Red Hat Security: Identity Management and Authentication

Instructions

1. Review the domain configuration and the enabled roles for the idm, replica1, and replica2 machines.

   1. Log in to the idm machine and authenticate to IdM as the admin user.

      [student@workstation ~]$ ssh idm
      [student@idm ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. Review the current domain configuration.

      Verify the roles enabled on the servers.

      [student@idm ~]$ ipa config-show
      ...output omitted...
        IPA masters: idm.lab.example.com, replica1.lab.example.com, replica2.lab.example.com
        IPA master capable of PKINIT: idm.lab.example.com, replica1.lab.example.com, replica2.lab.example.com
        IPA CA servers: idm.lab.example.com
        IPA CA renewal master: idm.lab.example.com
        IPA DNS servers: idm.lab.example.com, replica1.lab.example.com, replica2.lab.example.com

2. List the server roles on the replica1 machine.

   [student@idm ~]$ ipa server-show replica1.lab.example.com
     Server name: replica1.lab.example.com
     Managed suffixes: domain
     Min domain level: 1
     Max domain level: 1
     Enabled server roles: DNS server, IPA master

3. Enable the CA role on the replica1 machine.

   1. Log out of the idm machine. Log in to the replica1 machine and become the root user.

      [student@idm ~]$ exit
      logout
      Connection to idm closed.
      [student@workstation ~]$ ssh replica1
      [student@replica1 ~]$ sudo -i
      [sudo] password for student: student

   2. Install the IdM CA service.

      [root@replica1 ~]# ipa-ca-install
      Directory Manager (existing master) password: RedHat123^
      
      Run connection check to master
      Connection check OK
      Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
        [1/28]: creating certificate server db
        [2/28]: setting up initial replication
      Starting replication, please wait until this has completed.
      Update in progress, 5 seconds elapsed
      Update succeeded
      
        [3/28]: creating ACIs for admin
        [4/28]: creating installation admin user
        [5/28]: configuring certificate server instance
      ...output omitted...
        [28/28]: deploying ACME service
      Done configuring certificate server (pki-tomcatd).
      Updating DNS system records

   3. Log out of the replica1 machine and log in to idm. Authenticate to IdM as the admin user.

      [root@replica1 ~]# exit
      logout
      [student@replica1 ~]$ exit
      Connection to replica1 closed.
      [student@workstation ~]$ ssh idm
      [student@idm ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   4. Review the roles that are enabled for the replica1 machine and identify the servers that have the CA server role enabled.

      The replica1 machine now has the CA server role enabled.

      [student@idm ~]$ ipa server-show replica1.lab.example.com
        Server name: replica1.lab.example.com
        Managed suffixes: domain, ca
        Min domain level: 1
        Max domain level: 1
        Enabled server roles: CA server, DNS server, IPA master
      [student@idm ~]$ ipa server-find --servrole "CA server"
      ---------------------
      2 IPA servers matched
      ---------------------
        Server name: idm.lab.example.com
        Min domain level: 1
        Max domain level: 1
      
        Server name: replica1.lab.example.com
        Min domain level: 1
        Max domain level: 1
      ----------------------------
      Number of entries returned 2
      ----------------------------

   5. Review the ca topology segments.

      IdM automatically creates the replication agreement between the idm and replica1 machines.

      [student@idm ~]$ ipa topologysegment-find ca
      -----------------
      1 segment matched
      -----------------
        Segment name: idm.lab.example.com-to-replica1.lab.example.com
        Left node: idm.lab.example.com
        Right node: replica1.lab.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 1
      ----------------------------

   6. Exit the idm machine.

      [student@idm ~]$ exit
      logout
      Connection to idm closed.