Chapter 6. Installing an IdM server: Without integrated DNS, with an integrated CA as the root CA
This chapter describes how you can install a new Identity Management (IdM) server without integrated DNS.
Red Hat strongly recommends installing IdM-integrated DNS for basic usage within the IdM deployment: When the IdM server also manages DNS, there is tight integration between DNS and native IdM tools which enables automating some of the DNS record management.
For more details, see Planning your DNS services and host names.
6.1. Interactive installation
During the interactive installation using the ipa-server-install utility, you are asked to supply basic configuration of the system, for example the realm, the administrator’s password and the Directory Manager’s password.
The ipa-server-install installation script creates a log file at /var/log/ipaserver-install.log. If the installation fails, the log can help you identify the problem.
This procedure installs a server:
- Without integrated DNS
- With integrated Identity Management (IdM) certificate authority (CA) as the root CA, which is the default CA configuration
Procedure
Run the
ipa-server-installutility.# ipa-server-install
The script prompts to configure an integrated DNS service. Press Enter to select the default
nooption.Do you want to configure integrated DNS (BIND)? [no]:
The script prompts for several required settings and offers recommended default values in brackets.
- To accept a default value, press Enter.
To provide a custom value, enter the required value.
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:
WarningPlan these names carefully. You will not be able to change them after the installation is complete.
Enter the passwords for the Directory Server superuser (
cn=Directory Manager) and for the IdM administration system user account (admin).Directory Manager password: IPA admin password:
The script prompts for several required settings and offers recommended default values in brackets.
- To accept a default value, press Enter.
To provide a custom value, enter the required value.
NetBIOS domain name [EXAMPLE]: Do you want to configure chrony with NTP server or pool address? [no]:
Enter
yesto confirm the server configuration.Continue to configure the system with these values? [no]:
yes- The installation script now configures the server. Wait for the operation to complete.
The installation script produces a file with DNS resource records:
the /tmp/ipa.system.records.UFRPto.dbfile in the example output below. Add these records to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.... Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server ...
ImportantThe server installation is not complete until you add the DNS records to the existing DNS servers.
Additional resources
- For more information about the DNS resource records you must add to your DNS system, see IdM DNS records for external DNS systems.
6.2. Non-interactive installation
This procedure installs a server without integrated DNS or with integrated Identity Management (IdM) certificate authority (CA) as the root CA, which is the default CA configuration.
The ipa-server-install installation script creates a log file at /var/log/ipaserver-install.log. If the installation fails, the log can help you identify the problem.
Procedure
Run the
ipa-server-installutility with the options to supply all the required information. The minimum required options for non-interactive installation are:-
--realmto provide the Kerberos realm name -
--ds-passwordto provide the password for the Directory Manager (DM), the Directory Server super user -
--admin-passwordto provide the password foradmin, the IdM administrator -
--unattendedto let the installation process select default options for the host name and domain name
For example:
# ipa-server-install --realm IDM.EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended-
The installation script produces a file with DNS resource records:
the /tmp/ipa.system.records.UFRPto.dbfile in the example output below. Add these records to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.... Restarting the KDC Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db Restarting the web server ...
ImportantThe server installation is not complete until you add the DNS records to the existing DNS servers.
Additional resources
- For more information about the DNS resource records you must add to your DNS system, see IdM DNS records for external DNS systems.
-
For a complete list of options accepted by ipa-server-install, run the
ipa-server-install --helpcommand.
6.3. IdM DNS records for external DNS systems
After installing an IdM server without integrated DNS, you must add LDAP and Kerberos DNS resource records for the IdM server to your external DNS system.
The ipa-server-install installation script generates a file containing the list of DNS resource records with a file name in the format /tmp/ipa.system.records.<random_characters>.db and prints instructions to add those records:
Please add records in this file to your DNS system: /tmp/ipa.system.records.6zdjqxh3.dbThis is an example of the contents of the file:
_kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._tcp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos._udp.example.com. 86400 IN SRV 0 100 88 server.example.com. _kerberos.example.com. 86400 IN TXT "EXAMPLE.COM" _kpasswd._tcp.example.com. 86400 IN SRV 0 100 464 server.example.com. _kpasswd._udp.example.com. 86400 IN SRV 0 100 464 server.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 server.example.com.
After adding the LDAP and Kerberos DNS resource records for the IdM server to your DNS system, ensure that the DNS management tools have not added PTR records for ipa-ca. The presence of PTR records for ipa-ca in your DNS could cause subsequent IdM replica installations to fail.
