5.5. Setting up a Linux Client Through Kickstart
A kickstart enrollment automatically adds a new system to the IdM domain at the time it is provisioned.
This requires pre-creating the hosts on the IdM server, with a predefined password that can be used to authenticate to complete the enrollment operation.
- Create the host entry on the IdM server and set a temporary Kerberos password for the entry.When the
ipa-client-installscript is run normally (interactively), it prompts for authentication credentials to access the IdM domain. However, when the script is run automatically, the system has to have some way to access the IdM domain without using an existing IdM user; this is done by setting the host principal in the script and using a Kerberos password (configured for the host account) to access the IdM domain.For example:[jsmith@server ~]$ ipa host-add kickstart-server.example.com --password=secret
The password expires after the first authentication attempt. After enrollment completes, the host is authenticated using its keytab. - Include the ipa-client package with the other install packages.
%packages @ X Window System @ Desktop @ Sound and Video ipa-client ...
- Create a post-install instruction that ensures SSH keys are generated before enrollment, runs the
ipa-client-installscript, passes all the required information to access and configure the IdM domain services, and specifies the pre-set password. Use the--unattendedoption to instruct the script to run non-interactively.%post --log=/root/ks-post.log # Generate SSH keys to ensure that ipa-client-install uploads them to the IdM server /usr/bin/ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_rsa_key chmod 644 /etc/ssh/ssh_host_rsa_key.pub /sbin/restorecon /etc/ssh/ssh_host_rsa_key.pub /usr/bin/ssh-keygen -q -t rsa1 -f /etc/ssh/ssh_host_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_key chmod 644 /etc/ssh/ssh_host_key.pub /sbin/restorecon /etc/ssh/ssh_host_key.pub /usr/bin/ssh-keygen -q -t dsa -f /etc/ssh/ssh_host_dsa_key -C '' -N '' chmod 600 /etc/ssh/ssh_host_dsa_key chmod 644 /etc/ssh/ssh_host_dsa_key.pub /sbin/restorecon /etc/ssh/ssh_host_dsa_key.pub # Get the hostname to set as the host principal /bin/hostname > /tmp/hostname.txt # Run the client install script /usr/sbin/ipa-client-install --domain=EXAMPLEDOMAIN --enable-dns-updates --mkhomedir -w secret --realm=EXAMPLEREALM --server=server.example.com --unattended
Note
Red Hat recommends not to start thesshdservice prior to the kickstart enrollment. While startingsshdbefore enrolling the client generates the SSH keys automatically, using the above script is the preferred solution. - Run the kickstart script.
