5.5. Setting up a Linux Client Through Kickstart
- Create the host entry on the IdM server and set a temporary Kerberos password for the entry.When the
ipa-client-installscript is run normally (interactively), it prompts for authentication credentials to access the IdM domain. However, when the script is run automatically, the system has to have some way to access the IdM domain without using an existing IdM user; this is done by setting the host principal in the script and using a Kerberos password (configured for the host account) to access the IdM domain.For example:
[jsmith@server ~]$ ipa host-add kickstart-server.example.com --password=secretThe password expires after the first authentication attempt. After enrollment completes, the host is authenticated using its keytab.
- Include the ipa-client package with the other install packages.
%packages @ X Window System @ Desktop @ Sound and Video ipa-client ...
- Create a post-install instruction that ensures SSH keys are generated before enrollment, runs the
ipa-client-installscript, passes all the required information to access and configure the IdM domain services, and specifies the pre-set password. Use the
--unattendedoption to instruct the script to run non-interactively.
%post --log=/root/ks-post.log # Generate SSH keys to ensure that ipa-client-install uploads them to the IdM server /usr/bin/ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_rsa_key chmod 644 /etc/ssh/ssh_host_rsa_key.pub /sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub /usr/bin/ssh-keygen -q -t rsa1 -f /etc/ssh/ssh_host_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_key chmod 644 /etc/ssh/ssh_host_key.pub /sbin/restorecon /etc/ssh/ssh_host_key.pub /usr/bin/ssh-keygen -q -t dsa -f /etc/ssh/ssh_host_dsa_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_dsa_key chmod 644 /etc/ssh/ssh_host_dsa_key.pub /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub # Get the hostname to set as the host principal /bin/hostname > /tmp/hostname.txt # Run the client install script /usr/sbin/ipa-client-install --domain=EXAMPLEDOMAIN --enable-dns-updates --mkhomedir -w secret --realm=EXAMPLEREALM --server=server.example.com --unattended
NoteRed Hat recommends not to start the
sshdservice prior to the kickstart enrollment. While starting
sshdbefore enrolling the client generates the SSH keys automatically, using the above script is the preferred solution.
- Run the kickstart script.