Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

5.7.2. 使用 ipa-advise 实用程序进行客户端配置

ipa-advise 程序提供配置指令，用于为 AD 信任设置旧的客户端。
要显示 ipa-advise 可以提供配置说明的完整场景列表，请在没有任何选项的情况下运行 ipa-advise。运行 ipa-advise 会打印所有可用配置指令集的名称，以及每个集合的作用以及建议使用它的描述。 
[root@server ~]# ipa-advise
config-redhat-nss-ldap		: Instructions for configuring a system
				  with nss-ldap as a IPA client.
				  This set of instructions is targeted
				  for platforms that include the
				  authconfig utility, which are all
				  Red Hat based platforms.
config-redhat-nss-pam-ldapd	: Instructions for configuring a system
(...)
要显示一组指令，运行 ipa-advise 工具，并将指令设置为参数： 
[root@server ~]# ipa-advise config-redhat-nss-ldap
#!/bin/sh
# ----------------------------------------------------------------------
# Instructions for configuring a system with nss-ldap as a IPA client.
# This set of instructions is targeted for platforms that include the
# authconfig utility, which are all Red Hat based platforms.
# ----------------------------------------------------------------------
# Schema Compatibility plugin has not been configured on this server. To
# configure it, run "ipa-adtrust-install --enable-compat"
# Install required packages via yum
yum install -y wget openssl nss_ldap authconfig

# NOTE: IPA certificate uses the SHA-256 hash function. SHA-256 was
# introduced in RHEL5.2. Therefore, clients older than RHEL5.2 will not
# be able to interoperate with IPA server 3.x.
# Please note that this script assumes /etc/openldap/cacerts as the
# default CA certificate location. If this value is different on your
# system the script needs to be modified accordingly.
# Download the CA certificate of the IPA server
mkdir -p -m 755 /etc/openldap/cacerts
wget http://idm.example.com/ipa/config/ca.crt -O /etc/openldap/cacerts/ca.crt
(...)
您可以使用 ipa-advise 实用程序配置 Linux 客户端，方法是将显示的说明作为 shell 脚本运行，或者手动执行说明。
以 shell 脚本的形式运行指令：
  1. 创建 脚本文件。 
    [root@server ~]# ipa-advise config-redhat-nss-ldap > setup_script.sh
  2. 使用 chmod 实用程序向 文件添加执行权限。 
    [root@server ~]# chmod +x setup_script.sh
  3. 使用 scp 实用程序将 脚本复制到客户端。 
    [root@server ~]# scp setup_script.sh root@client
  4. 在客户端上运行 脚本。 
    [root@client ~]# ./setup_script.sh
    重要
    在客户端上运行脚本文件之前，请务必仔细阅读和查看脚本文件。
要手动配置客户端，请从命令行执行 ipa-advise 显示的说明。