FreeIPA

最新推荐文章于 2025-06-13 15:59:03 发布

原创

最新推荐文章于 2025-06-13 15:59:03 发布 · 2k 阅读

7 ·

CC 4.0 BY-SA版权

FreeIPA是一个开源的身份管理系统，适用于Linux/Unix环境，提供类似Active Directory或LDAP的集中式账户管理和身份验证。它集成了389目录服务器、Kerberos、HTTP服务器等组件，实现标识、策略和审计跟踪的一体化安全解决方案。安装FreeIPA需要配置DNS，设置hostname，并安装bind-dyndb-ldap。完成安装后，可以通过Web UI或命令行工具进行管理，包括管理身份识别、策略和审计跟踪。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

FreeIPA是一个用于Linux/Unix环境的开源身份管理系统，它提供集中式帐户管理和身份验证，如Microsoft Active Directory或LDAP。FreeIPA集成389目录服务器、MIT Kerberos、Apache HTTP服务器、NTP、DNS、Dogtag(证书系统)和SSSD，使其成为管理标识、策略和执行审计跟踪的单一集成安全解决方案。FreeIPA支持通过Web UI和命令行工具来执行管理任务，其主要功能包括：
身份识别: (机器、用户、虚拟机、组、身份验证凭据)
策略: (配置设置，访问控制信息)
审计跟踪: (事件、日志、分析)

安装前准备

1，我们安装带有集成DNS的FreeIPA，需确保网络配置文件中的 DNS1=127.0.0.1
vi /etc/resolv.conf
nameserver 127.0.0.1

2，设置hostname
hostnamectl set-hostname ipa.kclouder.local

3，添加hosts条目
echo "192.168.91.132 ipa.kclouder.local ipa" >> /etc/hosts

安装 FreeIPA

1，安装 bind-dyndb-ldap，通过FreeIPA管理集成的DNS
yum install -y ipa-server ipa-server-dns bind-dyndb-ldap
2，启动Bind(DNS)服务，并设置自动启动
systemctl start named
systemctl enable named
3，执行以下命令开始安装FreeIPA
ipa-server-install

[root@ipa ~]# ipa-server-install

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.

This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure the KDC to enable PKINIT

To accept the default shown in brackets, press the Enter key.

Do you want to configure integrated DNS (BIND)? [no]: yes

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.

Server host name [ipa.kclouder.local]: ipa.kclouder.local

Warning: skipping DNS resolution of host ipa.kclouder.local
The domain name has been determined based on the host name.

Please confirm the domain name [kclouder.local]: kclouder.local

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.
Please provide a realm name [KCLOUDER.LOCAL]: KCLOUDER.LOCAL
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password:    <--输入密码（Directory manager password）
Password (confirm):    <--输入密码（Directory manager password）

The IPA server requires an administrative user, named 'admin'.
This user is a regular