Attachment 610675 Details for Bug 855304 – An ipa-server-install run output

An ipa-server-install run output

ipa-server-install.out (text/plain), 6.82 KB, created by Nikolai Kondrashov on 2012-09-07 09:59:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nikolai Kondrashov

Created: 2012-09-07 09:59:49 UTC

Size: 6.82 KB

patch

obsolete

>$ sudo ipa-server-install --no-ntp
>
>The log file for this installation can be found in /var/log/ipaserver-install.log
>==============================================================================
>This program will set up the FreeIPA Server.
>
>This includes:
>  * Configure a stand-alone CA (dogtag) for certificate management
>  * Create and configure an instance of Directory Server
>  * Create and configure a Kerberos Key Distribution Center (KDC)
>  * Configure Apache (httpd)
>
>Excluded by options:
>  * Configure the Network Time Daemon (ntpd)
>
>To accept the default shown in brackets, press the Enter key.
>
>Enter the fully qualified domain name of the computer
>on which you're setting up server software. Using the form
><hostname>.<domainname>
>Example: master.example.com.
>
>
>Server host name [dc.freeipa.test]:
>
>Warning: Hostname (dc.freeipa.test) not found in DNS
>The domain name has been calculated based on the host name.
>
>Please confirm the domain name [freeipa.test]:
>
>The kerberos protocol requires a Realm name to be defined.
>This is typically the domain name converted to uppercase.
>
>Please provide a realm name [FREEIPA.TEST]:
>Certain directory server operations require an administrative user.
>This user is referred to as the Directory Manager and has full access
>to the Directory for system management tasks and will be added to the
>instance of directory server created for IPA.
>The password must be at least 8 characters long.
>
>Directory Manager password:
>Password (confirm):
>
>The IPA server requires an administrative user, named 'admin'.
>This user is a regular system account used for IPA server administration.
>
>IPA admin password:
>Password (confirm):
>
>
>The IPA Master Server will be configured with:
>Hostname:      dc.freeipa.test
>IP address:    192.168.122.2
>Domain name:   freeipa.test
>Realm name:    FREEIPA.TEST
>
>Continue to configure the system with these values? [no]: yes
>
>The following operations may take some minutes to complete.
>Please wait until the prompt is returned.
>
>Configuring directory server for the CA: Estimated time 30 seconds
>  [1/3]: creating directory server user
>  [2/3]: creating directory server instance
>  [3/3]: restarting directory server
>done configuring pkids.
>Configuring certificate server: Estimated time 3 minutes 30 seconds
>  [1/18]: creating certificate server user
>  [2/18]: creating pki-ca instance
>  [3/18]: configuring certificate server instance
>  [4/18]: disabling nonces
>  [5/18]: creating CA agent PKCS#12 file in /root
>  [6/18]: creating RA agent certificate database
>  [7/18]: importing CA chain to RA certificate database
>  [8/18]: fixing RA database permissions
>  [9/18]: setting up signing cert profile
>  [10/18]: set up CRL publishing
>  [11/18]: set certificate subject base
>  [12/18]: enabling Subject Key Identifier
>  [13/18]: configuring certificate server to start on boot
>  [14/18]: restarting certificate server
>  [15/18]: requesting RA certificate from CA
>  [16/18]: issuing RA agent certificate
>  [17/18]: adding RA agent as a trusted user
>  [18/18]: Configure HTTP to proxy connections
>done configuring pki-cad.
>Configuring directory server: Estimated time 1 minute
>  [1/35]: creating directory server user
>  [2/35]: creating directory server instance
>  [3/35]: adding default schema
>  [4/35]: enabling memberof plugin
>  [5/35]: enabling referential integrity plugin
>  [6/35]: enabling winsync plugin
>  [7/35]: configuring replication version plugin
>  [8/35]: enabling IPA enrollment plugin
>  [9/35]: enabling ldapi
>  [10/35]: configuring uniqueness plugin
>  [11/35]: configuring uuid plugin
>  [12/35]: configuring modrdn plugin
>  [13/35]: enabling entryUSN plugin
>  [14/35]: configuring lockout plugin
>  [15/35]: creating indices
>  [16/35]: configuring ssl for ds instance
>  [17/35]: configuring certmap.conf
>  [18/35]: configure autobind for root
>  [19/35]: configure new location for managed entries
>  [20/35]: restarting directory server
>  [21/35]: adding default layout
>  [22/35]: adding delegation layout
>  [23/35]: adding replication acis
>  [24/35]: creating container for managed entries
>  [25/35]: configuring user private groups
>  [26/35]: configuring netgroups from hostgroups
>  [27/35]: creating default Sudo bind user
>  [28/35]: creating default Auto Member layout
>  [29/35]: creating default HBAC rule allow_all
>  [30/35]: initializing group membership
>  [31/35]: adding master entry
>  [32/35]: configuring Posix uid/gid generation
>  [33/35]: enabling compatibility plugin
>  [34/35]: tuning directory server
>  [35/35]: configuring directory to start on boot
>done configuring dirsrv.
>Configuring Kerberos KDC: Estimated time 30 seconds
>  [1/10]: adding sasl mappings to the directory
>  [2/10]: adding kerberos container to the directory
>  [3/10]: configuring KDC
>  [4/10]: initialize kerberos container
>  [5/10]: adding default ACIs
>  [6/10]: creating a keytab for the directory
>  [7/10]: creating a keytab for the machine
>  [8/10]: adding the password extension to the directory
>  [9/10]: starting the KDC
>  [10/10]: configuring KDC to start on boot
>done configuring krb5kdc.
>Configuring kadmin
>  [1/2]: starting kadmin
>  [2/2]: configuring kadmin to start on boot
>done configuring kadmin.
>Configuring ipa_memcached
>  [1/2]: starting ipa_memcached
>  [2/2]: configuring ipa_memcached to start on boot
>done configuring ipa_memcached.
>Configuring the web interface: Estimated time 1 minute
>  [1/14]: disabling mod_ssl in httpd
>  [2/14]: setting mod_nss port to 443
>  [3/14]: setting mod_nss password file
>  [4/14]: enabling mod_nss renegotiate
>  [5/14]: adding URL rewriting rules
>  [6/14]: configuring httpd
>  [7/14]: setting up ssl
>  [8/14]: setting up browser autoconfig
>  [9/14]: publish CA cert
>  [10/14]: creating a keytab for httpd
>  [11/14]: clean up any existing httpd ccache
>  [12/14]: configuring SELinux for httpd
>  [13/14]: restarting httpd
>  [14/14]: configuring httpd to start on boot
>done configuring httpd.
>Applying LDAP updates
>Restarting the directory server
>Restarting the KDC
>Sample zone file for bind has been created in /tmp/sample.zone.vzJoLD.db
>Restarting the web server
>==============================================================================
>Setup complete
>
>Next steps:
>        1. You must make sure these network ports are open:
>                TCP Ports:
>                  * 80, 443: HTTP/HTTPS
>                  * 389, 636: LDAP/LDAPS
>                  * 88, 464: kerberos
>                UDP Ports:
>                  * 88, 464: kerberos
>
>        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
>           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
>           and the web user interface.
>        3. Kerberos requires time synchronization between clients
>           and servers for correct operation. You should consider enabling ntpd.
>
>Be sure to back up the CA certificate stored in /root/cacert.p12
>This file is required to create replicas. The password for this
>file is the Directory Manager password

Actions: View

Attachments on bug 855304: 610675 | 610676