FreeIPA Active Directory trust setup

環境

主機名	IP	os
dc01.demo.com	192.168.33.6	centos6
ipa.demo.com	192.168.33.10	win2008r2

• IPA server IP address: 192.168.33.10

• IPA server hostname: admin

• IPA domain: ipa.demo.com

• IPA NetBIOS: IPA

• IPA Kerberos realm IPA.DEMO.COM

• AD DC IP address: 192.168.33.6

• AD DC hostname: admin

• AD domain: ad.demi.com

• AD NetBIOS: AD

#AD的安裝與配置 角色-->添加域控制器 cmd--> dcpromo 根據提示安裝便可 ###配置dns

dnscmd 127.0.0.1 /ZoneAdd ipa.demo.com /Forwarder 192.168.33.10

FreeIPA 安裝與配置

安裝軟件包

yum install -y "*ipa-server" "*ipa-server-trust-ad" bind bind-dyndb-ldap  samba4-winbind-clients

配置主機名

echo "192.168.33.10 admin.ipa.demo.com admin" >> /etc/hosts
hostname admin.ipa.demo.com
hostname --fqdn

配置Freeipa

ipa-server-install -a password -p password --domain=ipa.demo.com --realm=IPA.DEMO.COM --setup-dns --no-forwarders -U

配置adtrust

ipa-adtrust-install --netbios-name=IPA -a password

配置dns

ipa dnszone-add ad.demo.com --name-server=admin.ad.demo.com --admin-email='hostmaster@ad.demo.com' --force --forwarder=192.168.33.6 --forward-policy=only --ip-address=192.168.33.6

配置信任

ipa trust-add --type=ad ad.demo.com --admin Administrator --password  --base-id=1155300028

映射AD用戶至FreeIPA

ipa group-add --desc='ad_domain admins external map' ad_admins_external --external
ipa group-add --desc='ad_domain admins' ad_admins
ipa group-add-member ad_admins --groups ad_admins_external
ipa group-add-member ad_admins_external --external 'AD\Domain Admins'

|參考: https://www.freeipa.org/page/Active_Directory_trust_setup