User Tools
решение_freeipa
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
решение_freeipa [2025/09/29 10:06] val |
решение_freeipa [2025/10/02 18:18] (current) val [Управление сертификатами] |
||
|---|---|---|---|
| Line 2: | Line 2: | ||
| ===== Установка и инициализация ===== | ===== Установка и инициализация ===== | ||
| + | |||
| + | ==== На выделенный сервер ==== | ||
| + | |||
| + | * Настройка сети [[Настройка сети в Linux#Файлы конфигурации Alma Linux]] | ||
| + | * Отключить Сервис Firewall [[Сервис Firewall#CentOS, AlmaLinux]] | ||
| + | |||
| + | * [[https://computingforgeeks.com/install-freeipa-server-on-rocky-almalinux/|Install FreeIPA Server on Rocky Linux 9 / AlmaLinux 9]] | ||
| ==== С использованием docker compose ==== | ==== С использованием docker compose ==== | ||
| Line 96: | Line 103: | ||
| server# docker exec -ti freeipa-server systemctl reload named | server# docker exec -ti freeipa-server systemctl reload named | ||
| </code> | </code> | ||
| - | ==== Инициализация клиента ==== | + | |
| + | ==== Поверка после установки ==== | ||
| + | <code> | ||
| + | [root@server ~]# ipactl status | ||
| + | </code> | ||
| + | |||
| + | ===== Установка и инициализация клиента ===== | ||
| * [[https://www.altlinux.org/FreeIPA/Клиент]] | * [[https://www.altlinux.org/FreeIPA/Клиент]] | ||
| <code> | <code> | ||
| + | # apt update && apt install freeipa-client | ||
| + | |||
| + | # #kinit admin | ||
| + | |||
| gate# ipa-client-install --mkhomedir | gate# ipa-client-install --mkhomedir | ||
| client1# hostnamectl hostname client1.corp13.un | client1# hostnamectl hostname client1.corp13.un | ||
| + | clientN:~# cat /etc/hosts | ||
| + | </code><code> | ||
| + | 127.0.0.1 localhost | ||
| + | 127.0.1.1 client1.corp13.un clientN | ||
| + | </code><code> | ||
| client1# ipa-client-install --mkhomedir --enable-dns-updates | client1# ipa-client-install --mkhomedir --enable-dns-updates | ||
| + | |||
| + | # systemctl status sssd | ||
| + | |||
| + | [root@server ~]# ipa host-show gate|client1 | ||
| + | |||
| + | [root@server ~]# host gate|client1 | ||
| + | </code> | ||
| + | |||
| + | ===== Управление пользователями ===== | ||
| + | <code> | ||
| + | [root@server ~]# ipa user-add user1 --first="Иван" --last="Иванов" --password | ||
| + | |||
| + | [root@server ~]# #ipa passwd user1 | ||
| </code> | </code> | ||
| ===== Создание service principal ===== | ===== Создание service principal ===== | ||
| + | |||
| + | * [[Установка, настройка и запуск пакета SQUID]] | ||
| + | |||
| <code> | <code> | ||
| + | # kinit admin | ||
| + | |||
| [root@freeipa-server /]# ipa service-add HTTP/gate.corp13.un | [root@freeipa-server /]# ipa service-add HTTP/gate.corp13.un | ||
| gate.corp13.un:~# ipa-getkeytab -p HTTP/gate.corp13.un -k /etc/krb5.keytab | gate.corp13.un:~# ipa-getkeytab -p HTTP/gate.corp13.un -k /etc/krb5.keytab | ||
| </code> | </code> | ||
| + | |||
| + | * [[Аутентификация доступа к SQUID#Копируем ключи в системный keytab]] | ||
| + | * [[Аутентификация доступа к SQUID#Настройка сервиса SQUID на использование GSSAPI]] | ||
| ===== Управление сертификатами ===== | ===== Управление сертификатами ===== | ||
| <code> | <code> | ||
| + | [root@server ~]# cat /etc/ipa/ca.crt | ||
| + | |||
| + | gate# ipa-getcert request -f /root/gate.crt -k /root/gate.key | ||
| + | </code> | ||
| + | * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]] | ||
| + | <code> | ||
| + | client1# ipa cert-request --principal=user1 --certificate-out=user1.crt user1.req | ||
| + | </code> | ||
| + | |||
| + | <code> | ||
| + | |||
| server.corp13.un:~# cat /opt/freeipa-data/etc/ipa/ca.crt | server.corp13.un:~# cat /opt/freeipa-data/etc/ipa/ca.crt | ||
| Line 126: | Line 180: | ||
| - | gate.corp13.un:~# ipa-getcert request -f /root/gate.crt -k /root/gate.key -K host/gate.corp13.un | ||
| - | ###server.corp13.un:~# scp kube1:webd-k8s/webd.req /opt/freeipa-data/ | ||
| - | ---- | ||
| - | ldapsearch -x -b"dc=corp13,dc=un" -H ldap://server "uid=admin" | + | ###server.corp13.un:~# scp kube1:webd-k8s/webd.req /opt/freeipa-data/ |
| + | </code> | ||
| + | ===== Работа с LDAP ===== | ||
| + | <code> | ||
| + | [root@server ~]# ldapsearch -x -b"dc=corp13,dc=un" -H ldap://server "uid=admin" | ||
| </code> | </code> | ||
решение_freeipa.1759129596.txt.gz · Last modified: 2025/09/29 10:06 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
