如何在 RHEL 8 上安装 FreeIPA 服务器
FreeIPA
![](/data/attachment/album/202305/05/160246m3vu7phhy7eyuo7j.png)


你是否正在寻找有关如何在 Linux 上安装 FreeIPA 服务器的简单指南？


此页面上的分步指南将展示如何在 RHEL 8、Rocky Linux 8 和 AlmaLinux 8 上安装 FreeIPA 服务器。


[FreeIPA](https://www.freeipa.org/page/Main_Page) 是一个自由开源的基于 Linux 系统的集中式身份和访问管理工具，它是 Red Hat 身份管理器的上游项目。使用 FreeIPA，我们可以轻松地管理集中式身份验证以及帐户管理、策略（基于主机的访问控制）和审计。


FreeIPA 基于以下开源项目：


* LDAP 服务器 – 基于 389 项目
* KDC – 基于 MIT Kerberos 实现
* 基于 Dogtag 项目的 PKI
* 用于活动目录集成的 Samba 库
* 基于 BIND 和 Bind-DynDB-LDAP 插件的 DNS 服务器
* NTP


### 先决条件


* 预装 RHEL 8 或 Rocky Linux 8 或 AlmaLinux 8
* 具有管理员权限的 Sudo 用户
* 内存 = 2 GB
* CPU = 2 个 vCPU
* 磁盘 = 根目录有 12GB 可用空间
* 互联网连接


### FreeIPA 的实验室详细信息


* IP 地址 = 192.168.1.102
* Hostanme = ipa.linuxtechi.lan
* 操作系统：RHEL 8 或 Rocky Linux 8 或 AlmaLinux 8


事不宜迟，让我们深入了解 FreeIPA 安装步骤。


### 1、设置主机名并安装更新


打开服务器的终端并使用 `hostnamectl` 命令设置主机名：



```
$ sudo hostnamectl set-hostname "ipa.linuxtechi.lan"
$ exec bash

```

使用 `yum`/`dnf` 命令安装更新，然后重新启动：



```
$ sudo dnf update -y
$ sudo reboot

```

### 2、更新主机文件并将 SELinux 设置为许可


运行以下 `tee` 命令更新 `/etc/hosts` 文件，根据你的设置替换 IP 地址和主机名。



```
$ echo -e "192.168.1.102\tipa.linuxtechi.lan\t ipa" | sudo tee -a /etc/hosts

```

将 SELinux 设置为许可，运行以下命令：



```
$ sudo setenforce 0
$ sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config
$ getenforce
Permissive

```

### 3、安装 FreeIPA 及其组件


Appstream 包仓库中提供了 FreeIPA 包及其依赖项。由于我们计划安装集成 DNS 的 FreeIPA，因此我们还将安装 `ipa-server-dns` 和 `bind-dyndb-ldap`。


运行以下命令安装 FreeIPA 及其依赖项：



```
$ sudo dnf -y install @idm:DL1
$ sudo dnf install freeipa-server ipa-server-dns bind-dyndb-ldap -y

```

### 4、开始安装 FreeIPA


成功安装 FreeIPA 包及其依赖项后，使用以下命令启动 FreeIPA 安装设置。


它将提示几件事，例如配置集成 DNS、主机名、域名和领域名。



```
$ sudo ipa-server-install

```

上述命令的输出如下所示：


![](/data/attachment/album/202305/05/160518qihozk3cio397ssg.jpg)


![](/data/attachment/album/202305/05/160525s20i0nyzhi7sae78.jpg)


在上面的窗口中输入 “yes” 后，需要一些时间来配置你的 FreeIPA 服务器，设置成功后，我们将得到下面的输出：


![](/data/attachment/album/202305/05/160532czv95zvwavaki3ts.jpg)


以上输出确认 FreeIPA 已成功安装。


### 5、在防火墙中允许 FreeIPA 端口


如果正在你的服务器上运行系统防火墙，那么运行如下 `firewall-cmd` 命令以允许 FreeIPA 端口：



```
$ sudo firewall-cmd --add-service={http,https,dns,ntp,freeipa-ldap,freeipa-ldaps} --permanent
$ sudo firewall-cmd --reload

```

### 6、访问 FreeIPA 管理门户


执行下面的 `ipactl` 命令查看 FreeIPA 的所有服务是否都在运行：



```
$ ipactl status
You must be root to run ipactl.
$ sudo ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
$

```

让我们使用 `kinit` 命令验证管理员用户是否会通过 Kerberos 获取令牌，使用我们在 FreeIPA 安装期间提供的相同管理员用户密码。



```
$ kinit admin
$ klist

```

以上命令的输出：


![](/data/attachment/album/202305/05/160543zzifmnusfsl05uqh.jpg)


完美，上面的输出确认管理员获得了令牌。现在，尝试访问 FreeIPA Web 控制台，在网络浏览器上输入以下 URL：



```
https://ipa.linuxtechi.lan/ipa/ui

```

或者



```
https://<Server-IPAddress>/ipa/ui

```

使用我们在安装过程中指定的用户名 `admin` 和密码。


![](/data/attachment/album/202305/05/160553qnz0ibslqstmhhzr.jpg)


对于 FreeIPA Web 控制台，使用自签名 SSL 证书，这就是我们看到此窗口的原因，因此单击“<ruby> 接受风险并继续 <rt>  Accept the Risk and Continue </rt></ruby>”。


![](/data/attachment/album/202305/05/160601j4kltzoofyftfbl0.jpg)


输入凭据后，单击“<ruby> 登录 <rt>  Log in </rt></ruby>”。


![](/data/attachment/album/202305/05/160610bj3luggvg377gnhg.jpg)


这证实我们已在 RHEL 8/Rocky Linux 8 / AlmaLinux8 上成功设置 FreeIPA。


这就是全部，我希望你觉得它提供了很多信息。请在下面的评论部分中发表你的疑问和反馈。


*（题图：MJ/9df57ea0-b5a0-48f9-a323-853a28ca6162）*




---


via: <https://www.linuxtechi.com/install-freeipa-rhel-rocky-almalinux/>


作者：[Pradeep Kumar](https://www.linuxtechi.com/author/pradeep/) 选题：[lkxed](https://github.com/lkxed/) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Are you looking for an easy guide on how to install FreeIPA server on Linux ?

The step-by-step guide on this page will show how to install FreeIPA server on RHEL 8 , Rocky Linux 8 and AlmaLinux 8.

[FreeIPA ](https://www.freeipa.org/page/Main_Page)is a free and open source centralized identity and access management tool for Linux-based systems, it is the upstream project for Red Hat identity manager. Using FreeIPA, we can easily manage centralized authentication along with account management, policy (host-based access control) and audit.

FreeIPA is based on the following Open Source projects,

- LDAP Server – based on the 389 project
- KDC – based on MIT Kerberos implementation
- PKI based on Dogtag project
- Samba libraries for Active Directory integration
- DNS Server based on BIND and the Bind-DynDB-LDAP plugin
- NTP

#### Prerequisites

- Pre Installed RHEL 8 or Rocky Linux 8 or AlmaLinux 8
- Sudo User with admin rights
- RAM = 2 GB
- CPU =2 vCPU
- Disk = 12 GB free space on /
- Internet connectivity

#### Lab Details for FreeIPA

- IP Address = 192.168.1.102
- Hostanme = ipa.linuxtechi.lan
- OS: RHEL 8 or Rocky Linux 8 or AlmaLinux 8

Without further ado, let’s deep dive into FreeIPA installation steps,

## 1) Set Hostname and Install Updates

Open the terminal of your server and set the hostname using [hostnamectl](https://www.linuxtechi.com/change-hostname-rhel-centos/) command,

$ sudo hostnamectl set-hostname "ipa.linuxtechi.lan" $ exec bash

Install updates using yum/dnf command and then reboot it

$ sudo dnf update -y $ sudo reboot

## 2) Update the hosts file & Set SELinux as Permissive


Run the below [tee command](https://www.linuxtechi.com/tee-command-examples-in-linux/) to update /etc/hosts file, replace the ip address and hostname as per your setup.

$ echo -e "192.168.1.102\tipa.linuxtechi.lan\t ipa" | sudo tee -a /etc/hosts

Set the selinux as permissive, run following commands,

$ sudo setenforce 0 $ sudo sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config ]$ getenforce Permissive $

## 3) Install FreeIPA and its Components


FreeIPA packages and its dependencies are available in the Appstream package repositories. As we are planning to install integrated DNS of FreeIPA, so we will also install “ipa-server-dns & bind-dyndb-ldap”

Run the below command to install FreeIPA and its dependencies

$ sudo dnf -y install @idm:DL1 $ sudo dnf install freeipa-server ipa-server-dns bind-dyndb-ldap -y

## 4) Start FreeIPA Installation


Once FreeIPA package and it’s dependencies are installed successfully then use the below command to start the freeipa installation setup,

It will prompt couple of things like to configure Integrated DNS, Host name, Domain Name and Realm Name.

$ sudo ipa-server-install

Output of above command would be something like below

After pressing yes in above window, it will take some time to configure your FreeIPA server and once it has been setup successfully then we will get output something like below,

Above output confirms that FreeIPA has been installed successfully.

## 5) Allow FreeIPA ports in Firewall

In case OS firewall is running on your server then run beneath firewall-cmd commands to allow FreeIPA ports,

$ sudo firewall-cmd --add-service={http,https,dns,ntp,freeipa-ldap,freeipa-ldaps} --permanent $ sudo firewall-cmd --reload

## 6) Access FreeIPA admin portal

Execute the below ipactl command to check whether all services of FreeIPA are running or not

[sysops@ipa ~]$ ipactl status You must be root to run ipactl. [sysops@ipa ~]$ sudo ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [sysops@ipa ~]$

Let’s verify whether admin user will get token via Kerberos using the kinit command, use the same password of admin user that we supplied during FreeIPA installation.

$ kinit admin $ klist

Output of above commands,

Perfect, output above confirms that admin gets the token. Now, try to access FreeIPA Web Console, type following url on web browser,

https://ipa.linuxtechi.lan/ipa/ui

or

https://<Server-IPAddress>/ipa/ui

Use the user name as admin and the password that we specify during the installation.

For FreeIPA web console, self-signed ssl certificates are used that’s why we got this window, so click on “Accept the Risk and Continue”

After entering the credentials, click on ‘Log in‘

This confirms that we have successfully setup FreeIPA on RHEL 8/Rocky Linux 8 / AlmaLinux8.

That’s all from this, I hope you have found it informative. Kindly do post your queries and feedback in below comments section.

Read Also : [How to Install FreeIPA Client on RHEL | Rocky Linux | AlmaLinux](https://www.linuxtechi.com/install-freeipa-client-on-rhel-rockylinux-almalinux/)

yunusThanks for correct steps

GauravNot able to access the web UI, FreeIPA is installed successfully. error “DNS_PROBE_FINISHED_NXDOMAIN”

BobHello Gauray. Do you solve it .I found the same problem

Gaurav AgnihoriDo you have DNS setup? If not add in the /etc/hosts file like- 10.103.x.x ipa.linuxtechi.lan

DaveThanks for this,it really helped me a lot.

Is there a way this can be installed on a system with no internet connection. All i have is a Basic Server with a GUI. Can this be done and if so how?

Thanks

JohnDave,

Ultimately the answer is “no”. The free-ipa package has a LOT of dependencies (~250) that you would need to download and make available to your target system.

For me, the solution was to create a CentOS repository on a machine connected to the Internet, move it to my closed network, and install my Identity Manager from this repository.

I also have a requirement to install CentOS Identity Manager clients from the repository, so the solution works for me.

AamirCreate a local yum repos! Copy all the packages or mount iso staright and point your local repos to that mount point. It will be achievable. As admin mention ipa does need packages/dependencies so local repos would be perfect solution if you don’t have internet connection!

Ajad Kumar GautamThis is good article, Thank you so much for writing step by step article

AnilCan we setup FreeIPA on CentOS 8.2 also?

Mac T Mohanshowing this error

ipa.ipapython.install.cli.install_tool(Server): ERROR Integrated DNS requires ‘ipa-server-dns’ package

Bobcan i use ipa on centos 7 as a website hosting server for my own websites? i ask because it doesn’t really mention anything about being a hosting server and i have been 3 years trying to turn my home desktop into a private website server for my wife and i.

ArvindDear Support Team,

I am unable to start httpd service of freeipa .how to resolved it.

Sivai am getting below error, please advise, where do i need to check this DNS entry ?

Checking DNS domain byuprod.cxos.tech., please wait …

DNS zone byuprod.cxos.tech. already exists in DNS and is handled by server(s): [‘ns-1536.awsdns-00.co.uk.’, ‘ns-512.awsdns-00.net.’, ‘ns-0.awsdns-00.com.’, ‘ns-1024.awsdns-00.org.’]

The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information