FreeIPA介绍

主要特点
* 集成安全信息管理解决方案，结合了Linux（Fedora），389 Directory Server，MIT Kerberos，NTP，DNS，Dogtag证书系统，SSSD等。
* 建立在众所周知的开源组件和标准协议之上
* 重点关注易于管理和自动化安装和配置任务。
* 完全多主复制，实现更高的冗余和可扩展性
* 可扩展的管理界面（CLI，Web UI，XMLRPC和JSONRPC API）和Python SDK

主要为了管理用户系统，其他平台可以通过LDAP协议获取账户信息。例如jumpserver。

部署

• 系统要求: fedora 28 (本次部署用的此系统，用centos7.5没部署上，强烈建议用此系统。此系统和centos一样)
• FreeIPA: 4.7版本
• IP: 192.168.100.23

本次部署 用的本机当DNS (也可以用外网DNS，或者自建的DNS,下面执行的命令不一样，请注意)

部署fedora 很简单。hostnamectl set-hostname server.zhuxu.co   ##这个名字可以根据实际需要修改，请不要加  - cat /etc/hosts
192.168.100.23 server.zhuxu.co  serveryum install -y ipa-server bind bind-dyndb-ldap ipa-server-dnscat /etc/resolv.conf
search zhuxu.con
nameserver 127.0.0.1

ipa-server-install --setup-dns         ##如果指定DNS，加 参数 --forwarder=X.X.X.XServer host name [server.zhuxu.co]:  回车
Please confirm the domain name [zhuxu.co]:回车
Please provide a realm name [ZHUXU.CO]:回车Directory Manager password: 密码
Password (confirm): 密码The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.IPA admin password: 登录密码
Password (confirm): 登录密码Checking DNS domain zhuxu.co., please wait ...
Do you want to configure DNS forwarders? [yes]: no
No DNS forwarders configured
Do you want to search for missing reverse zones? [yes]: yes
Reverse record for IP address 192.168.100.23 already existsThe IPA Master Server will be configured with:
Hostname:       server.zhuxu.co
IP address(es): 192.168.100.23
Domain name:    zhuxu.co
Realm name:     ZHUXU.COThe CA will be configured with:
Subject DN:   CN=Certificate Authority,O=ZHUXU.CO
Subject base: O=ZHUXU.CO
Chaining:     self-signedBIND DNS server will be configured to serve IPA domain with:
Forwarders:       No forwarders
Forward policy:   only
Reverse zone(s):  No reverse zoneContinue to configure the system with these values? [no]:  yesThe following operations may take some minutes to complete.
Please wait until the prompt is returned

成功显示如下The ipa-client-install command was successful==============================================================================
Setup completeNext steps:1. You must make sure these network ports are open:TCP Ports:* 80, 443: HTTP/HTTPS* 389, 636: LDAP/LDAPS* 88, 464: kerberos* 53: bindUDP Ports:* 88, 464: kerberos* 53: bind* 123: ntp2. You can now obtain a kerberos ticket using the command: 'kinit admin'This ticket will allow you to use the IPA tools (e.g., ipa user-add)and the web user interface.Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful

本地测试

[root@server ~]# kinit admin                  ###必须要登陆admin 才能管理域
Password for admin@ZHUXU.CO:
[root@server ~]# ipa user-find --all           ###查看所有域用户的信息
--------------
1 user matched
--------------dn: uid=admin,cn=users,cn=accounts,dc=zhuxu,dc=coUser login: adminLast name: AdministratorFull name: AdministratorHome directory: /home/adminGECOS: AdministratorLogin shell: /bin/bashPrincipal alias: admin@ZHUXU.COUser password expiration: 20181122134155ZUID: 1919200000GID: 1919200000Account disabled: FalsePreserved user: FalseMember of groups: admins, trust adminsipauniqueid: ded602aa-a7a2-11e8-a94d-000c298c2968krbextradata: AAIjC4Bbcm9vdC9hZG1pbkBaSFVYVS5DTwA=krblastpwdchange: 20180824134155Zobjectclass: top, person, posixaccount, krbprincipalaux, krbticketpolicyaux, inetuser, ipaobject, ipasshuser,ipaSshGroupOfPubKeys
----------------------------
Number of entries returned 1
----------------------------

ipactl --help
Usage: ipactl start|stop|restart|statusOptions:-h, --help            show this help message and exit-d, --debug           Display debugging information-f, --force           Force IPA to start. Combine options --skip-version-check and --ignore-service-failures--ignore-service-failuresIf any service start fails, do not rollback theservices, continue with the operation--skip-version-check  skip version check

网页访问

https://server.zhuxu.co/ipa/ui/

登录admin

参考:https://blog.51cto.com/zhuxu91313/2150779