Installing Identity Management Red Hat Enterprise Linux 9 Methods of installing IdM servers and clients Red Hat Customer Content Services

Commands:
[user@server ~]USD dig +short -t SRV _ntp._udp.example.com 0 100 123 ntpserver .example.com.
[user@server ~]USD dig +short -t SRV _ntp._udp.example.com 0 100 123 ntpserver .example.com.
hostname server.idm.example.com
ip addr show 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:1a:4a:10:4e:33 brd ff:ff:ff:ff:ff:ff inet 192.0.2.1 /24 brd 192.0.2.255 scope global dynamic eth0 valid_lft 106694sec preferred_lft 106694sec inet6 2001:DB8::1111 /32 scope global dynamic valid_lft 2591521sec preferred_lft 604321sec inet6 fe80::56ee:75ff:fe2b:def6/64 scope link valid_lft forever preferred_lft forever
dig +short server.idm.example.com A 192.0.2.1
dig +short server.idm.example.com AAAA 2001:DB8::1111
dig +short -x 192.0.2.1 server.idm.example.com
dig +short -x 2001:DB8::1111 server.idm.example.com
dig @ IP_address_of_the_DNS_forwarder . SOA
dig +dnssec @ IP_address_of_the_DNS_forwarder . SOA
;; ->>HEADER<<- opcode: QUERY, status: NOERROR , id: 48655 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; ANSWER SECTION: . 31679 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2015100701 1800 900 604800 86400 . 31679 IN RRSIG SOA 8 0 86400 20151017170000 20151007160000 62530 . GNVz7SQs [...]
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.0.2.1 server.idm.example.com server 2001:DB8::1111 server.idm.example.com server
systemctl status firewalld.service
systemctl start firewalld.service systemctl enable firewalld.service
firewall-cmd --permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,88/udp,464/tcp,464/udp,53/tcp,53/udp}
firewall-cmd --permanent --add-service={freeipa-4,dns}
firewall-cmd --reload
firewall-cmd --runtime-to-permanent
nmap -p 80,443,389,636,88,464,53 server.idm.example.com [...] PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 389/tcp open ldap 443/tcp open https 464/tcp open kpasswd5 636/tcp open ldapssl
nmap -sU -p 88,464,53 server.idm.example.com [...] PORT STATE SERVICE 53/udp open domain 88/udp open|filtered kerberos-sec 464/udp open|filtered kpasswd5
subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms
dnf install ipa-server
dnf install ipa-server ipa-server-dns
dnf install ipa-server ipa-server-trust-ad samba-client
umask 0027
umask 0022
umask 0027
ipa-server-install
Do you want to configure integrated DNS (BIND)? [no]: yes
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:
Directory Manager password: IPA admin password:
Do you want to configure DNS forwarders? [yes]:
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
ipa-server-install --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended --setup-dns --forwarder 192.0.2.1 --no-reverse
ipa-server-install --external-ca
ipa-server-install --external-ca --external-ca-type=ms-cs --external-ca-profile= <oid>/<name>/default
ipa-server-install --external-ca
Do you want to configure integrated DNS (BIND)? [no]: yes
Server host name [ server.idm.example.com ]: Please confirm the domain name [ idm.example.com ]: Please provide a realm name [ IDM.EXAMPLE.COM ]:
Directory Manager password: IPA admin password:
Do you want to configure DNS forwarders? [yes]:
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/8]: creating certificate server user [2/8]: configuring certificate server instance The next step is to get /root/ipa.csr signed by your CA and re-run /sbin/ipa-server-install as: /sbin/ipa-server-install --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate
ipa-server-install --external-cert-file= /tmp/servercert20170601.pem --external-cert-file= /tmp/cacert.pem
ipa : CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/ configuration_file ' returned non-zero exit status 1 Configuration of CA failed
ipa : CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/ configuration_file ' returned non-zero exit status 1 Configuration of CA failed
env|grep proxy http_proxy=http://example.com:8080 ftp_proxy=http://example.com:8080 https_proxy=http://example.com:8080
for i in ftp http https; do unset USD{i}_proxy; done
pkidestroy -s CA -i pki-tomcat; rm -rf /var/log/pki/pki-tomcat /etc/sysconfig/pki-tomcat /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat /etc/pki/pki-tomcat /root/ipa.csr
ipa-server-install --uninstall
ipa-server-install --http-cert-file /tmp/server.crt --http-cert-file /tmp/server.key --http-pin secret --dirsrv-cert-file /tmp/server.crt --dirsrv-cert-file /tmp/server.key --dirsrv-pin secret --ca-cert-file ca.crt
Do you want to configure integrated DNS (BIND)? [no]: yes
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:
Directory Manager password: IPA admin password:
Do you want to configure DNS forwarders? [yes]:
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
ipa-server-install
Do you want to configure integrated DNS (BIND)? [no]:
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:
Directory Manager password: IPA admin password:
NetBIOS domain name [EXAMPLE]: Do you want to configure chrony with NTP server or pool address? [no]:
Continue to configure the system with these values? [no]: yes
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
ipa-server-install --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
Please add records in this file to your DNS system: /tmp/ipa.system.records.6zdjqxh3.db
_kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos.example.com. 86400 IN TXT "EXAMPLE.COM" _kpasswd._tcp.example.com. 86400 IN SRV 0 100 464 server.example.com. _kpasswd._udp.example.com. 86400 IN SRV 0 100 464 server.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server.example.com.
ipa-server-install --external-ca --external-ca-type=ms-cs --external-ca-profile= <oid>/<name>/default
ipa-server-install --external-ca
Do you want to configure integrated DNS (BIND)? [no]:
Server host name [ server.idm.example.com ]: Please confirm the domain name [ idm.example.com ]: Please provide a realm name [ IDM.EXAMPLE.COM ]:
Directory Manager password: IPA admin password:
Continue to configure the system with these values? [no]: yes
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds [1/8]: creating certificate server user [2/8]: configuring certificate server instance The next step is to get /root/ipa.csr signed by your CA and re-run /sbin/ipa-server-install as: /sbin/ipa-server-install --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate
ipa-server-install --external-cert-file= /tmp/servercert20170601.pem --external-cert-file= /tmp/cacert.pem
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
ipa : CRITICAL failed to configure ca instance Command '/usr/sbin/pkispawn -s CA -f /tmp/pass:quotes[ configuration_file ]' returned non-zero exit status 1 Configuration of CA failed
ipa-server-install --external-ca --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/11]: configuring certificate server instance The next step is to get /root/ipa.csr signed by your CA and re-run /usr/sbin/ipa-server-install as: /usr/sbin/ipa-server-install --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate The ipa-server-install command was successful
ipa-server-install --external-cert-file= /tmp/servercert20170601.pem --external-cert-file= /tmp/cacert.pem --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
Please add records in this file to your DNS system: /tmp/ipa.system.records.6zdjqxh3.db
_kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos.example.com. 86400 IN TXT "EXAMPLE.COM" _kpasswd._tcp.example.com. 86400 IN SRV 0 100 464 server.example.com. _kpasswd._udp.example.com. 86400 IN SRV 0 100 464 server.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server.example.com.
dn: cn=config changetype: modify replace: nsslapd-idletimeout nsslapd-idletimeout: 1800 - replace: nsslapd-maxdescriptors nsslapd-maxdescriptors: 8192
ipa-server-install --dirsrv-config-file filename.ldif
ipa-replica-install --dirsrv-config-file filename.ldif
[user@server ~]USD sudo tail -n 10 /var/log/ipaserver-install.log [sudo] password for user: value = gen.send(prev_value) File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python3.6/site-packages/ipaserver/install/server/ init .py", line 564, in main master_install(self) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 291, in decorated raise ScriptError() 2020-05-27T22:59:41Z DEBUG The ipa-server-install command failed, exception: ScriptError: 2020-05-27T22:59:41Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
[user@server ~]USD sudo less -N +G /var/log/ipaserver-install.log
[user@server ~]USD sudo less -N +G /var/log/httpd/error_log [user@server ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /access [user@server ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /errors
[user@server ~]USD sudo less -N +G /var/log/pki/pki-ca-spawn. 20200527185902 .log
ipa-server-install The log file for this installation can be found in /var/log/ipaserver-install.log IPA server is already configured on this system. If you want to reinstall the IPA server, please uninstall it first using 'ipa-server-install --uninstall' . The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
ipa-server-install --uninstall
ipa server-role-find --role 'DNS server' ---------------------- 2 server roles matched ---------------------- Server name: server456.idm.example.com Role name: DNS server Role status: enabled [...] ---------------------------- Number of entries returned 2 ----------------------------
ipa server-role-find --role 'CA server' ---------------------- 2 server roles matched ---------------------- Server name: server123.idm.example.com Role name: CA server Role status: enabled Server name: r8server.idm.example.com Role name: CA server Role status: enabled ---------------------------- Number of entries returned 2 ----------------------------
ipa server-role-find --role 'KRA server' ---------------------- 2 server roles matched ---------------------- Server name: server123.idm.example.com Role name: KRA server Role status: enabled Server name: r8server.idm.example.com Role name: KRA server Role status: enabled ---------------------------- Number of entries returned 2 ----------------------------
ipa config-show | grep 'CA renewal' IPA CA renewal master: r8server.idm.example.com
ipa-crlgen-manage status CRL generation: disabled
ssh idm_user@server456
[idm_user@server456 ~]USD kinit admin
[idm_user@server456 ~]USD ipa-replica-manage dnarange-show server123.idm.example.com: 1001-1500 server456.idm.example.com: 1501-2000 [...]
[idm_user@server456 ~]USD ipa user-add test_idm_user
[idm_user@server456 ~]USD ipa server-del server123.idm.example.com
ipa-server-install --uninstall Are you sure you want to continue with the uninstall procedure? [no]: true
ipactl stop
dnf upgrade ipa- *
dnf distro-sync ipa- *
lookup_family_order = ipv4_only
dnf install ipa-client
ipa-client-install --mkhomedir
ipa-client-install --enable-dns-updates --mkhomedir
Client hostname: client.example.com Realm: EXAMPLE.COM DNS Domain: example.com IPA Server: server.example.com BaseDN: dc=example,dc=com Continue to configure the system with these values? [no]: yes
User authorized to enroll computers: hostadmin Password for hostadmin @ EXAMPLE.COM :
Client configuration complete.
ipa host-add client.example.com --random -------------------------------------------------- Added host "client.example.com" -------------------------------------------------- Host name: client.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: server.example.com
ipa-client-install --mkhomedir --password= password
ipa-client-install --password 'W5YpARl=7M.n' --enable-dns-updates --mkhomedir
Client hostname: client.example.com Realm: EXAMPLE.COM DNS Domain: example.com IPA Server: server.example.com BaseDN: dc=example,dc=com Continue to configure the system with these values? [no]: yes
Client configuration complete.
ipa-client-install --password ' W5YpARl=7M.n ' --mkhomedir --unattended
ipa-client-install --password ' W5YpARl=7M.n ' --domain idm.example.com --server server.idm.example.com --realm IDM.EXAMPLE.COM --mkhomedir --unattended
BASE dc=example,dc=com URI ldap://ldap.example.com #URI ldaps://server.example.com # modified by IPA #BASE dc=ipa,dc=example,dc=com # modified by IPA
[user@client ~]USD id admin uid=1254400000(admin) gid=1254400000(admins) groups=1254400000(admins)
[user@client ~]USD su - Last login: Thu Oct 18 18:39:11 CEST 2018 from 192.168.122.1 on pts/0
ipa host-add client.example.com --password= secret
%packages ipa-client
%post --log=/root/ks-post.log Generate SSH keys; ipa-client-install uploads them to the IdM server by default /usr/libexec/openssh/sshd-keygen rsa Run the client install script /usr/sbin/ipa-client-install --hostname= client.example.com --domain= EXAMPLE.COM --enable-dns-updates --mkhomedir -w secret --realm= EXAMPLE.COM --server= server.example.com
env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null getcert list env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null ipa-client-install
[user@client ~]USD id admin uid=1254400000(admin) gid=1254400000(admins) groups=1254400000(admins)
[user@client ~]USD su - Last login: Thu Oct 18 18:39:11 CEST 2018 from 192.168.122.1 on pts/0
[user@server ~]USD sudo grep ScriptError /var/log/ipaclient-install.log [sudo] password for user: 2020-05-28T18:24:50Z DEBUG The ipa-client-install command failed, exception: ScriptError : One of password / principal / keytab is required.
[user@server ~]USD sudo less -N +G /var/log/ipaclient-install.log
[user@server ~]USD ipa dnszone-mod idm.example.com. --dynamic-update=TRUE
[user@server ~]USD sudo firewall-cmd --permanent --add-port=53/tcp --add-port=53/udp [sudo] password for user: success [user@server ~]USD firewall-cmd --runtime-to-permanent success
[user@server ~]USD sudo grep nsupdate /var/log/ipaclient-install.log
Joining realm failed: Failed to add key to the keytab child exited with 11 Installation failed. Rolling back changes.
[user@client ~]USD sudo rm /etc/krb5.keytab [sudo] password for user: [user@client ~]USD ls /etc/krb5.keytab ls: cannot access '/etc/krb5.keytab': No such file or directory
The ipa-client-install command was successful.
/usr/sbin/ipa-client-automount -U --location <raleigh>
ipa-client-install --force-join
User authorized to enroll computers: hostadmin Password for hostadmin @ EXAMPLE.COM :
ipa-client-install --keytab /tmp/krb5.keytab
[user@client ~]USD id admin uid=1254400000(admin) gid=1254400000(admins) groups=1254400000(admins)
[user@client ~]USD su - Last login: Thu Oct 18 18:39:11 CEST 2018 from 192.168.122.1 on pts/0
ipa-client-install --uninstall
kinit admin kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM
ipa dnsrecord-del Record name: old-client-name Zone name: idm.example.com No option to delete specific record provided. Delete all? Yes/No (default No): true ------------------------ Deleted record "old-client-name"
ipa host-del client.idm.example.com
rm /etc/krb5.conf
mv /etc/krb5.conf.ipa /etc/krb5.conf
dnf reinstall krb5-libs
kinit admin kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
ipa service-find old-client-name.example.com
find / -name "*.keytab"
ipa hostgroup-find old-client-name.example.com
ipa-client-install --uninstall
kinit admin kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM
ipa dnsrecord-del Record name: old-client-name Zone name: idm.example.com No option to delete specific record provided. Delete all? Yes/No (default No): true ------------------------ Deleted record "old-client-name"
ipa host-del client.idm.example.com
rm /etc/krb5.conf
mv /etc/krb5.conf.ipa /etc/krb5.conf
dnf reinstall krb5-libs
kinit admin kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
hostnamectl set-hostname new-client-name.example.com
ipa service-add service_name/new-client-name
ipa --version VERSION: 4.8.0 , API_VERSION: 2.233
rpm -q ipa-server ipa-server-4.8.0-11 .module+el8.1.0+4247+9f3fd721.x86_64
kinit admin
ipa hostgroup-add-member ipaservers --hosts client.idm.example.com Host-group: ipaservers Description: IPA server hosts Member hosts: server.idm.example.com, client.idm.example.com ------------------------- Number of members added 1 -------------------------
kinit admin
kinit admin
ipa host-add replica.example.com --random -------------------------------------------------- Added host "replica.example.com" -------------------------------------------------- Host name: replica.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: server.example.com
ipa hostgroup-add-member ipaservers --hosts replica.example.com Host-group: ipaservers Description: IPA server hosts Member hosts: server.example.com, replica.example.com ------------------------- Number of members added 1 -------------------------
ipa-replica-install --setup-dns --forwarder 192.0.2.1 --setup-ca
ipa-replica-install --setup-dns --forwarder 192.0.2.1
ipa-replica-install --setup-ca
ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate
ipa-replica-install --dirsrv-cert-file /tmp/server.crt --dirsrv-cert-file /tmp/server.key --dirsrv-pin secret --http-cert-file /tmp/server.crt --http-cert-file /tmp/server.key --http-pin secret
ipa-replica-install --hidden-replica
[admin@new_replica ~]USD ipa user-add test_user
[admin@another_replica ~]USD ipa user-show test_user
[user@replica ~]USD sudo tail -n 10 /var/log/ipareplica-install.log [sudo] password for user: func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 424, in decorated func(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 785, in promote_check ensure_enrolled(installer) File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 740, in ensure_enrolled raise ScriptError("Configuration of client side components failed!") 2020-05-28T18:24:51Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Configuration of client side components failed! 2020-05-28T18:24:51Z ERROR Configuration of client side components failed! 2020-05-28T18:24:51Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
[user@replica ~]USD sudo less -N +G /var/log/ipareplica-install.log
[user@replica ~]USD sudo less -N +G /var/log/ipareplica-conncheck.log [user@replica ~]USD sudo less -N +G /var/log/ipaclient-install.log [user@replica ~]USD sudo less -N +G /var/log/httpd/error_log [user@replica ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /access [user@replica ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /errors [user@replica ~]USD sudo less -N +G /var/log/ipaserver-install.log
[user@server ~]USD sudo less -N +G /var/log/httpd/error_log [user@server ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /access [user@server ~]USD sudo less -N +G /var/log/dirsrv/slapd- INSTANCE-NAME /errors
[user@server ~]USD sudo less -N +G /var/log/pki/pki-ca-spawn. 20200527185902 .log
ipa-replica-install Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. IPA server is already configured on this system. If you want to reinstall the IPA server, please uninstall it first using 'ipa-server-install --uninstall'. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
ipa-server-install --uninstall
ipa server-del replica.idm.example.com
[27/40]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ldap://server.example.com:389] reports: Update failed! Status: [49 - LDAP error: Invalid credentials] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Failed to start replication ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
[user@server ~]USD date Thu May 28 21:03:57 EDT 2020 [user@replica ~]USD sudo timedatectl set-time '2020-05-28 21:04:00'
ipa topologysuffix-find --------------------------- 2 topology suffixes matched --------------------------- Suffix name: ca Managed LDAP suffix DN: o=ipaca Suffix name: domain Managed LDAP suffix DN: dc=example,dc=com ---------------------------- Number of entries returned 2 ----------------------------
ipa topologysegment-find Suffix name: domain ----------------- 1 segment matched ----------------- Segment name: server1.example.com-to-server2.example.com Left node: server1.example.com Right node: server2.example.com Connectivity: both ---------------------------- Number of entries returned 1 ----------------------------
ipa topologysegment-show Suffix name: domain Segment name: server1.example.com-to-server2.example.com Segment name: server1.example.com-to-server2.example.com Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa topologysegment-add Suffix name: domain Left node: server1.example.com Right node: server2.example.com Segment name [server1.example.com-to-server2.example.com]: new_segment --------------------------- Added segment "new_segment" --------------------------- Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa topologysegment-show Suffix name: domain Segment name: new_segment Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both
ipa topologysegment-find Suffix name: domain ------------------ 8 segments matched ------------------ Segment name: new_segment Left node: server1.example.com Right node: server2.example.com Connectivity: both ---------------------------- Number of entries returned 8 ----------------------------
ipa topologysegment-del Suffix name: domain Segment name: new_segment ----------------------------- Deleted segment "new_segment" -----------------------------
ipa topologysegment-find Suffix name: domain ------------------ 7 segments matched ------------------ Segment name: server2.example.com-to-server3.example.com Left node: server2.example.com Right node: server3.example.com Connectivity: both ---------------------------- Number of entries returned 7 ----------------------------
[user@server2 ~]USD ipa server-del Server name: server1.example.com Removing server1.example.com from replication topology, please wait ---------------------------------------------------------- Deleted IPA server "server1.example.com" ----------------------------------------------------------
ipa server-install --uninstall
ipa-replica-manage list-ruv server1.example.com:389: 6 server2.example.com:389: 5 server3.example.com:389: 4 server4.example.com:389: 12
ipa-replica-manage clean-ruv 6 ipa-replica-manage clean-ruv 5
dn: cn=clean replica_ID, cn=cleanallruv, cn=tasks, cn=config objectclass: extensibleObject replica-base-dn: dc=example,dc=com replica-id: replica_ID replica-force-cleaning: no cn: clean replica_ID
ipa config-show IPA masters: server1.example.com, server2.example.com, server3.example.com IPA CA servers: server1.example.com, server2.example.com IPA CA renewal master: server1.example.com
ipa server-show Server name: server.example.com Enabled server roles: CA server, DNS server, KRA server
ipa server-find --servrole "CA server" --------------------- 2 IPA servers matched --------------------- Server name: server1.example.com Server name: server2.example.com ---------------------------- Number of entries returned 2 ----------------------------
ipa server-state replica.idm.example.com --state=hidden
ipa server-state replica.idm.example.com --state=enabled
ipa config-show
dnf install ipa-healthcheck
ipa-healthcheck --failures-only []
ipa-healthcheck
subscription-manager repos --enable rhel-9-for-x86_64-appstream-rpms
dnf install ansible-freeipa
ls -1 /usr/share/ansible/roles/ ipaclient ipareplica ipaserver
ls -1 /usr/share/doc/ansible-freeipa/ playbooks README-client.md README.md README-replica.md README-server.md README-topology.md
ls -1 /usr/share/doc/ansible-freeipa/playbooks/ install-client.yml install-cluster.yml install-replica.yml install-server.yml uninstall-client.yml uninstall-cluster.yml uninstall-replica.yml uninstall-server.yml
mkdir MyPlaybooks
ipaserver_setup_dns=true
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone
--- - name: Playbook to configure IPA server hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaserver state: present
--- - name: Playbook to configure IPA server hosts: ipaserver become: true roles: - role: ipaserver state: present
mkdir MyPlaybooks
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone
--- - name: Playbook to configure IPA server hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaserver state: present
--- - name: Playbook to configure IPA server hosts: ipaserver become: true roles: - role: ipaserver state: present
ansible-playbook -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server.yml
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
mkdir MyPlaybooks
ipaserver_setup_dns=true
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=true ipaserver_auto_forwarders=true ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone [...]
--- - name: Playbook to configure IPA server Step 1 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_ca: true roles: - role: ipaserver state: present post_tasks: - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}" fetch: src: /root/ipa.csr dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}" flat: true
--- - name: Playbook to configure IPA server Step 2 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_cert_files: - "/root/servercert20240601.pem" - "/root/cacert.pem" pre_tasks: - name: Copy "{{ groups.ipaserver[0] }}-{{ item }}" to "/root/{{ item }}" on node ansible.builtin.copy: src: "{{ groups.ipaserver[0] }}-{{ item }}" dest: "/root/{{ item }}" force: true with_items: - servercert20240601.pem - cacert.pem roles: - role: ipaserver state: present
mkdir MyPlaybooks
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 [...]
[ipaserver] server.idm.example.com [ipaserver:vars] ipaserver_domain=idm.example.com ipaserver_realm=IDM.EXAMPLE.COM ipaserver_setup_dns=no ipaadmin_password=MySecretPassword123 ipadm_password=MySecretPassword234 ipaserver_firewalld_zone= custom zone [...]
--- - name: Playbook to configure IPA server Step 1 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_ca: true roles: - role: ipaserver state: present post_tasks: - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}" fetch: src: /root/ipa.csr dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}" flat: true
--- - name: Playbook to configure IPA server Step 2 hosts: ipaserver become: true vars_files: - playbook_sensitive_data.yml vars: ipaserver_external_cert_files: - "/root/servercert20240601.pem" - "/root/cacert.pem" pre_tasks: - name: Copy "{{ groups.ipaserver[0] }}-{{ item }}" to "/root/{{ item }}" on node ansible.builtin.copy: src: "{{ groups.ipaserver[0] }}-{{ item }}" dest: "/root/{{ item }}" force: true with_items: - servercert20240601.pem - cacert.pem roles: - role: ipaserver state: present
ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step1.yml
ansible-playbook -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step2.yml
Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server
--- - name: Playbook to uninstall an IdM replica hosts: ipaserver become: true roles: - role: ipaserver ipaserver_remove_from_domain: true state: absent
ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/inventory <path_to_playbooks_directory>/uninstall-server.yml
--- - name: Playbook to uninstall an IdM replica hosts: ipaserver become: true roles: - role: ipaserver ipaserver_remove_from_domain: true ipaserver_remove_on_server: server456.idm.example.com ipaserver_ignore_topology_disconnect: true state: absent
ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/hosts <path_to_playbooks_directory>/uninstall-server.yml
[ipareplicas] replica1.idm.example.com replica2.idm.example.com replica3.idm.example.com [...]
[ipaservers] server.idm.example.com [ipareplicas] replica1.idm.example.com replica2.idm.example.com replica3.idm.example.com [...]
[ipaservers] server.idm.example.com replica1.idm.example.com [ipareplicas] replica2.idm.example.com replica3.idm.example.com ipareplica_servers=replica1.idm.example.com
[ipaservers] server.idm.example.com [ipareplicas_tier1] replica1.idm.example.com [ipareplicas_tier2] replica2.idm.example.com \ ipareplica_servers=replica1.idm.example.com,server.idm.example.com
--- - name: Playbook to configure IPA replicas (tier1) hosts: ipareplicas_tier1 become: true roles: - role: ipareplica state: present - name: Playbook to configure IPA replicas (tier2) hosts: ipareplicas_tier2 become: true roles: - role: ipareplica state: present
[ipaservers] server.idm.example.com [ipareplicas] replica1.idm.example.com replica2.idm.example.com replica3.idm.example.com [...] [ipareplicas:vars] ipareplica_firewalld_zone= custom zone
[ipaservers] server.idm.example.com [ipareplicas] replica1.idm.example.com replica2.idm.example.com replica3.idm.example.com [...] [ipareplicas:vars] ipareplica_setup_dns=true ipareplica_forwarders=192.0.2.1,192.0.2.2
[...] [ipaclient:vars] ipaclient_configure_dns_resolver=true ipaclient_dns_servers=192.168.100.1
- name: Playbook to configure IPA replicas hosts: ipareplicas become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipareplica state: present
[...] [ipareplicas:vars] ipaadmin_password=Secret123
- name: Playbook to configure IPA replicas hosts: ipareplicas become: true roles: - role: ipareplica state: present
[...] [ipareplicas:vars] ipaadmin_principal=my_admin ipaadmin_password=my_admin_secret123
- name: Playbook to configure IPA replicas hosts: ipareplicas become: true roles: - role: ipareplica state: present
ansible-playbook -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-replica.yml
[ipaclients] client.idm.example.com [...]
- name: Playbook to configure IPA clients with username/password hosts: ipaclients become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaclient state: present
[...] [ipaclients:vars] ipaadmin_principal=my_admin ipaadmin_password=Secret123
- name: Playbook to unconfigure IPA clients hosts: ipaclients become: true roles: - role: ipaclient state: true
[...] [ipaclients:vars] ipaadmin_password: "{{ ipaadmin_password }}" ipaclient_domain=idm.example.com ipaclient_configure_dns_resolver=true ipaclient_dns_servers=192.168.100.1
[ipaclients] client.idm.example.com [ipaservers] server.idm.example.com [ipaclients:vars] ipaclient_domain=idm.example.com [...]
- name: Playbook to configure IPA clients with username/password hosts: ipaclients become: true vars_files: - playbook_sensitive_data.yml roles: - role: ipaclient state: present
[...] [ipaclients:vars] ipaadmin_principal=my_admin ipaadmin_password=Secret123
- name: Playbook to unconfigure IPA clients hosts: ipaclients become: true roles: - role: ipaclient state: true
[ipaclients:vars] ipaadmin_password=Secret123 ipaclient_use_otp=true
[ipaclients:vars] ipaclient_otp=<W5YpARl=7M.>
[ipaclients:vars] ipaadmin_keytab=/root/admin.keytab ipaclient_use_otp=true
[ipaclients:vars] ipaclient_keytab=/root/krb5.keytab
[ipaclients:vars] ipaadmin_password=Secret123
[ipaclients:vars] [...]
[ipaclients:vars] [...]
- name: Playbook to configure IPA clients hosts: ipaclients become: true vars_files: - ansible_vault_file.yml roles: - role: ipaclient state: present
- name: Playbook to configure IPA clients hosts: ipaclients become: true roles: - role: ipaclient state: true
ansible-playbook -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-client.yml
ssh admin@server.idm.example.com
[admin@server ~]USD ipa host-add client.idm.example.com --ip-address=172.25.250.11 --random -------------------------------------------------- Added host "client.idm.example.com" -------------------------------------------------- Host name: client.idm.example.com Random password: W5YpARl=7M.n Password: True Keytab: False Managed by: server.idm.example.com
exit logout Connection to server.idm.example.com closed.
[...] [ipaclients] client.idm.example.com [ipaclients:vars] ipaclient_domain=idm.example.com ipaclient_otp=W5YpARl=7M.n [...]
sudo dnf install krb5-workstation
ansible-playbook -i inventory install-client.yml
[user@client1 ~]USD id admin uid=1254400000(admin) gid=1254400000(admins) groups=1254400000(admins)
[user@client1 ~]USD su - idm_user Last login: Thu Oct 18 18:39:11 CEST 2018 from 192.168.122.1 on pts/0 [idm_user@client1 ~]USD
ansible-playbook -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/uninstall-client.yml
ipa server-role-show r8server.idm.example.com Role name: DNS server Server name: r8server.idm.example.com Role name: DNS server Role status: absent
dnf install ipa-server-dns
ipa-dns-install
Do you want to configure DNS forwarders? [yes]:
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
[root@idmserver ~] ipa-ca-install
[root@idmserver ~] ipa-ca-install --external-ca
ipa-ca-install --external-cert-file=/root/master.crt --external-cert-file=/root/ca.crt
[root@idmserver ~] ipa-ca-install