- So, the easiest way to verify the setup
of this FreeIPA server, very simple.
su - ldapuser2
because we wanna be able to log in on the IPA server.
Well, we can log in on the IPA server.
So, that is one thing.
Of course, there's also LDAP search.
We've seen the LDAP search command before.
It's a nasty command with all the parameters,
and that's why I'm using !ldapse.
And there we can see it repeats
the last LDAP search command.
Now if you would go to another system,
let's check out the Ubuntu system.
Here is the Ubuntu system.
Now on this Ubuntu system,
LDAP search is also going to work.
So from the Ubuntu system,
we can also use the LDAP search command.
And here is the LDAP search command.
Again, I'm making it easy on myself.
Now everything that you need
in the LDAP search command is in the command.
So LDAP is an unsecure LDAP URL to freeipa.example.com.
The base context is DC as example.
DC is local, and sub objectclass is going
to show all the objects right here.
Now setting up a client, as I told you,
that would go beyond the scope of this course
because on IPA you need an IPA setup utility
that's taking care of everything.
But as a generic test that your LDAP server is working,
this LDAP search is doing pretty well.
Okay, even if it doesn't really matter for your LFCS,
I wanna show you how
to easily set up the IPA client software
by using the IPA client utility.
So dnf install ipa-client is what it all starts with.
- y so that we don't have to press Yes.
Alright, so the package is installed.
Before we are going to continue,
there's a couple of things that we need to check.
First, hostnamectl
is showing that my host currently has a name.
However, the host name is set to server4.example.com.
That does matter in an IPA environment.
In an IPA environment,
you need the host name to be part of the same domain.
So I'm using set-hostname
and make that server4
.example
.local.
That's because example.com is a
registered internet domain name.
We can't use that.
So my IP address is 142.
I'm going to put an entry in etc/host
that allows for resolving.
And that should do it.
Then the final thing is also important.
That is the DNS configuration.
IPA has integrated DNS,
and in order to work with the integrated DNS
we should set the name server
to the IPA IP address.
IPA is the DNS name server.
IPA is connected to the DNS hierarchy.
So, that is going to forward everything to the internet.
Now that we have done that,
we can use ipa-client-
install.
Here, like the set of procedure of the IPA server,
it's safe to press Enter on most of the prompts.
On most of the prompts, there's one prompt only.
That's because it has successfully discovered.
If it has not successfully discovered the DNS configuration,
there's multiple prompts.
But here there's one only.
We can see the summary.
And the summary is telling me that it's going to
use the IPA server freeipa.example.local.
And do we want to continue with these settings?
Yes, we do.
So, it has set up time synchronization.
That's an important part because in IPA,
Kerberos tickets are used for authentication.
And they are time based.
So the time should really be the same
on the server as well as on the clients.
And now it's prompting me
for an admin authorized to enroll computers.
In order to work with IPA I need to register this computer
with the IPA server.
And that is why it needs this admin user account.
That is what is happening right now.
And it is extending the IPA server configuration.
And at this moment, it should be good.
How are we testing?
Well, su -
ldap
user2.
And there we can see that I'm currently ldapuser2@server4.
That means that my IPA client is set up successfully.