|
|
1. classroom.example.com(一般了解)
- [root@classroom ~]# kadmin.local
- Authenticating as principal admin/admin@EXAMPLE.COM with password.
- kadmin.local: ?
- Available kadmin.local requests:
- add_principal, addprinc, ank
- Add principal
- delete_principal, delprinc
- Delete principal
- modify_principal, modprinc
- Modify principal
- rename_principal, renprinc
- Rename principal
- change_password, cpw Change password
- get_principal, getprinc Get principal
- list_principals, listprincs, get_principals, getprincs
- List principals
- add_policy, addpol Add policy
- modify_policy, modpol Modify policy
- delete_policy, delpol Delete policy
- get_policy, getpol Get policy
- list_policies, listpols, get_policies, getpols
- List policies
- get_privs, getprivs Get privileges
- ktadd, xst Add entry(s) to a keytab
- ktremove, ktrem Remove entry(s) from a keytab
- lock Lock database exclusively (use with extreme caution!)
- unlock Release exclusive database lock
- purgekeys Purge previously retained old keys from a principal
- get_strings, getstrs Show string attributes on a principal
- set_string, setstr Set a string attribute on a principal
- kadmin.local: list_principals
- admin@EXAMPLE.COM
- K/M@EXAMPLE.COM
- krbtgt/EXAMPLE.COM@EXAMPLE.COM
- kadmin/classroom.example.com@EXAMPLE.COM
- kadmin/admin@EXAMPLE.COM
- kadmin/changepw@EXAMPLE.COM
- kiprop/classroom.example.com@EXAMPLE.COM
- ldap/classroom.example.com@EXAMPLE.COM
- host/classroom.example.com@EXAMPLE.COM
- WELLKNOWN/ANONYMOUS@EXAMPLE.COM
- dogtag/classroom.example.com@EXAMPLE.COM
- HTTP/classroom.example.com@EXAMPLE.COM
- ldapuser1@EXAMPLE.COM
- ldapuser2@EXAMPLE.COM
- ldapuser3@EXAMPLE.COM
- ldapuser4@EXAMPLE.COM
- ldapuser5@EXAMPLE.COM
- ldapuser6@EXAMPLE.COM
- ldapuser7@EXAMPLE.COM
- ldapuser8@EXAMPLE.COM
- ldapuser9@EXAMPLE.COM
- ldapuser10@EXAMPLE.COM
- ldapuser11@EXAMPLE.COM
- ldapuser12@EXAMPLE.COM
- ldapuser13@EXAMPLE.COM
- ldapuser14@EXAMPLE.COM
- ldapuser15@EXAMPLE.COM
- ldapuser16@EXAMPLE.COM
- ldapuser17@EXAMPLE.COM
- ldapuser18@EXAMPLE.COM
- ldapuser19@EXAMPLE.COM
- ldapuser20@EXAMPLE.COM
- nfs/classroom.example.com@EXAMPLE.COM
- host/server1.example.com@EXAMPLE.COM
- host/desktop1.example.com@EXAMPLE.COM
- nfs/server1.example.com@EXAMPLE.COM
- host/server2.example.com@EXAMPLE.COM
- host/desktop2.example.com@EXAMPLE.COM
- nfs/server2.example.com@EXAMPLE.COM
- host/server3.example.com@EXAMPLE.COM
- host/desktop3.example.com@EXAMPLE.COM
- nfs/server3.example.com@EXAMPLE.COM
- host/server4.example.com@EXAMPLE.COM
- host/desktop4.example.com@EXAMPLE.COM
- nfs/server4.example.com@EXAMPLE.COM
- host/server5.example.com@EXAMPLE.COM
- host/desktop5.example.com@EXAMPLE.COM
- nfs/server5.example.com@EXAMPLE.COM
- host/server6.example.com@EXAMPLE.COM
- host/desktop6.example.com@EXAMPLE.COM
- nfs/server6.example.com@EXAMPLE.COM
- host/server7.example.com@EXAMPLE.COM
- host/desktop7.example.com@EXAMPLE.COM
- nfs/server7.example.com@EXAMPLE.COM
- host/server8.example.com@EXAMPLE.COM
- host/desktop8.example.com@EXAMPLE.COM
- nfs/server8.example.com@EXAMPLE.COM
- host/server9.example.com@EXAMPLE.COM
- host/desktop9.example.com@EXAMPLE.COM
- nfs/server9.example.com@EXAMPLE.COM
- host/server10.example.com@EXAMPLE.COM
- host/desktop10.example.com@EXAMPLE.COM
- nfs/server10.example.com@EXAMPLE.COM
- host/server11.example.com@EXAMPLE.COM
- host/desktop11.example.com@EXAMPLE.COM
- nfs/server11.example.com@EXAMPLE.COM
- host/server12.example.com@EXAMPLE.COM
- host/desktop12.example.com@EXAMPLE.COM
- nfs/server12.example.com@EXAMPLE.COM
- host/server13.example.com@EXAMPLE.COM
- host/desktop13.example.com@EXAMPLE.COM
- nfs/server13.example.com@EXAMPLE.COM
- host/server14.example.com@EXAMPLE.COM
- host/desktop14.example.com@EXAMPLE.COM
- nfs/server14.example.com@EXAMPLE.COM
- host/server15.example.com@EXAMPLE.COM
- host/desktop15.example.com@EXAMPLE.COM
- nfs/server15.example.com@EXAMPLE.COM
- host/server16.example.com@EXAMPLE.COM
- host/desktop16.example.com@EXAMPLE.COM
- nfs/server16.example.com@EXAMPLE.COM
- host/server17.example.com@EXAMPLE.COM
- host/desktop17.example.com@EXAMPLE.COM
- nfs/server17.example.com@EXAMPLE.COM
- host/server18.example.com@EXAMPLE.COM
- host/desktop18.example.com@EXAMPLE.COM
- nfs/server18.example.com@EXAMPLE.COM
- host/server19.example.com@EXAMPLE.COM
- host/desktop19.example.com@EXAMPLE.COM
- nfs/server19.example.com@EXAMPLE.COM
- host/server20.example.com@EXAMPLE.COM
- host/desktop20.example.com@EXAMPLE.COM
- nfs/server20.example.com@EXAMPLE.COM
- kadmin.local:
- kinit admin
- for i in {1..20}
- do
- ipa user-add ldapuser$i --first=ldapuser$i --last=Trump
- echo "kerberos" | ipa user-mod ldapuser$i --password --password-expiration=20990421191926Z --principal-expiration=20990421191926Z --homedir=/home/guests/ldapuser$i
- mkdir /home/guests/ldapuser$i
- cp -rp /etc/skel/.[a-z]* /home/guests/ldapuser$i/
- chown -R `id -u ldapuser$i`:`id -g ldapuser$i` /home/guests/ldapuser$i
- done
2. desktopX.example.com 和serverX.example.com要有这些远程用户：
就是加入LDAP域
切记：执行ipa-client-install之前，时间同步要配。
------------------下节课：
- ipa service-add nfs/classroom.example.com
- for i in {1..20}
- do
- ipa host-add server$i.example.com
- ipa host-add desktop$i.example.com
- ipa service-add nfs/server$i.example.com
- ipa service-allow-retrieve-keytab nfs/server$i.example.com --hosts=server$i.example.com
- ipa service-allow-retrieve-keytab nfs/classroom.example.com --hosts=desktop$i.example.com
- ipa service-allow-retrieve-keytab nfs/classroom.example.com --hosts=server$i.example.com
- done
|
|
发表于 2020-2-17 21:45:41
