如何在 RHEL 8 上安装 FreeIPA 客户端
FreeIPA
![](/data/attachment/album/202305/12/182652jucsshn48zogzs1h.jpg)



> 
> 在本文中，我们将向你展示如何在 RHEL、Rocky Linux 或 AlmaLinux 上安装和配置 FreeIPA 客户端。
> 
> 
> 


为了演示，我们在 RHEL 系统上集成了 [FreeIPA 服务器](/article-15783-1.html)，使用 FreeIPA 进行集中认证。


FreeIPA 服务器是一个开源的身份管理解决方案，为 Linux 系统提供集中的身份验证、授权和帐户信息。


### 先决条件


* 已预装 RHEL 9/8 或 Rocky Linux 9/8 或 AlmaLinux 9/8
* 具有 sudo 权限的普通用户
* RHEL 系统的有效订阅。
* 互联网连接


事不宜迟，让我们深入了解 FreeIPA 客户端安装和配置步骤，


### 1、在 FreeIPA 服务器上创建一个用户


登录到 FreeIPA 服务器并创建一个用户以进行集中身份验证，这里我使用以下命令使用创建了一个用户 `opsadm`：



```
$ sudo kinit admin
$ sudo ipa user-add opsadm --first=Ops --last=Admin --password
Password:
Enter Password again to verify:
-------------------
Added user "opsadm"
-------------------
  User login: opsadm
  First name: Ops
  Last name: Admin
  Full name: Ops Admin
  Display name: Ops Admin
  Initials: OA
  Home directory: /home/opsadm
  GECOS: Ops Admin
  Login shell: /bin/bash
  Principal name: opsadm@LINUXTECHI.LAN
  Principal alias: opsadm@LINUXTECHI.LAN
  User password expiration: 20230502010113Z
  Email address: opsadm@linuxtechi.lan
  UID: 464600004
  GID: 464600004
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
$

```

### 2、为 RHEL、Rocky Linux 或 AlmaLinux 添加 DNS 记录


下一步是为我们想要与 FreeIPA 服务器集成以集中身份验证的机器添加 DNS 记录。在 FreeIPA 服务器上，运行以下命令：



```
$ sudo ipa dnsrecord-add linuxtechi.lan rhel.linuxtechi.lan --a-rec 192.168.1.2

```

注意：在上述命令中**替换**为你自己的 IP 地址和主机名。


![](/data/attachment/album/202305/12/182842ph19hn9rj719rtjr.jpg)


现在登录到 RHEL 客户端并在 `/etc/hosts` 文件中添加以下条目：



```
192.168.1.102 ipa.linuxtechi.lan ipa
192.168.1.2   rhel.linuxtechi.lan rhel

```

保存并退出文件。


### 3、在 RHEL、RockyLinux 和 AlmaLinux 上安装和配置 FreeIPA 客户端


FreeIPA 客户端及其依赖项在默认软件包仓库（AppStream 和 BaseOS）中可用，因此要安装 FreeIPA 客户端，请运行：



```
$ sudo dnf install freeipa-client -y

```

![](/data/attachment/album/202305/12/182851s224j502opco4zuo.jpg)


安装完成后，配置 FreeIPA 客户端，运行以下命令：



```
$ sudo ipa-client-install --hostname=`hostname -f` --mkhomedir --server=ipa.linuxtechi.lan --domain linuxtechi.lan  --realm LINUXTECHI.LAN

```

根据你的设置**替换** FreeIPA 服务器的主机名、域名和领域。


输出：


![](/data/attachment/album/202305/12/182900oh9co9oezvmvionz.jpg)


完美，上面的输出确认 `freeipa-client` 命令已成功执行。要测试 FreeIPA 客户端集成，请从当前用户注销并尝试以我们在 IPA 服务器上创建的 `opsadm` 用户身份登录。


### 4、测试 FreeIPA 客户端


试着在你刚刚配置了 FreeIPA 客户端的 RHEL 系统上使用 `opsadm` 用户通过 SSH 登录。



```
$ ssh opsadm@<IPAddress-RHEL>

```

![](/data/attachment/album/202305/12/182908t3777ej7om42400m.jpg)


当我们第一次登录系统时，由于密码过期政策，它会提示你设置新密码。


修改密码后，再次尝试登录。这次你应该可以登录了。


![](/data/attachment/album/202305/12/182917kggjggjk55g5gj75.jpg)


很好，上面的输出确认我们可以使用 `opsadm` 用户登录。这确认 FreeIPA 客户端安装和配置成功。


以上就是这篇文章的全部内容，希望你发现它提供了丰富的信息，请在下面的评论部分中发表你的疑问和反馈。


*（题图：MJ/583ee400-3bad-4036-a725-f9d2078d69ab）*




---


via: <https://www.linuxtechi.com/install-freeipa-client-on-rhel-rockylinux-almalinux/>


作者：[Pradeep Kumar](https://www.linuxtechi.com/author/pradeep/) 选题：[lkxed](https://github.com/lkxed/) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
In this post, we will show you how to install and configure FreeIPA client on RHEL, Rocky Linux or AlmaLinux.

For the demonstration purpose, we will integrate a RHEL system with FreeIPA server using FreeIPA client for centralize authentication.

FreeIPA server is an open-source identity management solution that provides centralized authentication, authorization, and account information for Linux systems.

#### Prerequisites

- Pre-Installed RHEL-9/8 or Rocky Linux9/8 or AlmaLinux 9/8
- Regular user with sudo rights
- Valid subscription for RHEL system.
- Internet Connectivity

Also Read: [How to Install FreeIPA Server on RHEL 8 | Rocky Linux 8 | AlmaLinux 8](https://www.linuxtechi.com/install-freeipa-rhel-rocky-almalinux/)

Without any delay, let’s deep dive into FreeIPA client installation and configuration steps,

## 1) Create a User on FreeIPA Server

Login to FreeIPA server and create a user for centralize authentication, here I am creating a user with opsadm using following command.

$ sudo kinit admin $ sudo ipa user-add opsadm --first=Ops --last=Admin --password Password: Enter Password again to verify: ------------------- Added user "opsadm" ------------------- User login: opsadm First name: Ops Last name: Admin Full name: Ops Admin Display name: Ops Admin Initials: OA Home directory: /home/opsadm GECOS: Ops Admin Login shell: /bin/bash Principal name:[[email protected]]Principal alias:[[email protected]]User password expiration: 20230502010113Z Email address:[[email protected]]UID: 464600004 GID: 464600004 Password: True Member of groups: ipausers Kerberos keys available: True $

## 2) Add DNS Record for RHEL, Rocky Linux or AlmaLinux

Next step is to add DNS record for machine which we want to integrate with FreeIPA server for centralize authentication. On FreeIPA Server, run following command

$ sudo ipa dnsrecord-add linuxtechi.lan rhel.linuxtechi.lan --a-rec 192.168.1.2

Note: Replace IP address and hostname in above commands that suits to your setup.

Now login to RHEL client and add following entries in /etc/hosts file

192.168.1.102 ipa.linuxtechi.lan ipa 192.168.1.2 rhel.linuxtechi.lan rhel

Save and exit the file.

## 3) Install and configure FreeIPA client on RHEL, RockyLinux & AlmaLinux

FreeIPA client and its dependencies are available in the default package repositories (AppStream and BaseOS), so to install freeipa client, run

$ sudo dnf install freeipa-client -y

After the installation, configure the FreeIPA client, run following command

$ sudo ipa-client-install --hostname=`hostname -f` --mkhomedir --server=ipa.linuxtechi.lan --domain linuxtechi.lan --realm LINUXTECHI.LAN

// Replace freeipa server’s hostname, domain name and realm according to your setup.

Output ,

Perfect, output above confirms that freeipa-client command has been executed successfully. To test the freeipa client integration, logout from the current user and try to login as opsadm user that we had created on IPA server.

## 4) Test FreeIPA Client

Try to ssh the rhel system on which you have just configured FreeIPA client using opsadm user,

$ ssh opsadm@<IPAddress-RHEL>

When we login to the system first time then it will prompt you to set new password because of password expiry policy.

After changing the password, try to login again. This time you should be able to login

$ ssh[[email protected]]

Great, output above confirms that we can login using opsadm user. This confirms that FreeIPA client installation and configuration is successful.

That’s all from this post, I hope you have found it informative, please do post your queries and feedback in below comments section.