Bookmark this page

Lab: Connecting to Network-defined Users and Groups

In this lab, you will configure your desktopX system to become a client of the IPA server running on serverX.

Resources:
Machines: desktopX and serverX

Outcomes:

Your desktopX system should use the network users and groups defined by the IPA server running on serverX for both user information and authentication.

If you haven't already done so at the start of the previous exercise:

  • Reset your serverX system.

  • Log into and setup your serverX system. Please note: This step will take approximately 15 minutes.

    [student@serverX ~]$ lab ipaclient setup

Always perform this step:

  • Reset your desktopX system. You can reset your desktopX system while the setup on serverX is still running.

  • Wait for the setup on serverX to complete before continuing.

In your company's quest for a central user information and authentication system, you have settled on using an IPA server for central user management. Another department has already configured an IPA server on your serverX machine. This IPA server is configured with all the relevant DNS SRV records for the following settings:

NameValue
Realm SERVERX.EXAMPLE.COM, where X is your station number.
Domain serverX.example.com, where X is your station number. Note that your desktopX machine is not a part of this DNS domain.
Administrative user admin
Password redhat123

A user has already been configured for you to test with. The username is ipauser, and the password is password. Due to the password policy, this password will need to be changed on first login. Change this password to redhat123.

Central home directories have not yet been configured, so for now, configure the system to automatically create a new local home directory when a user first logs in.

When you have completed your work, run lab ipaclient grade on your desktopX machine to verify your work.

  1. Install the ipa-client package on your desktopX machine.

    1. [student@desktopX ~]$ sudo yum -y install ipa-client
  2. Configure your system, using ipa-client-install, to use the IPA server setup for the serverX.example.com DNS domain. Home directories should automatically be created, and NTP should not be configured during this process.

    1. [student@desktopX ~]$ sudo ipa-client-install --domain=serverX.example.com --no-ntp --mkhomedir
      Discovery was successful!
      Hostname: desktopX.example.com
      Realm: SERVERX.example.com
      DNS Domain: serverX.example.com
      IPA Server: serverX.example.com
      BaseDN: dc=serverX,dc=example,dc=com
      
      Continue to configure the system with these values? [no]: yes
      User authorized to enroll computers: admin
      Password for admin@SERVERX.EXAMPLE.COM: redhat123
      ...
      Client configuration complete.
      
  3. Verify that you can now successfully log into desktopX as the user ipauser by using ssh. The initial password is password, but this should be changed to redhat123. Due to the password change requirement, you will have to log in twice.

    1. [student@desktopX ~]$ ssh ipauser@desktopX.example.com
      ipauser@desktopX.example.com's password: password
      Password expired. Change your password now.
      Creating home directory for ipauser.
      WARNING: Your password has expired.
      You must change your password now and login again!
      Changing password for user ipauser.
      Current password: password
      New password: redhat123
      Retype new password: redhat123
      passwd: all authentication tokens updated successfully.
      Connection to desktopX.example.com closed.
      [student@desktopX ~]$ ssh ipauser@desktopX.example.com
      ipauser@desktopX.example.com's password: redhat123
      Last login: Wed Feb 26 05:19:15 2014 from desktopX.example.com
      -sh-4.2$ logout
  4. Run lab ipaclient grade on your desktopX machine to verify your work.

    1. [student@desktopX ~]$ lab ipaclient grade
Revision: rh134-7-c643331