Chapter 5. Installing an IdM server: Without integrated DNS, with an integrated CA as the root CA

Procedure

1. Run the ipa-server-install utility.

   # ipa-server-install

2. The script prompts to configure an integrated DNS service. Press Enter to select the default no option.

   Do you want to configure integrated DNS (BIND)? [no]:

3. The script prompts for several required settings and offers recommended default values in brackets.

   • To accept a default value, press Enter.

   • To provide a custom value, enter the required value.

     Server host name [server.idm.example.com]:
     Please confirm the domain name [idm.example.com]:
     Please provide a realm name [IDM.EXAMPLE.COM]:

     Warning

     Plan these names carefully. You will not be able to change them after the installation is complete.

4. Enter the passwords for the Directory Server superuser (cn=Directory Manager) and for the IdM administration system user account (admin). Note that the administrator is responsible for picking a strong password for the Directory Manager account.

   Directory Manager password:
   IPA admin password:

5. The script prompts for several required settings and offers recommended default values in brackets.

   • To accept a default value, press Enter.

   • To provide a custom value, enter the required value.

     NetBIOS domain name [EXAMPLE]:
     Do you want to configure chrony with NTP server or pool address? [no]:

6. Enter yes to confirm the server configuration.

   Continue to configure the system with these values? [no]: yes

7. The installation script now configures the server. Wait for the operation to complete.

8. The installation script produces a file with DNS resource records: the /tmp/ipa.system.records.UFRPto.db file in the example output below. Add these records to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.

   _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com.
   _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 server.example.com.
   _kerberos._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com.
   _kerberos._udp.example.com. 86400 IN SRV 0 100 88 server.example.com.
   _kerberos.example.com. 86400 IN TXT "EXAMPLE.COM"
   _kpasswd._tcp.example.com. 86400 IN SRV 0 100 464 server.example.com.
   _kpasswd._udp.example.com. 86400 IN SRV 0 100 464 server.example.com.
   _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server.example.com.

   Important

   The server installation is not complete until you add the DNS records to the existing DNS servers.

Procedure

1. Run the ipa-server-install utility with the options to supply all the required information. The minimum required options for non-interactive installation are:

   • --realm to provide the Kerberos realm name
   • --ds-password to provide the password for the Directory Manager (DM), the Directory Server super user. Note that the administrator is responsible for picking a strong password for the Directory Manager account
   • --admin-password to provide the password for admin, the IdM administrator
   • --unattended to let the installation process select default options for the host name and domain name

   For example:

   # ipa-server-install --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended

2. The installation script produces a file with DNS resource records: the /tmp/ipa.system.records.UFRPto.db file in the example output below. Add these records to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.

   ...
   Restarting the KDC
   Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db
   Restarting the web server
   ...

   Important

   The server installation is not complete until you add the DNS records to the existing DNS servers.