Chapter 3. Installing an IdM server: With integrated DNS, with an integrated CA as the root CA
Installing a new Identity Management (IdM) server with integrated DNS has the following advantages:
- You can automate much of the maintenance and DNS record management using native IdM tools. For example, DNS SRV records are automatically created during the setup, and later on are automatically updated.
- You can configure global forwarders during the installation of the IdM server for a stable external internet connection. Global forwarders are also useful for trusts with Active Directory.
- You can set up a DNS reverse zone to prevent emails from your domain to be considered spam by email servers outside of the IdM domain.
Installing IdM with integrated DNS has certain limitations:
- IdM DNS is not meant to be used as a general-purpose DNS server. Some of the advanced DNS functions are not supported. For more information, see DNS services available in an IdM server.
This chapter describes how you can install a new IdM server with an integrated certificate authority (CA) as the root CA.
The default configuration for the ipa-server-install command is an integrated CA as the root CA. If no CA option, for example --external-ca
or --ca-less
is specified, the IdM server is installed with an integrated CA.
3.1. Interactive installation
During the interactive installation using the ipa-server-install
utility, you are asked to supply basic configuration of the system, for example the realm, the administrator’s password and the Directory Manager’s password.
The ipa-server-install
installation script creates a log file at /var/log/ipaserver-install.log
. If the installation fails, the log can help you identify the problem.
Procedure
Run the ipa-server-install utility.
# ipa-server-install
The script prompts to configure an integrated DNS service. Enter
yes
.Do you want to configure integrated DNS (BIND)? [no]:
yes
The script prompts for several required settings and offers recommended default values in brackets.
- To accept a default value, press Enter.
To provide a custom value, enter the required value.
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:
WarningPlan these names carefully. You will not be able to change them after the installation is complete.
Enter the passwords for the Directory Server superuser (
cn=Directory Manager
) and for the Identity Management (IdM) administration system user account (admin
).Directory Manager password: IPA admin password:
The script prompts for per-server DNS forwarders.
Do you want to configure DNS forwarders? [yes]:
To configure per-server DNS forwarders, enter
yes
, and then follow the instructions on the command line. The installation process will add the forwarder IP addresses to the IdM LDAP.-
For the forwarding policy default settings, see the
--forward-policy
description in the ipa-dns-install(1) man page.
-
For the forwarding policy default settings, see the
If you do not want to use DNS forwarding, enter
no
.With no DNS forwarders, hosts in your IdM domain will not be able to resolve names from other, internal, DNS domains in your infrastructure. The hosts will only be left with public DNS servers to resolve their DNS queries.
The script prompts to check if any DNS reverse (PTR) records for the IP addresses associated with the server need to be configured.
Do you want to search for missing reverse zones? [yes]:
If you run the search and missing reverse zones are discovered, the script asks you whether to create the reverse zones along with the PTR records.
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.
NoteUsing IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead.
Enter
yes
to confirm the server configuration.Continue to configure the system with these values? [no]:
yes
- The installation script now configures the server. Wait for the operation to complete.
After the installation script completes, update your DNS records in the following way:
Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is
idm.example.com
, add a name server (NS) record to theexample.com
parent domain.ImportantRepeat this step each time after an IdM DNS server is installed.
-
Add an
_ntp._udp
service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.
3.2. Non-interactive installation
The ipa-server-install
installation script creates a log file at /var/log/ipaserver-install.log
. If the installation fails, the log can help you identify the problem.
Procedure
Run the ipa-server-install utility with the options to supply all the required information. The minimum required options for non-interactive installation are:
-
--realm
to provide the Kerberos realm name -
--ds-password
to provide the password for the Directory Manager (DM), the Directory Server super user -
--admin-password
to provide the password foradmin
, the Identity Management (IdM) administrator -
--unattended
to let the installation process select default options for the host name and domain name
To install a server with integrated DNS, add also these options:
-
--setup-dns
to configure integrated DNS -
--forwarder
or--no-forwarders
, depending on whether you want to configure DNS forwarders or not -
--auto-reverse
or--no-reverse
, depending on whether you want to configure automatic detection of the reverse DNS zones that must be created in the IdM DNS or no reverse zone auto-detection
For example:
# ipa-server-install --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended --setup-dns --forwarder 192.0.2.1 --no-reverse
-
After the installation script completes, update your DNS records in the following way:
Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is
idm.example.com
, add a name server (NS) record to theexample.com
parent domain.ImportantRepeat this step each time after an IdM DNS server is installed.
-
Add an
_ntp._udp
service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.
Additional resources
-
For a complete list of options accepted by ipa-server-install, run the
ipa-server-install --help
command. - Failover, load-balancing, and high-availability in IdM.