FreeIPA is a useful tool for managing hosts. I find myself wanting to do work on remote systems from my desktop using the ipa CLI. Here’s how I set it up.
I have installed the IPA server on a RedHat cloud image, so the default user for remote access is cloud-user. For Fedora it would be ‘fedora’ and for Centos it would be ‘centos’, but the rest is the same.
My remote host has a FQDN of ipa.ayoung.os1.test, a non-routable IPv4 address and an entry in my /etc/hosts file that references it.
10.3.10.240 ipa.ayoung.os1.test
I can ssh to the host via:
ssh cloud-user@ipa.ayoung.os1.test
I’ll make a local directory to stash files:
mkdir /tmp/ayoung.os1 scp cloud-user@openstack.ayoung.os1.test:/etc/krb5.conf /tmp/ayoung.os1 scp cloud-user@openstack.ayoung.os1.test:/etc/ipa/default.conf /tmp/ayoung.os1/ipa.conf curl -o /tmp/ayoung.os1/ca.crt http://ipa.ayoung.os1.test/ipa/config/ca.crt
I can get a Kerberos TGT once I’ve set the appropriate Environment variables.
export KRB5CCNAME=/tmp/ayoung.os1/ccache export KRB5_CONFIG=/tmp/ayoung.os1/krb5.conf kinit admin@AYOUNG.OS1.TEST Password for admin@AYOUNG.OS1.TEST: [ayoung@ayoung541 ayoung.os1]$ klist Ticket cache: FILE:/tmp/ayoung.os1/ccache Default principal: admin@AYOUNG.OS1.TEST Valid starting Expires Service principal 09/18/2015 13:37:23 09/19/2015 13:37:20 krbtgt/AYOUNG.OS1.TEST@AYOUNG.OS1.TEST
IPA uses NSS as the cryptography libary,and assumes the certificates are stored in /etc/ipa/nssdb/.
Older versions had it in /etc/pki/nssdb. Since my laptop is not enrolled as an IPA client, I need to make this directory and populate the NSS certificate store.
sudo mkdir /etc/ipa/nssdb sudo chown 666 /etc/ipa/nssdb sudo certutil -N -d /etc/ipa/nssdb sudo certutil -d /etc/ipa/nssdb -A -n 'IPA CA' -t CT,, -a -i /tmp/ayoung.os1/ca.crt sudo chmod 644 /etc/ipa/nssdb/*
Test that the NSS Database works
certutil -d /etc/ipa/nssdb -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
IPA CA CT,,
Run the ipa client like this:
$ ipa -c /tmp/ayoung.os1/ipa.conf user-find --------------- 2 users matched --------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: 733200000 GID: 733200000 Account disabled: False Password: True Kerberos keys available: True User login: ayoung First name: Adam Last name: Young Home directory: /home/ayoung Login shell: /bin/sh Email address: ayoung@ayoung.os1.test UID: 733200001 GID: 733200001 Account disabled: False Password: True Kerberos keys available: True ---------------------------- Number of entries returned 2 ----------------------------