FreeIPA est une solution de gestion d’utilisateur et d’habilitation centralisée pour les serveurs Linux. Il s’appuie sur des composants open-source tels que LDAP, Kerberos, NTP, DNS… et se compose d’une interface Web et d’outils d’administration en ligne de commande. Enfin, il permet également l’approbation avec un Active-Directory et gère l’authentification avec le mécanisme OTP.

1 – Pré-requis
2 – Installation de FreeIPA
3 – Configuration de FreeIPA
4 – Modification du certificat TLS

Dans cet article, nous allons voir comment installer un serveur FreeIPA sur CentOS 7.

.

1 – Pré-requis

# sudo -s
password:

Il est important de bien configurer le hostname du serveur :

# hostnamectl set-hostname example.domain.tld
# echo -e "192.0.2.1\t\texample.online.lan\texample" >> /etc/hosts
# echo -e "2001:db8::1\t\texample.online.lan\texample" >> /etc/hosts

Aussi, il est préférable que le serveur soit à jour :

# yum -y update

.

2 – Installation de FreeIPA

Une fois que les pré-requis sont réalisés, nous pouvons débuter l’installation de FreeIPA

# yum -y install ipa-server bind bind-dyndb-ldap ipa-server-dns

Remarque : ce processus installera de nombreuses dépendances.

.

3 – Configuration de FreeIPA

FreeIPA dispose d’un script de configuration automatique. Il est juste nécessaire de renseigner certaines informations pour que le script configure les composants embarqués :

# ipa-server-install

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.

This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure the KDC to enable PKINIT

To accept the default shown in brackets, press the Enter key.

Do you want to configure integrated DNS (BIND)? [no]: yes

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
hostname.domainname
Example: master.example.com.

Server host name [example.domain.tld]:

Warning: skipping DNS resolution of host example.domain.tld
The domain name has been determined based on the host name.

Please confirm the domain name [domain.tld]:

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [DOMAIN.TLD]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password:
Password (confirm):

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password:
Password (confirm):

Checking DNS domain domain.tld., please wait ...
Do you want to configure DNS forwarders? [yes]:
Following DNS servers are configured in /etc/resolv.conf: 80.67.169.12, 80.67.169.40
Do you want to configure these servers as DNS forwarders? [yes]:
All DNS servers from /etc/resolv.conf were added. You can enter additional addresses now:
Enter an IP address for a DNS forwarder, or press Enter to skip:
Checking DNS forwarders, please wait ...
Do you want to search for missing reverse zones? [yes]:
Do you want to create reverse zone for IP 192.0.2.1 [yes]:
Please specify the reverse zone name [2.0.192.in-addr.arpa.]:
Do you want to create reverse zone for IP 2001:db8::1 [yes]:
Please specify the reverse zone name [8.b.d.0.1.0.0.2.ip6.arpa.]:
Using reverse zone(s) 2.0.192.in-addr.arpa., 8.b.d.0.1.0.0.2.ip6.arpa.

The IPA Master Server will be configured with:
Hostname:       example.domain.tld
IP address(es): 192.0.2.1, 2001:db8::1
Domain name:    domain.tld
Realm name:     DOMAIN.TLD

BIND DNS server will be configured to serve IPA domain with:
Forwarders:       80.67.169.12, 80.67.169.40
Forward policy:   only
Reverse zone(s):  2.0.192.in-addr.arpa., 8.b.d.0.1.0.0.2.ip6.arpa.

Continue to configure the system with these values? [no]: yes

# kinit admin
Password for admin@DOMAIN.TLD:

# klist

Ticket cache: KEYRING:persistent:0:0
Default principal: admin@DOMAIN.TLD

Valid starting       Expires              Service principal
16/07/2018 14:05:17  17/07/2018 14:05:15  krbtgt/DOMAIN.TLD@DOMAIN.TLD

Enfin, il est nécessaire d’exécuter la commande suivante pour que la création du home directory de l’utilisateur se fasse automatiquement

# authconfig --enablesssd --enablesssdauth --enablemkhomedir --enablelocauthorize --update

.

4 – Modification du certificat TLS

Par défaut, FreeIPA génère automatiquement un certificat x509 auto-signé. Vous avez la possibilité de remplacer ce certificat par autre.

Dans un premier temps, il faut renseigner le certificat de l’autorité.

# ipa-cacert-manage -p PASSWORD -n httpcrt -t C,, install /etc/ssl/rootCA/ca.pem
# ipa-certupdate

Trying https://example.domain.tld/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://example.domain.tld/ipa/json'
trying https://example.domain.tld/ipa/json
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://example.domain.tld/ipa/json'
[try 1]: Forwarding 'ca_find/1' to json server 'https://example.domain.tld/ipa/json'
Systemwide CA database updated.
Systemwide CA database updated.
The ipa-certupdate command was successful

Ensuite, il faut renseigner la clé privée et la clé public :

# ipa-server-certinstall -w -d /etc/ssl/private/domain.tld.key /etc/ssl/issued/domain.tld.crt
Directory Manager password:

Enter private key unlock password:

Please restart ipa services after installing certificate (ipactl restart)

The ipa-server-certinstall command was successful

Enfin, il faut redémarrer complétement FreeIPA pour que la modification du certificat soit prise en compte :

# ipactl restart

Stopping pki-tomcatd Service
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting ntpd Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful

Vous pouvez désormait accéder à l’interface de gestion via l’URL :
https://example.domain.tld/ipa/ui

Je ferais prochainement d’autres articles sur l’administration de FreeIPA, et l’installation des clients IPA sur CentOS mais aussi pour Debian.