run # yum update once and take the snapshot of that VM
right click on VM –> Snapshot –> Take Snapshot
provide the snapshot name and click on Take Snapshot
setup Linux Lab yet home – installing and configuring IPA server . In order to build the lab server we have to install and configure below server roles.
- YUM Server
- DNS Server
- Web Server
- NTP Server
- LDAP Server
- Kerberos Server
- 389 Directory Server
before creating all the above mentioned servers, we have to assign static IP address and hostname to the server. in this case we will use nmcli utility to set static IP address.
Adding New connection
#nmcli connection add type ethernet con-name eth0 ifname ens01677
Assign IP address
#nmcli connection modify eht0 ipv4.address 192.168.4.13/24 ipv4.gateway 192.168.4.2 ipv4.dns 192.168.4.13 +ipv4.dns 8.8.8.8
Set to Manual IP address method
#nmcli connection modify eth0 ipv4.method manual
Bring down the connection
#nmcli connection down eth0
Brind UP the connection
#nmcli connection up eth0
YUM Server setup
Yellowdog updater, modified required to manage your RPM packages. YUM server will automatically resolve dependencies of rpm packages while installing them. Red Hat Enterprise Linux 7 will not provide YUM, without subscription. Always installing the packages without YUM is very difficult, so we will setup our local repository using installation media packages (RHEL 7 DVD).
Step 1: Mount DVD to temp directory
Mount your ISO file to your virtual machine, then mount to any directory using mount command as mentioned below.
#mount /dev/sr0 /rpms
Step 2: Install FTP and CREATEREPO packages
while installing the createrepo package it may ask you for the dependencies to install, delrarpm and python-deltarpm.
[root@arkit-server ~]# rpm -ivh /rpms/Packages/createrepo-0.9.9-23.el7.noarch.rpm
warning: /rpms/Packages/createrepo-0.9.9-23.el7.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
error: Failed dependencies:
deltarpm is needed by createrepo-0.9.9-23.el7.noarch
python-deltarpm is needed by createrepo-0.9.9-23.el7.noarch
[root@arkit-server ~]# rpm -ivh /rpms/Packages/deltarpm-3.6-3.el7.x86_64.rpm
warning: /rpms/Packages/deltarpm-3.6-3.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:deltarpm-3.6-3.el7 ################################# [100%]
[root@arkit-server ~]# rpm -ivh /rpms/Packages/python-deltarpm-3.6-3.el7.x86_64.rpm
warning: /rpms/Packages/python-deltarpm-3.6-3.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:python-deltarpm-3.6-3.el7 ################################# [100%]
[root@arkit-server ~]# rpm -ivh /rpms/Packages/createrepo-0.9.9-23.el7.noarch.rpm
warning: /rpms/Packages/createrepo-0.9.9-23.el7.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:createrepo-0.9.9-23.el7 ################################# [100%]
[root@arkit-server ~]# rpm -ivh /rpms/Packages/vsftpd-3.0.2-9.el7.x86_64.rpm
warning: /rpms/Packages/vsftpd-3.0.2-9.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:vsftpd-3.0.2-9.el7 ################################# [100%]
Step 3: Enable and Start the FTP service
FTP: File transfer protocol, it uses port number 20 and 21 to download and upload files.
[root@arkit-server ~]# systemctl enable vsftpd.service
ln -s '/usr/lib/systemd/system/vsftpd.service' '/etc/systemd/system/multi-user.target.wants/vsftpd.service'
[root@arkit-server ~]# systemctl start vsftpd.service
[root@arkit-server ~]# systemctl status vsftpd.service
vsftpd.service - Vsftpd ftp daemon
Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; enabled)
Active: active (running) since Sun 2016-03-06 22:50:41 IST; 6s ago
Process: 2778 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS)
Main PID: 2779 (vsftpd)
CGroup: /system.slice/vsftpd.service
└─2779 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf
[root@arkit-server ~]# firewall-cmd --permanent --add-service=ftp
success
[root@arkit-server ~]# firewall-cmd --reload
success
[root@arkit-server ~]# systemctl restart vsftpd.service
verify that in /etc/vsftpd/vsftpd.conf file anonymous_enable=YES string is enabled or not.
set the SELinux policy enabled.
#getsebool -a |grep ftp
#setsebool -P ftpd_full_access on
Step 4: Copy the packages to /var/ftp/pub/ and create repository
We have to share the YUM repository to our client machines via FTP.
create repository using installation DVD repomod.xml file.
# createrepo -vg /var/ftp/pub/repodata/repomd.xml /var/ftp/pub/
Workers Finished
Saving Primary metadata
Saving file lists metadata
Saving other metadata
Generating sqlite DBs
Starting other db creation: Sun Mar 6 23:06:41 2016
Ending other db creation: Sun Mar 6 23:06:43 2016
Starting filelists db creation: Sun Mar 6 23:06:43 2016
Ending filelists db creation: Sun Mar 6 23:06:46 2016
Starting primary db creation: Sun Mar 6 23:06:46 2016
Ending primary db creation: Sun Mar 6 23:06:49 2016
Sqlite DBs complete
create new yum configuration file and add the entries as mentioned below.
[root@arkit-server ~]# cat /etc/yum.repos.d/ftp.repo
[ARKIT-YUM]
name=yumserver
baseurl=ftp://192.168.4.13/pub/
enabled=1
gpgcheck=0
Now test the yum is working..
That’s about yum server setup.
DNS Server, NTP Server, LDAP Server, Kerberos Server and 389 Directory Server
Instead of installing all DNS, LDAP, Kerberos and 389 director server, We can also install an IPA server which includes all of the above.
First enable the firewall rules to install
[root@arkit-server ~]# firewall-cmd --permanent --add-service=http
success
[root@arkit-server ~]# firewall-cmd --permanent --add-service=https
success
[root@arkit-server ~]# firewall-cmd --permanent --add-service=ldap
success
[root@arkit-server ~]# firewall-cmd --permanent --add-service=ldaps
success
[root@arkit-server ~]# firewall-cmd --permanent --add-service=kerberos
success
[root@arkit-server ~]# firewall-cmd --permanent --add-service=dns
success
[root@arkit-server ~]# firewall-cmd --reload
success
[root@arkit-server ~]# yum install ipa-server bind nds-ldap bind-dyndb-ldap
Transaction Summary
===========================================================================================================================================================
Install 3 Packages (+325 Dependent packages)
Total download size: 136 M
Installed size: 392 M
Is this ok [y/d/N]: y
Complete!
[root@arkit-server ~]# ipa-server-install --setup-dns
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure DNS (bind)
To accept the default shown in brackets, press the Enter key.
Existing BIND configuration detected, overwrite? [no]: yes
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.
Server host name [arkit-server.lab.local]:
Warning: skipping DNS resolution of host arkit-server.lab.local
The domain name has been determined based on the host name.
Please confirm the domain name [lab.local]:
Enter the IP address to use, or press Enter to finish.
Please provide the IP address to be used for this host name: 192.168.4.13
Please provide the IP address to be used for this host name:
Adding [192.168.4.13 arkit-server.lab.local] to your /etc/hosts file
The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Enter the IP address to use, or press Enter to finish.
Please provide the IP address to be used for this host name: 192.168.4.13
Please provide the IP address to be used for this host name:
Adding [192.168.4.13 arkit-server.lab.local] to your /etc/hosts file
The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Please provide a realm name [LAB.LOCAL]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.
Directer Password: PASSWORD
Confirm Password: CONFIRM-PASSWORD
The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.
IPA admin password: PASSWORD
Password (confirm): CONFIRM-PASSWORD
Do you want to configure DNS forwarders? [yes]:
Enter the IP address of DNS forwarder to use, or press Enter to finish.
Enter IP address for a DNS forwarder: 8.8.8.8
DNS forwarder 8.8.8.8 added
Enter IP address for a DNS forwarder:
Checking forwarders, please wait ...
Do you want to configure the reverse zone? [yes]:
Please specify the reverse zone name [4.168.192.in-addr.arpa.]:
Using reverse zone(s) 4.168.192.in-addr.arpa.
The IPA Master Server will be configured with:
Hostname: arkit-server.lab.local
IP address(es): 192.168.4.13
Domain name: lab.local
Realm name: LAB.LOCAL
BIND DNS server will be configured to serve IPA domain with:
Forwarders: 8.8.8.8
Reverse zone(s): 4.168.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
The following operations may take some minutes to complete.
Please wait until the prompt is returned.
Configuring NTP daemon (ntpd)
[1/4]: stopping ntpd
[2/4]: writing configuration
[3/4]: configuring ntpd to start on boot
[4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv): Estimated time 1 minute
[1/38]: creating directory server user
[2/38]: creating directory server instance
[3/38]: adding default schema
[4/38]: enabling memberof plugin
[5/38]: enabling winsync plugin
[6/38]: configuring replication version plugin
[7/38]: enabling IPA enrollment plugin
[8/38]: enabling ldapi
[9/38]: configuring uniqueness plugin
[10/38]: configuring uuid plugin
[11/38]: configuring modrdn plugin
[12/38]: configuring DNS plugin
[13/38]: enabling entryUSN plugin
[14/38]: configuring lockout plugin
[15/38]: creating indices
[16/38]: enabling referential integrity plugin
[17/38]: configuring certmap.conf
[18/38]: configure autobind for root
[19/38]: configure new location for managed entries
[20/38]: configure dirsrv ccache
[21/38]: enable SASL mapping fallback
[22/38]: restarting directory server
[23/38]: adding default layout
[24/38]: adding delegation layout
[25/38]: creating container for managed entries
[26/38]: configuring user private groups
[27/38]: configuring netgroups from hostgroups
[28/38]: creating default Sudo bind user
[29/38]: creating default Auto Member layout
[30/38]: adding range check plugin
[31/38]: creating default HBAC rule allow_all
[32/38]: initializing group membership
[33/38]: adding master entry
[34/38]: configuring Posix uid/gid generation
[35/38]: adding replication acis
[36/38]: enabling compatibility plugin
[37/38]: tuning directory server
[38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
[1/27]: creating certificate server user
[2/27]: configuring certificate server instance
[3/27]: stopping certificate server instance to update CS.cfg
[4/27]: backing up CS.cfg
[5/27]: disabling nonces
[6/27]: set up CRL publishing
[7/27]: enable PKIX certificate path discovery and validation
[8/27]: starting certificate server instance
[9/27]: creating RA agent certificate database
[10/27]: importing CA chain to RA certificate database
[11/27]: fixing RA database permissions
[12/27]: setting up signing cert profile
[13/27]: set certificate subject base
[14/27]: enabling Subject Key Identifier
[15/27]: enabling Subject Alternative Name
[16/27]: enabling CRL and OCSP extensions for certificates
[17/27]: setting audit signing renewal to 2 years
[18/27]: configuring certificate server to start on boot
[19/27]: restarting certificate server
[20/27]: requesting RA certificate from CA
[21/27]: issuing RA agent certificate
[22/27]: adding RA agent as a trusted user
[23/27]: configure certmonger for renewals
[24/27]: configure certificate renewals
[25/27]: configure RA certificate renewal
[26/27]: configure Server-Cert certificate renewal
[27/27]: Configure HTTP to proxy connections
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv): Estimated time 10 seconds
[1/3]: configuring ssl for ds instance
[2/3]: restarting directory server
[3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
[1/10]: adding sasl mappings to the directory
[2/10]: adding kerberos container to the directory
[3/10]: configuring KDC
[4/10]: initialize kerberos container
WARNING: Your system is running out of entropy, you may experience long delays
since we already enabled the fire ports we no need to enable now. setup Linux Lab yet home – installing and configuring IPA server
Now verify the kerberos and ldap user is able to login or not
[root@arkit-server ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@LAB.LOCAL
Valid starting Expires Service principal
03/06/2016 21:46:37 03/07/2016 21:46:31 krbtgt/LAB.LOCAL@LAB.LOCAL
[root@arkit-server ~]# ipa user-find admin
--------------
1 user matched
--------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
UID: 823800000
GID: 823800000
Account disabled: False
Password: True
Kerberos keys available: True
----------------------------
Number of entries returned 1
----------------------------
[root@arkit-server ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
ipa_memcached Service: RUNNING
httpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
Create one more user in ipa server to test from client
[root@arkit-server ~]# ipa user-add
First name: Ravi
Last name: Kumar
User login [rkumar]:
-------------------
Added user "rkumar"
-------------------
User login: rkumar
First name: Ravi
Last name: Kumar
Full name: Ravi Kumar
Display name: Ravi Kumar
Initials: RK
Home directory: /home/rkumar
GECOS: Ravi Kumar
Login shell: /bin/sh
Kerberos principal: rkumar@LAB.LOCAL
Email address: rkumar@lab.local
UID: 823800001
GID: 823800001
Password: False
Member of groups: ipausers
Kerberos keys available: False
[root@arkit-server ~]# ipa passwd rkumar
New Password:
Enter New Password again to verify:
---------------------------------------
Changed password for "rkumar@LAB.LOCAL"
---------------------------------------
NOW GO TO CLIENT
Assign the hostname to client
add yum repo to client
# scp /etc/yum.repos.d/ftp.repo root@ipaclient:/etc/yum.repos.d/
Add DNS server IP address to /etc/resolve.conf
[root@ravikumar ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search lab.local
nameserver 192.168.4.10
# yum install nss-pam-ldapd pam_krb5 ipa-client
[root@ravikumar yum.repos.d]# ipa-client-install
Discovery was successful!
Client hostname: ipaclient.lab.local
Realm: LAB.LOCAL
DNS Domain: lab.local
IPA Server: arkit-server.lab.local
BaseDN: dc=lab,dc=local
Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...
Attempting to sync time using ntpd. Will timeout after 15 seconds
Attempting to sync time using ntpd. Will timeout after 15 seconds
Unable to sync time with NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
User authorized to enroll computers: admin
Password for admin@LAB.LOCAL:
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=LAB.LOCAL
Issuer: CN=Certificate Authority,O=LAB.LOCAL
Valid From: Sun Mar 06 16:03:04 2016 UTC
Valid Until: Thu Mar 06 16:03:04 2036 UTC
Enrolled in IPA realm LAB.LOCAL
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm LAB.LOCAL
trying https://arkit-server.lab.local/ipa/json
Forwarding 'ping' to json server 'https://arkit-server.lab.local/ipa/json'
Forwarding 'ca_is_enabled' to json server 'https://arkit-server.lab.local/ipa/json'
Systemwide CA database updated.
Added CA certificates to the default NSS database.
Hostname (ipaclient.lab.local) does not have A/AAAA record.
Missing reverse record(s) for address(es): 192.168.4.12.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Forwarding 'host_mod' to json server 'https://arkit-server.lab.local/ipa/json'
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring lab.local as NIS domain.
Client configuration complete.
Now your client is added successfully to IPA server
[root@ravikumar ~]# getent passwd rkumar
rkumar:*:823800001:823800001:Ravi Kumar:/home/rkumar:/bin/sh
[root@ravikumar ~]#
[root@ravikumar ~]# su - admin
Last login: Sun Mar 6 22:50:42 IST 2016 on pts/0
su: warning: cannot change directory to /home/admin: No such file or directory
-bash-4.2$ id
uid=823800000(admin) gid=823800000(admins) groups=823800000(admins) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-bash-4.2$ exit
logout
[root@ravikumar ~]# su - rkumar
su: warning: cannot change directory to /home/rkumar: No such file or directory
when you login from client you will not get home directory
to get home directory add below line to mentioned file setup Linux Lab yet home – installing and configuring IPA server
# vi /etc/pam.d/password-auth
# session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
login again you will get it.
We can also login to IPA server using web UI
That’s about setting up an Linux Lab yet home using virtualization softwares such as vmware & virtualbox setup Linux Lab yet home – installing and configuring IPA server
Thanks for the read. setup Linux Lab yet home – installing and configuring IPA server
No comments:
Post a Comment