{"id":44146,"date":"2025-06-17T10:20:35","date_gmt":"2025-06-17T02:20:35","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/44146.html"},"modified":"2025-06-17T10:20:35","modified_gmt":"2025-06-17T02:20:35","slug":"%e5%9c%a8rhel-centos-8%e4%b8%ad%e5%ae%89%e8%a3%85%e5%92%8c%e9%85%8d%e7%bd%aefreeipa%e6%9c%8d%e5%8a%a1%e5%99%a8","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/44146.html","title":{"rendered":"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668"},"content":{"rendered":"

\u5728\u6211\u4e4b\u524d\u7684\u6587\u7ae0\u4e2d，\u6211\u5206\u4eab\u4e86\u5728 CentOS\/RHEL 7 \u4e2d\u5b89\u88c5\u548c\u8bbe\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u3002\u73b0\u5728，\u5728\u672c\u6587\u4e2d，\u6211\u5c06\u5206\u4eab\u5728 RHEL 8 \u548c\/\u6216 CentOS 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u3002\u73b0\u5728，\u5728 RHEL 8 \u4e2d，openldap-servers \u5df2\u88ab\u5f03\u7528，\u800c\u4e14 rpm \u4e5f\u4e0d\u518d\u53ef\u7528\u3002\u56e0\u6b64，\u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684 rpm \u5df2\u66f4\u6539，\u6211\u4eec\u5c06\u5728\u672c\u6587\u4e2d\u6df1\u5165\u8ba8\u8bba\u3002ipa-server<\/span><\/span><\/p>\n

FreeIPA \u662f\u4e00\u79cd\u4f7f\u7528\u672c\u673a Linux \u5de5\u5177\u5728 Linux \u7cfb\u7edf\u4e0a\u521b\u5efa\u8eab\u4efd\u5b58\u50a8\u3001\u96c6\u4e2d\u8eab\u4efd\u9a8c\u8bc1\u3001Kerberos \u548c DNS \u670d\u52a1\u7684\u57df\u63a7\u5236\u4ee5\u53ca\u6388\u6743\u7b56\u7565\u7684\u65b9\u6cd5\u3002\u867d\u7136\u96c6\u4e2d\u5f0f\u8eab\u4efd\/\u7b56\u7565\/\u6388\u6743\u8f6f\u4ef6\u5e76\u4e0d\u662f\u4ec0\u4e48\u65b0\u9c9c\u4e8b\u7269，\u4f46 FreeIPA \u662f\u652f\u6301 Linux\/Unix \u57df\u7684\u552f\u4e00\u9009\u9879\u4e4b\u4e00\u3002IPA \u4ee3\u8868\u00a0Identity\u3001Policy \u548c\u00a0Authentication\u3002<\/span><\/span><\/p>\n

\n

\"\u9010\u6b65\u6559\u7a0b：\u5728RHEL<\/p>\n

\u00a0<\/span><\/span><\/p>\n

\u6211\u4eec\u5c06\u6db5\u76d6\u7684\u4e3b\u9898\u00a0\u00a0\u9690\u85cf\u00a0<\/span><\/span><\/span><\/span> <\/p>\n

FreeIPA \u4e0e LDAP：\u4e00\u79cd\u66f4\u4e13\u6ce8\u7684\u670d\u52a1\u7c7b\u578b<\/span><\/span><\/span><\/span> <\/p>\n

\u8eab\u4efd\u7ba1\u7406 （FreeIPA） \u670d\u52a1\u5668<\/span><\/span><\/span><\/span> <\/p>\n

Identity Management （FreeIPA） \u5ba2\u6237\u7aef<\/span><\/span><\/span><\/span> <\/p>\n

\u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u5148\u51b3\u6761\u4ef6<\/span><\/span><\/span><\/span> <\/p>\n

\u5b89\u88c5\u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u6240\u9700\u7684 RPM<\/span><\/span><\/span><\/span> <\/p>\n

\u5728RHEL 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668，\u5e76\u96c6\u6210DNS\u548cCA\u8bc1\u4e66<\/span><\/span><\/span><\/span> <\/p>\n

\u8bbf\u95ee IPA \u670d\u52a1\u5668\u7684 WebGUI<\/span><\/span><\/span><\/span> <\/p>\n

\u5c06\u7cfb\u7edf\u8bbe\u7f6e\u4e3a FreeIPA \u5ba2\u6237\u7aef<\/span><\/span><\/span><\/span> <\/p>\n

\u5b89\u88c5 Identity Management \u5ba2\u6237\u7aef\u6240\u9700\u7684\u8f6f\u4ef6\u5305<\/span><\/span><\/span><\/span> <\/p>\n

\u5b89\u88c5 Identity Management \u5ba2\u6237\u7aef<\/span><\/span><\/span><\/span> <\/p>\n

\u5378\u8f7d Identity Management \u5ba2\u6237\u7aef<\/span><\/span><\/span><\/span> <\/p>\n

FreeIPA \u4e0e LDAP：\u4e00\u79cd\u66f4\u4e13\u6ce8\u7684\u670d\u52a1\u7c7b\u578b<\/span><\/span><\/h3>\n

\u5728\u6700\u57fa\u672c\u7684\u5c42\u9762\u4e0a，FreeIPA \u662f Linux \u548c Unix \u8ba1\u7b97\u673a\u7684\u57df\u63a7\u5236\u5668\u3002FreeIPA \u4f7f\u7528\u63a7\u5236\u670d\u52a1\u5668\u548c\u5df2\u6ce8\u518c\u7684\u5ba2\u6237\u7aef\u8ba1\u7b97\u673a\u5b9a\u4e49\u57df\u3002\u8fd9\u63d0\u4f9b\u4e86\u4ee5\u524d Linux\/Unix \u73af\u5883\u4e0d\u53ef\u7528\u7684\u96c6\u4e2d\u5f0f\u7ed3\u6784，\u5e76\u4e14\u5b83\u4f7f\u7528\u672c\u673a Linux \u5e94\u7528\u7a0b\u5e8f\u548c\u534f\u8bae\u6765\u5b9e\u73b0\u3002<\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

FreeIPA \u505a\u4e09\u4ef6\u4e8b：<\/span><\/span><\/h4>\n
    \n
  • \u521b\u5efa\u57fa\u4e8e Linux \u548c Linux \u63a7\u5236\u7684\u57df\u3002FreeIPA \u670d\u52a1\u5668\u548c FreeIPA \u5ba2\u6237\u7aef\u90fd\u662f Linux \u6216 Unix \u8ba1\u7b97\u673a\u3002\u867d\u7136 FreeIPA \u53ef\u4ee5\u4e0e Active Directory \u57df\u540c\u6b65\u6570\u636e\u4ee5\u5141\u8bb8\u4e0e Windows \u670d\u52a1\u5668\u96c6\u6210，\u4f46\u5b83\u4e0d\u662f Windows \u8ba1\u7b97\u673a\u7684\u7ba1\u7406\u5de5\u5177，\u4e5f\u4e0d\u652f\u6301 Windows \u5ba2\u6237\u7aef\u3002FreeIPA \u662f Linux \u57df\u7684\u7ba1\u7406\u5de5\u5177\u3002<\/li>\n
  • \u96c6\u4e2d\u8eab\u4efd\u7ba1\u7406\u548c\u8eab\u4efd\u7b56\u7565\u3002<\/li>\n
  • \u57fa\u4e8e\u73b0\u6709\u7684\u539f\u751f Linux \u5e94\u7528\u7a0b\u5e8f\u548c\u534f\u8bae\u8fdb\u884c\u6784\u5efa\u3002\u867d\u7136 FreeIPA \u6709\u81ea\u5df1\u7684\u6d41\u7a0b\u548c\u914d\u7f6e，\u4f46\u5176\u5e95\u5c42\u6280\u672f\u4e3a Linux \u7ba1\u7406\u5458\u6240\u719f\u6089\u548c\u4fe1\u4efb，\u5e76\u4e14\u5728 Linux \u7cfb\u7edf\u4e0a\u5df2\u7ecf\u5efa\u7acb\u8d77\u6765\u3002<\/li>\n<\/ul>\n

    \u00a0<\/span><\/span><\/p>\n

    \u8eab\u4efd\u7ba1\u7406 （FreeIPA） \u670d\u52a1\u5668<\/span><\/span><\/h3>\n
      \n
    • \u8eab\u4efd\u7ba1\u7406\u670d\u52a1\u5668\u662f\u7528\u4f5c\u57df\u63a7\u5236\u5668 （DC） \u7684 Red Hat Enterprise Linux \u7cfb\u7edf\u3002\u5728\u5927\u591a\u6570\u90e8\u7f72\u4e2d，\u96c6\u6210\u7684\u8bc1\u4e66\u9881\u53d1\u673a\u6784 （CA） \u4e5f\u4e0e IdM \u670d\u52a1\u5668\u4e00\u8d77\u5b89\u88c5\u3002<\/li>\n
    • \u670d\u52a1\u5668\u662f\u8eab\u4efd\u548c\u7b56\u7565\u4fe1\u606f\u7684\u4e2d\u592e\u5b58\u50a8\u5e93\u3002\u5b83\u4eec\u8fd8\u6258\u7ba1\u57df\u6210\u5458\u4f7f\u7528\u7684\u670d\u52a1\u3002<\/li>\n<\/ul>\n

      \u00a0<\/span><\/span><\/p>\n

      Identity Management （FreeIPA） \u5ba2\u6237\u7aef<\/span><\/span><\/h3>\n
        \n
      • \u8eab\u4efd\u7ba1\u7406\u5ba2\u6237\u7aef\u662f\u5411\u670d\u52a1\u5668\u6ce8\u518c\u5e76\u914d\u7f6e\u4e3a\u4f7f\u7528\u8fd9\u4e9b\u670d\u52a1\u5668\u4e0a\u7684\u8eab\u4efd\u7ba1\u7406\u670d\u52a1\u7684 Red Hat Enterprise Linux \u7cfb\u7edf\u3002<\/li>\n
      • \u5ba2\u6237\u7aef\u4e0e Identity Management \u670d\u52a1\u5668\u4ea4\u4e92\u4ee5\u8bbf\u95ee\u5b83\u4eec\u63d0\u4f9b\u7684\u670d\u52a1\u3002\u4f8b\u5982，\u5ba2\u6237\u7aef\u4f7f\u7528 Kerberos \u534f\u8bae\u6267\u884c\u8eab\u4efd\u9a8c\u8bc1\u5e76\u83b7\u53d6\u4f01\u4e1a SSO \u7684\u7968\u8bc1，\u4f7f\u7528 LDAP \u83b7\u53d6\u8eab\u4efd\u548c\u7b56\u7565\u4fe1\u606f，\u4f7f\u7528 DNS \u68c0\u6d4b\u670d\u52a1\u5668\u548c\u670d\u52a1\u7684\u4f4d\u7f6e\u4ee5\u53ca\u5982\u4f55\u8fde\u63a5\u5230\u5b83\u4eec\u3002<\/li>\n
      • Identity Management \u670d\u52a1\u5668\u4e5f\u662f\u5d4c\u5165\u5f0f Identity Management \u5ba2\u6237\u7aef\u3002\u5f53\u5ba2\u6237\u7aef\u5411\u81ea\u8eab\u6ce8\u518c\u65f6，\u670d\u52a1\u5668\u63d0\u4f9b\u4e0e\u5176\u4ed6\u5ba2\u6237\u7aef\u76f8\u540c\u7684\u529f\u80fd\u3002<\/li>\n<\/ul>\n

        \u53e6\u8bf7\u53c2\u9605<\/span><\/span><\/span><\/span> <\/p>\n

        \u5982\u4f55\u5728 Linux \u4e2d\u5b89\u88c5 apr \u548c apr-util [\u5206\u6b65]<\/span><\/span><\/span> <\/p>\n

        \u00a0<\/span><\/span><\/p>\n

        \u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u5148\u51b3\u6761\u4ef6<\/span><\/span><\/h3>\n

        \u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u4e4b\u524d，\u8bf7\u786e\u4fdd\u5b89\u88c5\u73af\u5883\u5df2\u6b63\u786e\u914d\u7f6e\u3002\u5728\u5b89\u88c5\u548c\u914d\u7f6e\u8fc7\u7a0b\u4e2d，\u60a8\u8fd8\u9700\u8981\u63d0\u4f9b\u67d0\u4e9b\u4fe1\u606f，\u5305\u62ec\u9886\u57df\u540d\u79f0\u4ee5\u53ca\u67d0\u4e9b\u7528\u6237\u540d\u548c\u5bc6\u7801\u3002<\/span><\/span><\/p>\n

        \u00a0<\/span><\/span><\/p>\n

        \u786c\u4ef6\u5efa\u8bae<\/span><\/span><\/h4>\n

        \u57fa\u672c\u7528\u6237\u6761\u76ee\u6216\u5e26\u6709\u8bc1\u4e66\u7684\u7b80\u5355\u4e3b\u673a\u6761\u76ee\u7684\u5927\u5c0f\u7ea6\u4e3a 5-10 kB，\u5e26\u6709\u8bc1\u4e66\u7684\u7b80\u5355\u4e3b\u673a\u6761\u76ee\u4e5f\u662f\u5982\u6b64\u3002\u8981\u6b63\u786e\u8c03\u6574\u5927\u5c0f\u7684\u6700\u91cd\u8981\u7684\u786c\u4ef6\u529f\u80fd\u662f RAM\u3002\u867d\u7136\u6240\u6709\u90e8\u7f72\u90fd\u4e0d\u540c，\u4f46\u6839\u636e\u7528\u6237\u548c\u7ec4\u7684\u6570\u91cf\u4ee5\u53ca\u5b58\u50a8\u7684\u6570\u636e\u7c7b\u578b，\u6709\u4e00\u4e2a\u7ecf\u9a8c\u6cd5\u5219\u53ef\u7528\u4e8e\u5e2e\u52a9\u786e\u5b9a\u8981\u4f7f\u7528\u591a\u5c11 RAM：<\/span><\/span><\/p>\n

          \n
        • \u5bf9\u4e8e 10000 \u4e2a\u7528\u6237\u548c 100 \u4e2a\u7ec4：\u81f3\u5c11 3 GB \u7684 RAM \u548c 1 GB \u7684\u4ea4\u6362\u7a7a\u95f4<\/li>\n
        • \u5bf9\u4e8e 100,000 \u4e2a\u7528\u6237\u548c 50,000 \u4e2a\u7ec4：\u81f3\u5c11 16 GB \u7684 RAM \u548c 4 GB \u7684\u4ea4\u6362\u7a7a\u95f4<\/li>\n<\/ul>\n

          \u00a0<\/span><\/span><\/p>\n

          \u9a8c\u8bc1\u670d\u52a1\u5668\u4e3b\u673a\u540d<\/span><\/span><\/h4>\n

          \u8981\u5728 RHEL 8 \u4e2d\u914d\u7f6e freeipa \u670d\u52a1\u5668，\u4e3b\u673a\u540d\u5fc5\u987b\u662f\u5b8c\u5168\u9650\u5b9a\u57df\u540d，\u4f8b\u5982 server.example.com\u3002<\/span><\/span><\/p>\n

          \u8981\u9a8c\u8bc1\u4e3b\u673a\u540d，\u8bf7\u4f7f\u7528\u8981\u5b89\u88c5\u7684\u7cfb\u7edf\u4e0a\u7684 hostname \u5b9e\u7528\u7a0b\u5e8f：<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          # hostname
          \nipa-server.example.com<\/span><\/span> <\/p>\n

          hostname \u7684\u8f93\u51fa\u4e0d\u80fd\u4e3a \u6216 \u3002localhostlocalhost6<\/span><\/span><\/p>\n

          \u5e7f\u544a<\/span><\/span><\/span><\/span> <\/p>\n

          \u4e0b\u9762\u662f\u4e00\u4e2a\u6587\u4ef6\u793a\u4f8b\/etc\/hosts<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# cat \/etc\/hosts
          \n127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
          \n::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
          \n10.0.2.20 ipa-server.example.com ipa-server<\/span><\/span><\/span> <\/p>\n

          \u00a0<\/span><\/span><\/p>\n

          Firewalld \u914d\u7f6e<\/span><\/span><\/h4>\n

          \u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u4e4b\u524d，\u8bf7\u52a1\u5fc5\u6253\u5f00\u91cd\u8981\u7aef\u53e3\u3002<\/span><\/span><\/p>\n\n\u670d\u52a1<\/span><\/span>\u6e2f\u53e3<\/span><\/span>\u534f\u8bae<\/span><\/span><\/tr>\n\n\n\n\n\n\n
          HTTP\/HTTPS \u534f\u8bae<\/span><\/span><\/td>\n80,443<\/span><\/span><\/td>\nTCP \u534f\u8bae<\/span><\/span><\/td>\n<\/tr>\n
          LDAP\/LDAPS<\/span><\/span><\/td>\n389,636<\/span><\/span><\/td>\nTCP \u534f\u8bae<\/span><\/span><\/td>\n<\/tr>\n
          Kerberos （\u82f1\u8bed）<\/span><\/span><\/td>\n88,464<\/span><\/span><\/td>\nTCP \u548c UDP<\/span><\/span><\/td>\n<\/tr>\n
          DNS \u89e3\u6790<\/span><\/span><\/td>\n53<\/span><\/span><\/td>\nTCP \u548c UDP（\u53ef\u9009）<\/span><\/span><\/td>\n<\/tr>\n
          NTP<\/span><\/span><\/td>\n123<\/span><\/span><\/td>\nUDP （\u53ef\u9009）<\/span><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          \u00a0<\/span><\/span><\/p>\n

          \u4f7f\u7528\u547d\u4ee4\u5c06 firewalld \u670d\u52a1\u6dfb\u52a0\u5230\u9632\u706b\u5899\u3002\u4f8b\u5982，\u8981\u6253\u5f00\u9ed8\u8ba4\u533a\u57df\u4e2d\u7684\u7aef\u53e3：firewall-cmd –add-service<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          # firewall-cmd –permanent –add-service={freeipa-ldap,freeipa-ldaps,dns}<\/span><\/span> <\/p>\n

          \u91cd\u65b0\u52a0\u8f7d\u914d\u7f6e\u4ee5\u786e\u4fdd\u66f4\u6539\u7acb\u5373\u751f\u6548：firewall-cmd<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          # firewall-cmd –reload<\/span><\/span> <\/p>\n

          \u00a0<\/span><\/span><\/p>\n

          \u5b89\u88c5\u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u6240\u9700\u7684 RPM<\/span><\/span><\/h3>\n

          \u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u6240\u9700\u7684\u8f6f\u4ef6\u5305\u4ee5\u6a21\u5757\u5f62\u5f0f\u63d0\u4f9b\u3002IdM \u670d\u52a1\u5668\u6a21\u5757\u6d41\u79f0\u4e3a DL1 \u6d41，\u60a8\u9700\u8981\u5728\u4ece\u6b64\u6d41\u4e0b\u8f7d\u5305\u4e4b\u524d\u542f\u7528\u6b64\u6d41\u3002<\/span><\/span><\/p>\n

          \u6ce8\u610f：<\/span><\/span><\/span><\/span> <\/p>\n

          \u5728 RHEL \u7cfb\u7edf\u4e0a，\u60a8\u5fc5\u987b\u5177\u6709\u00a0RHN \u7684\u6709\u6548\u8ba2\u9605，\u6216\u8005\u60a8\u53ef\u4ee5\u914d\u7f6e\u672c\u5730\u79bb\u7ebf\u5b58\u50a8\u5e93，\u201cyum\u201d\u8f6f\u4ef6\u5305\u7ba1\u7406\u5668\u53ef\u4ee5\u4f7f\u7528\u8be5\u5b58\u50a8\u5e93\u5b89\u88c5\u63d0\u4f9b\u7684 rpm \u53ca\u5176\u4f9d\u8d56\u9879\u3002<\/span><\/span> <\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# yum module enable idm:DL1<\/span><\/span> <\/p>\n

          \u5207\u6362\u6a21\u5757\u6d41\u4e0d\u4f1a\u66f4\u6539\u5df2\u5b89\u88c5\u7684\u8f6f\u4ef6\u5305<\/span><\/span><\/p>\n

          \u5e7f\u544a<\/span><\/span><\/span><\/span> <\/p>\n

          \u5207\u6362\u5230\u901a\u8fc7\u6d41\u4f20\u8f93\u7684 RPM：idm:DL1<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# yum distro-sync
          \nUpdating Subscription Management repositories.
          \nLast metadata expiration check: 0:00:24 ago on Thu 26 Sep 2019 12:40:03 PM IST.
          \nDependencies resolved.
          \n================================================================================================
          \n Package Arch Version Repository Size
          \n================================================================================================
          \nInstalling:
          \n kernel-core x86_64 4.18.0-80.11.2.el8_0 ipa-server-for-x86_64-baseos-rpms 24 M
          \n kernel x86_64 4.18.0-80.11.2.el8_0 ipa-server-for-x86_64-baseos-rpms 424 k
          \n kernel-modules x86_64 4.18.0-80.11.2.el8_0 ipa-server-for-x86_64-baseos-rpms 20 M<\/p>\n

          <Output trimmed><\/span><\/p>\n

          Installed:
          \n kernel-core-4.18.0-80.11.2.el8_0.x86_64 kernel-4.18.0-80.11.2.el8_0.x86_64
          \n kernel-modules-4.18.0-80.11.2.el8_0.x86_64 grub2-tools-efi-1:2.02-66.el8_0.1.x86_64<\/p>\n

          Removed:
          \n kernel-4.18.0-80.el8.x86_64 kernel-core-4.18.0-80.el8.x86_64
          \n kernel-modules-4.18.0-80.el8.x86_64<\/p>\n

          Complete!<\/span><\/span> <\/p>\n

          \u00a0 \u5982\u679c\u5728\u4e0a\u8ff0\u6b65\u9aa4\u4e2d\u5b89\u88c5\u4e86\u65b0\u5185\u6838，\u5219\u6700\u597d\u91cd\u542f\u8282\u70b9\u4ee5\u6fc0\u6d3b\u65b0\u5185\u6838\u3002\u60a8\u8fd8\u53ef\u4ee5\u68c0\u67e5\u4e0b\u4e00\u4e2a\u5185\u6838\u7248\u672c\u5c06\u5728\u91cd\u542f\u540e\u52a0\u8f7d<\/span><\/span><\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# reboot<\/span><\/span> <\/p>\n

          \u8981\u4e0b\u8f7d\u5728\u5177\u6709\u96c6\u6210 DNS \u7684 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u6240\u9700\u7684\u8f6f\u4ef6\u5305，\u8bf7\u6267\u884c\u4ee5\u4e0b\u6b65\u9aa4：<\/span><\/span><\/p>\n

          \u63d0\u793a：<\/span><\/span><\/span><\/span> <\/p>\n

          \u8981\u4e0b\u8f7d\u5fc5\u8981\u7684\u8f6f\u4ef6\u5305，\u8bf7\u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA Server，\u800c\u65e0\u9700\u96c6\u6210 DNS：<\/span><\/span> <\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# yum module install idm:DL1\/server<\/span><\/span><\/span><\/span> <\/p>\n

          \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

          [root@ipa-server ~]# yum module install idm:DL1\/dns
          \nUpdating Subscription Management repositories.
          \nLast metadata expiration check: 0:16:42 ago on Thu 26 Sep 2019 12:40:03 PM IST.
          \nDependencies resolved.
          \n================================================================================================
          \n Package Arch Version Repository Size
          \n================================================================================================
          \nInstalling group\/module packages:
          \n ipa-server-dns noarch 4.7.1-11.module+el8+2842+7481110c
          \n ipa-server-for-x86_64-appstream-rpms 177 k
          \nInstalling dependencies:
          \n ldns x86_64 1.7.0-20.el8 ipa-server-for-x86_64-appstream-rpms 165 k
          \n bind-dyndb-ldap x86_64 11.1-13.module+el8+2555+b334d87b
          \n ipa-server-for-x86_64-appstream-rpms 130 k
          \n opendnssec x86_64 1.4.14-1.module+el8+2555+b334d87b
          \n ipa-server-for-x86_64-appstream-rpms 468 k
          \n bind x86_64 32:9.11.4-17.P2.el8_0.1 ipa-server-for-x86_64-appstream-rpms 2.1 M
          \n bind-pkcs11-utils x86_64 32:9.11.4-17.P2.el8_0.1 ipa-server-for-x86_64-appstream-rpms 225 k
          \n bind-pkcs11-libs x86_64 32:9.11.4-17.P2.el8_0.1 ipa-server-for-x86_64-appstream-rpms 1.1 M
          \n bind-pkcs11 x86_64 32:9.11.4-17.P2.el8_0.1 ipa-server-for-x86_64-appstream-rpms 378 k<\/p>\n

          <Output Trimmed><\/span><\/p>\n

          Installed:
          \n ipa-server-dns-4.7.1-11.module+el8+2842+7481110c.noarch
          \n ldns-1.7.0-20.el8.x86_64
          \n bind-dyndb-ldap-11.1-13.module+el8+2555+b334d87b.x86_64
          \n opendnssec-1.4.14-1.module+el8+2555+b334d87b.x86_64
          \n bind-32:9.11.4-17.P2.el8_0.1.x86_64
          \n bind-pkcs11-utils-32:9.11.4-17.P2.el8_0.1.x86_64
          \n bind-pkcs11-libs-32:9.11.4-17.P2.el8_0.1.x86_64
          \n bind-pkcs11-32:9.11.4-17.P2.el8_0.1.x86_64
          \n libitm-8.2.1-3.5.el8.x86_64
          \n opencryptoki-3.10.0-3.el8.x86_64
          \n opencryptoki-libs-3.10.0-3.el8.x86_64
          \n sqlite-3.26.0-3.el8.x86_64
          \n opencryptoki-icsftok-3.10.0-3.el8.x86_64<\/p>\n

          Complete!<\/span><\/span> <\/p>\n

          \u00a0<\/span><\/span><\/p>\n

          \u53e6\u8bf7\u53c2\u9605<\/span><\/span><\/span><\/span> <\/p>\n

          \u8bbe\u7f6e Samba Active Directory DC CentOS 15 \u7684 8 \u4e2a\u6b65\u9aa4<\/span><\/span><\/span> <\/p>\n

          \u5728RHEL 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668，\u5e76\u96c6\u6210DNS\u548cCA\u8bc1\u4e66<\/span><\/span><\/h3>\n

          FreeIPA \u8bbe\u7f6e\u811a\u672c\u5c06\u521b\u5efa\u4e00\u4e2a\u670d\u52a1\u5668\u5b9e\u4f8b，\u5176\u4e2d\u5305\u62ec\u4e3a FreeIPA \u57df\u914d\u7f6e\u6240\u6709\u5fc5\u9700\u7684\u670d\u52a1：<\/span><\/span><\/p>\n

            \n
          • \u7f51\u7edc\u65f6\u95f4\u5b88\u62a4\u7a0b\u5e8f （ntpd）<\/li>\n
          • \u4e00\u4e2a 389 Directory Server \u5b9e\u4f8b<\/li>\n
          • Kerberos \u5bc6\u94a5\u5206\u53d1\u4e2d\u5fc3 （KDC）<\/li>\n
          • \u963f\u5e15\u5947 （httpd）<\/li>\n
          • \u66f4\u65b0\u7684 SELinux \u76ee\u6807\u7b56\u7565<\/li>\n
          • Active Directory WinSync \u63d2\u4ef6<\/li>\n
          • \u8bc1\u4e66\u9881\u53d1\u673a\u6784<\/li>\n
          • \u81ea\u9009\u3002\u57df\u540d\u670d\u52a1 （DNS） \u670d\u52a1\u5668<\/li>\n<\/ul>\n

            \u00a0 \u8981\u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668，\u8bf7\u4ece\u7ec8\u7aef\u6267\u884c\u811a\u672c\u3002\u6b64\u811a\u672c\u53ef\u4ee5\u63a5\u53d7 FreeIPA \u5b9e\u4f8b\u4f7f\u7528\u7684\u670d\u52a1（\u5982 DNS \u548c Kerberos）\u7684\u7528\u6237\u5b9a\u4e49\u8bbe\u7f6e，\u4e5f\u53ef\u4ee5\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u6700\u5c11\u7684\u8f93\u5165\u9884\u5b9a\u4e49\u503c\u3002ipa-server-install<\/span><\/span><\/p>\n

            \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

            [root@ipa-server ~]# ipa-server-install –allow-zone-overlap<\/p>\n

            The log file for this installation can be found in \/var\/log\/ipaserver-install.log
            \n==============================================================================
            \nThis program will set up the IPA Server.
            \nVersion 4.7.1<\/p>\n

            This includes:
            \n * Configure a stand-alone CA (dogtag) for certificate management
            \n * Configure the NTP client (chronyd)
            \n * Create and configure an instance of Directory Server
            \n * Create and configure a Kerberos Key Distribution Center (KDC)
            \n * Configure Apache (httpd)
            \n * Configure the KDC to enable PKINIT<\/p>\n

            To accept the default shown in brackets, press the Enter key.<\/p>\n

            Do you want to configure integrated DNS (BIND)? [no]: yes<\/p>\n

            Enter the fully qualified domain name of the computer
            \non which you're setting up server software. Using the form
            \n.
            \nExample: master.example.com.<\/p>\n

            Server host name [ipa-server.example.com]:<\/span><\/p>\n

            Warning: skipping DNS resolution of host ipa-server.example.com
            \nThe domain name has been determined based on the host name.<\/p>\n

            Please confirm the domain name [example.com]:<\/span><\/p>\n

            The kerberos protocol requires a Realm name to be defined.
            \nThis is typically the domain name converted to uppercase.<\/p>\n

            Please provide a realm name [EXAMPLE.COM]:<\/span>
            \nCertain directory server operations require an administrative user.
            \nThis user is referred to as the Directory Manager and has full access
            \nto the Directory for system management tasks and will be added to the
            \ninstance of directory server created for IPA.
            \nThe password must be at least 8 characters long.<\/p>\n

            Directory Manager password:
            \nPassword (confirm):<\/span><\/p>\n

            The IPA server requires an administrative user, named 'admin'.
            \nThis user is a regular system account used for IPA server administration.<\/p>\n

            IPA admin password:
            \nPassword (confirm):<\/span><\/p>\n

            Checking DNS domain example.com., please wait …
            \nDNS zone example.com. already exists in DNS and is handled by server(s): a.iana-servers.net., b.iana-servers.net. Please make sure that the domain is properly delegated to this IPA server.
            \nInvalid IP address fe80::a00:27ff:fe26:9186 for ipa-server.example.com: cannot use link-local IP address fe80::a00:27ff:fe26:9186
            \nDo you want to configure DNS forwarders? [yes]:<\/span>
            \nFollowing DNS servers are configured in \/etc\/resolv.conf: 8.8.8.8<\/span>
            \nDo you want to configure these servers as DNS forwarders? [yes]:
            \nAll DNS servers from \/etc\/resolv.conf were added. You can enter additional addresses now:
            \nEnter an IP address for a DNS forwarder, or press Enter to skip:
            \nChecking DNS forwarders, please wait …
            \nDo you want to search for missing reverse zones? [yes]:
            \nDo you want to create reverse zone for IP 10.0.2.20 [yes]:
            \nPlease specify the reverse zone name [2.0.10.in-addr.arpa.]:<\/span>
            \nUsing reverse zone(s) 2.0.10.in-addr.arpa.<\/p>\n

            The IPA Master Server will be configured with:
            \nHostname: ipa-server.example.com
            \nIP address(es): 10.0.2.20
            \nDomain name: example.com
            \nRealm name: EXAMPLE.COM<\/p>\n

            The CA will be configured with:
            \nSubject DN: CN=Certificate Authority,O=EXAMPLE.COM
            \nSubject base: O=EXAMPLE.COM
            \nChaining: self-signed<\/p>\n

            BIND DNS server will be configured to serve IPA domain with:
            \nForwarders: 8.8.8.8
            \nForward policy: only
            \nReverse zone(s): 2.0.10.in-addr.arpa.<\/p>\n

            Continue to configure the system with these values? [no]: yes<\/span><\/p>\n

            The following operations may take some minutes to complete.
            \nPlease wait until the prompt is returned.<\/p>\n

            Adding [10.0.2.20 ipa-server.example.com] to your \/etc\/hosts file
            \nSynchronizing time
            \nNo SRV records of NTP servers found and no NTP server or pool address was provided.
            \nUsing default chrony configuration.
            \nAttempting to sync time with chronyc.
            \nTime synchronization was successful.
            \nConfiguring directory server (dirsrv). Estimated time: 30 seconds
            \n<Output Trimmed><\/span>
            \nConfigured sudoers in \/etc\/nsswitch.conf
            \nConfigured \/etc\/sssd\/sssd.conf
            \nSystemwide CA database updated.
            \nAdding SSH public key from \/etc\/ssh\/ssh_host_ed25519_key.pub
            \nAdding SSH public key from \/etc\/ssh\/ssh_host_ecdsa_key.pub
            \nAdding SSH public key from \/etc\/ssh\/ssh_host_rsa_key.pub
            \nWARNING: The configuration pre-client installation is not managed by authselect and cannot be backed up. Uninstallation may not be able to revert to the original state.
            \nSSSD enabled
            \nConfigured \/etc\/openldap\/ldap.conf
            \nConfigured \/etc\/ssh\/ssh_config
            \nConfigured \/etc\/ssh\/sshd_config
            \nConfiguring example.com as NIS domain.
            \nClient configuration complete.
            \nThe ipa-client-install command was successful<\/p>\n

            ==============================================================================
            \nSetup complete<\/p>\n

            Next steps:
            \n 1. You must make sure these network ports are open:
            \n TCP Ports:
            \n * 80, 443: HTTP\/HTTPS
            \n * 389, 636: LDAP\/LDAPS
            \n * 88, 464: kerberos
            \n * 53: bind
            \n UDP Ports:
            \n * 88, 464: kerberos
            \n * 53: bind
            \n * 123: ntp<\/p>\n

            2. You can now obtain a kerberos ticket using the command: 'kinit admin'
            \n This ticket will allow you to use the IPA tools (e.g., ipa user-add)
            \n and the web user interface.<\/p>\n

            Be sure to back up the CA certificates stored in \/root\/cacert.p12
            \nThese files are required to create replicas. The password for these
            \nfiles is the Directory Manager password
            \nThe ipa-server-install command was successful<\/span><\/span> <\/p>\n

            \u8fd9\u5e94\u8be5\u4e3a\u60a8\u5728 RHEL 8 \u4e2d\u914d\u7f6e FreeIPA \u670d\u52a1\u5668，\u63a5\u4e0b\u6765\u9a8c\u8bc1\u60a8\u7684 DNS \u533a\u57df\u914d\u7f6e\u548c\u8bb0\u5f55\u6761\u76ee<\/span><\/span><\/p>\n

            \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

            [root@ipa-server ~]# dig +short ipa-server.example.com A
            \n10.0.2.20<\/p>\n

            [root@ipa-server ~]# dig +short -x 10.0.2.20
            \nipa-server.example.com.<\/span><\/span> <\/p>\n

            \u4f7f\u7528 admin \u7528\u6237\u7684\u51ed\u8bc1\u5bf9 Kerberos \u9886\u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1，\u4ee5\u786e\u4fdd\u7528\u6237\u914d\u7f6e\u6b63\u786e\u4e14 Kerberos \u9886\u57df\u53ef\u8bbf\u95ee\u3002<\/span><\/span><\/p>\n

            \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

            [root@ipa-server ~]# kinit admin
            \nPassword for admin@EXAMPLE.COM:<\/span><\/span> <\/p>\n

            \u4f7f\u7528\u547d\u4ee4\u9a8c\u8bc1\u6765\u81ea\u670d\u52a1\u5668\u7684\u8eab\u4efd\u548c\u7968\u8bc1\u6388\u4e88\u7968\u8bc1 （TGT）：klist<\/span><\/span><\/p>\n

            \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

            [root@ipa-server ~]# klist
            \nTicket cache: KCM:0
            \nDefault principal: admin@EXAMPLE.COM<\/p>\n

            Valid starting Expires Service principal
            \n09\/26\/2019 17:07:22 09\/27\/2019 17:07:18 krbtgt\/EXAMPLE.COM@EXAMPLE.COM<\/span><\/span> <\/p>\n

            \u00a0<\/span><\/span><\/p>\n

            \u5e7f\u544a<\/span><\/span><\/span><\/span> <\/p>\n

            \u8bbf\u95ee IPA \u670d\u52a1\u5668\u7684 WebGUI<\/span><\/span><\/h3>\n

            \u5728 RHEL 8 \u4e2d\u6210\u529f\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u540e，\u60a8\u8fd8\u53ef\u4ee5\u4f7f\u7528 UI \u8bbf\u95ee IPA \u670d\u52a1\u5668\u3002\u8981\u4f7f\u7528 Web UI，\u7528\u6237\u5fc5\u987b\u4f7f\u7528 FreeIPA Kerberos \u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1，\u5e76\u5177\u6709\u6709\u6548\u7684 Kerberos \u7968\u8bc1\u3002\u901a\u5e38，Web UI \u53ea\u80fd\u4ece FreeIPA \u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u8ba1\u7b97\u673a\u8bbf\u95ee，\u5e76\u4e14\u7528\u6237\u5fc5\u987b\u7ecf\u8fc7\u672c\u5730\u8eab\u4efd\u9a8c\u8bc1\u3002\u6709\u51e0\u79cd\u65b9\u6cd5\u53ef\u4ee5\u89e3\u51b3\u6b64\u95ee\u9898，\u65b9\u6cd5\u662f\u5728\u975e\u57df\u8ba1\u7b97\u673a\u4e0a\u914d\u7f6e Kerberos \u4ee5\u8fde\u63a5\u5230 Kerberos \u57df，\u6216\u8005\u901a\u8fc7\u5bf9 UI \u8fdb\u884c\u5bc6\u7801\u8eab\u4efd\u9a8c\u8bc1\u3002<\/span><\/span><\/p>\n

            \u53e6\u8bf7\u53c2\u9605<\/span><\/span><\/span><\/span> <\/p>\n

            \u5728 RHEL\/CentOS 7\/8 \u4e2d\u91cd\u65b0\u542f\u52a8\u7f51\u7edc\u7684 8 \u4e2a\u4e0d\u540c\u547d\u4ee4<\/span><\/span><\/span> <\/p>\n

            \u8981\u6253\u5f00 Web UI，\u8bf7\u6267\u884c\u4ee5\u4e0b\u4f5c：<\/span><\/span><\/p>\n

          • \u4f7f\u7528 kinit \u83b7\u53d6\u6709\u6548\u7684 Kerberos \u7968\u8bc1<\/li>\n
          • \u6253\u5f00 FreeIPA URL\u3002\u5b8c\u6574\u7684 URL \u662f ，\u4f46\u6b64\u670d\u52a1\u4e5f\u53ea\u9700\u6253\u5f00 \u5373\u53ef\u8bbf\u95ee \u3002https:\/\/IPAserver-FQDN\/ipa\/uihttps:\/\/IPAserver-FQDN<\/li>\n

            \u793a\u4f8b\u5c4f\u5e55\u622a\u56fe：<\/span><\/span><\/p>\n

            \"\u9010\u6b65\u6559\u7a0b：\u5728RHEL<\/p>\n

            \u00a0<\/span><\/span><\/p>\n

            \u5c06\u7cfb\u7edf\u8bbe\u7f6e\u4e3a FreeIPA \u5ba2\u6237\u7aef<\/span><\/span><\/h3>\n

            Once you finish configure FreeIPA server in RHEL 8, proceed with setting up client nodes. Below are the set of tasks performed in the background while integrating a system as a client to FreeIPA server<\/span><\/span><\/p>\n

              \n
            • \u68c0\u7d22 FreeIPA CA \u7684 CA \u8bc1\u4e66\u3002<\/li>\n
            • \u521b\u5efa\u5355\u72ec\u7684 Kerberos \u914d\u7f6e\u4ee5\u6d4b\u8bd5\u63d0\u4f9b\u7684\u51ed\u8bc1\u3002\u8fd9\u5c06\u542f\u7528\u4e0e FreeIPA XML-RPC \u670d\u52a1\u5668\u7684 Kerberos \u8fde\u63a5，\u8fd9\u662f\u5c06 FreeIPA \u5ba2\u6237\u7aef\u52a0\u5165<\/li>\n
            • FreeIPA \u57df\u3002\u6b64 Kerberos \u914d\u7f6e\u6700\u7ec8\u5c06\u88ab\u4e22\u5f03\u3002<\/li>\n
            • \u8bbe\u7f6e Kerberos \u914d\u7f6e\u5305\u62ec\u6307\u5b9a\u9886\u57df\u548c\u57df\u8be6\u7ec6\u4fe1\u606f\u4ee5\u53ca\u9ed8\u8ba4\u7968\u8bc1\u5c5e\u6027\u3002\u9ed8\u8ba4\u914d\u7f6e\u53ef\u8f6c\u53d1\u7968\u636e，\u65b9\u4fbf<\/li>\n
            • \u4ece\u4efb\u4f55\u4f5c\u7cfb\u7edf\u8fde\u63a5\u5230\u7ba1\u7406\u754c\u9762，\u5e76\u4e14\u8fd8\u63d0\u4f9b\u7ba1\u7406\u4f5c\u7684\u5ba1\u8ba1\u3002<\/li>\n
            • \u8fd0\u884c\u547d\u4ee4\u4ee5\u6267\u884c\u5b9e\u9645\u7684\u8054\u63a5ipa-join<\/li>\n
            • \u83b7\u53d6\u4e3b\u673a\u670d\u52a1\u7684\u670d\u52a1\u4e3b\u4f53\u5e76\u5c06\u5176\u5b89\u88c5\u5230 \u4e2d\u3002\u4f8b\u5982\u3002\/etc\/krb5.keytabhost\/ipa.example.com@EXAMPLE.COM<\/li>\n
            • \u542f\u7528 certmonger，\u68c0\u7d22\u00a0SSL \u670d\u52a1\u5668\u8bc1\u4e66，\u5e76\u5c06\u8bc1\u4e66\u5b89\u88c5\u5728 \/etc\/pki\/nssdb \u4e2d\u3002<\/li>\n
            • \u7981\u7528 nscd \u5b88\u62a4\u7a0b\u5e8f\u3002<\/li>\n
            • \u914d\u7f6e SSSD \u6216 LDAP\/KRB5，\u5305\u62ec NSS \u548c PAM \u914d\u7f6e\u6587\u4ef6\u3002<\/li>\n
            • \u914d\u7f6e OpenSSH \u670d\u52a1\u5668\u548c\u5ba2\u6237\u7aef，\u5e76\u5141\u8bb8\u4e3b\u673a\u521b\u5efa DNS SSHFP \u8bb0\u5f55\u3002<\/li>\n
            • \u914d\u7f6e NTP\u3002<\/li>\n<\/ul>\n

              \u00a0<\/span><\/span><\/p>\n

              \u5148\u51b3\u6761\u4ef6<\/span><\/span><\/h4>\n

              \u786e\u4fdd\u60a8\u62e5\u6709\u6709\u6743\u5c06\u5ba2\u6237\u7aef\u6ce8\u518c\u5230 Identity Management \u57df\u7684\u7528\u6237\u7684\u51ed\u8bc1\u3002\u4f8b\u5982，\u8fd9\u53ef\u80fd\u662f\u5177\u6709 Enrollment Administrator \u89d2\u8272\u7684 hostadmin \u7528\u6237\u3002\u6211\u4eec\u5c06\u4f7f\u7528 IPA \u7ba1\u7406\u5458\u51ed\u8bc1\u6765\u5b9e\u73b0\u6b64\u76ee\u7684\u3002 \u5728\/etc\/resolv.conf<\/span><\/span><\/p>\n

              \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

              [root@ipa-client ~]# grep DNS \/etc\/sysconfig\/network-scripts\/ifcfg-enp0s3
              \nDNS1=10.0.2.20<\/p>\n

              [root@ipa-client ~]# cat \/etc\/resolv.conf
              \n# Generated by NetworkManager
              \nsearch example.com
              \nnameserver 10.0.2.20<\/span><\/span><\/span> <\/p>\n

              \u91cd\u65b0\u542f\u52a8\u7f51\u7edc\u670d\u52a1<\/span><\/span><\/p>\n

              \u6ce8\u610f：<\/span><\/span><\/span><\/span> <\/p>\n

              \u5728 RHEL 8 \u4e2d，\u9ed8\u8ba4\u60c5\u51b5\u4e0b network.service \u4e0d\u53ef\u7528，\u56e0\u4e3a\u5b83\u5df2\u5f03\u7528，\u56e0\u6b64\u5fc5\u987b\u5355\u72ec\u5904\u7406\u3002<\/span><\/span> <\/p>\n

              \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

              [root@ipa-client ~]# systemctl restart network<\/span><\/span> <\/p>\n

              \u00a0<\/span><\/span><\/p>\n

              \u53e6\u8bf7\u53c2\u9605<\/span><\/span><\/span><\/span> <\/p>\n

              \u5728 Ubuntu \u4e2d\u4f7f\u7528 TLS\u3001MTLS\u3001STARTTLS \u4fdd\u62a4 OpenLDAP<\/span><\/span><\/span> <\/p>\n

              \u5b89\u88c5 Identity Management \u5ba2\u6237\u7aef\u6240\u9700\u7684\u8f6f\u4ef6\u5305<\/span><\/span><\/h3>\n

              \u5728 RHEL8 \u4e2d，\u5b89\u88c5 Identity Management \u5ba2\u6237\u7aef\u6240\u9700\u7684\u8f6f\u4ef6\u5305\u4f5c\u4e3a\u6a21\u5757\u63d0\u4f9b\u3002\u4e24\u4e2a IdM \u6d41\u63d0\u4f9b IdM \u5ba2\u6237\u7aef\u5305：<\/span><\/span><\/p>\n

                \n
              • \u6eaa\u6d41idm:client<\/li>\n
              • \u6eaa\u6d41idm:DL1<\/li>\n<\/ul>\n

                \u6ce8\u610f：<\/span><\/span><\/span><\/span> <\/p>\n

                \u5728 RHEL \u7cfb\u7edf\u4e0a，\u60a8\u5fc5\u987b\u5177\u6709\u00a0RHN \u7684\u6709\u6548\u8ba2\u9605，\u6216\u8005\u60a8\u53ef\u4ee5\u914d\u7f6e\u672c\u5730\u79bb\u7ebf\u5b58\u50a8\u5e93，\u201cyum\u201d\u8f6f\u4ef6\u5305\u7ba1\u7406\u5668\u53ef\u4ee5\u4f7f\u7528\u8be5\u5b58\u50a8\u5e93\u5b89\u88c5\u63d0\u4f9b\u7684 rpm \u53ca\u5176\u4f9d\u8d56\u9879\u3002<\/span><\/span> <\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u4ece idm：client \u6d41\u5b89\u88c5 ipa-client \u8f6f\u4ef6\u5305<\/span><\/span><\/h4>\n

                \u8981\u4e0b\u8f7d\u5b89\u88c5 IdM \u5ba2\u6237\u7aef\u6240\u9700\u7684\u8f6f\u4ef6\u5305：<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# yum module install idm<\/span><\/span> <\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u4ece idm：DL1 \u6d41\u5b89\u88c5 ipa-client \u8f6f\u4ef6\u5305<\/span><\/span><\/h4>\n

                \u8981\u5207\u6362\u5230\u901a\u8fc7\u6d41\u4f20\u8f93\u7684 RPM，\u8bf7\u6267\u884c\u4ee5\u4e0b\u4f5c：idm:DL1<\/span><\/span><\/p>\n

                \u5e7f\u544a<\/span><\/span><\/span><\/span> <\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# yum module enable idm:DL1 -y<\/span><\/span> <\/p>\n

                \u5207\u6362\u6a21\u5757\u6d41\u4e0d\u4f1a\u66f4\u6539\u5df2\u5b89\u88c5\u7684\u8f6f\u4ef6\u5305<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# yum distro-sync -y<\/span><\/span> <\/p>\n

                \u8981\u4e0b\u8f7d\u5b89\u88c5 IdM \u5ba2\u6237\u7aef\u6240\u9700\u7684\u8f6f\u4ef6\u5305：<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# yum module install idm:DL1\/client -y
                \nUpdating Subscription Management repositories.
                \nUnable to read consumer identity
                \nThis system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
                \nLast metadata expiration check: 0:02:49 ago on Thu 26 Sep 2019 05:09:38 PM IST.
                \nDependencies resolved.
                \n==========================================================================================================
                \n Package Arch Version Repository Size
                \n==========================================================================================================
                \nInstalling group\/module packages:
                \n ipa-client x86_64 4.7.1-11.module+el8+2842+7481110c rhel_dvd_appstream 266 k
                \nInstalling dependencies:
                \n certmonger x86_64 0.79.6-5.el8 rhel_dvd_appstream 654 k
                \n ipa-client-common noarch 4.7.1-11.module+el8+2842+7481110c rhel_dvd_appstream 169 k
                \n ipa-common noarch 4.7.1-11.module+el8+2842+7481110c rhel_dvd_appstream 725 k
                \n nss-tools x86_64 3.41.0-5.el8 rhel_dvd_appstream 567 k<\/p>\n

                <Output trimmed><\/span><\/p>\n

                python3-qrcode-core-5.1-11.module+el8+2555+b334d87b.noarch
                \n python3-yubico-1.3.2-9.module+el8+2555+b334d87b.noarch
                \n autofs-1:5.1.4-29.el8.x86_64
                \n krb5-workstation-1.16.1-22.el8.x86_64
                \n libkadm5-1.16.1-22.el8.x86_64
                \n python3-dns-1.15.0-8.el8.noarch
                \n python3-libipa_hbac-2.0.0-43.el8.x86_64
                \n python3-sss-2.0.0-43.el8.x86_64
                \n python3-sss-murmur-2.0.0-43.el8.x86_64
                \n sssd-tools-2.0.0-43.el8.x86_64<\/p>\n

                Complete!<\/span><\/span> <\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u5b89\u88c5 Identity Management \u5ba2\u6237\u7aef<\/span><\/span><\/h3>\n

                \u5728\u8981\u914d\u7f6e\u4e3a Identity Management \u5ba2\u6237\u7aef\u7684\u7cfb\u7edf\u4e0a\u8fd0\u884c\u8be5\u5b9e\u7528\u7a0b\u5e8f\u3002\u5b89\u88c5\u811a\u672c\u4f1a\u5c1d\u8bd5\u81ea\u52a8\u83b7\u53d6\u6240\u6709\u5fc5\u9700\u7684\u8bbe\u7f6e，\u4f8b\u5982 DNS \u8bb0\u5f55\u3002ipa-client-install<\/span><\/span><\/p>\n

                \u63d0\u793a：<\/span><\/span><\/span><\/span> <\/p>\n

                \u6dfb\u52a0\u9009\u9879\u4ee5\u4f7f\u7528\u5ba2\u6237\u7aef\u7cfb\u7edf\u7684 IP \u5730\u5740\u66f4\u65b0 DNS \u8bb0\u5f55–enable-dns-updates<\/span><\/span> <\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                # ipa-client-install
                \n[root@ipa-client ~]# ipa-client-install
                \nThis program will set up IPA client.
                \nVersion 4.7.1
                \nDiscovery was successful!
                \nClient hostname: ipa-client.example.com
                \nRealm: EXAMPLE.COM
                \nDNS Domain: example.com
                \nIPA Server: ipa-server.example.com
                \nBaseDN: dc=example,dc=com<\/p>\n

                Continue to configure the system with these values? [no]: yes<\/span>
                \nSynchronizing time
                \nNo SRV records of NTP servers found and no NTP server or pool address was provided.
                \nUsing default chrony configuration.
                \nAttempting to sync time with chronyc.
                \nTime synchronization was successful.
                \nUser authorized to enroll computers: admin
                \nPassword for admin@EXAMPLE.COM:<\/span>
                \nSuccessfully retrieved CA cert
                \nSubject: CN=Certificate Authority,O=EXAMPLE.COM
                \nIssuer: CN=Certificate Authority,O=EXAMPLE.COM
                \nValid From: 2019-09-26 11:22:07
                \nValid Until: 2039-09-26 11:22:07<\/p>\n

                Enrolled in IPA realm EXAMPLE.COM
                \nCreated \/etc\/ipa\/default.conf
                \nConfigured sudoers in \/etc\/nsswitch.conf
                \nConfigured \/etc\/sssd\/sssd.conf
                \nConfigured \/etc\/krb5.conf for IPA realm EXAMPLE.COM
                \nSystemwide CA database updated.
                \nHostname (ipa-client.example.com) does not have A\/AAAA record.
                \nMissing reverse record(s) for address(es): 10.0.2.14.
                \nAdding SSH public key from \/etc\/ssh\/ssh_host_rsa_key.pub
                \nAdding SSH public key from \/etc\/ssh\/ssh_host_ecdsa_key.pub
                \nAdding SSH public key from \/etc\/ssh\/ssh_host_ed25519_key.pub
                \nSSSD enabled
                \nConfigured \/etc\/openldap\/ldap.conf
                \nConfigured \/etc\/ssh\/ssh_config
                \nConfigured \/etc\/ssh\/sshd_config
                \nConfiguring example.com as NIS domain.
                \nClient configuration complete.
                \nThe ipa-client-install command was successful<\/span><\/span> <\/p>\n

                \u4f7f\u7528 admin \u7528\u6237\u7684\u51ed\u8bc1\u5bf9 Kerberos \u9886\u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1，\u4ee5\u786e\u4fdd\u7528\u6237\u914d\u7f6e\u6b63\u786e\u4e14 Kerberos \u9886\u57df\u53ef\u8bbf\u95ee\u3002<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# kinit admin
                \nPassword for admin@EXAMPLE.COM:<\/span><\/span> <\/p>\n

                \u4f7f\u7528\u547d\u4ee4\u9a8c\u8bc1\u6765\u81ea\u670d\u52a1\u5668\u7684\u8eab\u4efd\u548c\u7968\u8bc1\u6388\u4e88\u7968\u8bc1 （TGT）：klist<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# klist
                \nTicket cache: KCM:0
                \nDefault principal: admin@EXAMPLE.COM<\/p>\n

                Valid starting Expires Service principal
                \n09\/26\/2019 17:17:38 09\/27\/2019 17:17:36 krbtgt\/EXAMPLE.COM@EXAMPLE.COM<\/span><\/span> <\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u53e6\u8bf7\u53c2\u9605<\/span><\/span><\/span><\/span> <\/p>\n

                \u66f4\u6539\u9ed8\u8ba4\u5185\u6838\u7248\u672c RHEL\/CentOS 8 \u7684\u7b80\u5355\u6b65\u9aa4<\/span><\/span><\/span> <\/p>\n

                \u5378\u8f7d Identity Management \u5ba2\u6237\u7aef<\/span><\/span><\/h3>\n

                \u4f5c\u4e3a\u7ba1\u7406\u5458，\u60a8\u53ef\u4ee5\u4ece\u73af\u5883\u4e2d\u5220\u9664 Identity Management \u5ba2\u6237\u7aef\u3002<\/span><\/span><\/p>\n

                \u5378\u8f7d\u5ba2\u6237\u7aef\u4f1a\u4ece Identity Management \u57df\u4e2d\u5220\u9664\u5ba2\u6237\u7aef，\u4ee5\u53ca\u7cfb\u7edf\u670d\u52a1\u7684\u6240\u6709\u7279\u5b9a Identity Management \u914d\u7f6e，\u4f8b\u5982\u7cfb\u7edf\u5b89\u5168\u670d\u52a1\u5b88\u62a4\u7a0b\u5e8f （SSSD）\u3002\u8fd9\u5c06\u6062\u590d\u5ba2\u6237\u7aef\u7cfb\u7edf\u7684\u5148\u524d\u914d\u7f6e\u3002<\/span><\/span><\/p>\n

                \u8fd0\u884c\u547d\u4ee4：ipa-client-install –uninstall<\/span><\/span><\/p>\n

                \u91cd\u51fb<\/span><\/span><\/span> <\/p>\n

                [root@ipa-client ~]# ipa-client-install –uninstall
                \nUnenrolling client from IPA server
                \nRemoving Kerberos service principals from \/etc\/krb5.keytab
                \nDisabling client Kerberos and LDAP configurations
                \nRedundant SSSD configuration file \/etc\/sssd\/sssd.conf was moved to \/etc\/sssd\/sssd.conf.deleted
                \nRestoring client configuration files
                \nUnconfiguring the NIS domain.
                \nnscd daemon is not installed, skip configuration
                \nnslcd daemon is not installed, skip configuration
                \nSystemwide CA database updated.
                \nClient uninstall complete.
                \nThe original nsswitch.conf configuration has been restored.
                \nYou may need to restart services or reboot the machine.
                \nDo you want to reboot the machine? [no]: no<\/span>
                \nThe ipa-client-install command was successful<\/span><\/span> <\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u6700\u540e，\u6211\u5e0c\u671b\u672c\u6587\u4e2d\u6709\u5173\u5728\u00a0RHEL 8 \u548c CentOS8 Linux\u00a0\u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u5bf9\u60a8\u6709\u6240\u5e2e\u52a9\u3002\u6240\u4ee5，\u4f7f\u7528\u8bc4\u8bba\u90e8\u5206\u8ba9\u6211\u77e5\u9053\u60a8\u7684\u5efa\u8bae\u548c\u53cd\u9988\u3002<\/span><\/span><\/p>\n

                \u00a0<\/span><\/span><\/p>\n

                \u53c2\u8003\u8d44\u6599： FreeIPA：\u8eab\u4efd\/\u7b56\u7565\u7ba1\u7406 \u5b89\u88c5 Idetity Management<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

                \u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb906\u6b21\uff0c\u70b9\u8d5e26\u6b21\uff0c\u6536\u85cf28\u6b21\u3002\u8981\u4f7f\u7528 Web UI\uff0c\u7528\u6237\u5fc5\u987b\u4f7f\u7528 FreeIPA Kerberos \u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u5e76\u5177\u6709\u6709\u6548\u7684 Kerberos \u7968\u8bc1\u3002\u8fd9\u5c06\u6062\u590d\u5ba2\u6237\u7aef\u7cfb\u7edf\u7684\u5148\u524d\u914d\u7f6e\u3002\u6b64\u811a\u672c\u53ef\u4ee5\u63a5\u53d7 FreeIPA \u5b9e\u4f8b\u4f7f\u7528\u7684\u670d\u52a1\uff08\u5982 DNS \u548c Kerberos\uff09\u7684\u7528\u6237\u5b9a\u4e49\u8bbe\u7f6e\uff0c\u4e5f\u53ef\u4ee5\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u6700\u5c11\u7684\u8f93\u5165\u9884\u5b9a\u4e49\u503c\u3002\u56e0\u6b64\uff0c\u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684 rpm \u5df2\u66f4\u6539\uff0c\u6211\u4eec\u5c06\u5728\u672c\u6587\u4e2d\u6df1\u5165\u8ba8\u8bba\u3002\u73b0\u5728\uff0c\u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u5206\u4eab\u5728 RHEL 8 \u548c\/\u6216 CentOS 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u3002<\/p>\n","protected":false},"author":2,"featured_media":44144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[59,58,43],"topic":[],"class_list":["post-44146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-centos","tag-linux","tag-43"],"yoast_head":"\n\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/44146.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb906\u6b21\uff0c\u70b9\u8d5e26\u6b21\uff0c\u6536\u85cf28\u6b21\u3002\u8981\u4f7f\u7528 Web UI\uff0c\u7528\u6237\u5fc5\u987b\u4f7f\u7528 FreeIPA Kerberos \u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u5e76\u5177\u6709\u6709\u6548\u7684 Kerberos \u7968\u8bc1\u3002\u8fd9\u5c06\u6062\u590d\u5ba2\u6237\u7aef\u7cfb\u7edf\u7684\u5148\u524d\u914d\u7f6e\u3002\u6b64\u811a\u672c\u53ef\u4ee5\u63a5\u53d7 FreeIPA \u5b9e\u4f8b\u4f7f\u7528\u7684\u670d\u52a1\uff08\u5982 DNS \u548c Kerberos\uff09\u7684\u7528\u6237\u5b9a\u4e49\u8bbe\u7f6e\uff0c\u4e5f\u53ef\u4ee5\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u6700\u5c11\u7684\u8f93\u5165\u9884\u5b9a\u4e49\u503c\u3002\u56e0\u6b64\uff0c\u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684 rpm \u5df2\u66f4\u6539\uff0c\u6211\u4eec\u5c06\u5728\u672c\u6587\u4e2d\u6df1\u5165\u8ba8\u8bba\u3002\u73b0\u5728\uff0c\u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u5206\u4eab\u5728 RHEL 8 \u548c\/\u6216 CentOS 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/44146.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-17T02:20:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2025\/06\/20250617022034-6850d0f2389c9.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/44146.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/44146.html\",\"name\":\"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2025-06-17T02:20:35+00:00\",\"dateModified\":\"2025-06-17T02:20:35+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/44146.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/44146.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/44146.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/44146.html","og_locale":"zh_CN","og_type":"article","og_title":"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb906\u6b21\uff0c\u70b9\u8d5e26\u6b21\uff0c\u6536\u85cf28\u6b21\u3002\u8981\u4f7f\u7528 Web UI\uff0c\u7528\u6237\u5fc5\u987b\u4f7f\u7528 FreeIPA Kerberos \u57df\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u5e76\u5177\u6709\u6709\u6548\u7684 Kerberos \u7968\u8bc1\u3002\u8fd9\u5c06\u6062\u590d\u5ba2\u6237\u7aef\u7cfb\u7edf\u7684\u5148\u524d\u914d\u7f6e\u3002\u6b64\u811a\u672c\u53ef\u4ee5\u63a5\u53d7 FreeIPA \u5b9e\u4f8b\u4f7f\u7528\u7684\u670d\u52a1\uff08\u5982 DNS \u548c Kerberos\uff09\u7684\u7528\u6237\u5b9a\u4e49\u8bbe\u7f6e\uff0c\u4e5f\u53ef\u4ee5\u4e3a\u7ba1\u7406\u5458\u63d0\u4f9b\u6700\u5c11\u7684\u8f93\u5165\u9884\u5b9a\u4e49\u503c\u3002\u56e0\u6b64\uff0c\u5728 RHEL 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684 rpm \u5df2\u66f4\u6539\uff0c\u6211\u4eec\u5c06\u5728\u672c\u6587\u4e2d\u6df1\u5165\u8ba8\u8bba\u3002\u73b0\u5728\uff0c\u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u5206\u4eab\u5728 RHEL 8 \u548c\/\u6216 CentOS 8 \u4e2d\u5b89\u88c5\u548c\u914d\u7f6e FreeIPA \u670d\u52a1\u5668\u7684\u6b65\u9aa4\u3002","og_url":"https:\/\/www.wsisp.com\/helps\/44146.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2025-06-17T02:20:35+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2025\/06\/20250617022034-6850d0f2389c9.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/44146.html","url":"https:\/\/www.wsisp.com\/helps\/44146.html","name":"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2025-06-17T02:20:35+00:00","dateModified":"2025-06-17T02:20:35+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/44146.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/44146.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/44146.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u5728RHEL\/CentOS 8\u4e2d\u5b89\u88c5\u548c\u914d\u7f6eFreeIPA\u670d\u52a1\u5668"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/44146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=44146"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/44146\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/44144"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=44146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=44146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=44146"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=44146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}