CentOS 安装ipa-server作为域控、DNS等全套身份验证
一、yum install -y ipa-server
二、安装ipa服务
ipa-server-install [Options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
basic options:
-r REALM_NAME, --realm=REALM_NAME
realm name
-n DOMAIN_NAME, --domain=DOMAIN_NAME
domain name
-p DM_PASSWORD, --ds-password=DM_PASSWORD
admin password
-P MASTER_PASSWORD, --master-password=MASTER_PASSWORD
kerberos master password (normally autogenerated)
-a ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD
admin user kerberos password
--hostname=HOST_NAME
fully qualified name of server
--ip-address=IP_ADDRESS
Master Server IP Address
-N, --no-ntp do not configure ntp
--idstart=IDSTART The starting value for the IDs range (default random)
--idmax=IDMAX The max value value for the IDs range (default:
idstart+199999)
--no_hbac_allow Don't install allow_all HBAC rule
--no-ui-redirect Do not automatically redirect to the Web UI
--ssh-trust-dns configure OpenSSH client to trust DNS SSHFP records
--no-ssh do not configure OpenSSH client
--no-sshd do not configure OpenSSH server
-d, --debug print debugging information
-U, --unattended unattended (un)installation never prompts the user
certificate system options:
--external-ca Generate a CSR to be signed by an external CA
--external_cert_file=EXTERNAL_CERT_FILE
File containing PKCS#10 certificate
--external_ca_file=EXTERNAL_CA_FILE
File containing PKCS#10 of the external CA chain
--dirsrv_pkcs12=DIRSRV_PKCS12
PKCS#12 file containing the Directory Server SSL
certificate
--http_pkcs12=HTTP_PKCS12
PKCS#12 file containing the Apache Server SSL
certificate
--dirsrv_pin=DIRSRV_PIN
The password of the Directory Server PKCS#12 file
--http_pin=HTTP_PIN
The password of the Apache Server PKCS#12 file
--subject=SUBJECT The certificate subject base (default O=<realm-name>)
--selfsign Configure a self-signed CA instance rather than a
dogtag CA. WARNING: Certificate management
capabilities will be limited
DNS options:
--setup-dns configure bind with our zone
--forwarder=FORWARDERS
Add a DNS forwarder
什么是DNS forwarder：http://technet.microsoft.com/zh-cn/ff622996.aspx
--no-forwarders Do not add any DNS forwarders, use root servers
instead
--reverse-zone=REVERSE_ZONE
The reverse DNS zone to use
什么是reverse DNS zone：The Domain Name System (DNS) is a globally distributed Internet service. Among other services, it provides name-to-number (forward) and number-to-name (reverse) translations using defined client-server and server-server protocols. The DNS is a public service and any user is freely able to query the DNS system for forward or reverse translations.
http://www.apnic.net/apnic-info/whois_search/about-whois/what-is-in-whois/reverse-dns
--no-reverse Do not create reverse DNS zone
--zonemgr=ZONEMGR DNS zone manager e-mail address. Defaults to
hostmaster@DOMAIN
--no-persistent-search
Do not enable persistent search feature in the name
server
--zone-refresh=ZONE_REFRESH
When set to non-zero the name server will use DNS zone
detection based on polling instead of a persistent
search
--no-host-dns Do not use DNS for hostname lookup during installation
--no-dns-sshfp Do not automatically create DNS SSHFP records
--no-serial-autoincrement
Do not enable SOA serial autoincrement
uninstall options:
--uninstall uninstall an existing installation. The uninstall can
be run with --unattended option