- So, if you want to set up
centralized authentication in your environment,
you need an LDAP server.
There's a couple of choices. The main choice is IPA.
IPA stands for Identity, Policy, and Authorization.
And FreeIPA is a commonly used LDAP server.
It was developed to offer
a Linux-based alternative for Active Directory.
And it can be installed on many distributions,
or even be started as a container.
Administration of free IPA is done
through the LDAP utilities,
or the specialized IPA command line utility,
or the web interface that it provides.
Now, if you want to use IPA,
then you need to prepare for installation.
It does integrate tightly with DNS.
So, you need to make sure that it is set up with a hostname.
And this is a hostname that should be unique,
unique from a DNS perspective.
So, use hostname CTL to set up the host name,
and then also make sure
that only IPA server you can resolve the hostname.
And, and this is an important one,
make sure that you use a unique DNS name.
Unique DNS name, that means
that you can't use example.com, for instance.
You get a complaint that example.com
is already a registered.
So, use one of the local domains, like example.local,
which is exactly what I'm going to do in the demo.
Let me show you how to set up FreeIPA.
I'm doing this on CentOS.
FreeIPA is easily accessible
from the repositories on Red Hat and family.
So, let me start using hostname CTL,
set hostname, FreeIPA.example.local.
As I told you, don't use dot com, because that won't work.
You'll get a conflict message.
Then we need to set up ETC hosts.
It's a local IP address for this example.local.
(keyboard clicking)
And then you can start the actual installation.
So, that will be DNF install
minus Y IPA server, bind, DYNDB, LDAP,
and IPA server DNS.
Alright.
Now that everything is installed,
we can run the installation program.
That is IPA server install, dash dash, set up DNS.
So, this is going to ask a couple of questions.
And you can even see in the middle of the screen
what exactly it's going to do.
So, it's installing a standalone certificate authority
an NTP client, the directory server, KDC
which is about Kerberos Keys and more.
You don't need to know about it,
but it's cool to see what it is doing.
So next, server hostname. You can just accept the defaults.
As we have just used hostname CTL set hostname,
we have all this information set up correctly.
So, free IPA example.local
which will be the domain, which will be the realm.
Next, we need a password
for the directory manager, as well as for the IPA admin.
These are the two administrative entities
where the admin user is the most important one.
Then it's asking for a DNS forwarder.
This is how it's connecting this IPA server
to the DNS hierarchy.
You normally do want to set
up a DNS forwarder and use a client to pick it.
It picks it up automatically from the resolve.com.
Just use it.
And if there's more forwarders that you would like to use,
you can enter them here.
Normally that's not needed, so just press enter to skip.
Next, it is asking for reversed DNS and that's okay as well.
So just press enter three times
in order to accept all the default settings.
Likewise for the netBIOS domain name, press enter again.
No time synchronization.
And then the, then you see an overview
with all the current settings and there you type "yes",
and then free IPA setup will be started.
Alright, as you can see, setup is complete.
And the next thing that we need to do, we need to make sure
that the ports in the firewall are open.
We'll take care of that in just a little bit.
And then if you want to use the IPA tools,
we need kinit admin.
We'll do that in a while, but not yet.
Also it's telling us, "be sure to back
up the CA certificate stored in /route/cacert.p12",
and these are required to create replica.
That's not something that we are going to do.
So IPA server install commands are successful.
That's what matters now.
To take care of the firewall, let's create a short loop.
Okay, we get a warning that can safely be ignored.
Now we can activate a firewall using firewall
CMD, dash dash reload, right.
That's a good start, time for part two.
Let me show you on the slide what we are
going to do in the second part of this demo.
Here, you can see the steps
that I'm going to perform right now.
We need to create a couple of LDAP users,
and we are going to use the IPA commands to do so.
Now, in IPA, Kerberos is used everywhere.
And in order to get Kerberized access, I need kinit admin.
That's like the login command.
That's prompting for a password,
and here you are entering the secret password
that you have used while installing FreeIPA.
So next I'm using klist.
Klist is a convenient command.
It's showing me all the Kerberos tickets that exist.
And I'm going to use IPA, user add, LDAP user one.
It's opening an interactive interface.
So I need to provide my information to create LDAP user one
and let's also create LDAP user two.
(keyboard clicking)
Now the interactive interface is convenient
if you want to create a couple of users.
If you would like to have more users,
then you should import them using L diff,
the LDAP import format.
That goes beyond what you need to know
about LDAP for the LFCS exam.
So, I want to keep it simple and that is why
I'm also going to show you IPA pass WD LDAP user one,
another interactive command that is prompting
for the password.
And I want to set the password for LDAP user two, as well.
Oops. Typo, apparently.
And there we go. Now the LDAP users are ready.
So the next thing is to use these users.
So, we need to have a look at the LDAP client.
That's what we are going to do in the next video.