Методические материалы Лохтурова Вячеслава

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Решение FreeIPA ======

  * [[https://youtu.be/HjbWMi3h8r4|youtu.be Синхронизация пользователей MSAD ↔ Freeipa]]
  * [[https://habr.com/ru/companies/astralinux/articles/806223/|Хотите присоединить Windows к домену ALD Pro (FreeIPA)? Спросите меня как]]
===== Установка и инициализация =====

  * Долго инициализируется, лучше добавить ресурсов (4Gb + 2CPU)

==== На выделенный сервер ====

  * Настройка сети [[Настройка сети в Linux#Файлы конфигурации Alma Linux]]
  * Отключить Сервис Firewall [[Сервис Firewall#CentOS, AlmaLinux]]

  * [[https://computingforgeeks.com/install-freeipa-server-on-rocky-almalinux/|Install FreeIPA Server on Rocky Linux 9 / AlmaLinux 9]]

==== С использованием docker compose ====

  * [[https://hub.docker.com/r/freeipa/freeipa-server]]
  * [[https://github.com/freeipa/freeipa-container]]
  * [[https://itzm.tech/p/freeipa/|Установка сервера FreeIPA в Docker-compose]]
  * [[https://tx0.ru/ru/notes/docker-compose/running-freeipa-through-traefik-reverse-proxy-using-docker-compose|Запуск FreeIPA с использованием Docker Compose]]
  * [[https://medium.com/@farshadnick/how-to-set-up-freeipa-on-docker-12b3dc41acd6|How to set up FreeIPA on docker]]

  * [[Технология Docker#docker-compose]]

<code>
# cat /etc/docker/daemon.json
</code><code>
{ 
  "userns-remap": "default" 
}
</code><code>
# service docker restart

# ###docker run --userns=host ...

# ###cat docker-compose.yml
...
    userns_mode: 'host'
...

# ###rm -rf /opt/freeipa-data/

server# mkdir freeipa; cd $_

server:~/freeipa# cat docker-compose.yml
</code><code>
services:
  freeipa:
#    image: freeipa/freeipa-server:centos-9-stream
    image: freeipa/freeipa-server:centos-9-stream-4.12.2
    hostname: freeipa-server
    container_name: freeipa-server
    ports:
      - 80:80
      - 443:443
      - 389:389
      - 636:636
      - 88:88
      - 464:464
      - 88:88/udp
      - 464:464/udp
      - 123:123/udp
      - 53:53/udp
      - 53:53/tcp
    dns:
      - 172.16.1.254
    restart: unless-stopped
    tty: true
    stdin_open: true
    environment:
      IPA_SERVER_HOSTNAME: server.corpX.un
      IPA_SERVER_IP: 192.168.X.10
      DNS: 172.16.1.254
      TZ: "Europe/Moscow"
      IPA_DOMAIN_NAME: corpX.un
      IPA_REALM_NAME: CORPX.UN
      PASSWORD: strongpassword
    command:
      - --domain=corpX.un
      - --realm=CORPX.UN
      - --admin-password=strongpassword
      - --http-pin=strongpassword
      - --dirsrv-pin=strongpassword
      - --ds-password=strongpassword
      - --setup-dns
      - --forwarder=172.16.1.254
      - --no-ntp
      - --unattended
    cap_add:
      - SYS_TIME
      - NET_ADMIN
    volumes:
      - /opt/freeipa-data:/data:Z
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.lo.disable_ipv6=0
</code><code>
server:~/freeipa# docker-compose up -d

server:~/freeipa# docker-compose logs -f

docker-compose logs -t | head -1

docker-compose logs -t | tail -1

Около 20 минут
</code>
==== Настройка доступа для клиентов DNS ====
<code>
server# cat /opt/freeipa-data/etc/named/ipa-options-ext.conf
</code><code>
...
allow-recursion { any; };
</code><code>
server# docker exec -ti freeipa-server systemctl reload named

server# host server.corpX.un 192.168.X.10

gate# host ya.ru 192.168.X.10
</code>

==== Поверка после установки ====
<code>
[root@server ~]# ipactl status
</code>

===== Установка и инициализация клиента =====

  * [[https://www.altlinux.org/FreeIPA/Клиент]]

<code>
# apt update && apt install freeipa-client
...
  Default Kerberos version 5 realm: CORPX.UN 
...

# #kinit admin

gate# ipa-client-install --mkhomedir

client1# hostnamectl hostname client1.corpX.un

client1# cat /etc/hosts
</code><code>
127.0.0.1 localhost
127.0.1.1 client1.corpX.un client1
</code><code>
client1# ipa-client-install --mkhomedir --enable-dns-updates
...: no
...: yes
...: admin
...: .....

# systemctl status sssd
# cat /etc/resolv.conf

[root@server ~]# ipa host-show gate|client1

[root@server ~]# host gate|client1
</code>

===== Управление пользователями =====
<code>
[root@server ~]# ipa user-add user1 --first="Иван" --last="Иванов" --password
...
Password: password1
...

[root@server ~]# #ipa passwd user1
</code>

===== Создание service principal =====

  * [[Установка, настройка и запуск пакета SQUID]]

<code>
gate# kinit admin

gate# ipa service-add HTTP/gate.corpX.un

gate# ipa-getkeytab -p HTTP/gate.corpX.un -k /etc/krb5.keytab

gate# klist -ek /etc/krb5.keytab
</code>

  * [[Аутентификация доступа к SQUID#Настройка сервиса SQUID на использование GSSAPI]]
===== Управление сертификатами =====

==== Корневой сертификат ====

  * [[Пакет OpenSSL#Импорт сертификата центра сертификации]]

<code>
[root@server ~]# cat /etc/ipa/ca.crt

server# cat /opt/freeipa-data/etc/ipa/ca.crt
</code>
==== Создание ключа и сертификата для зарегистрированного узла ====
<code>
gate# ipa-getcert request -f /root/gate.crt -k /root/gate.key

gate# ipa-getcert list
</code>
==== Создание ключа и сертификата для зарегистрированного пользователя ====

  * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]]
<code>
client1# ipa cert-request --principal=user1 --certificate-out=user1.crt user1.req
</code>

==== Создание ключа и сертификата для gitlab на той же системе ====
<code>
server.corpX.un:~# openssl genrsa -out /etc/gitlab/ssl/$(hostname).key 2048

server.corpX.un:~# openssl req -new -key /etc/gitlab/ssl/$(hostname).key -subj '/CN=server.corpX.un/O=CORPX.UN' -addext 'subjectAltName=DNS:server.corpX.un' -out /opt/freeipa-data/server-gitlab.req

[root@freeipa-server /]# ipa cert-request /data/server-gitlab.req --principal=HTTP/server.corpX.un --certificate-out=/data/server-gitlab.crt

server.corpX.un:~# cp /opt/freeipa-data/server-gitlab.crt -v /etc/gitlab/ssl/$(hostname).crt
</code>
==== Создание ключа и сертификата для стороннего сервиса ====
  * [[https://itdraft.ru/2023/03/20/resheno-freeipa-pki-sozdaem-i-podpisyvaem-ssl-sertifikat/|FreeIPA PKI - Создаем и подписываем ssl сертификат]]
<code>
[root@freeipa-server /]#

ipa dnsrecord-add corpX.un keycloak --a-rec="192.168.X.64"
sleep 5

ipa host-add keycloak.corpX.un
ipa service-add HTTP/keycloak.corpX.un

openssl genrsa -out /data/keycloak.key 2048
openssl req -new -key /data/keycloak.key -subj '/CN=keycloak.corpX.un/O=CORPX.UN' -addext 'subjectAltName=DNS:keycloak.corpX.un' -out /data/keycloak.req
ipa cert-request /data/keycloak.req --principal=HTTP/keycloak.corpX.un --certificate-out=/data/keycloak.crt

server# scp /opt/freeipa-data/keycloak.* kube1:/tmp/
</code>

==== Поддержка ACME ====

  * [[https://www.freeipa.org/page/V4/ACME|FreeIPA Automated Certificate Management Environment]]

<code>
[root@freeipa-server /]# 

ipa-acme-manage enable

ipa-acme-manage status
</code>
===== Управление DNS =====
<code>
server# ###docker exec -ti freeipa-server bash

[root@freeipa-server /]# kinit admin
</code><code>
ipa dnsrecord-add corpX.un kube1 --a-rec="192.168.X.221"
ipa dnsrecord-add corpX.un kube2 --a-rec="192.168.X.222"
ipa dnsrecord-add corpX.un kube3 --a-rec="192.168.X.223"
ipa dnsrecord-add corpX.un kube4 --a-rec="192.168.X.224"
</code>
===== Работа с LDAP =====

  * [[Авторизация с использованием LDAP сервера]]

===== Динамический DNS =====

  * [[https://astrid.tech/2021/04/18/0/k8s-freeipa-dns/|How to set up Dynamic DNS on FreeIPA for your Kubernetes Cluster]]
  * [[https://www.ipamworldwide.com/ipam/update-policy.html|BIND update-policy option]]

<code>
[root@freeipa-server ~]# tsig-keygen cert-manager | tee /data/etc/named/cert-manager.key

server# cat /opt/freeipa-data/etc/named/ipa-ext.conf
...
include "/data/etc/named/cert-manager.key";

[root@freeipa-server ~]# rndc reload

Network Service->DNS-Zone-corpX.un->Settings->BIND update policy
...; grant cert-manager subdomain corpX.un. TXT;

[root@freeipa-server ~]# nsupdate -k /data/etc/named/cert-manager.key
server 127.0.0.1
zone corpX.un
update add _acme-challenge.gitlab.corpX.un. 30 IN TXT "your_txt_record_data 1"
send
</code>

===== Отладка =====

  * [[https://www.freeipa.org/page/Centralized_Logging|FreeIPA Centralized Logging]]
<code>
[root@freeipa-server /]# find /data/var/log/ -mmin -2 -type f -ls

server# find /opt/freeipa-data/var/log/ -mmin -2 -type f -ls
</code>

===== Дополнительные материалы ====

==== Попытка запуска в привилегированном режиме ====
<code>
server.corpX.un:~/freeipa# cat docker-compose.yml
services:
  freeipa:
#    image: freeipa/freeipa-server:centos-9-stream
    image: freeipa/freeipa-server:centos-9-stream-4.12.2
#    image: freeipa/freeipa-server:almalinux-10-4.12.2
#    read_only: true
    hostname: server
#    hostname: freeipa-server
#    domainname: server.corpX.un
    container_name: freeipa-server
    network_mode: host
    privileged: true
    cgroup: host
    dns:
#      - 172.16.1.254
      - 192.168.X.10
    restart: unless-stopped
    tty: true
    stdin_open: true
    environment:
      IPA_SERVER_HOSTNAME: server.corpX.un
      IPA_SERVER_IP: 192.168.X.10
#      DNS: 172.16.1.254
      DNS: 192.168.X.10
      TZ: "Europe/Moscow"
      IPA_DOMAIN_NAME: corpX.un
      IPA_REALM_NAME: CORPX.UN
      PASSWORD: strongpassword
    command:
      - -U
      - --domain=corpX.un
      - --realm=CORPX.UN
      - --admin-password=strongpassword
      - --http-pin=strongpassword
      - --dirsrv-pin=strongpassword
      - --ds-password=strongpassword
      - --setup-dns
      - --forwarder=172.16.1.254
      - --no-ntp
      - --unattended
      - --skip-mem-check
      - --no-host-dns
    cap_add:
      - SYS_TIME
      - NET_ADMIN
    volumes:
#      - /etc/localtime:/etc/localtime:ro
#      - /sys/fs/cgroup:/sys/fs/cgroup:rw
      - /sys/fs/cgroup:/sys/fs/cgroup
#      - /sys/fs/cgroup:/sys/fs/cgroup
      - /opt/freeipa-data:/data:Z
#      - /var/lib/ipa-data:/data:Z
#    sysctls:
#      - net.ipv6.conf.all.disable_ipv6=0
#      - net.ipv6.conf.lo.disable_ipv6=0
#    security_opt:
#      - "seccomp:unconfined"


server.corpX.un:~/freeipa# cat /opt/freeipa-data/var/log/ipaclient-install.log
...
2025-09-29T05:28:56Z DEBUG The ipa-client-install command failed, exception: KerberosError: No valid Negotiate header in server response
2025-09-29T05:28:56Z ERROR No valid Negotiate header in server response
2025-09-29T05:28:56Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
</code>
==== Черновик ====
<code>
ipa dnsrecord-add corp26.un gitlab --a-rec="192.168.26.65"
sleep 5

ipa host-add gitlab.corp26.un
ipa service-add HTTP/gitlab.corp26.un

rndc-confgen -a -A hmac-sha512 -k cert-manager -c /data/etc/named/cert-manager.key
[root@freeipa-server ~]# chown root:named /data/etc/named/cert-manager.key
[root@freeipa-server ~]# chmod 640 /data/etc/named/cert-manager.key

/data/etc/named/ipa-ext.conf
...
include "/data/etc/named/cert-manager.key";

grant cert-manager subdomain corp26.un ANY;


nsupdate -k /data/etc/named/cert-manager.key
server 127.0.0.1
server 172.18.0.2
zone corp26.un
update add _acme-challenge.gitlab.corp26.un. 30 IN TXT "your_txt_record_data 1"
send

update add test.corp26.un. 30 IN A 80.80.80.80

freeipa TSIG error with server: tsig indicates error update failed: NOTAUTH(BADKEY)

# > server 195.19.32.2
# > zone _acme-challenge.anysite.bmstu.ru
# > update add _acme-challenge.anysite.bmstu.ru. 30 IN TXT "your_txt_record_data 1"
# > send
# > update del _acme-challenge.anysite.bmstu.ru. 30 IN TXT "your_txt_record_data 1"
# > send
# > quit


====
ipa dnsrecord-add corp26.un keycloak --a-rec="192.168.26.64"
sleep 5

ipa host-add keycloak.corp26.un
ipa service-add HTTP/keycloak.corp26.un

openssl genrsa -out /data/keycloak.key 2048
openssl req -new -key /data/keycloak.key -subj '/CN=keycloak.corp26.un/O=CORP26.UN' -addext 'subjectAltName=DNS:keycloak.corp26.un' -out /data/keycloak.req
ipa cert-request /data/keycloak.req --principal=HTTP/keycloak.corp26.un --certificate-out=/data/keycloak.crt

===============

ipa dnsrecord-add corp26.un apwebd --a-rec="192.168.26.64"
sleep 5

ipa host-add apwebd.corp26.un
ipa service-add HTTP/apwebd.corp26.un

</code>
Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Page Tools
