Difference between revisions of "Omnios ipa client"

Revision as of 14:29, 1 April 2013

Thanks to Johan Petersson in the freeipa-users mailing list (https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html).

add machine account to IPA domain

add a host to dns and create an machine account for it in the realm. In this example the host we want to join is solaris.example.com, the ipa server (kdc) is ipaserver.example.com. We assign solaris.example.com the ip address 192.168.0.1; run these commands as an admin user (with a kerberos ticket) on a host with the ipa admin tools installed:

<ipa> ipa host-add --force --ip-address=192.168.0.1 solaris.example.com [enter]

ipa host-add-managedby --host ipaserver.example.com solaris.example.com </pre>

export keytab for machine account

just like before, run this as an admin user on host with ipa admin tools:

ipa-getkeytab -s ipaserver.example.com -p host/solaris.example.com -k /tmp/solaris.keytab

Copy this solaris.keytab file to the omnios host to /etc/krb5/krb5.keytab. Apply these permissions to this file:

chown root:sys krb5.keytab
chmod 600 krb5.keytab

configure kerberos on omnios host

Edit /etc/krb5/krb5.conf:

[libdefaults]
        default_realm = EXAMPLE.COM
        verify_ap_req_nofail = false
[realms]
        EXAMPLE.COM = {
                kdc = ipaserver.example.com
                admin_server = ipaserver.example.com

[domain_realm]
        example.com = EXAMPLE.COM
        .example.com = EXAMPLE.COM

configure ntp

Add serverlist to /etc/inet/ntp.client and rename it to ntp.conf:

server ipaserver.example.com iburst

# svcadm enable ntp

To see it is running properly:

# svcs ntp

To see what servers you are using:

# ntpq -p

verify kerberos is working

root@testomnios:~# kinit admin
Password for admin@EXAMPLE.COM: 
root@testomnios:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@EXAMPLE.COM

Valid starting                Expires                Service principal
04/01/13 14:17:23  04/02/13 14:17:23  krbtgt/EXAMPLE.COM@EXAMPLE.COM
        renew until 04/08/13 14:17:23
root@testomnios:~# kdestroy

configure ldap

now we have ntp and kerberos configured, we can use sasl with ldap. Use the ldapclient tool for this (the ipa ldap server has an ldap default profile we can use for ldapclient):

# ldapclient init -v -a authenticationMethod=sasl/gssapi -a credentialLevel=self -a profileName=default ipaserver.example.com
Parsing authenticationMethod=sasl/gssapi
Parsing credentialLevel=self
Parsing profileName=default
Arguments parsed:
        authenticationMethod: sasl/gssapi
        credentialLevel: self
        profileName: default
        defaultServerList: ipaserver.example.com
Handling init option
About to configure machine by downloading a profile
Warning: init authentication method not found in DUAConfigProfile.
Proxy DN: NULL
Proxy password: NULL
Authentication method: 0
No proxyDN/proxyPassword required
Shadow Update is not enabled, no adminDN/adminPassword is required.
About to modify this machines configuration by writing the files
Stopping network services
Stopping sendmail
stop: network/smtp:sendmail... failed: entity not found
Stopping sendmail failed with (1). You may need to restart it manually for changes to take effect.
nscd not running
Stopping autofs
stop: sleep 100000 microseconds
stop: sleep 200000 microseconds
stop: system/filesystem/autofs:default... success
ldap not running
nis(yp) not running
file_backup: stat(/etc/nsswitch.conf)=0
file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf)
file_backup: stat(/etc/defaultdomain)=0
file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain)
file_backup: nis domain is "example.com"
file_backup: stat(/var/yp/binding/example.com)=-1
file_backup: No /var/yp/binding/example.com directory.
file_backup: stat(/var/ldap/ldap_client_file)=-1
file_backup: No /var/ldap/ldap_client_file file.
Starting network services
start: /usr/bin/domainname example.com... success
start: sleep 100000 microseconds
start: sleep 200000 microseconds
start: network/ldap/client:default... success
start: sleep 100000 microseconds
start: system/filesystem/autofs:default... success
restart: sleep 100000 microseconds
restart: milestone/name-services:default... success
System successfully configured

Verify it is working, we now have a ticket as the machine account we just joined (using the keytab file) and we see we have used the ldap service on the kdc to get ldap info:

root@testomnios:~# klist 
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: host/solaris.example.com@EXAMPLE.COM

Valid starting                Expires                Service principal
04/01/13 14:22:21  04/02/13 00:22:21  krbtgt/EXAMPLE.COM@EXAMPLE.COM
04/01/13 14:22:21  04/02/13 00:22:21  ldap/ipaserver.example.com@EXAMPLE.COM

Verify ldap is workin, we can see users info from the ldap database

root@testomnios:~# id admin
uid=xxxxxxxxxxxxxxx(admin) gid=xxxxxxxxxxxxxxx(admins) groups=xxxxxxxxxxx(admins)

Difference between revisions of "Omnios ipa client"

Revision as of 14:29, 1 April 2013

Contents

add machine account to IPA domain

export keytab for machine account

configure kerberos on omnios host

configure ntp

verify kerberos is working

configure ldap

Navigation menu

Views

Personal tools

Navigation

Search

Tools

@@ Line 2: / Line 2: @@
 [[Category:IPA]]
-To enable ldap queries from an omnios server we need to use the ldapclient tool as documented in http://docs.oracle.com/cd/E19253-01/816-4556/clientsetup-1/index.html
+Thanks to Johan Petersson in the freeipa-users mailing list (https://www.redhat.com/archives/freeipa-users/2013-January/msg00021.html).
-But there is a catch22 when using ldapclient: the tool copies the file /etc/nsswitch.ldap to /etc/nsswitch.conf and this file has this line:
+== add machine account to IPA domain ==
+add a host to dns and create an machine account for it in the realm. In this example the host we want to join is solaris.example.com, the ipa server (kdc) is ipaserver.example.com. We assign solaris.example.com the ip address 192.168.0.1; run these commands as an admin user (with a kerberos ticket) on a host with the ipa admin tools installed:
+<code><ipa>
+ipa host-add --force --ip-address=192.168.0.1 solaris.example.com [enter]
+ipa host-add-managedby --host ipaserver.example.com solaris.example.com
+</pre></code>
+== export keytab for machine account ==
+just like before, run this as an admin user on host with ipa admin tools:
 <code><pre>
-hosts:    files ldap
+ipa-getkeytab -s ipaserver.example.com -p host/solaris.example.com -k /tmp/solaris.keytab
 </pre></code>
-What this means is that all dns queries will ask first the local hosts file and then the ldap servers, but this is not what we want. When trying to configure the ldap resolution I was running into this problem:
+Copy this solaris.keytab file to the omnios host to /etc/krb5/krb5.keytab. Apply these permissions to this file:
 <code><pre>
-# ldapclient init -v -a profileName=default kdc.ipa.asenjo.nxParsing profileName=default
+chown root:sys krb5.keytab
-Arguments parsed:
+chmod 600 krb5.keytab
-        profileName: default
+</pre></code>
-        defaultServerList: kdc.ipa.asenjo.nx
-Handling init option
-About to configure machine by downloading a profile
-Proxy DN: NULL
-Proxy password: NULL
-Authentication method: 0
-No proxyDN/proxyPassword required
-Shadow Update is not enabled, no adminDN/adminPassword is required.
-About to modify this machines configuration by writing the files
-Stopping network services
-Stopping sendmail
-stop: network/smtp:sendmail... failed: entity not found
-Stopping sendmail failed with (1). You may need to restart it manually for changes to take effect.
-nscd not running
-autofs not running
-Stopping ldap
-stop: network/ldap/client:default... restoring from maintenance state
-stop: sleep 100000 microseconds
-stop: network/ldap/client:default... success
-nis(yp) not running
-file_backup: stat(/etc/nsswitch.conf)=0
-file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf)
-file_backup: stat(/etc/defaultdomain)=0
-file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain)
-file_backup: nis domain is "ipa.asenjo.nx"
-file_backup: stat(/var/yp/binding/ipa.asenjo.nx)=-1
-file_backup: No /var/yp/binding/ipa.asenjo.nx directory.
-file_backup: stat(/var/ldap/ldap_client_file)=-1
-file_backup: No /var/ldap/ldap_client_file file.
-Starting network services
-start: /usr/bin/domainname ipa.asenjo.nx... success
-start: sleep 100000 microseconds
-start: sleep 200000 microseconds
-start: sleep 400000 microseconds
-start: sleep 800000 microseconds
-start: sleep 1600000 microseconds
-start: sleep 3200000 microseconds
-start: sleep 6400000 microseconds
-start: sleep 12800000 microseconds
-start: sleep 25600000 microseconds
-start: sleep 51200000 microseconds
-start: sleep 17700000 microseconds
-start: network/ldap/client:default... timed out
-start: network/ldap/client:default... offline to disable
-stop: sleep 100000 microseconds
-stop: sleep 200000 microseconds
-stop: network/ldap/client:default... success
-restart: sleep 100000 microseconds
-restart: milestone/name-services:default... success
-Error resetting system.
-Recovering old system settings.
-Stopping network services
-Stopping sendmail
-stop: network/smtp:sendmail... failed: entity not found
-Stopping sendmail failed with (1). You may need to restart it manually for changes to take effect.
-nscd not running
-autofs not running
-ldap not running
-nis(yp) not running
-recover: stat(/var/ldap/restore/defaultdomain)=0
-recover: open(/var/ldap/restore/defaultdomain)
-recover: read(/var/ldap/restore/defaultdomain)
-recover: old domainname "ipa.asenjo.nx"
-recover: stat(/var/ldap/restore/ldap_client_file)=-1
-recover: stat(/var/ldap/restore/ldap_client_cred)=-1
-recover: stat(/var/ldap/restore/ipa.asenjo.nx)=-1
-recover: stat(/var/ldap/restore/nsswitch.conf)=0
-recover: file_move(/var/ldap/restore/nsswitch.conf, /etc/nsswitch.conf)=0
-recover: stat(/var/ldap/restore/defaultdomain)=0
-recover: file_move(/var/ldap/restore/defaultdomain, /etc/defaultdomain)=0
-Starting network services
-start: /usr/bin/domainname ipa.asenjo.nx... success
-start: sleep 100000 microseconds
-start: sleep 200000 microseconds
-start: network/ldap/client:default... maintenance
-restart: sleep 100000 microseconds
-restart: milestone/name-services:default... success
-Error (1) while starting services during reset
+== configure kerberos on omnios host==
+Edit /etc/krb5/krb5.conf:
+<code><pre>
+[libdefaults]
+        default_realm = EXAMPLE.COM
+        verify_ap_req_nofail = false
+[realms]
+        EXAMPLE.COM = {
+                kdc = ipaserver.example.com
+                admin_server = ipaserver.example.com
+[domain_realm]
+        example.com = EXAMPLE.COM
+        .example.com = EXAMPLE.COM
 </pre></code>
-After modifying /etc/nsswitch.ldap to have the line
+== configure ntp ==
+Add serverlist to /etc/inet/ntp.client and rename it to ntp.conf:
+server ipaserver.example.com iburst
 <code><pre>
-hosts:      files dns
+# svcadm enable ntp
 </pre></code>
-I rerun the ldapclient command and this time it worked as it should:
+To see it is running properly:
+<code><pre>
+# svcs ntp
+</pre></code>
+To see what servers you are using:
 <code><pre>
-# ldapclient init -v -a profileName=default kdc.ipa.asenjo.nx
+# ntpq -p
+</pre></code>
+== verify kerberos is working ==
+<code><pre>
+root@testomnios:~# kinit admin
+Password for admin@EXAMPLE.COM:
+root@testomnios:~# klist
+Ticket cache: FILE:/tmp/krb5cc_0
+Default principal: admin@EXAMPLE.COM
+Valid starting                Expires                Service principal
+/01/13 14:17:23  04/02/13 14:17:23  krbtgt/EXAMPLE.COM@EXAMPLE.COM
+        renew until 04/08/13 14:17:23
+root@testomnios:~# kdestroy
+</pre></code>
+== configure ldap ==
+now we have ntp and kerberos configured, we can use sasl with ldap. Use the ldapclient tool for this (the ipa ldap server has an ldap default profile we can use for ldapclient):
+<code><pre>
+# ldapclient init -v -a authenticationMethod=sasl/gssapi -a credentialLevel=self -a profileName=default ipaserver.example.com
+Parsing authenticationMethod=sasl/gssapi
+Parsing credentialLevel=self
 Parsing profileName=default
 Arguments parsed:
+        authenticationMethod: sasl/gssapi
+        credentialLevel: self
          profileName: default
-         defaultServerList: kdc.ipa.asenjo.nx
+         defaultServerList: ipaserver.example.com
 Handling init option
 About to configure machine by downloading a profile
+Warning: init authentication method not found in DUAConfigProfile.
 Proxy DN: NULL
 Proxy password: NULL
@@ Line 124: / Line 104: @@
 Stopping sendmail failed with (1). You may need to restart it manually for changes to take effect.
 nscd not running
-autofs not running
+Stopping autofs
-Stopping ldap
-stop: network/ldap/client:default... restoring from maintenance state
 stop: sleep 100000 microseconds
-stop: network/ldap/client:default... success
+stop: sleep 200000 microseconds
+stop: system/filesystem/autofs:default... success
+ldap not running
 nis(yp) not running
 file_backup: stat(/etc/nsswitch.conf)=0
@@ Line 134: / Line 114: @@
 file_backup: stat(/etc/defaultdomain)=0
 file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain)
-file_backup: nis domain is "ipa.asenjo.nx"
+file_backup: nis domain is "example.com"
-file_backup: stat(/var/yp/binding/ipa.asenjo.nx)=-1
+file_backup: stat(/var/yp/binding/example.com)=-1
-file_backup: No /var/yp/binding/ipa.asenjo.nx directory.
+file_backup: No /var/yp/binding/example.com directory.
 file_backup: stat(/var/ldap/ldap_client_file)=-1
 file_backup: No /var/ldap/ldap_client_file file.
 Starting network services
-start: /usr/bin/domainname ipa.asenjo.nx... success
+start: /usr/bin/domainname example.com... success
 start: sleep 100000 microseconds
 start: sleep 200000 microseconds
 start: network/ldap/client:default... success
+start: sleep 100000 microseconds
+start: system/filesystem/autofs:default... success
 restart: sleep 100000 microseconds
 restart: milestone/name-services:default... success
 System successfully configured
+</pre></code>
+Verify it is working, we now have a ticket as the machine account we just joined (using the keytab file) and we see we have used the ldap service on the kdc to get ldap info:
+<code><pre>
+root@testomnios:~# klist
+Ticket cache: FILE:/tmp/krb5cc_0
+Default principal: host/solaris.example.com@EXAMPLE.COM
+Valid starting                Expires                Service principal
+/01/13 14:22:21  04/02/13 00:22:21  krbtgt/EXAMPLE.COM@EXAMPLE.COM
+/01/13 14:22:21  04/02/13 00:22:21  ldap/ipaserver.example.com@EXAMPLE.COM
+</pre></code>
+Verify ldap is workin, we can see users info from the ldap database
+<code><pre>
 root@testomnios:~# id admin
-uid=642800000(admin) gid=642800000(admins) groups=642800000(admins),642801438(libvirt)
+uid=xxxxxxxxxxxxxxx(admin) gid=xxxxxxxxxxxxxxx(admins) groups=xxxxxxxxxxx(admins)
 </pre></code>