5.3. Configuring a Linux System as an IdM Client
- There must be a way to connect the client machine to the Kerberos domain, either by having an available Kerberos identity (such as the admin user) or by manually adding the client machine to the KDC on the server with a one-time password before beginning the enrollment process for the client machine.
- If there is an Active Directory server on the same network that serves DNS records, the Active Directory DNS records could prevent the client from automatically detecting the IdM server address. The
ipa-client-installscript retrieves the Active Directory DNS records instead of any records that were added for IdM.In this case, it is necessary to pass the IdM server address directly to the
5.3.1. Installing the Client (Full Example)
- Install the client packages. These packages provide a simple way to configure the system as a client; they also install and configure SSSD.For a regular user system, this requires only the
[root@client ~]# yum install ipa-clientAn administrator machine requires the
ipa-admintoolspackage, as well:
[root@client ~]# yum install ipa-client ipa-admintools
- If the IdM server is configured as the DNS server and is in the same domain as the client, add the server's IP address as the first entry in the list of name servers in the client's
NoteIf every machine in the domain will be an IdM client, then add the IdM server address to the DHCP configuration.
- Run the client setup command.
[root@client ~]# ipa-client-install --enable-dns-updatesThe
--enable-dns-updatesoption updates DNS with the client machine's IP address. This option should only be used if the IdM server was installed with integrated DNS or if the DNS server on the network accepts DNS entry updates with the GSS-TSIG protocol.Options for
ipa-client-installare listed in the
- If prompted, enter the domain name for the IdM DNS domain.
DNS discovery failed to determine your DNS domain Please provide the domain name of your IPA server (ex: example.com): example.com
- If prompted, enter the fully-qualified domain name of the IdM server. Alternatively, use the
--serveroption with the client installation script to supply the fully-qualified domain name of the IdM server.
DNS discovery failed to find the IPA Server Please provide your IPA server name (ex: ipa.example.com): server.example.com
ImportantThis must be a valid DNS name, which means only numbers, alphabetic characters, and hyphens (-) are allowed. Other characters, like underscores, in the hostname will cause DNS failures.
- The client script then prompts for a Kerberos identity to use to contact and then join the Kerberos realm. When these credentials are supplied, then the client is able to join the IdM Kerberos domain and then complete the configuration:
Continue to configure the system with these values? [no]: y User authorized to enroll computers: admin Synchronizing time with KDC... Password for admin@EXAMPLE.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=EXAMPLE.COM Issuer: CN=Certificate Authority,O=EXAMPLE.COM Valid From: Tue Aug 13 09:29:07 2013 UTC Valid Until: Sat Aug 13 09:29:07 2033 UTC Enrolled in IPA realm EXAMPLE.COM Created /etc/ipa/default.conf New SSSD config will be created Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm EXAMPLE.COM Failed to update DNS records. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Could not update DNS SSHFP records. SSSD enabled Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete.
- Test that the client can connect successfully to the IdM domain and can perform basic tasks. For example, check that the IdM tools can be used to get user and group information:
[jsmith@client ~]$ id [jsmith@client ~]$ getent passwd admin [jsmith@client ~]$ getent group admins
- If an NFS server is already configured, then set NFS on the client system to work with Kerberos.An NFS server must already be configured within the domain. This is covered in Section 18.2, “Configuring Automount”.
NoteTo help troubleshoot potential NFS setup errors, enable debug information in the
- On an IdM server, add an NFS service principal for the NFS client.
[root@client ~]# kinit admin [root@client ~]# ipa service-add nfs/ipaclient.example.com@EXAMPLE
NoteThis must be run from a machine with the ipa-admintools package installed so that the
ipacommand is available.
- On the IdM server, obtain a keytab for the NFS service principal.
[root@client ~]# ipa-getkeytab -s server.example.com -p nfs/ipaclient.example.com@EXAMPLE -k /tmp/krb5.keytab
- Copy the keytab from the IdM server to the IdM client. For example:
[root@client ~]# scp /tmp/krb5.keytab email@example.com:/etc/krb5.keytab
- Configure the
/etc/exportsfile on the NFS server.
- Create the mount point.
[root@client ~]# mkdir /mnt/ipashare
- On the client, mount the NFS share. Use the same
-o secsetting as is used in the
/etc/exportsfile for the NFS server.
[root@client ~]# mount -v -t nfs4 -o sec=krb5p nfs.example.com:/ /mnt/ipashare
5.3.2. Examples of Other Client Installation Options
ipa-client-installcommand which can be used to configure the client system in different ways, depending on the infrastructure requirements.
Example 5.1. Enabling DNS Updates
--enable-dns-updatesoption sets the System Security Services Daemon to update the DNS entries whenever the IP address for a client changes.
[root@client ~]# ipa-client-install --enable-dns-updates
Example 5.2. Specifying Domain Information
--domainfor the DNS domain name (which is only used if the IdM server is configured to host DNS services)
--serverfor the IdM server to register with (which can be any server or replica in the topology)This must be a valid DNS name, which means only numbers, alphabetic characters, and hyphens (-) are allowed. Other characters, like underscores, in the hostname will cause DNS failures.
--realmfor the Kerbero realm name and, optionally,
-pfor a Kerberos principal name
[root@client ~]# ipa-client-install --domain EXAMPLE.COM --server server.example.com --realm EXAMPLE -p host/server.example.com
Example 5.3. Setting a Specific IdM Server
[root@client ~]# ipa-client-install --fixed-primary server.example.com
Example 5.4. Disabling System Authentication Tools
authconfigtool to set and update authentication clients and settings for a local system. Identity Management uses the System Security Services Daemon (SSSD) to store IdM server configuration and to retrieve policy information, users, passwords, and groups configured within the IdM domain.
--noacoption prevents any changes through
--no-sssdoption prevents IdM from using SSSD.
[root@client ~]# ipa-client-install --noac --no-sssd
--preserve-sssd. While this allows the client to change the SSSD configuration file to configure the IdM domain, it saves the old SSSD configuration.
Example 5.5. Disabling Password Caching
--no-krb5-offline-passwordsoption can be used to prevent passwords from being cached in SSSD.
[root@client ~]# ipa-client-install --no-krb5-offline-passwords