RHCSA Lab setup using CentOS 7 with ipa server and ipa client
This is in preparation of me studying for my RHCSA (Redhat Certified System Administrator)
------------------------------------
Now for the base server installs.
------------------------------------
I will using the CentOS-7-x86_64-Everything.iso for the installs in my VMware vSphere Client 6.0 and ESXi 6.0. Each Server gets 2 Cores, 2GB Ram, 25GB disk, and 1 NIC.
Servers names and IP addresses will be:
rh-ipa.whittenberg.local 192.168.10.30
rh-srv1.whittenberg.local 192.168.10.31
rh-srv2.whittenberg.local 192.168.10.32
My Local LAN router is 192.168.10.1 and i will use this for my gateway out and DNS server.
At the CentOS 7 install I set my Network and Hostname.
Click on Network and Hostname on home screen.
Hostname: rh-ipa.whittenberg.local
Click slider to turn ethernet adapter ON. This gives me an IP from my DHCP server from my local LAN router.
Click the Configure button.
[General]
click on Automatically connect to this network
[IPv4 Settings]
Method: Manual
Addresses, click add button
address: 192.168.10.30
netmask: 24
gateway: 192.168.10.1
DNS server: 192.168.10.1
Click Save button
Click Done button
You should now be able to ping 192.168.10.30 from your workstation on the LAN.
Click on Date & Time from the home screen.
Chose your region and city.
Make sure Network Time slider shows ON.
Click on gears next to slider. Time servers should be green. If red then you are unable to reach them.
Click Done button.
Click on Software Selection from home screen.
Select Minimal Install under Base Environment and nothing under Add-Ons.
Click Done button.
Click on Installation Destination from home screen.
Make sure white check mark on your hard disk.
Select I will configure partitioning.
Click Done button.
Click the + button and setup as follows.
/boot = 500MB
swap = 1024MB
/root = 23.5GB
Click Done button.
Accept Changes.
Now click the Begin Installation button.
Supply root password while the installation is taking place.
When finished click the Reboot button.
Putty/SSH into your server from your workstation.
Disable selinux.
cp /etc/sysconfig/selinux /etc/sysconfig/selinux.bak
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/sysconfig/selinux
cat /etc/sysconfig/selinux
reboot
Disable and turn off firewalld.
systemctl disable firewalld
systemctl stop firewalld
cat or edit your /etc/hostname file and add the following entree if not there already.
ipa.whittenberg.local
cat or edit your /etc/hosts file and add the following entries if not there already.
192.168.10.30 ipa.whittenberg.local ipa
cat or edit your /etc/resolv.conf file and add the following entries if not there already.
search whittenberg.local
nameserver 192.168.10.1
Install additional packages I need on normal basis.
yum -y install bind-utils traceroute net-tools ntp* gcc glibc glibc-common gd gd-devel make net-snmp openssl-devel xinetd unzip libtool* make patch perl bison flex-devel gcc-c++ ncurses-devel flex libtermcap-devel autoconf* automake* autoconf libxml2-devel cmake sqlite* wget ntp* lm_sensors ncurses-devel qt-devel hmaccalc zlib-devel binutils-devel elfutils-libelf-devel wget bc gzip uuid* libuuid-devel jansson* libxml2* sqlite* openssl* lsof NetworkManager-tui mlocate yum-utils kernel-devel nfs-utils tcpdump git
yum -y groupinstall "Development Tools"
Now update the server.
yum -y update
reboot
**Optional - Install of GNOME Desktop.
yum -y groups install "GNOME Desktop"
yum -y update
systemctl set-default graphical.target
systemctl get-default
reboot and make sure GNOME Desktop starts.
**END Optional - Install of GNOME Desktop.
**Optional - Turn off console screen saver and display all boot messages.
vi /etc/default/grub and on the line starting with GRUB_CMDLINE_LINUX= remove 'rhgb' and 'quiet'. Now add 'consoleblank=0' just before the last " on the line. DO NOT include the ' in the 'consoleblank=0' add.
Now make a new grub.cfg using the line below.
grub2-mkconfig -o /boot/grub2/grub.cfg
If using efi then use this line to make new grub.cfg
grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg
Now when you boot your server you will see all the boot messages.
**END Optional - Turn off console screen saver and display all boot messages.
NOW REPEAT all the steps above under base server installs for the other two server of rh-srv1 and rh-srv2, of course using the correct IP and hostname for each server.
------------------------------------
Now for the ipa server install
------------------------------------
Now its time to setup ipa on the ipa server and we will user srv1 as our first client.
On your ipa server.
# yum -y install ipa-server bind-dyndb-ldap ipa-server-dns
# ipa-server-install --setup-dns
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure DNS (bind)
To accept the default shown in brackets, press the Enter key.
WARNING: conflicting time&date synchronization service 'chronyd' will be disabled
in favor of ntpd
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.
Server host name [rh-ipa.whittenberg.local]:
Warning: skipping DNS resolution of host rh-ipa.whittenberg.local
The domain name has been determined based on the host name.
Please confirm the domain name [whittenberg.local]:
The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Please provide a realm name [WHITTENBERG.LOCAL]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.
Directory Manager password:
Password (confirm):
The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.
IPA admin password:
Password (confirm):
Existing BIND configuration detected, overwrite? [no]: yes
Do you want to configure DNS forwarders? [yes]:
Enter an IP address for a DNS forwarder, or press Enter to skip: 8.8.8.8
DNS forwarder 8.8.8.8 added. You may add another.
Enter an IP address for a DNS forwarder, or press Enter to skip:
Checking DNS forwarders, please wait ...
Do you want to configure the reverse zone? [yes]:
Please specify the reverse zone name [10.168.192.in-addr.arpa.]:
Using reverse zone(s) 10.168.192.in-addr.arpa.
The IPA Master Server will be configured with:
Hostname: rh-ipa.whittenberg.local
IP address(es): 192.168.10.30
Domain name: whittenberg.local
Realm name: WHITTENBERG.LOCAL
BIND DNS server will be configured to serve IPA domain with:
Forwarders: 8.8.8.8
Reverse zone(s): 10.168.192.in-addr.arpa.
Continue to configure the system with these values? [no]: yes
Install info scrolls by then at the end we see.
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
* 53: bind
UDP Ports:
* 88, 464: kerberos
* 53: bind
* 123: ntp
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
# kinit admin
Password for admin@WHITTENBERG.LOCAL:
# ipa user-find admin
--------------
1 user matched
--------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
UID: 1546000000
GID: 1546000000
Account disabled: False
Password: True
Kerberos keys available: True
----------------------------
Number of entries returned 1
----------------------------
# ipa user-add
First name: ldapuser1
Last name: ldapuser1
User login [lldapuser1]: ldapuser1
----------------------
Added user "ldapuser1"
----------------------
User login: ldapuser1
First name: ldapuser1
Last name: ldapuser1
Full name: ldapuser1 ldapuser1
Display name: ldapuser1 ldapuser1
Initials: ll
Home directory: /home/ldapuser1
GECOS: ldapuser1 ldapuser1
Login shell: /bin/sh
Kerberos principal: ldapuser1@WHITTENBERG.LOCAL
Email address: ldapuser1@whittenberg.local
UID: 1546000001
GID: 1546000001
Password: False
Member of groups: ipausers
Kerberos keys available: False
# ls -lsa /etc/ipa/
total 24
0 drwxr-xr-x. 6 root root 89 Oct 20 20:02 .
12 drwxr-xr-x. 147 root root 8192 Oct 20 20:02 ..
4 -r--r--r--. 1 root root 1337 Oct 20 20:01 ca.crt
4 -rw-r--r--. 1 root root 321 Oct 20 20:00 default.conf
0 drwxr-xr-x. 2 root root 76 Oct 20 20:02 dnssec
4 drwxr-xr-x. 2 root root 4096 Oct 20 19:52 html
0 drwxr-xr-x. 2 root root 51 Oct 20 20:01 kdcproxy
0 drwxr-xr-x. 2 root root 69 Oct 20 20:02 nssdb
# cat /etc/ipa/ca.crt
-----BEGIN CERTIFICATE-----
MIIDoDCCAoigAwIBAgIBATANBgkqhkiG9w0BAQsFADA8MRowGAYDVQQKDBFXSElU
VEVOQkVSRy5MT0NBTDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4X
DTE2MTAyMTAzMDAwNFoXDTM2MTAyMTAzMDAwNFowPDEaMBgGA1UECgwRV0hJVFRF
TkJFUkcuTE9DQUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANC2wYqkiEwRY/YUY5cyDTEh+OaK
tU8KtPEeyAOhE8COugNYUZhx8bvoJyM7c7KGzxU/nuY4MAYF6sMOslIcaAHR7S4A
Wi+1URBFI8xsCoO7YktVoyTkV0sNY93dUlK+dpKNnL7P1oDJlcqDWflne/BG0h4i
gq5NRRdWQvh33yJAriBNSw2AIYvuQMiMQ1kdFqQ/T5VjQUU+L20QGE2Ox7AnHkYd
Tovn+Alok8FIqbDNqIn4VNsz0Zy010eHC7zmRK/kiWrnauf+r/JHi3zGz9GVKtUE
3swEE4dXejA7SAd03ZnmF2oruJ+o5u3ZwK4bN8S9dKuZZTaXxjSbT+FbM3MCAwEA
AaOBrDCBqTAfBgNVHSMEGDAWgBRO+0W/EXt3Qbkun00PARxow2PUvjAPBgNVHRMB
Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUTvtFvxF7d0G5Lp9N
DwEcaMNj1L4wRgYIKwYBBQUHAQEEOjA4MDYGCCsGAQUFBzABhipodHRwOi8vcmgt
aXBhLndoaXR0ZW5iZXJnLmxvY2FsOjgwL2NhL29jc3AwDQYJKoZIhvcNAQELBQAD
ggEBAGGiKMrGrcCAtRVfKdA2f4Ko1FpIKKUsEMG4yyBxio//HxDja8X0MUzG7RWQ
3xKvkcNO08zFNd5/5YCiboy5RRrz4N/fIVFZDjJhLjwT9UQx1nktETLl/oirVSp4
e3z7Tc6m+4gpPABM7ryVNkQfdNCka82rLnzny5+U/YsZ2mGcl86MQ6T2U/0RXBHj
9QZVmVRJe7mTJzNW62rSsh6D7u2RBffZIQ7I/Huk5HFiDI9mogtizpb1Miwr5Vhb
uy+bVmPaHJfy/bHbVv8Vg3m0dKbP6bhS0lafnfWXF1iCmako0n0v2+T7IzwScW2Y
G94EkYeftqGg9LiFAogEEKZnuGg=
-----END CERTIFICATE-----
# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@WHITTENBERG.LOCAL
Valid starting Expires Service principal
10/20/2016 20:09:13 10/21/2016 20:07:42 HTTP/rh-ipa.whittenberg.local@WHITTENBERG.LOCAL
10/20/2016 20:07:48 10/21/2016 20:07:42 krbtgt/WHITTENBERG.LOCAL@WHITTENBERG.LOCAL
# cat /etc/resolv.conf
search whittenberg.local
nameserver 127.0.0.1
vi /etc/resolv.conf (change to nameserver 192.168.10.30)
# cat /etc/resolv.conf
search whittenberg.local
nameserver 192.168.10.30
Next you can use the Firefox browser on your ipa server and browse the server.
https://rh-ipa.whittenberg.local
Supply username and password. User name is admin.
Click on Network Services then DNS->DNS Zones, then click on whittenberg.local.
Click Add button. Add your servers here like rh-srv1 and rh-srv2. include name, IP address, and select Create Reverse. Like:
name = rh-srv1
Address = 192.168.10.31
Check mark on Create Reverse
and
name = rh-srv2
Address = 192.168.10.32
Check mark on Create Reverse
------------------------------------
Now for the ipa client installs
------------------------------------
On rh-srv1.whittenberg.local server.
[root@rh-srv1 ~]# cat /etc/hostname
rh-srv1.whittenberg.local
[root@rh-srv1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.10.31 rh-srv1.whittenberg.local rh-srv1
[root@rh-srv1 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search whittenberg.local
nameserver 192.168.10.1
nameserver 2001:578:3f::30
nameserver 2001:578:3f:1::30
Now change the nameserver in /etc/resolv.conf from 192.168.10.1, as shown above, to 192.168.10.30, as shown below.
[root@rh-srv1 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search whittenberg.local
nameserver 192.168.10.30
nameserver 2001:578:3f::30
nameserver 2001:578:3f:1::30
Install the ipa client.
[root@rh-srv1 ~]# yum -y install ipa-client
Now run the install/setup of the ipa client.
[root@rh-srv1 ~]# ipa-client-install
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd
Discovery was successful!
Client hostname: rh-srv1.whittenberg.local
Realm: WHITTENBERG.LOCAL
DNS Domain: whittenberg.local
IPA Server: rh-ipa.whittenberg.local
BaseDN: dc=whittenberg,dc=local
Continue to configure the system with these values? [no]: yes
Skipping synchronizing time with NTP server.
User authorized to enroll computers: admin
Password for admin@WHITTENBERG.LOCAL:
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=WHITTENBERG.LOCAL
Issuer: CN=Certificate Authority,O=WHITTENBERG.LOCAL
Valid From: Fri Oct 21 03:00:04 2016 UTC
Valid Until: Tue Oct 21 03:00:04 2036 UTC
Enrolled in IPA realm WHITTENBERG.LOCAL
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm WHITTENBERG.LOCAL
trying https://rh-ipa.whittenberg.local/ipa/json
Forwarding 'ping' to json server 'https://rh-ipa.whittenberg.local/ipa/json'
Forwarding 'ca_is_enabled' to json server 'https://rh-ipa.whittenberg.local/ipa/json'
Systemwide CA database updated.
Added CA certificates to the default NSS database.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Forwarding 'host_mod' to json server 'https://rh-ipa.whittenberg.local/ipa/json'
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring whittenberg.local as NIS domain.
Client configuration complete.
Setup the server to auto create home directories for ipa users when first login from the server.
[root@rh-srv1 ~]# authconfig --enablemkhomedir --update
getsebool: SELinux is disabled
Now logout as local user root and back in as ipa user admin.
[root@rh-srv1 ~]# logout
login as: admin
admin@192.168.10.31's password:
Creating home directory for admin.
[admin@rh-srv1 ~]$
[admin@rh-srv1 ~]$ pwd
/home/admin
[admin@rh-srv1 ~]$ whoami
admin
[admin@rh-srv1 ~]$ ping rh-ipa
PING rh-ipa.whittenberg.local (192.168.10.30) 56(84) bytes of data.
64 bytes from rh-ipa.whittenberg.local (192.168.10.30): icmp_seq=1 ttl=64 time=0.084 ms
64 bytes from rh-ipa.whittenberg.local (192.168.10.30): icmp_seq=2 ttl=64 time=0.084 ms
^C
--- rh-ipa.whittenberg.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.084/0.084/0.084/0.000 ms
Now you should be able to ssh into the rh-ipa server without supplying credentials if still login as admin on rh-srv1.
[admin@rh-srv1 ~]$ ssh rh-ipa
Could not chdir to home directory /home/admin: No such file or directory
-bash-4.2$
It worked! Looks like we have home dir issue for ipa user admin on the ipa server though. Lets try and take care of that. First exit back to rh-srv1.
-bash-4.2$ exit
logout
Connection to rh-ipa closed.
[admin@rh-srv1 ~]$
Now ssh to rh-ipa as local user root.
[admin@rh-srv1 ~]$ ssh root@rh-ipa
root@rh-ipa's password:
Last failed login: Fri Oct 21 22:40:19 MST 2016 from 192.168.10.31 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Thu Oct 20 21:19:20 2016 from 192.168.10.5
[root@rh-ipa ~]#
Setup the server to auto create home directories for ipa users when first login from the server.
[root@rh-srv1 ~]# authconfig --enablemkhomedir --update
Now exit back to rh-srv1.
[root@rh-ipa ~]# exit
logout
Connection to rh-ipa closed.
[admin@rh-srv1 ~]$
Now ssh back in to rh-ipa as ipa user admin.
[admin@rh-srv1 ~]$ ssh rh-ipa
Creating home directory for admin.
Last login: Fri Oct 21 22:36:53 2016 from 192.168.10.31
[admin@rh-ipa ~]$ pwd
/home/admin
[admin@rh-ipa ~]$
That solved the problem!!
NOW REPEAT all the steps above in ipa client install section for rh-srv2, of course using the correct IP and hostname for each server.
Thats it folks. Enjoy!
No comments:
Post a Comment