如何在 Ubuntu 22.04 / 20.04 上配置 FreeIPA 客户端
FreeIPA
![](/data/attachment/album/202305/27/154923gzbqexm0b1japa62.jpg)


FreeIPA 是一个强大的开源身份管理系统，提供集中的身份验证、授权和计费服务。在本文中，我们将逐步介绍在 Ubuntu 22.04 / 20.04 上配置 FreeIPA 客户端的步骤。配置 FreeIPA 客户端后，我们将尝试使用在 FreeIPA 服务器上创建的用户登录。


在我们之前的帖子中，我们已经讨论了 FreeIPA 服务器在 RHEL8/Rokcy Linux 8/ AlmaLinux 8 上的安装步骤。


### 在 FreeIPA 服务器上创建用户进行集中认证


登录到你的 FreeIPA 服务器并创建一个名为 `sysadm` 的用户，运行以下命令:



```
$ sudo kinit admin
Password for admin@LINUXTECHI.LAN:
$
$ sudo ipa config-mod --defaultshell=/bin/bash
$ sudo ipa user-add sysadm --first=System --last=Admin --password
Password:
Enter Password again to verify:
-------------------
Added user "sysadm"
-------------------
User login: sysadm
First name: System
Last name: Admin
Full name: System Admin
Display name: System Admin
Initials: SA
Home directory: /home/sysadm
GECOS: System Admin
Login shell: /bin/bash
Principal name: sysadm@LINUXTECHI.LAN
Principal alias: sysadm@LINUXTECHI.LAN
User password expiration: 20230415073041Z
Email address: sysadm@linuxtechi.lan
UID: 464600003
GID: 464600003
Password: True
Member of groups: ipausers
Kerberos keys available: True
$

```

第一个命令是获取 Kerberos 凭证，第二个命令将所有用户的默认登录 shell 设置为 `/bin/bash`，第三个命令用于创建名为 `sysadm` 的用户。


### 在 Ubuntu 22.04 /20.04 上配置 FreeIPA 客户端的步骤


执行以下步骤来配置 FreeIPA 客户端以进行集中身份验证。


#### 1、在 FreeIPA 服务器上添加 Ubuntu 系统的 DNS 记录


登录到你的 FreeIPA 服务器并运行以下命令为 FreeIPA 客户端（即 Ubuntu 22.04/20.04）添加 DNS 记录：



```
$ sudo ipa dnsrecord-add linuxtechi.lan app01.linuxtechi.lan --a-rec 192.168.1.106
  Record name: app01.linuxtechi.lan
  A record: 192.168.1.106
$

```

在上面的命令中，`app01.linuxtechi.lan` 是我的 Ubuntu 系统，IP 地址为 `192.168.1.106`。


注意：确保你的 FreeIPA 服务器和客户端处于同一时区并从 NTP 服务器获取时间。


#### 2、安装 FreeIPA 客户端包


从你的 Ubuntu 系统运行以下命令以安装 `freeipa-client` 以及依赖项：



```
$ sudo apt install freeipa-client oddjob-mkhomedir -y

```

在安装 `freeipa-client` 时，我们将看到以下页面，选择确定并回车。


![](/data/attachment/album/202305/27/155107wu8ryfry3fuu3b38.jpg)


在下一个屏幕中，按回车键跳过。


![](/data/attachment/album/202305/27/155116e6lrwpv6wgtwtgpv.jpg)


#### 3、在主机文件中添加 FreeIPA 服务器 IP 和主机名


在 `/etc/hosts` 文件中添加以下 FreeIPA 服务器条目：



```
$ echo "192.168.1.102 ipa.linuxtechi.lan ipa" | sudo tee -a /etc/hosts
$ echo "192.168.1.106 app01.linuxtechi.lan app01" | sudo tee -a /etc/hosts

```

更改适合你的设置的 IP 地址和主机名。


#### 4、使用 ipa-client-install 配置 FreeIPA 客户端


现在运行以下 `ipa-client-install` 命令在你的 Ubuntu 系统上配置 FreeIPA 客户端：



```
$ sudo ipa-client-install --hostname=`hostname -f` --mkhomedir --server=ipa.linuxtechi.lan --domain linuxtechi.lan --realm LINUXTECHI.LAN

```

更改适合你设置的 FreeIPA 服务器地址、域名和领域。


上述命令的输出如下所示：


![](/data/attachment/album/202305/27/155126r926ehhf8etbbehh.jpg)


完美，上面的输出确认 FreeIPA 客户端安装成功。


现在允许在用户首次使用 FreeIPA 服务器进行身份验证时自动创建用户的主目录。


在文件 `/usr/share/pam-configs/mkhomedir` 中添加以下行：



```
required pam_mkhomedir.so umask=0022 skel=/etc/skel

```


```
$ echo "required pam_mkhomedir.so umask=0022 skel=/etc/skel" | sudo tee -a /usr/share/pam-configs/mkhomedir

```

要使上述更改生效，请运行以下命令：



```
$ sudo pam-auth-update

```

![](/data/attachment/album/202305/27/155136i63owiuzi6i6ezg4.jpg)


选择确定，然后按回车键。


#### 5、尝试使用 sysadm 用户登录到你的 Ubuntu 系统


尝试使用 `sysadm` 用户通过 SSH 登录到你的 Ubuntu 系统，



```
$ ssh sysadm@192.168.1.106

```

![](/data/attachment/album/202305/27/155146lklfy5gda0ukzqft.jpg)


正如你在上面看到的，当我们第一次登录时，它说密码已过期。它将提示我们设置新密码并断开会话。


更新密码后，尝试 SSH 登录 Ubuntu 系统，这次我们应该可以登录了。



```
$ ssh sysadm@192.168.1.106

```

输出：


![](/data/attachment/album/202305/27/155154gkssp69h6gqqlsbz.jpg)


太好了，上面的输出确认我们已经使用集中用户成功登录到我们的 Ubuntu 系统。这也说明我们已经成功配置了 FreeIPA 客户端。


如果你想从 ubuntu 系统中卸载 FreeIPA，然后运行以下命令集：



```
$ sudo ipa-client-install --uninstall
$ sudo  rm -rf /var/lib/sss/db/*
$ sudo systemctl restart sssd.service

```

以上就是这篇文章的全部内容，我相信你已经发现它提供了很多信息。请在下面发表你的疑问和反馈。


*（题图：MJ/bd5b7777-f70a-4367-ac78-d026792b855a）*




---


via: <https://www.linuxtechi.com/configure-freeipa-client-on-ubuntu/>


作者：[Pradeep Kumar](https://www.linuxtechi.com/author/pradeep/) 选题：[lkxed](https://github.com/lkxed/) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
FreeIPA is a powerful open-source identity management system that provides centralized authentication, authorization, and accounting services. In this post, we will walk through the steps to configure FreeIPA client on Ubuntu 22.04 / 20.04. After configuring the freeipa client then we will try to login with the user created on FreeIPA server.

In our previous post, we had already discussed FreeIPA Server installation steps on RHEL8/Rokcy Linux 8/ AlmaLinux 8.

Also Read: [How to Install FreeIPA Server on RHEL 8 | Rocky Linux 8 | AlmaLinux 8](https://www.linuxtechi.com/install-freeipa-rhel-rocky-almalinux/)

#### Creating User on FreeIPA Server for Centralization Authentication

Login to your freeipa server and create a user with name “sysadm”, run the following commands

$ sudo kinit admin Password for[[email protected]]: $ $ sudo ipa config-mod --defaultshell=/bin/bash $ sudo ipa user-add sysadm --first=System --last=Admin --password Password: Enter Password again to verify: ------------------- Added user "sysadm" ------------------- User login: sysadm First name: System Last name: Admin Full name: System Admin Display name: System Admin Initials: SA Home directory: /home/sysadm GECOS: System Admin Login shell: /bin/bash Principal name:[[email protected]]Principal alias:[[email protected]]User password expiration: 20230415073041Z Email address:[[email protected]]UID: 464600003 GID: 464600003 Password: True Member of groups: ipausers Kerberos keys available: True $

First command is to get Kerberos credentials and second command to set default login shell for all users as “/bin/bash” and third command used for creating the user with name “sysadm”

## Steps to configure FreeIPA Client on Ubuntu 22.04 /20.04


Perform the following steps to configure FreeIPA client for centralize authentication.

#### 1) Add DNS record of Ubuntu System on FreeIPA Server

Login to your FreeIPA Server and run the beneath command to add dns record for FreeIPA client (i.e Ubuntu 22.04/20.04)

$ sudo ipa dnsrecord-add linuxtechi.lan app01.linuxtechi.lan --a-rec 192.168.1.106 Record name: app01.linuxtechi.lan A record: 192.168.1.106 $

In the above command app01.linuxtechi.lan is my Ubuntu system with IP address 192.168.1.106.

Note: Make sure your FreeIPA Server and Clients are on the same timezone and getting the time from NTP Servers.

#### 2) Install FreeIPA client Package


Run the below command from your Ubuntu system to install freeipa-client along with the dependencies,

$ sudo apt install freeipa-client oddjob-mkhomedir -y

While installing freeipa-client, we will get following screen, Choose OK and hit enter

In the next screen, Hit enter to skip,

#### 3) Add FreeIPA Server IP & hostname in hosts file


Add below entries of your FreeIPA Server in /etc/hosts file

$ echo "192.168.1.102 ipa.linuxtechi.lan ipa" | sudo tee -a /etc/hosts $ echo "192.168.1.106 app01.linuxtechi.lan app01" | sudo tee -a /etc/hosts

Change IP address and hostname that suits to your setup.

#### 4) Configure FreeIPA client using ipa-client-install

Now run following “ipa-client-install” command to configure freeipa-client on your Ubuntu system,

$ sudo ipa-client-install --hostname=`hostname -f` --mkhomedir --server=ipa.linuxtechi.lan --domain linuxtechi.lan --realm LINUXTECHI.LAN

Change the FreeIPA Server address, domain name and realm that suits to your setup.

Output of above command would be something like below :

Perfect, output above confirms that ipa-client installation was successful.

Now allow user’s home directory to be created automatically when they first time authenticated with FreeIPA Server.

Append the following line in the file “/usr/share/pam-configs/mkhomedir”

required pam_mkhomedir.so umask=0022 skel=/etc/skel

$ echo "required pam_mkhomedir.so umask=0022 skel=/etc/skel" | sudo tee -a /usr/share/pam-configs/mkhomedir

To make above changes into affect, run following command

$ sudo pam-auth-update

Select OK and then hit enter.

#### 5) Try to Login to your Ubuntu System with sysadm user


Try to ssh or login to your Ubuntu system using the sysadm user,

$ ssh[[email protected]]

As you can see above, when we first time to login, it says password expired. It will prompt us to set new password and will disconnect the session.

After updating the password, try to ssh ubuntu system and this time we should able to login.

$ ssh[[email protected]]

Output,

Great, output above confirms that we have successfully login to our Ubuntu system using a centralize user. This also shows that we have successfully configured FreeIPA client.

In case, you want to uninstall freeipa from your ubuntu system then run following set of commands,

$ sudo ipa-client-install --uninstall $ sudo rm -rf /var/lib/sss/db/* $ sudo systemctl restart sssd.service

That’s all from this post, I believe you have found it informative. Kindly do post your queries and feedback in below comments section.

Bruce C.Very nice article but is there a command not listed in the article right after “Apply the above changes using following command,”

Pradeep KumarHi Bruce,

Thanks for notifying the missing command, now i have updated the article with correct suggested “pam-auth-update” command.

Myles P.Excellent, thank you for a concise, quality guide.

VysakhI’m encountering an issue with the sudo command in an IPA AD-trust environment. Specifically while logging in with Active Directory (AD) credentials works, the sudo command fails on Ubuntu versions 22.04 and 24.04. This problem does not occur on other Ubuntu flavors, CentOS or Red Hat-based distributions.

$ sudo su

sudo: PAM account management error: Permission denied

sudo: a password is required