1.文档编写目的
在前面的文章《如何在Redhat7上安装FreeIPA》介绍了FreeIPA的安装及使用，本篇文章主要介绍如何在RedHat7上安装FreeIPA的客户端并配置。
· 2.内容概述
1.环境准备
2.安装FreeIPA客户端及使用
3.总结及异常处理
· 3.测试环境
1.centos 7.6
2.FreeIPA4.6.4
4.环境准备
1.首先要确保安装FreeIPA客户端的服务器主机名为完全限定域名（FQDN），这里使用ipatest02.sztech.com作为本篇文章教程的FQDN。
[root@ipatest02 ~]# hostname
2.配置cdh03节点DNS服务器，FreeIPA已集成了DNS服务，所以ipa客户端需要配置FreeIPA的DNS地址
file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image002.jpg
配置DNS地址后重启network服务，验证DNS解析是否正确
file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image003.png
使用nslookup命令验证
[root@ipatest02 network-scripts]# nslookupipasrv1.sztech.com
Server: 192.168.133.130
Address: 192.168.133.130#53
Name: ipasrv1.sztech.com
Address: 192.168.133.130
[root@ipatest02 network-scripts]# nslookupipatest02.sztech.com
Server: 192.168.133.130
Address: 192.168.133.130#53
** server can't find ipatest02.sztech.com:NXDOMAIN
5.安装FreeIPA客户端
1.在命令行执行如下命令安装FreeIPA客户端
yum -y install freeipa-client
[root@ipatest02 network-scripts]# rpm -qlipa-client
/etc/bash_completion.d
/etc/bash_completion.d/ipa
/usr/bin/ipa
/usr/sbin/ipa-certupdate
/usr/sbin/ipa-client-automount
/usr/sbin/ipa-client-install
/usr/sbin/ipa-getkeytab
/usr/sbin/ipa-join
/usr/sbin/ipa-rmkeytab
/usr/share/doc/ipa-client-4.6.4
/usr/share/doc/ipa-client-4.6.4/Contributors.txt
/usr/share/doc/ipa-client-4.6.4/README.md
/usr/share/licenses/ipa-client-4.6.4
/usr/share/licenses/ipa-client-4.6.4/COPYING
/usr/share/man/man1/ipa-certupdate.1.gz
/usr/share/man/man1/ipa-client-automount.1.gz
/usr/share/man/man1/ipa-client-install.1.gz
/usr/share/man/man1/ipa-getkeytab.1.gz
/usr/share/man/man1/ipa-join.1.gz
/usr/share/man/man1/ipa-rmkeytab.1.gz
/usr/share/man/man1/ipa.1.gz
2.在命令行执行如下命令进行客户端配置
[root@ipatest02 network-scripts]# ipa-client-install--mkhomedir --realm=SZTECH.COM --domain=sztech.com --server=ipasrv1.sztech.com
[root@ipatest02 network-scripts]#ipa-client-install --mkhomedir --realm=SZTECH.COM --domain=sztech.com--server=ipasrv1.sztech.com
Autodiscovery of servers for failovercannot work with this configuration.
If you proceed with the installation,services will be configured to always access the discovered server for alloperations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNSdiscovery? [no]: yes
Client hostname: ipatest02.sztech.com
Realm: SZTECH.COM
DNS Domain: sztech.com
IPA Server: ipasrv1.sztech.com
BaseDN: dc=sztech,dc=com
Continue to configure the system with thesevalues? [no]: yes
Synchronizing time with KDC...
Attempting to sync time using ntpd. Will timeout after 15 seconds
User authorized to enroll computers: admin
Password for admin@SZTECH.COM:
Successfully retrieved CA cert
Subject: CN=CertificateAuthority,O=SZTECH.COM
Issuer: CN=CertificateAuthority,O=SZTECH.COM
Valid From: 2019-03-15 09:09:43
Valid Until: 2039-03-15 09:09:43
Enrolled in IPA realm SZTECH.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realmSZTECH.COM
trying https://ipasrv1.sztech.com/ipa/json
[try 1]: Forwarding 'schema' to json server'https://ipasrv1.sztech.com/ipa/json'
tryinghttps://ipasrv1.sztech.com/ipa/session/json
[try 1]: Forwarding 'ping' to json server'https://ipasrv1.sztech.com/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to jsonserver 'https://ipasrv1.sztech.com/ipa/session/json'
Systemwide CA database updated.
Hostname (ipatest02.sztech.com) does nothave A/AAAA record.
Missing reverse record(s) for address(es):192.168.133.120.
Adding SSH public key from/etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from/etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from/etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to jsonserver 'https://ipasrv1.sztech.com/ipa/session/json'
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring sztech.com as NIS domain.
Client configuration complete.
The ipa-client-install command wassuccessful
至此就完成了FreeIPA客户端安装及配置。
6.FreeIPA客户端使用
1.使用管理员账号登录FreeIPA管理台可以看到ipatest02.sztech.com已纳入管理
file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image005.jpg
2.在客户端节点上查看ipaadmin用户已同步
file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image007.jpg
3.切换至cdhadmin用户和使用ipaadmin用户ssh
file:///C:/Users/ZHENGQ~1/AppData/Local/Temp/msohtmlclip1/01/clip_image009.jpg
[root@ipatest02network-scripts]# nslookup ipatest02.sztech.com
Server: 192.168.133.130
Address: 192.168.133.130#53
Name: ipatest02.sztech.com
Address: 192.168.133.120
总结
1.集成FreeIPA Client需要在为客户端所在节点配置FreeIPA的DNS地址，佛则会出现域名解析失败，导致Kerberos认证失败等问题。
2.执行客户端安装命令的过程中需要输入FreeIPA的管理员账号和密码
3.使用FreeIPA上用户进行ssh登录或su切换用户时，如果登录失败可以检查/var/log/message日志文件查看异常日志（多是sssd和nslcd服务配置有问题，特别是之前已集成OpenLDAP或AD的客户端）
来源：oschina
链接：https://my.oschina.net/u/3635497/blog/3024680