# hostnamectl set-hostname ipa.example.test

# systemctl stop ahttpd
# a2dissite 000-default_https
# a2disport https
# systemctl condreload httpd2

# apt-get install haveged
# systemctl enable --now haveged

# ipa-server-install

Do you want to configure integrated DNS (BIND)? [no]: yes

Server host name [ipa.example.test]:
Please confirm the domain name [example.test]:
Please provide a realm name [EXAMPLE.TEST]:

Directory Manager password:
Password (confirm):

IPA admin password:
Password (confirm):

Do you want to configure DNS forwarders? [yes]:

Following DNS servers are configured in /etc/resolv.conf: 127.0.0.1
Do you want to configure these servers as DNS forwarders? [yes]:

All detected DNS servers were added. You can enter additional addresses now:
Enter an IP address for a DNS forwarder, or press Enter to skip: 8.8.8.8
DNS forwarder 8.8.8.8 added. You may add another.
Enter an IP address for a DNS forwarder, or press Enter to skip:
DNS forwarders: 127.0.0.1, 8.8.8.8
Checking DNS forwarders, please wait ...

Do you want to search for missing reverse zones? [yes]
Checking DNS domain 0.168.192.in-addr.arpa., please wait ...
Do you want to create reverse zone for IP 192.168.0.162 [yes]: yes
Please specify the reverse zone name [0.168.192.in-addr.arpa.]:
Checking DNS domain 0.168.192.in-addr.arpa., please wait ...
Using reverse zone(s) 0.168.192.in-addr.arpa.

NetBIOS domain name [EXAMPLE]:

Do you want to configure OPENNTPD with NTP server or pool address? [no]:

The IPA Master Server will be configured with:
Hostname:       ipa.example.test
IP address(es): 192.168.0.113
Domain name:    example.test
Realm name:     EXAMPLE.TEST

The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=EXAMPLE.TEST
Subject base: O=EXAMPLE.TEST
Chaining:     self-signed

BIND DNS server will be configured to serve IPA domain with:
Forwarders:       8.8.8.8
Forward policy:   only
Reverse zone(s):  0.168.192.in-addr.arpa.

Continue to configure the system with these values? [no]: yes

==============================================================================
Setup complete

Next steps:
    1. You must make sure these network ports are open:
        TCP Ports:
          * 80, 443: HTTP/HTTPS
          * 389, 636: LDAP/LDAPS
          * 88, 464: kerberos
          * 53: bind
        UDP Ports:
          * 88, 464: kerberos
          * 53: bind
          * 123: ntp

    2. You can now obtain a kerberos ticket using the command: 'kinit admin'
       This ticket will allow you to use the IPA tools (e.g., ipa user-add)
       and the web user interface.

Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful

# ipa-server-install -U --hostname=$(hostname) -r EXAMPLE.TEST -n example.test -p 12345678 -a 12345678 --setup-dns --no-forwarders --no-reverse

# mkdir ~/test_ca

# echo "SECret.123" > ~/test_ca/password.txt

# certutil -d ~/test_ca -N -f ~/test_ca/password.txt

# head -c20 /dev/random > ~/test_ca/noise.txt

# export CERT_SERIAL=1

# SKID="0x`openssl rand -hex 20`"
# echo $SKID
0xfa012b30b9407b0750b786ff5ed9f49ce3998622
# certutil -d ~/test_ca -S -n "CA" -s "CN=Certificate Authority" -x -t CT,,C -1 -2 -5 -m $CERT_SERIAL -v 120 -z ~/test_ca/noise.txt -f ~/test_ca/password.txt --extSKID

  0 - Digital Signature
  1 - Non-repudiation
  5 - Cert signing key
  9 - done
  Is this a critical extension [y/N]? y
  Is this a CA certificate [y/N]?  y
  Enter the path length constraint, enter to skip [<0 for unlimited path] 0
  Is this a critical extension [y/N]? y
  Enter value for the key identifier fields,enter to omit: 0xfa012b30b9407b0750b786ff5ed9f49ce3998622
  Is this a critical extension [y/N]? n
  5 - SSL CA
  6 - S/MIME CA
  7 - Object Signing CA
  9 - done
  Is this a critical extension [y/N]? n

# head -c20 /dev/random > ~/test_ca/noise.txt

# SKID="0x`openssl rand -hex 20`"
# echo $SKID
0xb17caf72b46288bcc9c887c89894dc917e06f724
# certutil -d ~/test_ca -R -s CN=$HOSTNAME,O=IPA -o /tmp/servercert.req -k rsa -g 2048 -z ~/test_ca/noise.txt -f ~/test_ca/password.txt -a --extSKID
Generating key.  This may take a few moments...

Adding Subject Key ID extension.
Enter value for the key identifier fields,enter to omit:
0xb17caf72b46288bcc9c887c89894dc917e06f724
Is this a critical extension [y/N]?
n

# export CERT_SERIAL=$(($CERT_SERIAL + 1))
# certutil -d ~/test_ca -C -c "CA" -i /tmp/servercert.req -o /tmp/servercert.pem -m $CERT_SERIAL -v 120 -f ~/test_ca/password.txt -1 -5 -a

  2 - Key encipherment
  9 - done
  Is this a critical extension [y/N]? n
  1 - SSL Server
  9 - done
  Is this a critical extension [y/N]? n

# certutil -d ~/test_ca -A -i /tmp/servercert.pem -n Server-Cert -a -t ,,
Enter Password or Pin for "NSS Certificate DB":

# pk12util -o ~/test_ca/servercert.p12 -n Server-Cert -d ~/test_ca -k ~/test_ca/password.txt -w ~/test_ca/password.txt
pk12util: PKCS12 EXPORT SUCCESSFUL

# certutil -d ~/test_ca -L -n "CA" -a > ~/test_ca/cacert.pem

# export PSWD=$(cat ~/test_ca/password.txt)

# ipa-server-install \
    --http-cert-file ~/test_ca/servercert.p12 \
    --http-pin $PSWD \
    --dirsrv-cert-file ~/test_ca/servercert.p12 \
    --dirsrv-pin $PSWD \
    --ca-cert-file ~/test_ca/cacert.pem \
    --no-pkinit

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
Version 4.9.11

This includes:
  * Configure the NTP client (CHRONY)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure SID generation

To accept the default shown in brackets, press the Enter key.

Do you want to configure integrated DNS (BIND)? [no]: yes

Server host name [ipa.example.test]:
Please confirm the domain name [example.test]:
Please provide a realm name [EXAMPLE.TEST]:

Directory Manager password:
Password (confirm):

IPA admin password:
Password (confirm):

Do you want to configure DNS forwarders? [yes]:

Do you want to configure these servers as DNS forwarders? [yes]:

Enter an IP address for a DNS forwarder, or press Enter to skip: 8.8.8.8

Do you want to search for missing reverse zones? [yes]
Checking DNS domain 0.168.192.in-addr.arpa., please wait ...
Do you want to create reverse zone for IP 192.168.0.162 [yes]: yes
Please specify the reverse zone name [0.168.192.in-addr.arpa.]:
Checking DNS domain 0.168.192.in-addr.arpa., please wait ...
Using reverse zone(s) 0.168.192.in-addr.arpa.

NetBIOS domain name [EXAMPLE]:

Do you want to configure OPENNTPD with NTP server or pool address? [no]:

The IPA Master Server will be configured with:
Hostname:       ipa.example.test
IP address(es): 192.168.0.113
Domain name:    example.test
Realm name:     EXAMPLE.TEST

BIND DNS server will be configured to serve IPA domain with:
Forwarders:       8.8.8.8
Forward policy:   only
Reverse zone(s):  0.168.192.in-addr.arpa.

Continue to configure the system with these values? [no]: yes

==============================================================================
Setup complete

Next steps:
    1. You must make sure these network ports are open:
        TCP Ports:
          * 80, 443: HTTP/HTTPS
          * 389, 636: LDAP/LDAPS
          * 88, 464: kerberos
          * 53: bind
        UDP Ports:
          * 88, 464: kerberos
          * 53: bind
          * 123: ntp

    2. You can now obtain a kerberos ticket using the command: 'kinit admin'
       This ticket will allow you to use the IPA tools (e.g., ipa user-add)
       and the web user interface.

The ipa-server-install command was successful

# ipa-server-install --uninstall

$ ipa krbtpolicy-show
  Максимальный срок жизни: 86400
  Максимальный срок для обновления: 604800

$ ipa krbtpolicy-mod --maxlife=43200 --maxrenew=86400
  Максимальный срок жизни: 43200
  Максимальный срок для обновления: 86400

# ipa-replica-install --principal admin --admin-password password

# ipa-replica-install \
    --dirsrv-cert-file ~/test_ca/replicacert.p12 \
    --dirsrv-pin SECret.123 \
    --http-cert-file ~/test_ca/replicacert.p12 \
    --http-pin SECret.123 \
    --no-pkinit

…
The ipa-replica-install command was successful

# ipa-replica-install --password='2AaT0Ix8itDsYugdDGoRtBt'
Configuring client side components
This program will set up IPA client.
Version 4.9.11

Discovery was successful!
Client hostname: hostb.example.test
Realm: EXAMPLE.TEST
DNS Domain: example.test
IPA Server: ipa.example.test
BaseDN: dc=example,dc=test

The ipa-client-install command was successful

The ipa-replica-install command was successful

# ipa-client-install --mkhomedir

This program will set up IPA client.
Version 4.9.11

Discovery was successful!
Do you want to configure CHRONY with NTP server or pool address? [no]:
Client hostname: comp08.example.test
Realm: EXAMPLE.TEST
DNS Domain: example.test
IPA Server: ipa.example.test
BaseDN: dc=example,dc=test

Continue to configure the system with these values? [no]: yes

User authorized to enroll computers: admin
Password for admin@EXAMPLE.TEST:

Client configuration complete.
The ipa-client-install command was successful

# ipa-client-install -U -p admin -w 12345678

# ipa-client-install -U --password='3SeOaJ5GyOxbPcLmF5wpFQH' --domain example.test --server ipa.example.test --realm EXAMPLE.TEST --mkhomedir

$ ssh-keyscan <IP-узел1> <hostname-узел1> ... >> ~/.ssh/known_hosts

# apt-get install ansible-freeipa

[ipaservers]
ipa.example.test

[ipaservers:vars]
ipaserver_domain=example.test
ipaserver_realm=EXAMPLE.TEST
ipaserver_setup_dns=yes
ipaserver_auto_forwarders=yes
ipaserver_allow_zone_overlap=yes
ipaserver_no_dnssec_validation=yes
ipaadmin_password=12345678
ipadm_password=12345678
ipaserver_setup_firewalld=no

---
- name: Playbook to configure IPA server
  hosts: ipaservers
  become: true

  roles:
  - role: ipaserver
    state: present

$ ansible-playbook -v -i inventory/hosts install-server.yml
Using /etc/ansible/ansible.cfg as config file

PLAY [Playbook to configure IPA server] **********************************************************

TASK [Gathering Facts] ***************************************************************************
ok: [ipa.example.test]
...
PLAY RECAP ***************************************************************************************
ipa.example.test          : ok=36   changed=20   unreachable=0    failed=0    skipped=37   rescued=0    ignored=0

---
- name: Playbook to uninstall an IdM replica
  hosts: ipaservers
  become: true

  roles:
  - role: ipaserver
    ipaserver_remove_from_domain: true
    state: absent

$ ansible-playbook -v -i inventory/hosts uninstall-server.yml

[ipaclients]
comp01.example.test
comp02.example.test

[ipaservers]
ipa.example.test

[ipaclients:vars]
ipaclient_domain=example.test
ipaclient_realm=EXAMPLE.TEST
#ipaclient_use_otp=yes
ipaadmin_principal=admin
ipaadmin_password=12345678

---
- name: Playbook to configure IPA clients with username/password
  hosts: ipaclients
  become: true

  roles:
  - role: ipaclient
    state: present

---
- name: Playbook to unconfigure IPA clients
  hosts: ipaclients
  become: true

  roles:
  - role: ipaclient
    state: absent

$ ansible-playbook -v -i inventory/hosts install-client.yml
Using /etc/ansible/ansible.cfg as config file

PLAY [Playbook to unconfigure IPA clients] *************************************************************************

TASK [Gathering Facts] *********************************************************************************************
ok: [comp02.example.test]
ok: [comp01.example.test]
...
PLAY RECAP **********************************************************
comp01.example.test         : ok=21   changed=11   unreachable=0    failed=0    skipped=20   rescued=0    ignored=0
comp02.example.test         : ok=21   changed=11   unreachable=0    failed=0    skipped=20   rescued=0    ignored=0

$ ansible-playbook -v -i inventory/hosts uninstall-client.yml

# kinit admin
# ipa dnsforwardzone-add test.alt --forwarder=192.168.0.122 --forward-policy=first
Сервер проверит DNS-перенаправитель (перенаправители).
Это может занять некоторое время; пожалуйста, подождите...
Имя зоны: test.alt.
Активная зона: TRUE
Перенаправители зон: 192.168.0.122
Политика перенаправления: first

# dig dc1.test.alt +noall +answer
dc1.test.alt.       709 IN  A   192.168.0.122

# kinit admin
# ipa trust-add --type=ad test.alt --admin Administrator --password --two-way=true
Пароль администратора домена Active Directory:
…

# ipa trust-fetch-domains test.alt
-------------------------------------------------------------------------------------------------------
Список надёжных доменов успешно обновлён. Используйте команду trustdomain-find для вывода этого списка.
-------------------------------------------------------------------------------------------------------
---------------------------------
Количество возвращённых записей 0
---------------------------------

# ipa trustdomain-find test.alt
  Имя домена: test.alt
  Имя домена NetBIOS: TEST
  Идентификатор безопасности домена: S-1-5-21-90931260-536030259-1550036695
  Домен включён: True
---------------------------------
Количество возвращённых записей 1
---------------------------------

# kinit ivanov@test.alt
Password for ivanov@test.alt:

# kvno -S host $(hostname)
host/ipa.example.test@EXAMPLE.TEST: kvno = 2

# kvno -S cifs dc1.test.alt
 cifs/dc1.test.alt@TEST.ALT: kvno = 1

# klist
Ticket cache: KEYRING:persistent:500:krb_ccache_QfXae5u
Default principal: ivanov@TEST.ALT


Valid starting       Expires              Service principal
07.09.2023 12:28:14  07.09.2023 22:27:51  cifs/dc1.test.alt@TEST.ALT
	renew until 08.09.2023 12:27:46
07.09.2023 12:27:33  07.09.2023 22:27:51  host/ipa.example.test@EXAMPLE.TEST
	renew until 08.09.2023 12:27:46
07.09.2023 12:28:05  07.09.2023 22:27:51  krbtgt/EXAMPLE.TEST@TEST.ALT
	renew until 08.09.2023 12:27:46
07.09.2023 12:27:51  07.09.2023 22:27:51  krbtgt/TEST.ALT@TEST.ALT
	renew until 08.09.2023 12:27:46

# getent passwd ivanov@test.alt
ivanov@test.alt:*:348001105:348001105:Иван Иванов:/home/test.alt/ivanov:

[domain/example.test]
...
default_shell = /bin/bash
...

# systemctl restart sssd
# getent passwd ivanov@test.alt
ivanov@test.alt:*:348001105:348001105:Иван Иванов:/home/test.alt/ivanov:/bin/bash

$ ipa user-add <логин> --first=<имя> --last=<фамилия> --email=<email>

$ ipa stageuser-add markov --first=Илья --last=Марков --email=markov@example.test
-----------------------------------------------
Добавлен неподтверждённый пользователь "markov"
-----------------------------------------------
  Имя учётной записи пользователя: markov
  Имя: Илья
  Фамилия: Марков
  Полное имя: Илья Марков
  Отображаемое имя: Илья Марков
  Инициалы: ИМ
  Домашний каталог: /home/markov
  GECOS: Илья Марков
  Оболочка входа: /bin/bash
  Имя учётной записи: markov@EXAMPLE.TEST
  Псевдоним учётной записи: markov@EXAMPLE.TEST
  Адрес электронной почты: markov@example.test
  UID: -1
  ID группы: -1
  Пароль: False
  Доступные ключи Kerberos: False

$ ipa help user-add

$ ipa user-find

$ ipa stageuser-activate <логин>

$ ipa stageuser-activate markov
---------------------------
Stage user markov activated
---------------------------
  Имя учётной записи пользователя: markov
  Имя: Илья
  Фамилия: Марков
  Домашний каталог: /home/markov
  Оболочка входа: /bin/bash
  Имя учётной записи: markov@EXAMPLE.TEST
  Псевдоним учётной записи: markov@EXAMPLE.TEST
  Адрес электронной почты: markov@example.test
  UID: 948000005
  ID группы: 948000005
  Пароль: False
  Участник групп: ipausers
  Доступные ключи Kerberos: False

$ ipa user-del --preserve <логин>

$ ipa user-del --preserve markov
-----------------------
Preserved user "markov"
-----------------------

$ ipa user-del --continue user1 user2 user3
-----------------------
Preserved user "markov"
-----------------------

$ ipa user-del markov
----------------------------
Удален пользователь "markov"
----------------------------

$ ipa user-undel markov
--------------------------------------------------------------
Учётная запись пользователя "markov" возвращена после удаления
--------------------------------------------------------------