freeipa with piv instructions
All checks were successful
Reese's Arch Toolbox / build-and-push-arch-toolbox (push) Successful in 37m55s
All checks were successful
Reese's Arch Toolbox / build-and-push-arch-toolbox (push) Successful in 37m55s
This commit is contained in:
@@ -1,83 +0,0 @@
|
|||||||
# FreeIPA
|
|
||||||
|
|
||||||
An AD Server.
|
|
||||||
|
|
||||||
This guide assumes Fedora 40+.
|
|
||||||
|
|
||||||
## Quickstart
|
|
||||||
|
|
||||||
<https://www.freeipa.org/page/Quick_Start_Guide>
|
|
||||||
|
|
||||||
- Set your hostname to your server's fqdn with `hostnamectl hostname freeipa.reeselink.com`
|
|
||||||
- Ensure you have a DNS entry pointing to your host
|
|
||||||
- Open ports:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps
|
|
||||||
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps --permanent
|
|
||||||
```
|
|
||||||
|
|
||||||
- Set a permanet DNS resolver: `sudo echo "nameserver 1.1.1.1" > /etc/resolv.conf`
|
|
||||||
- Disable NetworkManager DNS management
|
|
||||||
|
|
||||||
```bash
|
|
||||||
vim /etc/NetworkManager/NetworkManager.conf
|
|
||||||
|
|
||||||
[main]
|
|
||||||
dns=none
|
|
||||||
```
|
|
||||||
|
|
||||||
- Restart NetworkManager: `systemctl restart NetworkManager`
|
|
||||||
- Ensure resolv.conf hasn't been repopulated: `cat /etc/resolv.conf`
|
|
||||||
- Install freeipa: `dnf install -y freeipa-server freeipa-server-dns`
|
|
||||||
- Install the server (mostly choose defaults and sane options): `ipa-server-install`
|
|
||||||
- Authenticate as admin: `kinit admin`
|
|
||||||
|
|
||||||
## Adding a user
|
|
||||||
|
|
||||||
- `ipa user-add`
|
|
||||||
- `ipa passwd <user>`
|
|
||||||
- `kinit <user>`
|
|
||||||
|
|
||||||
## Arch Client
|
|
||||||
|
|
||||||
- Install krb5: `pacman -S krb5`
|
|
||||||
- Edit /etc/krb5.conf to match your server
|
|
||||||
|
|
||||||
```conf
|
|
||||||
vim /etc/krb5.conf
|
|
||||||
|
|
||||||
[logging]
|
|
||||||
default = FILE:/var/log/krb5libs.log
|
|
||||||
kdc = FILE:/var/log/krb5kdc.log
|
|
||||||
admin_server = FILE:/var/log/kadmind.log
|
|
||||||
|
|
||||||
[libdefaults]
|
|
||||||
default_realm = REESELINK.COM
|
|
||||||
dns_lookup_realm = false
|
|
||||||
dns_lookup_kdc = true
|
|
||||||
rdns = false
|
|
||||||
ticket_lifetime = 24h
|
|
||||||
forwardable = true
|
|
||||||
udp_preference_limit = 0
|
|
||||||
default_ccache_name = KEYRING:persistent:%{uid}
|
|
||||||
|
|
||||||
[realms]
|
|
||||||
REESELINK.COM = {
|
|
||||||
kdc = freeipa.reeselink.com:88
|
|
||||||
master_kdc = freeipa.reeselink.com:88
|
|
||||||
kpasswd_server = freeipa.reeselink.com:464
|
|
||||||
admin_server = freeipa.reeselink.com:749
|
|
||||||
default_domain = reeselink.com
|
|
||||||
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
|
|
||||||
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
|
|
||||||
}
|
|
||||||
|
|
||||||
[domain_realm]
|
|
||||||
.reeselink.com = REESELINK.COM
|
|
||||||
reeselink.com = REESELINK.COM
|
|
||||||
freeipa.reeselink.com = REESELINK.COM
|
|
||||||
```
|
|
||||||
|
|
||||||
- Log in with your user: `kinit <user>`
|
|
||||||
- List your tickets: `klist`
|
|
||||||
172
systemd/incubating/freeipa/freeipa.md
Normal file
172
systemd/incubating/freeipa/freeipa.md
Normal file
@@ -0,0 +1,172 @@
|
|||||||
|
# FreeIPA
|
||||||
|
|
||||||
|
An AD Server.
|
||||||
|
|
||||||
|
This guide assumes Fedora 40+.
|
||||||
|
|
||||||
|
## Quickstart
|
||||||
|
|
||||||
|
<https://www.freeipa.org/page/Quick_Start_Guide>
|
||||||
|
|
||||||
|
- Set your hostname to your server's fqdn with `hostnamectl hostname freeipa.reeselink.com`
|
||||||
|
- Ensure you have a DNS entry pointing to your host
|
||||||
|
- Open ports:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps
|
||||||
|
firewall-cmd --add-service=freeipa-ldap --add-service=freeipa-ldaps --permanent
|
||||||
|
```
|
||||||
|
|
||||||
|
- Set a permanet DNS resolver: `sudo echo "nameserver 1.1.1.1" > /etc/resolv.conf`
|
||||||
|
- Disable NetworkManager DNS management
|
||||||
|
|
||||||
|
```bash
|
||||||
|
vim /etc/NetworkManager/NetworkManager.conf
|
||||||
|
|
||||||
|
[main]
|
||||||
|
dns=none
|
||||||
|
```
|
||||||
|
|
||||||
|
Note, if installing for local use only, set /etc/hosts and reply "yes" to configure dns.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
vim /etc/hosts
|
||||||
|
|
||||||
|
192.168.122.100 freeipa.reeselink.com
|
||||||
|
```
|
||||||
|
|
||||||
|
- Restart NetworkManager: `systemctl restart NetworkManager`
|
||||||
|
- Ensure resolv.conf hasn't been repopulated: `cat /etc/resolv.conf`
|
||||||
|
- Install freeipa: `dnf install -y freeipa-server freeipa-server-dns`
|
||||||
|
- Install the server (mostly choose defaults and sane options): `ipa-server-install`
|
||||||
|
- Authenticate as admin: `kinit admin`
|
||||||
|
|
||||||
|
## Tips
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Install gnome desktop
|
||||||
|
dnf group install gnome-desktop
|
||||||
|
systemctl enable gdm
|
||||||
|
reboot
|
||||||
|
|
||||||
|
# Install spice tools for clipboard sync
|
||||||
|
sudo dnf install spice-vdagent
|
||||||
|
reboot
|
||||||
|
```
|
||||||
|
|
||||||
|
## Stop pcscd on the host
|
||||||
|
|
||||||
|
"virt-manager USB redirection error: Device is in use by another application"
|
||||||
|
|
||||||
|
You won't be able to pass through a smart card without stopping pcscd on the host.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl stop pcscd.socket && systemctl stop pcscd
|
||||||
|
```
|
||||||
|
|
||||||
|
## Adding a user
|
||||||
|
|
||||||
|
- `ipa user-add`
|
||||||
|
- `ipa passwd <user>`
|
||||||
|
- `kinit <user>`
|
||||||
|
|
||||||
|
## PIV
|
||||||
|
|
||||||
|
Self signed piv cert generation
|
||||||
|
<https://developers.yubico.com/yubico-piv-tool/Actions/key_generation.html>
|
||||||
|
|
||||||
|
Explaing Yubikey key slots
|
||||||
|
<https://developers.yubico.com/PIV/Introduction/Certificate_slots.html>
|
||||||
|
|
||||||
|
Ultimate guide to creating a CA
|
||||||
|
<https://checkmk.com/linux-knowledge/creating-server-certificate>
|
||||||
|
|
||||||
|
CA Public directory
|
||||||
|
<https://nextcloud.reeseapps.com/s/twRAFeWJZKJ3Qw5>
|
||||||
|
|
||||||
|
Convert pem to der
|
||||||
|
<https://knowledge.digicert.com/solution/how-to-convert-a-certificate-into-the-appropriate-format>
|
||||||
|
|
||||||
|
Add smart card login to extended key use
|
||||||
|
<https://docs.openssl.org/master/man5/x509v3_config/#key-usage>
|
||||||
|
|
||||||
|
This should set up a CA and a signed cert for your yubikey.
|
||||||
|
|
||||||
|
Note, add to `/etc/httpd/conf.d/ssl.conf`
|
||||||
|
|
||||||
|
```conf
|
||||||
|
SSLProtocol all -TLSv1 -TLSv1.1 -TLSv1.3
|
||||||
|
```
|
||||||
|
|
||||||
|
<https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/managing_smart_card_authentication/configuring-idm-for-smart-card-auth_managing-smart-card-authentication#conf-idm-server-for-smart-card-auth_configuring-idm-for-smart-card-auth>
|
||||||
|
|
||||||
|
This should do it
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp /etc/ipa/ca.crt ca.crt
|
||||||
|
kinit admin
|
||||||
|
ipa-advise config-server-for-smart-card-auth > config-server-for-smart-card-auth.sh
|
||||||
|
chmod +x config-server-for-smart-card-auth.sh
|
||||||
|
./config-server-for-smart-card-auth.sh ca.crt
|
||||||
|
```
|
||||||
|
|
||||||
|
Then in `/etc/httpd/conf.d/ssl.conf`
|
||||||
|
|
||||||
|
```conf
|
||||||
|
SSLOCSPEnable off
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl restart httpd
|
||||||
|
```
|
||||||
|
|
||||||
|
Then user -> actions -> new certificate. Paste in the yubikey CSR. Download then upload cert to the yubikey.
|
||||||
|
|
||||||
|
Auth with smart card
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kinit -X X509_user_identity='PKCS11:opensc-pkcs11.so' idm_user
|
||||||
|
```
|
||||||
|
|
||||||
|
## Arch Client
|
||||||
|
|
||||||
|
- Install krb5: `pacman -S krb5`
|
||||||
|
- Edit /etc/krb5.conf to match your server
|
||||||
|
|
||||||
|
```conf
|
||||||
|
vim /etc/krb5.conf
|
||||||
|
|
||||||
|
[logging]
|
||||||
|
default = FILE:/var/log/krb5libs.log
|
||||||
|
kdc = FILE:/var/log/krb5kdc.log
|
||||||
|
admin_server = FILE:/var/log/kadmind.log
|
||||||
|
|
||||||
|
[libdefaults]
|
||||||
|
default_realm = REESELINK.COM
|
||||||
|
dns_lookup_realm = false
|
||||||
|
dns_lookup_kdc = true
|
||||||
|
rdns = false
|
||||||
|
ticket_lifetime = 24h
|
||||||
|
forwardable = true
|
||||||
|
udp_preference_limit = 0
|
||||||
|
default_ccache_name = KEYRING:persistent:%{uid}
|
||||||
|
|
||||||
|
[realms]
|
||||||
|
REESELINK.COM = {
|
||||||
|
kdc = freeipa.reeselink.com:88
|
||||||
|
master_kdc = freeipa.reeselink.com:88
|
||||||
|
kpasswd_server = freeipa.reeselink.com:464
|
||||||
|
admin_server = freeipa.reeselink.com:749
|
||||||
|
default_domain = reeselink.com
|
||||||
|
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
|
||||||
|
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
|
||||||
|
}
|
||||||
|
|
||||||
|
[domain_realm]
|
||||||
|
.reeselink.com = REESELINK.COM
|
||||||
|
reeselink.com = REESELINK.COM
|
||||||
|
freeipa.reeselink.com = REESELINK.COM
|
||||||
|
```
|
||||||
|
|
||||||
|
- Log in with your user: `kinit <user>`
|
||||||
|
- List your tickets: `klist`
|
||||||
Reference in New Issue
Block a user