159 lines
5.3 KiB
Bash
Executable File
159 lines
5.3 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Exit on any error
|
|
set -e
|
|
|
|
# Variables
|
|
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
|
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
|
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
|
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
|
DNS_FORWARDER="8.8.8.8" # Externer DNS-Forwarder (Google in diesem Fall)
|
|
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
|
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
|
AD_REALM=$REALM # Active Directory Realm in Großbuchstaben
|
|
AD_DOMAIN=$DOMAIN # Active Directory Domain in Kleinbuchstaben
|
|
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
|
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
|
|
|
LOGFILE="/var/log/idm_install.log"
|
|
|
|
# Function to check if running as root
|
|
function check_root {
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Function to install the necessary packages
|
|
function install_packages {
|
|
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
|
yum update -y | tee -a $LOGFILE
|
|
|
|
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
|
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
|
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
|
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to install the IDM server with DNS
|
|
function install_idm_server {
|
|
echo "Installiere IdM-Server mit DNS..." | tee -a $LOGFILE
|
|
|
|
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
|
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
|
--ip-address=$IP_ADDRESS --no-pkinit \
|
|
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to configure AD trust
|
|
function configure_ad_trust {
|
|
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
|
|
|
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
|
|
|
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
|
|
|
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to configure Samba
|
|
function configure_samba {
|
|
echo "Konfiguriere Samba..." | tee -a $LOGFILE
|
|
|
|
cat <<EOF > /etc/samba/smb.conf
|
|
[global]
|
|
workgroup = $(echo $REALM | cut -d. -f1)
|
|
realm = $REALM
|
|
security = ADS
|
|
idmap config * : backend = tdb
|
|
idmap config * : range = 1000-9999
|
|
idmap config $REALM : backend = ad
|
|
idmap config $REALM : range = 10000-99999
|
|
log file = /var/log/samba/%m.log
|
|
log level = 1
|
|
kerberos method = system keytab
|
|
dedicated keytab file = /etc/samba/samba.keytab
|
|
map to guest = Bad User
|
|
winbind use default domain = true
|
|
template shell = /bin/bash
|
|
template homedir = /home/%U
|
|
EOF
|
|
|
|
# Restart Samba services
|
|
systemctl restart smb nmb winbind
|
|
}
|
|
|
|
# Function to configure firewall
|
|
function configure_firewall {
|
|
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
|
|
|
firewall-cmd --add-service=freeipa-ldap --permanent
|
|
firewall-cmd --add-service=freeipa-ldaps --permanent
|
|
firewall-cmd --add-service=freeipa-replication --permanent
|
|
firewall-cmd --add-service=freeipa-trust --permanent
|
|
firewall-cmd --add-service=dns --permanent
|
|
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
|
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
|
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
|
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
|
firewall-cmd --add-port=123/udp --permanent # NTP
|
|
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
|
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
|
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
|
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
|
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
|
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
|
firewall-cmd --reload | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to configure DNS settings without DNSSEC
|
|
function configure_dns {
|
|
echo "Konfiguriere DNS..." | tee -a $LOGFILE
|
|
|
|
cat <<EOF > /etc/named.conf
|
|
options {
|
|
directory "/var/named";
|
|
forwarders {
|
|
$DNS_FORWARDER;
|
|
};
|
|
};
|
|
zone "$DOMAIN" IN {
|
|
type master;
|
|
file "$DOMAIN.zone";
|
|
};
|
|
EOF
|
|
|
|
cat <<EOF > /var/named/$DOMAIN.zone
|
|
\$TTL 86400
|
|
@ IN SOA $HOSTNAME. admin.$DOMAIN. (
|
|
2024090701 ; Serial
|
|
3600 ; Refresh
|
|
1800 ; Retry
|
|
1209600 ; Expire
|
|
86400 ) ; Minimum TTL
|
|
|
|
@ IN NS $HOSTNAME.
|
|
@ IN A $IP_ADDRESS
|
|
EOF
|
|
|
|
# Restart DNS service
|
|
systemctl restart named
|
|
}
|
|
|
|
# Main function
|
|
function main {
|
|
check_root
|
|
install_packages
|
|
install_idm_server
|
|
configure_ad_trust
|
|
configure_samba
|
|
configure_firewall
|
|
configure_dns
|
|
echo "IdM-Server Installation und Konfiguration abgeschlossen." | tee -a $LOGFILE
|
|
}
|
|
|
|
# Run the script
|
|
main
|