Fedora 18 FreeIPA: Identity/ Policy Management Managing Identity and Authorization Policies for Linux-Based Infrastructures Ella Deon Lackey FreeIPA: Identity/Policy Management Fedora 18 FreeIPA: Identity/Policy Management Managing Identity and Authorization Policies for Linux-Based Infrastructures Edition 3.1.5 Author Ella Deon Lackey [email protected] Copyright © 2012 Red Hat. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. The original authors of this document, and Red Hat, designate the Fedora Project as the "Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. For guidelines on the permitted uses of the Fedora trademarks, refer to https://fedoraproject.org/wiki/ Legal:Trademark_guidelines. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Java® is a registered trademark of Oracle and/or its affiliates. XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries. All other trademarks are the property of their respective owners. Identity and policy management — for both users and machines — is a core function for almost any enterprise environment. IPA provides a way to create an identity domain that allows machines to enroll to a domain and immediately access identity information required for single sign-on and authentication services, as well as policy settings that govern authorization and access. This manual covers all aspects of installing, configuring, and managing IPA domains, including both servers and clients. This guide is intended for IT and systems administrators. Preface xi 1. Audience and Purpose ................................................................................................... xi 2. Examples and Formatting ............................................................................................... xi 2.1. Brackets .............................................................................................................. xi 2.2. Client Tool Information ......................................................................................... xi 2.3. Text Formatting and Styles .................................................................................. xii 3. Giving Feedback ............................................................................................................ xii 4. Document Change History ............................................................................................. xiii 1. Introduction to FreeIPA 1 1.1. FreeIPA v. LDAP: A More Focused Type of Service ....................................................... 1 1.1.1. A Working Definition for FreeIPA ........................................................................ 1 1.1.2. Contrasting FreeIPA with a Standard LDAP Directory ........................................... 2 1.2. Bringing Linux Services Together .................................................................................. 3 1.2.1. Authentication: Kerberos KDC ............................................................................ 4 1.2.2. Data Storage: 389 Directory Server .................................................................... 5 1.2.3. Authentication: Dogtag Certificate System ........................................................... 5 1.2.4. Server/Client Discovery: DNS ............................................................................. 5 1.2.5. Management: NTP ............................................................................................ 5 1.3. Relationships Between Servers and Clients ................................................................... 6 1.3.1. About FreeIPA Servers and Replicas .................................................................. 6 1.3.2. About FreeIPA Clients ....................................................................................... 7 2. Installing a FreeIPA Server 11 2.1. Preparing to Install the FreeIPA Server ........................................................................ 11 2.1.1. Hardware Recommendations ............................................................................ 11 2.1.2. Software Requirements .................................................................................... 11 2.1.3. Supported Web Browsers ................................................................................. 11 2.1.4. System Prerequisites ....................................................................................... 12 2.1.5. Networking ...................................................................................................... 14 2.2. Installing the FreeIPA Server Packages ....................................................................... 14 2.3. Creating a FreeIPA Server Instance ............................................................................ 15 2.3.1. About ipa-server-install ..................................................................................... 15 2.3.2. Setting up a FreeIPA Server: Basic Interactive Installation .................................. 17 2.3.3. Examples of Creating the FreeIPA Server ......................................................... 19 2.3.4. Troubleshooting Installation Problems ............................................................... 22 2.4. Setting up FreeIPA Replicas ....................................................................................... 23 2.4.1. Prepping and Installing the Replica Server ........................................................ 23 2.4.2. Creating the Replica ........................................................................................ 24 2.4.3. Troubleshooting Replica Installation .................................................................. 27 2.5. Uninstalling FreeIPA Servers and Replicas .................................................................. 28 2.6. Upgrading from FreeIPA 2.1 to 2.2 .............................................................................. 28 2.6.1. Upgrading Packages ........................................................................................ 28 2.6.2. Removing Browser Configuration for Ticket Delegation (For Upgrading from 6.2) .................................................................................................................................. 29 2.6.3. Testing Before Upgrading the FreeIPA Server (Recommended) ........................... 31 3. Setting up Systems as FreeIPA Clients 33 3.1. What Happens in Client Setup .................................................................................... 33 3.2. Supported Platforms for FreeIPA Clients ...................................................................... 34 3.3. System Ports ............................................................................................................. 34 3.4. Configuring a Fedora System as a FreeIPA Client ........................................................ 35 3.5. Manually Configuring a Linux Client ............................................................................ 38 3.6. Setting up a Linux Client Through Kickstart .................................................................. 43 3.7. Configuring a Microsoft Windows System to Join the FreeIPA Realm ............................. 44 iii FreeIPA: Identity/Policy Management 3.8. Configuring a Solaris System as a FreeIPA Client ........................................................ 45 3.8.1. Configuring Solaris 10 ...................................................................................... 45 3.8.2. Configuring Solaris 9 ....................................................................................... 49 3.9. Configuring an HP-UX System as a FreeIPA Client ...................................................... 50 3.9.1. Configuring NTP .............................................................................................. 50 3.9.2. Configuring LDAP Authentication ...................................................................... 50 3.9.3. Configuring Kerberos ....................................................................................... 52 3.9.4. Configuring PAM .............................................................................................. 53 3.9.5. Configuring SSH .............................................................................................. 55 3.9.6. Configuring Access Control .............................................................................. 56 3.9.7. Testing the Configuration .................................................................................. 57 3.10. Configuring an AIX System as a FreeIPA Client ......................................................... 57 3.10.1.