Linux 域身份、身份验证和策略指南

[root@server ~]# ip addr show
...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
	link/ether 00:1a:4a:10:4e:33 brd ff:ff:ff:ff:ff:ff
	inet 192.0.2.1/24 brd 192.0.2.255 scope global dynamic eth0
		valid_lft 106694sec preferred_lft 106694sec
	inet6 2001:DB8::1111/32 scope global dynamic
 		valid_lft 2591521sec preferred_lft 604321sec
	inet6 fe80::56ee:75ff:fe2b:def6/64 scope link
	       valid_lft forever preferred_lft forever

1. 使用 firewall-cmd --add-port 命令在防火墙中添加各个端口。例如，要在默认区中打开端口：

   # firewall-cmd --permanent --add-port={80/tcp,443/tcp,list_of_ports}

2. 使用 firewall-cmd --add-service 命令在防火墙中添加 firewalld 服务。例如，要在默认区中打开端口：

   # firewall-cmd --permanent --add-service={freeipa-ldap,list_of_services}

# firewall-cmd --reload

# firewall-cmd --runtime-to-permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,88/udp,464/tcp,464/udp,53/tcp,53/udp,123/udp}

# ipa-server-install --external-cert-file=/tmp/servercert20110601.pem --external-cert-file=/tmp/cacert.pem

1. 如果您的系统上正确设置了 DNS 区域和 SRV 记录，脚本会自动发现所有需要的值并打印它们。输入 yes 以确认。

   Client hostname: client.example.com
   Realm: EXAMPLE.COM
   DNS Domain: example.com
   IPA Server: server.example.com
   BaseDN: dc=example,dc=com
   
   Continue to configure the system with these values? [no]: yes

   如果要使用不同值安装系统，请取消当前安装。然后再次运行 ipa-client-install，并使用命令行选项指定所需的值。
   详情请查看 ipa-client-install(1) man page 中的 DNS 自动发现 部分。
2. 如果脚本自动获取一些设置，它会提示您输入这些值。
   重要
   不要使用单标签域名，例如 .company：IdM 域必须由一个或多个子域和一个顶层域组成，如 example.com 或 company.example.com。

   完全限定域名必须满足以下条件：

   • 它是一个有效的 DNS 名称，即只允许数字、字母字符和连字符(-)。主机名中的其他字符（如下划线(_)）会导致 DNS 失败。
   • 都是小写。不允许使用大写字母。
   • 完全限定域名不能解析到环回地址。它必须解析到计算机的公共 IP 地址，而不是 127.0.0.1。

   有关其他推荐的命名实践，请参阅 Red Hat Enterprise Linux 安全指南中的 推荐命名实践。

User authorized to enroll computers: admin
Password for admin@EXAMPLE.COM

Client configuration complete.

$ kinit admin

$ ipa host-add client.example.com --password=secret

# ipa-client-install --force-join

User authorized to enroll computers: admin
Password for admin@EXAMPLE.COM

# ipa-client-install --keytab /tmp/krb5.keytab

1. 以管理员身份登录。

   $ kinit admin

2. 将客户端机器添加到 ipaservers 主机组中。

   $ ipa hostgroup-add-member ipaservers --hosts client.example.com
     Host-group: ipaservers
     Description: IPA server hosts
     Member hosts: server.example.com, client.example.com
   -------------------------
   Number of members added 1
   -------------------------

   ipaservers 中的成员资格授予机器提升的权限，类似于管理员的凭证。

# ipa-replica-install

1. 以管理员身份登录。

   $ kinit admin

2. 将新机器作为 IdM 主机添加。在 ipa host-add 命令中使用 --random 选项来生成用于副本安装的随机一次性密码。

   $ ipa host-add client.example.com --random
   --------------------------------------------------
   Added host "client.example.com"
   --------------------------------------------------
     Host name: client.example.com
     Random password: W5YpARl=7M.n
     Password: True
     Keytab: False
     Managed by: server.example.com

   当使用生成的密码将机器注册到 IdM 域后，生成的密码将变为无效。注册完成后，它将被一个正确的主机 keytab 替换。
3. 将机器添加到 ipaservers 主机组中。

   $ ipa hostgroup-add-member ipaservers --hosts client.example.com
     Host-group: ipaservers
     Description: IPA server hosts
     Member hosts: server.example.com, client.example.com
   -------------------------
   Number of members added 1
   -------------------------

   ipaservers 中的成员资格授予设置所需服务器服务所需的机器提升特权。

# ipa-replica-install --password 'W5YpARl=7M.n'

# ipa-replica-install --setup-dns --forwarder 192.0.2.1

1. 为 DOMAIN 和 NAMESERVER 变量设置适当的值：

   # DOMAIN=example.com
   # NAMESERVER=replica

2. 使用以下命令检查 DNS 条目：

   # for i in _ldap._tcp _kerberos._tcp _kerberos._udp _kerberos-master._tcp _kerberos-master._udp _ntp._udp ; do
   dig @${NAMESERVER} ${i}.${DOMAIN} srv +nocmd +noquestion +nocomments +nostats +noaa +noadditional +noauthority
   done | egrep "^_"
   
   _ldap._tcp.example.com. 86400     IN    SRV     0 100 389 server1.example.com.
   _ldap._tcp.example.com. 86400     IN    SRV     0 100 389 server2.example.com.
   _kerberos._tcp.example.com. 86400 IN    SRV     0 100 88  server1.example.com.
   ...

[root@replica ~]# ipa-replica-install --setup-ca

[root@replica ~]# ipa-replica-install \
    --dirsrv-cert-file /tmp/server.crt \
    --dirsrv-cert-file /tmp/server.key \
    --dirsrv-pin secret \
    --http-cert-file /tmp/server.crt \
    --http-cert-file /tmp/server.key \
    --http-pin secret

# scp /etc/krb5.conf root@externalmachine.example.com:/etc/krb5_ipa.conf

$ export KRB5_CONFIG=/etc/krb5_ipa.conf

$ ipa topologysegment-add
Suffix name: domain
Left node: server1.example.com
Right node: server2.example.com
Segment name [server1.example.com-to-server2.example.com]: new_segment
---------------------------
Added segment "new_segment"
---------------------------
  Segment name: new_segment
  Left node: server1.example.com
  Right node: server2.example.com
  Connectivity: both

$ ipa topologysegment-show
Suffix name: domain
Segment name: new_segment
  Segment name: new_segment
  Left node: server1.example.com
  Right node: server2.example.com
  Connectivity: both

$ ipa topologysegment-find
Suffix name: domain
------------------
8 segments matched
------------------
  Segment name: new_segment
  Left node: server1.example.com
  Right node: server2.example.com
  Connectivity: both

...

----------------------------
Number of entries returned 8
----------------------------

$ ipa topologysegment-del
Suffix name: domain
Segment name: new_segment
-----------------------------
Deleted segment "new_segment"
-----------------------------

$ ipa topologysegment-find
Suffix name: domain
------------------
7 segments matched
------------------
  Segment name: server2.example.com-to-server3.example.com
  Left node: server2.example.com
  Right node: server3.example.com
  Connectivity: both

...

----------------------------
Number of entries returned 7
----------------------------

[user@server2 ~]$ ipa server-del
Server name: server1.example.com
Removing server1.example.com from replication topology, please wait...
----------------------------------------------------------
Deleted IPA server "server1.example.com"
----------------------------------------------------------

[root@server1 ~]# ipa server-install --uninstall

[root@rhel7 ~]# scp /usr/share/ipa/copy-schema-to-ca.py root@rhel6:/root/

[root@rhel6 ~]# python copy-schema-to-ca.py
ipa         : INFO     Installed /etc/dirsrv/slapd-PKI-IPA//schema/60kerberos.ldif
[... output truncated ...]
ipa         : INFO     Schema updated successfully

[root@rhel6 ~]# ipa-replica-prepare rhel7.example.com --ip-address 192.0.2.1

Directory Manager (existing master) password:
Preparing replica for rhel7.example.com from rhel6.example.com
[... output truncated ...]
The ipa-replica-prepare command was successful

[root@rhel6 ~]# scp /var/lib/ipa/replica-info-replica.example.com.gpg root@rhel7:/var/lib/ipa/

+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha

[root@rhel7 ~]# ipa-replica-install /var/lib/ipa/replica-info-rhel7.example.com.gpg --setup-ca --ip-address 192.0.2.1 --setup-dns --forwarder 192.0.2.20
Directory Manager (existing master) password:

Checking DNS forwarders, please wait ...
Run connection check to master
[... output truncated ...]
Client configuration complete.

[root@rhel7 ~]# ipactl status
Directory Service: RUNNING
[... output truncated ...]
ipa: INFO: The ipactl command was successful

[root@rhel6 ~]# getcert stop-tracking -d /var/lib/pki-ca/alias -n "auditSigningCert cert-pki-ca"
Request "20201127184547" removed.
[root@rhel6 ~]# getcert stop-tracking -d /var/lib/pki-ca/alias -n "ocspSigningCert cert-pki-ca"
Request "20201127184548" removed.
[root@rhel6 ~]# getcert stop-tracking -d /var/lib/pki-ca/alias -n "subsystemCert cert-pki-ca"
Request "20201127184549" removed.
[root@rhel6 ~]# getcert stop-tracking -d /etc/httpd/alias -n ipaCert
Request "20201127184550" removed.

1. 将续订帮助程序脚本复制到 certmonger 服务目录中，并设置适当的权限。

   [root@rhel6 ~]# cp /usr/share/ipa/ca_renewal /var/lib/certmonger/cas/
   [root@rhel6 ~]# chmod 0600 /var/lib/certmonger/cas/ca_renewal

2. 更新 SELinux 配置。

   [root@rhel6 ~]# restorecon /var/lib/certmonger/cas/ca_renewal

3. 重新启动 certmonger。

   [root@rhel6 ~]# service certmonger restart

4. 检查 CA 是否已列出以检索证书。

   [root@rhel6 ~]# getcert list-cas
   ...
   CA 'dogtag-ipa-retrieve-agent-submit':
           is-default: no
           ca-type: EXTERNAL
   	helper-location: /usr/libexec/certmonger/dogtag-ipa-retrieve-agent-submit

5. 获取 CA 证书数据库 PIN。

   [root@rhel6 ~]# grep internal= /var/lib/pki-ca/conf/password.conf

6. 配置 certmonger 以跟踪外部续订的证书。这需要数据库 PIN。

   [root@rhel6 ~]# getcert start-tracking \
       -c dogtag-ipa-retrieve-agent-submit \
       -d /var/lib/pki-ca/alias \
       -n "auditSigningCert cert-pki-ca" \
       -B /usr/lib64/ipa/certmonger/stop_pkicad \
       -C '/usr/lib64/ipa/certmonger/restart_pkicad \
       "auditSigningCert cert-pki-ca"' \
       -T "auditSigningCert cert-pki-ca" \
       -P database_pin
   New tracking request "20201127184743" added.
   [root@rhel6 ~]# getcert start-tracking \
       -c dogtag-ipa-retrieve-agent-submit \
       -d /var/lib/pki-ca/alias \
       -n "ocspSigningCert cert-pki-ca" \
       -B /usr/lib64/ipa/certmonger/stop_pkicad \
       -C '/usr/lib64/ipa/certmonger/restart_pkicad \
       "ocspSigningCert cert-pki-ca"' \
       -T "ocspSigningCert cert-pki-ca" \
       -P database_pin
   New tracking request "20201127184744" added.
   [root@rhel6 ~]# getcert start-tracking \
       -c dogtag-ipa-retrieve-agent-submit \
       -d /var/lib/pki-ca/alias \
       -n "subsystemCert cert-pki-ca" \
       -B /usr/lib64/ipa/certmonger/stop_pkicad \
       -C '/usr/lib64/ipa/certmonger/restart_pkicad \
       "subsystemCert cert-pki-ca"' \
       -T "subsystemCert cert-pki-ca" \
       -P database_pin
   New tracking request "20201127184745" added.
   [root@rhel6 ~]# getcert start-tracking \
       -c dogtag-ipa-retrieve-agent-submit \
       -d /etc/httpd/alias \
       -n ipaCert \
       -C /usr/lib64/ipa/certmonger/restart_httpd \
       -T ipaCert \
       -p /etc/httpd/alias/pwdfile.txt
   New tracking request "20201127184746" added.

1. 停止 CA 服务。

   [root@rhel6 ~]# service pki-cad stop

2. 在 rhel6.example.com 中禁用 CRL 生成。打开 /var/lib/pki-ca/conf/CS.cfg 文件，并将 ca.crl.MasterCRL.enableCRLCache 和 ca.crl.MasterCRLUpdates 参数的值设置为 false。

   ca.crl.MasterCRL.enableCRLCache=false
   ca.crl.MasterCRL.enableCRLUpdates=false

3. 启动 CA 服务。

   [root@rhel6 ~]# service pki-cad start

1. 打开 /etc/httpd/conf.d/ipa-pki-proxy.conf 文件，取消注释 RewriteRule 条目：

   RewriteRule ^/ipa/crl/MasterCRL.bin https://rhel6.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]

   注意
   不要替换 URL 中的服务器主机名。URL 必须引用本地主机名。
2. 重新启动 Apache.

   [root@rhel6 ~]# service httpd restart

1. 配置 rhel7.example.com 以处理 CA 子系统证书续订，如 第 D.4.1 节 “更改 Which 服务器处理证书续订” 所述。
2. 将 rhel7.example.com 配置为常规证书撤销列表(CRL)，如 第 6.5.2.2 节 “更改 Which Server Generates CRL” 所述。

[root@server ~]# cat >keygen <<EOF
> %echo Generating a standard key
> Key-Type: RSA
> Key-Length:2048
> Name-Real: IPA Backup
> Name-Comment: IPA Backup
> Name-Email: root@example.com
> Expire-Date: 0
> %pubring /root/backup.pub
> %secring /root/backup.sec
> %commit
> %echo done
> EOF
[root@server ~]#

[root@server ~]# gpg --batch --gen-key keygen
[root@server ~]# gpg --no-default-keyring --secret-keyring /root/backup.sec \
		     --keyring /root/backup.pub --list-secret-keys

[root@server ~]# systemctl stop sssd

[root@server ~]# find /var/lib/sss/ ! -type d | xargs rm -f

[root@server ~]# systemctl start sssd

$ ipa automountlocation-add userdirs
Location: userdirs

$ ipa automountkey-add userdirs auto.direct --key=/share --info="-ro,soft, server.example.com:/home/share"

Key: /share
Mount information: -ro,soft, server.example.com:/home/share

1. 添加 provisionator 用户帐户：

   $ ipa user-add provisionator --first=provisioning --last=account --password

2. 为 provisionator 用户授予所需的特权。
   创建一个自定义角色 System Provisioning ，来管理添加 stage 用户：

   $ ipa role-add --desc "Responsible for provisioning stage users" "System Provisioning"

   将 Stage User Provisioning 特权添加到该角色。这个特权提供了添加 stage 用户的能力：

   $ ipa role-add-privilege "System Provisioning" --privileges="Stage User Provisioning"

   将 provisionator 用户添加到角色中：

   $ ipa role-add-member --users=provisionator "System Provisioning"

1. 添加 activator 用户帐户：

   $ ipa user-add activator --first=activation --last=account --password

2. 授予 activator 用户所需的特权。
   将用户添加到默认的 User Administrator 角色中：

   $ ipa role-add-member --users=activator "User Administrator"

$ ipa group-add service-accounts

$ ipa pwpolicy-add service-accounts --maxlife=10000 --minlife=0 --history=0 --minclasses=4 --minlength=20 --priority=1 --maxfail=0 --failinterval=1 --lockouttime=0

$ ipa group-add-member service-accounts --users={provisionator,activator}

$ kpasswd provisionator
$ kpasswd activator

# ipa-getkeytab -s example.com -p "activator" -k /etc/krb5.ipa-activation.keytab

#!/bin/bash

kinit -k -i activator

ipa stageuser-find --all --raw | grep "  uid:" | cut -d ":" -f 2 | while read uid; do ipa stageuser-activate ${uid}; done

# chmod 755 /usr/local/sbin/ipa-activate-all
# chown root:root /usr/local/sbin/ipa-activate-all

[Unit]
Description=Scan IdM every minute for any stage users that must be activated

[Service]
Environment=KRB5_CLIENT_KTNAME=/etc/krb5.ipa-activation.keytab
Environment=KRB5CCNAME=FILE:/tmp/krb5cc_ipa-activate-all
ExecStart=/usr/local/sbin/ipa-activate-all

[Unit]
Description=Scan IdM every minute for any stage users that must be activated

[Timer]
OnBootSec=15min
OnUnitActiveSec=1min

[Install]
WantedBy=multi-user.target

# systemctl enable ipa-activate-all.timer