freeIPA客户端安装

最新推荐文章于 2024-08-06 21:09:16 发布

CCH2024

最新推荐文章于 2024-08-06 21:09:16 发布

阅读量499

点赞数

分类专栏： Linux freeIPA 文章标签：运维

本文链接：https://blog.csdn.net/chang_chunhua/article/details/130075865

版权

Linux 同时被 2 个专栏收录

63 篇文章

订阅专栏

freeIPA

1 篇文章

订阅专栏

文章描述了一台主机在尝试加入IPA(DNS和身份认证服务)域的过程中遇到的问题。首先，系统被更新，主机名被设置，然后编辑了/etc/hosts和resolv.conf文件。接着，ipa-client安装并尝试加入IPA服务器，但因主机已注册而失败。使用--force-join选项重试后，客户端成功加入域，但DNS记录更新出现问题。最后，验证用户登录功能是否正常。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1、更新系统：

yum update -y

2、设置主机名：

hostnamectl set-hostname client01.esit.lab

3、编辑/etc/hosts文件：

192.168.17.105 ipaserver.esit.lab
192.168.17.125 client01.esit.lab

4、安装ipa-client:

yum install -y ipa-client

5、编辑resolv.conf文件：

vim /etc/resolv.conf

nameserver 192.168.17.105

6、ipa-client-install

[root@client01 ~]# ipa-client-install
Discovery was successful!
Client hostname: client01.esit.lab
Realm: ESIT.LAB
DNS Domain: esit.lab
IPA Server: ipaserver.esit.lab
BaseDN: dc=esit,dc=lab

Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Unable to sync time with NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
User authorized to enroll computers: admin
Password for admin@ESIT.LAB:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=ESIT.LAB
    Issuer:      CN=Certificate Authority,O=ESIT.LAB
    Valid From:  2023-04-10 23:20:09
    Valid Until: 2043-04-10 23:20:09

Joining realm failed: Host is already joined.

Use --force-join option to override the host entry on the server and force client enrollment.
Installation failed. Rolling back changes.
Unconfigured automount client failed: Command '/usr/sbin/ipa-client-automount --uninstall --debug' returned non-zero exit status 1
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

看到错误提示信息：说主机已经joined了。需要使用--force-join 选项去覆盖主机entry。

然后重新执行命令：

[root@client01 ~]# ipa-client-install --force-join
Discovery was successful!
Client hostname: client01.esit.lab
Realm: ESIT.LAB
DNS Domain: esit.lab
IPA Server: ipaserver.esit.lab
BaseDN: dc=esit,dc=lab

Continue to configure the system with these values? [no]: yes
Synchronizing time with KDC...
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Attempting to sync time using ntpd.  Will timeout after 15 seconds
Unable to sync time with NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.
User authorized to enroll computers: admin
Password for admin@ESIT.LAB:
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=ESIT.LAB
    Issuer:      CN=Certificate Authority,O=ESIT.LAB
    Valid From:  2023-04-10 23:20:09
    Valid Until: 2043-04-10 23:20:09

Enrolled in IPA realm ESIT.LAB
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm ESIT.LAB
trying https://ipaserver.esit.lab/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://ipaserver.esit.lab/ipa/json'
trying https://ipaserver.esit.lab/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://ipaserver.esit.lab/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://ipaserver.esit.lab/ipa/session/json'
Systemwide CA database updated.
Hostname (client01.esit.lab) does not have A/AAAA record.
Failed to update DNS records.
Missing A/AAAA record(s) for host client01.esit.lab: 192.168.17.125.
Missing reverse record(s) for address(es): 192.168.17.125.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://ipaserver.esit.lab/ipa/session/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring esit.lab as NIS domain.
Client configuration complete.
The ipa-client-install command was successful

最后显示客户端安装成功。