires: 2019-04-22 13:05:35 UTC [... output truncated ...]
dig _ldap._tcp.ipa.example.com. SRV ; <<>> DiG 9.9.4-RedHat-9.9.4-48.el7 <<>> _ldap._tcp.ipa.example.com. SRV ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17851 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.ipa.example.com. IN SRV ;; ANSWER SECTION: _ldap._tcp.ipa.example.com. 86400 IN SRV 0 100 389 ipaserver.ipa.example.com. ;; AUTHORITY SECTION: ipa.example.com. 86400 IN NS ipaserver.ipa.example.com. ;; ADDITIONAL SECTION: ipaserver.ipa.example.com. 86400 IN A 192.0.21 ipaserver.ipa.example.com 86400 IN AAAA 2001:db8::1
host server.ipa.example.com server.ipa.example.com. 86400 IN A 192.0.21 server.ipa.example.com 86400 IN AAAA 2001:db8::1
ipa dnszone-show zone_name USD ipa dnsrecord-show zone_name record_name_in_the_zone
systemctl restart named-pkcs11
ipa dns-update-system-records --dry-run
dig +short server2.example.com A dig +short server2.example.com AAAA dig +short -x server2_IPv4_or_IPv6_address
dig +short server1.example.com A dig +short server1.example.com AAAA dig +short -x server1_IPv4_or_IPv6_address
kinit -kt /etc/dirsrv/ds.keytab ldap/ server1.example.com klist ldapsearch -Y GSSAPI -h server1.example.com -b "" -s base ldapsearch -Y GSSAPI -h server2_FQDN . -b "" -s base
ipa : CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/ configuration_file ' returned non-zero exit status 1 Configuration of CA failed
env|grep proxy http_proxy=http://example.com:8080 ftp_proxy=http://example.com:8080 https_proxy=http://example.com:8080
for i in ftp http https; do unset USD{i}_proxy; done
pkidestroy -s CA -i pki-tomcat; rm -rf /var/log/pki/pki-tomcat /etc/sysconfig/pki-tomcat /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat /etc/pki/pki-tomcat /root/ipa.csr
ipa-server-install --uninstall
ipaserver named[6886]: failed to dynamically load driver 'ldap.so': libldap-2.4.so.2: cannot open shared object file: No such file or directory
yum remove bind-chroot
ipactl restart
CRITICAL Failed to restart the directory server Command '/bin/systemctl restart dirsrv@EXAMPLE.service' returned non-zero exit status 1
slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_496' not found))
set_krb5_creds - Could not get initial credentials for principal [ldap/ replica1.example.com] in keytab [WRFILE:/etc/dirsrv/ds.keytab]: -1765328324 (Generic error)
Replication bind with GSSAPI auth resumed
ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer ipa: DEBUG: cert valid True for "CN=replica.example.com,O=EXAMPLE.COM" ipa: DEBUG: handshake complete, peer = 192.0.2.2:9444 Certificate operation cannot be completed: Unable to communicate with CMS (Not Found) ipa: DEBUG: Created connection context.ldap2_21534032 ipa: DEBUG: Destroyed connection context.ldap2_21534032 The DNS forward record replica.example.com. does not match the reverse address replica.example.org
Certificate operation cannot be completed: EXCEPTION (Certificate serial number 0x2d not found)
ipa-replica-manage list-ruv server1.example.com:389: 6 server2.example.com:389: 5 server3.example.com:389: 4 server4.example.com:389: 12
ipa-replica-manage clean-ruv 6 ipa-replica-manage clean-ruv 5 ipa-replica-manage clean-ruv 4 ipa-replica-manage clean-ruv 12
dn: cn=clean replica_ID , cn=cleanallruv, cn=tasks, cn=config objectclass: extensibleObject replica-base-dn: dc= example ,dc= com replica-id: replica_ID replica-force-cleaning: no cn: clean replica_ID
ldapsearch -p 389 -h IdM_node -D "cn=directory manager" -W -b "cn=config" "(objectclass=nsds5replica)" nsDS5ReplicaId
Jun 30 11:11:48 server1 krb5kdc[1279](info): AS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: NEEDED_PREAUTH: admin EXAMPLE COM for krbtgt/EXAMPLE COM EXAMPLE COM, Additional pre-authentication required Jun 30 11:11:48 server1 krb5kdc[1279](info): AS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: ISSUE: authtime 1309425108, etypes {rep=18 tkt=18 ses=18}, admin EXAMPLE COM for krbtgt/EXAMPLE COM EXAMPLE COM Jun 30 11:11:49 server1 krb5kdc[1279](info): TGS_REQ (4 etypes {18 17 16 23}) 192.0.2.1: UNKNOWN_SERVER: authtime 0, admin EXAMPLE COM for HTTP/server1.wrong.example.com@EXAMPLE.COM, Server not found in Kerberos database
debug_level = 9
systemctl start sssd
ipa: ERROR: Kerberos error: ('Unspecified GSS failure. Minor code may provide more information', 851968)/('Decrypt integrity check failed', -1765328353)
Wed Jun 14 18:24:03 2017) [sssd[pam]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [12370] (Wed Jun 14 18:24:03 2017) [sssd[pam]] [child_handler_setup] (0x2000): Signal handler set up for pid [12370] (Wed Jun 14 18:24:08 2017) [sssd[pam]] [pam_initgr_cache_remove] (0x2000): [idmeng] removed from PAM initgroup cache (Wed Jun 14 18:24:13 2017) [sssd[pam]] [p11_child_timeout] (0x0020): Timeout reached for p11_child. (Wed Jun 14 18:24:13 2017) [sssd[pam]] [pam_forwarder_cert_cb] (0x0040): get_cert request failed. (Wed Jun 14 18:24:13 2017) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]: System error.
certificate_verification = ocsp_default_responder= http://ocsp.proxy.url , ocsp_default_responder_signing_cert= nickname
systemctl restart sssd.service
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'cn=testvault,cn=user,cn=users,cn=vaults,cn=kra,dc=example,dc=com'.
kinit admin
ipa vaultcontainer-add-owner --user= user --users= user Owner users: admin, user Vault user: user ------------------------ Number of owners added 1 ------------------------
kinit user ipa vault-add testvault2 ------------------------ Added vault "testvault2" ------------------------
/var/log/httpd/*log { missingok notifempty sharedscripts delaycompress postrotate /sbin/service httpd reload > /dev/null 2>/dev/null || true endscript }
ipa-replica-prepare replica.example.com --ip-address 192.0.2.2 Directory Manager (existing master) password: Do you want to configure the reverse zone? [yes]: no Preparing replica for replica.example.com from server.example.com Creating SSL certificate for the Directory Server Creating SSL certificate for the dogtag Directory Server Saving dogtag Directory Server port Creating SSL certificate for the Web Server Exporting RA certificate Copying additional files Finalizing configuration Packaging replica information into /var/lib/ipa/replica-info-replica.example.com.gpg Adding DNS records for replica.example.com Waiting for replica.example.com. A or AAAA record to be resolvable This can be safely interrupted (Ctrl+C) The ipa-replica-prepare command was successful
yum install ipa-server
scp /var/lib/ipa/replica-info-replica.example.com.gpg root@ replica :/var/lib/ipa/
ipa-replica-install /var/lib/ipa/replica-info-replica.example.com.gpg Directory Manager (existing master) password: Run connection check to master Check connection from replica to remote master 'server.example.com': Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master admin@MASTER.EXAMPLE.COM password: Check SSH connection to remote master Connection from master to replica is OK. Configuring NTP daemon (ntpd) [1/4]: stopping ntpd [2/4]: writing configuration Restarting Directory server to apply updates [1/2]: stopping directory server [2/2]: starting directory server Done. Restarting the directory server Restarting the KDC Restarting the web server
ipa-replica-install /var/lib/ipa/ replica-info-replica.example.com.gpg --setup-dns --forwarder 198.51.100.0
ipa-replica-install /var/lib/ipa/ replica-info-replica.example.com.gpg --setup-ca
ipa-replica-prepare replica.example.com --dirsrv-cert-file /tmp/server.key --dirsrv-pin secret --http-cert-file /tmp/server.crt --http-cert-file /tmp/server.key --http-pin secret --dirsrv-cert-file /tmp/server.crt
ipa-replica-manage list server1.example.com : master server2.example.com: master server3.example.com: master server4.example.com: master
ipa-replica-manage list server1.example.com server2.example.com: replica server3.example.com: replica
ipa-replica-manage connect server1.example.com server2.example.com
ipa-replica-manage disconnect server1.example.com server4.example.com
ipa-replica-manage del server2.example.com
ipa-replica-manage force-sync --from server1.example.com
ipa-replica-manage re-initialize --from server1.example.com
ipa-replica-manage list server1.example.com: master server2.example.com: master server3.example.com: master server4.example.com: master
ipa-replica-manage del server3.example.com
ipa-csreplica-manage del server3.example.com
ipa-server-install --uninstall -U
ipa config-show | grep "CA renewal master" IPA CA renewal master: server.example.com
ldapsearch -H ldap://USDHOSTNAME -D 'cn=Directory Manager' -W -b 'cn=masters,cn=ipa,cn=etc,dc=example,dc=com' '(&(cn=CA)(ipaConfigString=caRenewalMaster))' dn CA, server.example.com, masters, ipa, etc, example.com dn: cn=CA,cn= server.example.com ,cn=masters,cn=ipa,cn=etc,dc=example,dc=com
ipa config-mod --ca-renewal-master-server new_server.example.com
ipa-csreplica-manage set-renewal-master