环境
主机名 | IP | os |
---|---|---|
dc01.demo.com | 192.168.33.6 | centos6 |
ipa.demo.com | 192.168.33.10 | win2008r2 |
-
IPA server IP address: 192.168.33.10
-
IPA server hostname: admin
-
IPA domain: ipa.demo.com
-
IPA NetBIOS: IPA
-
IPA Kerberos realm IPA.DEMO.COM
-
AD DC IP address: 192.168.33.6
-
AD DC hostname: admin
-
AD domain: ad.demi.com
-
AD NetBIOS: AD
#AD的安装与配置 角色-->添加域控制器 cmd--> dcpromo 根据提示安装即可 ###配置dns
dnscmd 127.0.0.1 /ZoneAdd ipa.demo.com /Forwarder 192.168.33.10
FreeIPA 安装与配置
安装软件包
yum install -y "*ipa-server" "*ipa-server-trust-ad" bind bind-dyndb-ldap samba4-winbind-clients
配置主机名
echo "192.168.33.10 admin.ipa.demo.com admin" >> /etc/hosts
hostname admin.ipa.demo.com
hostname --fqdn
配置Freeipa
ipa-server-install -a password -p password --domain=ipa.demo.com --realm=IPA.DEMO.COM --setup-dns --no-forwarders -U
配置adtrust
ipa-adtrust-install --netbios-name=IPA -a password
配置dns
ipa dnszone-add ad.demo.com --name-server=admin.ad.demo.com --admin-email='hostmaster@ad.demo.com' --force --forwarder=192.168.33.6 --forward-policy=only --ip-address=192.168.33.6
配置信任
ipa trust-add --type=ad ad.demo.com --admin Administrator --password --base-id=1155300028
映射AD用户至FreeIPA
ipa group-add --desc='ad_domain admins external map' ad_admins_external --external
ipa group-add --desc='ad_domain admins' ad_admins
ipa group-add-member ad_admins --groups ad_admins_external
ipa group-add-member ad_admins_external --external 'AD\Domain Admins'
|参考: https://www.freeipa.org/page/Active_Directory_trust_setup