init
This commit is contained in:
Vassiliy Yegorov
179
install.MD
Normal file
179
install.MD
Normal file
@@ -0,0 +1,179 @@
|
||||
# Setup
|
||||
|
||||
## install soft
|
||||
|
||||
dnf -y install freeipa-server ipa-server-dns bind-dyndb-ldap curl mc nano htop
|
||||
|
||||
## setup
|
||||
|
||||
export HNAME="id1.bildme.local"
|
||||
hostnamectl set-hostname $HNAME --static && hostname $HNAME
|
||||
|
||||
check /etc/hosts (clear bad records ip4\ip6 with 127.x.x.x)
|
||||
|
||||
192.168.9.42 id1.bildme.local id1
|
||||
192.168.9.45 id2.bildme.local id2
|
||||
|
||||
ipa-server-install
|
||||
|
||||
SAVE you PASSWORD!! (zAgQ9T2UEtGF0FRMPxIbg)
|
||||
|
||||
for i in 80 443 389 636 88 464 53; do firewall-cmd --add-port=$i/tcp --permanent; done
|
||||
for i in 88 464 123 53; do firewall-cmd --add-port=$i/udp --permanent; done
|
||||
firewall-cmd --reload
|
||||
|
||||
//todo: add groups\sudo setting with '!authenticate' and more..
|
||||
|
||||
Done.
|
||||
|
||||
## replica setup
|
||||
|
||||
dnf -y install freeipa-server ipa-server-dns bind-dyndb-ldap curl mc nano htop
|
||||
|
||||
export HNAME="id2.bildme.local"
|
||||
hostnamectl set-hostname $HNAME --static && hostname $HNAME
|
||||
|
||||
check /etc/hosts (clear bad records ip4\ip6 with 127.x.x.x)
|
||||
|
||||
192.168.9.42 id1.bildme.local id1
|
||||
192.168.9.45 id2.bildme.local id2
|
||||
|
||||
- check dns
|
||||
set resolv.conf on master replica!
|
||||
|
||||
ipa-client-install --mkhomedir --bildme=bildme.local --realm=BILDME.LOCAL --server=id1.bildme.local \
|
||||
--ntp-server=91.189.89.198 --ntp-server=91.189.91.157 --ntp-server=91.189.89.199 \
|
||||
--hostname=`hostname -f` --enable-dns-updates
|
||||
|
||||
on ID1!
|
||||
|
||||
kinit admin
|
||||
ipa hostgroup-add-member ipaservers --hosts id2.bildme.local
|
||||
|
||||
on ID2!
|
||||
|
||||
for i in 80 443 389 636 88 464 53; do firewall-cmd --add-port=$i/tcp --permanent; done
|
||||
for i in 88 464 123 53; do firewall-cmd --add-port=$i/udp --permanent; done
|
||||
firewall-cmd --reload
|
||||
|
||||
ipa-replica-install --setup-dns --setup-ca --forwarder 192.168.9.9
|
||||
|
||||
# Replica teardown
|
||||
|
||||
on del replica
|
||||
ipa-server-install --uninstall
|
||||
|
||||
on master:
|
||||
ipa-replica-manage del <name> --force
|
||||
ipa hostgroup-remove-member ipaservers --hosts <name>
|
||||
|
||||
# Client setup
|
||||
|
||||
- check hostname
|
||||
|
||||
/etc/hostname = client2.bildme.local
|
||||
|
||||
- check dns
|
||||
set resolv.conf on master\slave replica!
|
||||
|
||||
apt update && apt upgrade -y
|
||||
apt-get install freeipa-client
|
||||
|
||||
ipa-client-install --mkhomedir --hostname=`hostname -f` \
|
||||
--server=id1.bildme.local --server=id2.bildme.local --bildme=bildme.local --realm=BILDME.LOCAL \
|
||||
--ntp-server=192.168.9.42 --ntp-server=192.168.9.45
|
||||
|
||||
# Client windows setup
|
||||
|
||||
from AD:
|
||||
ipa-getkeytab -s id1.bildme.local -p host/client1.bildme.local -e aes256-cts,aes128-cts,des3-hmac-sha1,des-hmac-sha1,des-cbc-md5,des-cbc-crc -k krb5.keytab.windows -P
|
||||
|
||||
from client:
|
||||
|
||||
ksetup /setrealm BILDME
|
||||
ksetup /setbildme BILDME.LOCAL
|
||||
ksetup /addkdc BILDME.LOCAL id1.bildme.local
|
||||
ksetup /addkpasswd BILDME.LOCAL id1.bildme.local
|
||||
ksetup /setcomputerpassword [ПАРОЛЬ]
|
||||
ksetup /mapuser vasyansk@BILDME.LOCAL vasyansk
|
||||
|
||||
|
||||
# Fix warning on ID2
|
||||
|
||||
0. dnf install -y ipa-healthcheck
|
||||
|
||||
1. chmod 600 /var/log/kadmind.log
|
||||
2. fix idrange
|
||||
|
||||
ipa-replica-manage dnarange-show
|
||||
>> 762600004-762799999 # (199 995 / 2 = 99 997)
|
||||
|
||||
ipa-replica-manage dnarange-set id1.bildme.local 762600004-762700001
|
||||
ipa-replica-manage dnarange-set id2.bildme.local 762700002-762799999
|
||||
|
||||
# Backup catalog
|
||||
|
||||
- check dns
|
||||
set resolv.conf on master replica!
|
||||
|
||||
0. add new client to catalog
|
||||
ipa-client-install --mkhomedir --bildme=bildme.local --realm=BILDME.LOCAL --server=id1.bildme.local \
|
||||
--ntp-server=91.189.89.198 --ntp-server=91.189.91.157 --ntp-server=91.189.89.199 \
|
||||
--hostname=`hostname -f` --enable-dns-updates
|
||||
|
||||
- check new records of its replica in DNS-masters
|
||||
|
||||
- open ports
|
||||
for i in 80 443 389 636 88 464 53; do firewall-cmd --add-port=$i/tcp --permanent; done
|
||||
for i in 88 464 123 53; do firewall-cmd --add-port=$i/udp --permanent; done
|
||||
firewall-cmd --reload
|
||||
|
||||
- add its replica to ipaservers group
|
||||
|
||||
1. add hidden replica for backup (if you have more resource)
|
||||
ipa-replica-install --hidden-replica
|
||||
|
||||
# Restore replica
|
||||
|
||||
- check dns, ip, hostname and version of ipa packages
|
||||
- install ipaserver if you need
|
||||
|
||||
- ipa-restore /var/lib/ipa/backup/ipa-full-2022-03-07-10-42-22/
|
||||
|
||||
run ipa-healthcheck get error of replication
|
||||
|
||||
- ipa-replica-manage re-initialize --from id1.bildme.local
|
||||
- ipa-replica-manage force-sync --from id1.bildme.local
|
||||
- ipactl restart
|
||||
|
||||
# Auth application LDAP connect
|
||||
|
||||
https://docs.gitlab.com/ee/administration/auth/ldap/
|
||||
|
||||
- add uidgitlab to system users by ipa-ctl.sh
|
||||
- add ENV's config to you gitlab app
|
||||
|
||||
```bash
|
||||
LDAP_ENABLED=true
|
||||
LDAP_LABEL=LDAP
|
||||
|
||||
# "start_tls" if 389, or "simple_tls" if 636
|
||||
LDAP_METHOD=simple_tls
|
||||
LDAP_ACTIVE_DIRECTORY=false
|
||||
LDAP_HOST=id1.bildme.local
|
||||
LDAP_PORT=636
|
||||
LDAP_UID=uid
|
||||
LDAP_PASS=zAgQ9T2UEtGF0FRMPxIbg
|
||||
LDAP_VERIFY_SSL=false
|
||||
LDAP_BASE="cn=users,cn=accounts,dc=bildme,dc=local"
|
||||
LDAP_USER_FILTER="(&(objectClass=posixaccount)(memberOf=cn=gitlab,cn=groups,cn=accounts,dc=bildme,dc=local))"
|
||||
LDAP_BIND_DN="uid=uidgitlab,cn=sysaccounts,cn=etc,dc=bildme,dc=local"
|
||||
```
|
||||
|
||||
# Migrate users from AD
|
||||
|
||||
1. https://github.com/akeske/AD-to-FreeIPA-user-migration/blob/master/ad2ipa.py
|
||||
|
||||
# Freeipa behind ssl-proxy
|
||||
|
||||
1. https://www.adelton.com/freeipa/freeipa-behind-proxy-with-different-name
|
||||
130
ipa-ctl.sh
Executable file
130
ipa-ctl.sh
Executable file
@@ -0,0 +1,130 @@
|
||||
#!/usr/bin/env bash
|
||||
ssleval=true
|
||||
prefix=ldaps
|
||||
passeval() { [ -z $bindpass ] && passeval="UNSET!" || passeval="SET!"; }
|
||||
ssleval() { [ "$prefix" == "ldaps" ] && ssleval="true" || ssleval="false"; }
|
||||
actionseval() { [ "$ldapserver" ] && [ "$binduser" ] && [ "$domain" ] && [ "$passeval" == "SET!" ] && actionseval="ready" || actionseval="conditions not yet met" && return 1; }
|
||||
|
||||
menu() {
|
||||
passeval
|
||||
ssleval
|
||||
actionseval
|
||||
clear
|
||||
echo "\
|
||||
### FreeIPA - System Account Manager ###
|
||||
1.) ldapserver=$ldapserver
|
||||
2.) domain=$domain (ldapdomain=$ldapdomain)
|
||||
3.) binduser=$binduser
|
||||
4.) bindpass=$passeval
|
||||
5.) ssl=$ssleval
|
||||
|
||||
Actions ($actionseval):
|
||||
add | rm | ls | info | passwd
|
||||
|
||||
--- Results ---
|
||||
$results
|
||||
--- End Results ---
|
||||
"
|
||||
}
|
||||
|
||||
domain2ldapdomain() {
|
||||
echo "${1}" | awk -F'.' '{for(i=1;i<=NF;i++) printf "dc="$i","; print ""}' | sed 's/,$//'
|
||||
}
|
||||
|
||||
dotask() {
|
||||
case $1 in
|
||||
# Setup
|
||||
1|ldapserver)
|
||||
read -p "ldapserver=" ldapserver
|
||||
[ -z $domain ] && domain=${ldapserver#*.} && ldapdomain=$(domain2ldapdomain "$domain")
|
||||
;;
|
||||
2|domain)
|
||||
read -p "domain=" domain
|
||||
ldapdomain=$(domain2ldapdomain "$domain")
|
||||
#read -p "ldapdomain=" ldapdomain
|
||||
;;
|
||||
3|binduser)
|
||||
[ -z $domain ] && echo "We need the domain first." && dotask domain
|
||||
echo "Enter \"mgr\" for Directory Manager. Otherwise enter the username or full binddn (-D option in ldapsearch)"
|
||||
read -p "binduser=" swap
|
||||
[ "$swap" == "mgr" ] && binduser='cn=Directory Manager' && return
|
||||
echo "$swap" | grep '=' -q && binduser="$swap" || binduser="uid=$swap,cn=users,cn=accounts,$ldapdomain"
|
||||
;;
|
||||
4|bindpass)
|
||||
read -sp "Enter password (will not echo): " bindpass
|
||||
;;
|
||||
5|ssl)
|
||||
[ "$prefix" == "ldaps" ] && prefix=ldap || prefix=ldaps
|
||||
;;
|
||||
|
||||
# Actions
|
||||
# poc)
|
||||
# results=$(ldapsearch "$prefix""://""$ldapserver" -b "$ldapdomain" -D "$binduser" -w "$bindpass")
|
||||
# ;;
|
||||
ls)
|
||||
results=$(ldapsearch -H "$prefix""://""$ldapserver" -b "cn=sysaccounts,cn=etc,$ldapdomain" -D "$binduser" -w "$bindpass" "(uid=*)" "dn" | grep 'dn: uid')
|
||||
;;
|
||||
info)
|
||||
[ "$2" ] && local uid="$2" || uid="*"
|
||||
results=$(ldapsearch -H "$prefix""://""$ldapserver" -b "cn=sysaccounts,cn=etc,$ldapdomain" -D "$binduser" -w "$bindpass" "(uid=$uid)" "uid" "memberOf" "passwordExpirationTime")
|
||||
;;
|
||||
add)
|
||||
local uid password
|
||||
[ "$2" ] && local uid="$2" || read -p "uid of new user=" uid
|
||||
read -sp "password of new user (blank to generate a password)=" password
|
||||
[ -z "$password" ] && password=$(randpw) && echo && echo "Generated password: $password"
|
||||
echo
|
||||
read -p "password expiration date YYYYMMDD (blank for 20380119)=" expire
|
||||
[ -z "$expire" ] && expire=20380119
|
||||
echo -E "\
|
||||
dn: uid=$uid,cn=sysaccounts,cn=etc,$ldapdomain
|
||||
changetype: add
|
||||
objectclass: account
|
||||
objectclass: simplesecurityobject
|
||||
uid: $uid
|
||||
userPassword: $password
|
||||
passwordExpirationTime: ${expire}031407Z
|
||||
nsIdleTimeout: 0" | ldapmodify -H "$prefix""://""$ldapserver" -D "$binduser" -w "$bindpass" && results="Submitted." || results="Error."
|
||||
;;
|
||||
rm)
|
||||
local uid
|
||||
[ "$2" ] && local uid="$2" || read -p "uid of user to remove=" uid
|
||||
echo -E "\
|
||||
dn: uid=$uid,cn=sysaccounts,cn=etc,$ldapdomain
|
||||
changetype: delete" | ldapmodify -H "$prefix""://""$ldapserver" -D "$binduser" -w "$bindpass" && results="Submitted." || results="Error."
|
||||
;;
|
||||
passwd)
|
||||
local uid password
|
||||
[ "$2" ] && local uid="$2" || read -p "uid of user=" uid
|
||||
read -sp "new password for user (blank to generate a password)=" password
|
||||
[ -z "$password" ] && password=$(randpw) && echo && echo "Generated password: $password"
|
||||
echo
|
||||
read -p "password expiration date YYYYMMDD (blank for 20380119)=" expire
|
||||
[ -z "$expire" ] && expire=20380119
|
||||
echo -E "\
|
||||
dn: uid=$uid,cn=sysaccounts,cn=etc,$ldapdomain
|
||||
changetype: modify
|
||||
replace: userPassword
|
||||
userPassword: $password
|
||||
-
|
||||
replace: passwordExpirationTime
|
||||
passwordExpirationTime: ${expire}031407Z" | ldapmodify -H "$prefix""://""$ldapserver" -D "$binduser" -w "$bindpass" && results="Submitted." || results="Error."
|
||||
;;
|
||||
exit)
|
||||
exit
|
||||
;;
|
||||
"")
|
||||
results=""
|
||||
;;
|
||||
*)
|
||||
results="\"$input\" command not found."
|
||||
esac
|
||||
}
|
||||
|
||||
prompt() { read -p '> ' input; dotask $input; }
|
||||
randpw() { < /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-20};echo;}
|
||||
|
||||
while :; do
|
||||
menu
|
||||
prompt
|
||||
done
|
||||
18
letsencrypt/ipa-httpd.cnf
Normal file
18
letsencrypt/ipa-httpd.cnf
Normal file
@@ -0,0 +1,18 @@
|
||||
# the fully qualified server (or service) name
|
||||
FQDN = id1.storedme.com
|
||||
ALTNAMES = DNS:$FQDN
|
||||
|
||||
# --- no modifications required below ---
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_md = sha256
|
||||
prompt = no
|
||||
encrypt_key = no
|
||||
distinguished_name = dn
|
||||
req_extensions = req_ext
|
||||
|
||||
[ dn ]
|
||||
CN = $FQDN
|
||||
|
||||
[ req_ext ]
|
||||
subjectAltName = $ALTNAMES
|
||||
44
letsencrypt/renew-le.sh
Executable file
44
letsencrypt/renew-le.sh
Executable file
@@ -0,0 +1,44 @@
|
||||
#!/usr/bin/bash
|
||||
set -o nounset
|
||||
|
||||
WORKDIR=$(dirname "$(realpath $0)")
|
||||
EMAIL="mail@mail.ru"
|
||||
|
||||
### cron
|
||||
# check that the cert will last at least 2 days from now to prevent too frequent renewal
|
||||
# comment out this line for the first run
|
||||
if [ "${1:-renew}" != "--first-time" ]
|
||||
then
|
||||
start_timestamp=`date +%s --date="$(openssl x509 -startdate -noout -in /var/lib/ipa/certs/httpd.crt | cut -d= -f2)"`
|
||||
now_timestamp=`date +%s`
|
||||
let diff=($now_timestamp-$start_timestamp)/86400
|
||||
if [ "$diff" -lt "2" ]; then
|
||||
echo "Certificate is actuality"
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
cd "$WORKDIR"
|
||||
# cert renewal is needed if we reached this line
|
||||
|
||||
# cleanup
|
||||
rm -f "$WORKDIR"/*.pem
|
||||
rm -f "$WORKDIR"/httpd-csr.*
|
||||
|
||||
# generate CSR
|
||||
OPENSSL_PASSWD_FILE="/var/lib/ipa/passwds/$HOSTNAME-443-RSA"
|
||||
[ -f "$OPENSSL_PASSWD_FILE" ] && OPENSSL_EXTRA_ARGS="-passin file:$OPENSSL_PASSWD_FILE" || OPENSSL_EXTRA_ARGS=""
|
||||
openssl req -new -sha256 -config "$WORKDIR/ipa-httpd.cnf" -key /var/lib/ipa/private/httpd.key -out "$WORKDIR/httpd-csr.der" $OPENSSL_EXTRA_ARGS
|
||||
|
||||
# httpd process prevents letsencrypt from working, stop it
|
||||
service httpd stop
|
||||
|
||||
# get a new cert
|
||||
letsencrypt certonly --standalone --csr "$WORKDIR/httpd-csr.der" --email "$EMAIL" --agree-tos
|
||||
|
||||
# replace the cert
|
||||
cp /var/lib/ipa/certs/httpd.crt /var/lib/ipa/certs/httpd.crt.bkp
|
||||
mv -f "$WORKDIR/0000_cert.pem" /var/lib/ipa/certs/httpd.crt
|
||||
restorecon -v /var/lib/ipa/certs/httpd.crt
|
||||
|
||||
# start httpd with the new cert
|
||||
service httpd start
|
||||
31
letsencrypt/setup-le.sh
Executable file
31
letsencrypt/setup-le.sh
Executable file
@@ -0,0 +1,31 @@
|
||||
#!/usr/bin/bash
|
||||
set -o nounset -o errexit
|
||||
|
||||
FQDN=$(hostname -f)
|
||||
WORKDIR=$(dirname "$(realpath $0)")
|
||||
CERTS=("isrgrootx1.pem" "isrg-root-x2.pem" "lets-encrypt-r3.pem" "lets-encrypt-e1.pem" "lets-encrypt-r4.pem" "lets-encrypt-e2.pem")
|
||||
|
||||
sed -i "s/server.example.test/$FQDN/g" $WORKDIR/ipa-httpd.cnf
|
||||
|
||||
dnf install letsencrypt -y
|
||||
|
||||
if [ ! -d "/etc/ssl/$FQDN" ]
|
||||
then
|
||||
mkdir -p "/etc/ssl/$FQDN"
|
||||
fi
|
||||
|
||||
for CERT in "${CERTS[@]}"
|
||||
do
|
||||
if command -v wget &> /dev/null
|
||||
then
|
||||
wget -O "/etc/ssl/$FQDN/$CERT" "https://letsencrypt.org/certs/$CERT"
|
||||
elif command -v curl &> /dev/null
|
||||
then
|
||||
curl -o "/etc/ssl/$FQDN/$CERT" "https://letsencrypt.org/certs/$CERT"
|
||||
fi
|
||||
ipa-cacert-manage install "/etc/ssl/$FQDN/$CERT"
|
||||
done
|
||||
|
||||
ipa-certupdate
|
||||
|
||||
"$WORKDIR/renew-le.sh" --first-time
|
||||
Reference in New Issue
Block a user