1. Have the ability to create / modify / delete user accounts centrally, and not on each individual server
2. Centralized smelted for sudo
3. Later we will connect VPN authentication to this system, and then other internal office services can

Server Tuning

• FreeIPA is an open source project of RedHat, which combines many other open source projects: 389 Directory Server, MIT Kerberos, NTP, DNS (bind), Dogtag certificate system, SSSD and others. At the same time, this solution has a Web UI, CLI, XMLRPC, JSONRPC API and Python SDK.
• Dnsmasq is a lightweight DNS server (later I will explain why I needed it in addition to bind, which is used in FreeIPA).
• Docker is an open-source platform that automates the deployment of applications in lightweight, portable, self-contained containers that can be transferred between servers without any changes. © We use Docker and do not worry about vendor-lock

1. We create a directory that will be mounted in the image for the FreeIPA configs that need to be left after the restart (it is suggested to use in the documentation /var/lib/ipa-data/, but I do not like to clog the system, therefore /opt/):
   

   $ sudo mkdir -p /opt/dockers/freeipa-data
   

   
   
2. Add a file with options that will be used when installing freeipa-server:
   

   $ sudo tee /opt/dockers/freeipa-data/ipa-server-install-options
   --ds-password=The-directory-server-password
   --admin-password=The-admin-password
   

   
   
3. We’ll start it (the dock does not have enough port forwarding, although it’s obvious what needs to be done; it’s also worth noting that the dock says that you need to connect the partition with the postfix :Z:rw, but if you don’t have SELinux, you do not need this option (thanks grossws )):
   

   $ docker run \
       --name freeipa-server-test \
       -it \
       --rm \
       --hostname freeipa.example.test \
       --volume /opt/dockers/freeipa-data:/data \
       --publish "443:443" \
       --publish "389:389" \
       --publish "636:636" \
       --publish "88:88" \
       --publish "88:88/udp" \
       --publish "464:464" \
       --publish "464:464/udp" \
       adelton/freeipa-server
   

   
   
4. After a short installation, you will be kindly provided bash- with this, the installation and configuration of FreeIPA Server has by and large been completed. You can add freeipa.example.test to yourself in / etc / hosts, go to https: //freeipa.example.test/ , log in as admin and create a user.

1. Created a directory for configs:
   

   $ sudo mkdir -p /opt/dockers/dnsmasq.d
   

   
   
2. Added dnsmasq config there:
   

   $ sudo tee /opt/dockers/dnsmasq.d/dnsmasq.conf
   address=/freeipa.example.test/10.12.0.172
   address=/server00.example.test/10.12.0.172
   address=/server01.example.test/10.12.0.173
   address=/server02.example.test/10.12.0.174
   

   
   
3. We start (DNS works on 53 / tcp and 53 / udp ports, so we forward them to the config folder):
   

   $ docker run \
       --name dnsmasq-test \
       --rm \
       --publish 53:53 \
       --publish 53:53/udp \
       --cap-add NET_ADMIN \
       --volume /opt/dockers/dnsmasq.d:/etc/dnsmasq.d \
       --entrypoint /bin/sh \
       andyshinn/dnsmasq \
       -c '/usr/sbin/dnsmasq -k -h --conf-dir /etc/dnsmasq.d/'
   

   
   
4. Check what works:
   

   $ nslookup server00.example.test 127.0.0.1
   

dnsmasq:
    image: andyshinn/dnsmasq
    ports:
        - "53:53"
        - "53:53/udp"
    cap_add:
        - NET_ADMIN
    links:
        - freeipa
    volumes:
        - "/opt/dockers/dnsmasq.d:/etc/dnsmasq.d"
    entrypoint: ["/bin/sh", "-c", "/usr/sbin/dnsmasq -k -h --conf-dir /etc/dnsmasq.d/ -S /example.test/`getent hosts freeipa | cut -f1 -d' '`"]
freeipa:
    image: adelton/freeipa-server
    hostname: freeipa.example.test
    ports:
        - "443:443"
        - "389:389"
        - "636:636"
        - "88:88"
        - "88:88/udp"
        - "464:464"
        - "464:464/udp"
    cap_add:
        - NET_ADMIN
    volumes:
        - "/opt/dockers/freeipa-data:/data"

$ docker-compose up -d

Customer setup

1. You need to fix / etc / hosts so that the first in the list is the fully qualified domain name (FQDN):
   

   127.0.1.1    server00.example.test server00
   

   
   
2. Configure DNS (via /etc/network/interfacesor /etc/resolvconf/resolv.conf.d/head) so that the /etc/resolv.conffollowing lines appear:
   

   nameserver 10.12.0.172
   search example.test
   

   
   
3. And now changing the admin password for FreeIPA in the following command, you can run it:
   

   $ sudo bash -c 'bash -c "cat > /usr/share/pam-configs/mkhomedir <

   
Здесь добавится PAM-модуль для автоматического создания домашних директорий, установится freeipa-client, запустится установка ipa-client, добавится сервис sudo в sssd.conf и перегрузятся sssd и ssh.