Red Hat SummitEste contenido no está disponible en el idioma seleccionado.
3.4. Setting up an IdM Client Through Kickstart
A Kickstart enrollment automatically adds a new system to the IdM domain at the time Red Hat Enterprise Linux is installed. For details on Kickstart, see Kickstart Installations in the Installation Guide.
Preparing for a Kickstart client installation includes these steps:
3.4.1. Pre-creating a Client Host Entry on the IdM Server
- Log in as admin:
$ kinit admin
- Create the host entry on the IdM server, and set a temporary password for the entry:
$ ipa host-add client.example.com --password=secret
The password is used by Kickstart to authenticate during the client installation and expires after the first authentication attempt. After the client is successfully installed, it authenticates using its keytab.
3.4.2. Creating a Kickstart File for the Client
A Kickstart file used to set up an IdM client must include the following:
- The ipa-client package in the list of packages to be installed:
%packages @ X Window System @ Desktop @ Sound and Video
ipa-client...See Package Selection in the Installation Guide for details. - Post-installation instructions that:
- ensure SSH keys are generated before enrollment
- runs the
ipa-client-installutility, specifying:- all required information to access and configure the IdM domain services
- the password which you set when pre-creating the client host on the IdM server, in Section 3.4.1, “Pre-creating a Client Host Entry on the IdM Server”
For example:%post --log=/root/ks-post.log # Generate SSH keys to ensure that ipa-client-install uploads them to the IdM server /usr/sbin/sshd-keygen # Run the client install script /usr/sbin/ipa-client-install --hostname=client.example.com --domain=EXAMPLE.COM --enable-dns-updates --mkhomedir -w secret --realm=EXAMPLE.COM --server=server.example.com
For a non-interactive installation, add also the--unattendedoption.To let the client installation script request a certificate for the machine:- Add the
--request-certoption toipa-client-install. - Set the system bus address to
/dev/nullfor both thegetcertandipa-client-installutility in the kickstartchrootenvironment. To do this, add these lines to the post-installation instruction file before theipa-client-installinstruction:# env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null getcert list # env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null ipa-client-install
NoteRed Hat recommends not to start thesshdservice prior to the kickstart enrollment. While startingsshdbefore enrolling the client generates the SSH keys automatically, using the above script is the preferred solution.See Post-installation Script in the Installation Guide for details.
For details on using Kickstart, see How Do You Perform a Kickstart Installation? in the Installation Guide. For examples of Kickstart files, see Sample Kickstart Configurations.
