96 lines
3.9 KiB
Bash
Executable File
96 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Exit on any error
|
|
set -e
|
|
|
|
# Variables
|
|
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
|
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
|
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
|
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
|
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
|
PASSWORD="ipaAdminPassword" # Admin-Passwort (in der Praxis sicher speichern)
|
|
DIRMAN_PASSWORD="dirmanPassword" # Directory Manager Passwort
|
|
AD_REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Active Directory Realm in Großbuchstaben
|
|
AD_DOMAIN=$(hostname -d) # Active Directory Domain in Kleinbuchstaben
|
|
AD_ADMIN_USER="administrator" # Administrator-Account der AD-Domäne
|
|
AD_ADMIN_PASS="adAdminPassword" # Passwort des Administrator-Accounts
|
|
|
|
LOGFILE="/var/log/idm_install.log"
|
|
|
|
# Function to check if running as root
|
|
function check_root {
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "Dieses Skript muss als Root ausgeführt werden!" 1>&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Function to install the necessary packages
|
|
function install_packages {
|
|
echo "Installiere benötigte Pakete..." | tee -a $LOGFILE
|
|
yum update -y | tee -a $LOGFILE
|
|
|
|
echo "Installiere erforderliche Pakete..." | tee -a $LOGFILE
|
|
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm | tee -a $LOGFILE
|
|
dnf -y install @idm:DL1 | tee -a $LOGFILE
|
|
yum install -y ipa-server ipa-server-dns bind samba samba-client bind-pkcs11-utils | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to install the IDM server with DNS and AD Trust
|
|
function install_idm_server {
|
|
echo "Installiere IdM-Server mit DNS und AD-Trust..." | tee -a $LOGFILE
|
|
|
|
ipa-server-install --hostname=$HOSTNAME --domain=$DOMAIN --realm=$REALM \
|
|
--ds-password=$DIRMAN_PASSWORD --admin-password=$PASSWORD \
|
|
--ip-address=$IP_ADDRESS --no-pkinit \
|
|
--setup-dns --auto-reverse --forwarder=$DNS_FORWARDER --no-ntp -U | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to configure AD trust
|
|
function configure_ad_trust {
|
|
echo "Konfiguriere AD-Trust..." | tee -a $LOGFILE
|
|
|
|
yum install -y ipa-server-trust-ad | tee -a $LOGFILE
|
|
|
|
ipa-adtrust-install --add-sids --netbios-name=$(echo $REALM | cut -d. -f1) --no-msdcs --admin-password=$PASSWORD -U | tee -a $LOGFILE
|
|
|
|
ipa trust-add --type=ad $AD_REALM --admin=$AD_ADMIN_USER --password=$AD_ADMIN_PASS | tee -a $LOGFILE
|
|
}
|
|
|
|
# Function to configure firewall
|
|
function configure_firewall {
|
|
echo "Konfiguriere Firewall..." | tee -a $LOGFILE
|
|
|
|
firewall-cmd --add-service=freeipa-ldap --permanent
|
|
firewall-cmd --add-service=freeipa-ldaps --permanent
|
|
firewall-cmd --add-service=freeipa-replication --permanent
|
|
firewall-cmd --add-service=freeipa-trust --permanent
|
|
firewall-cmd --add-service=dns --permanent
|
|
firewall-cmd --add-port=88/tcp --permanent # Kerberos
|
|
firewall-cmd --add-port=88/udp --permanent # Kerberos
|
|
firewall-cmd --add-port=464/tcp --permanent # Kerberos kpasswd
|
|
firewall-cmd --add-port=464/udp --permanent # Kerberos kpasswd
|
|
firewall-cmd --add-port=123/udp --permanent # NTP
|
|
firewall-cmd --add-port=135/tcp --permanent # DCE/RPC locator service
|
|
firewall-cmd --add-port=138/udp --permanent # NetBIOS Datagram Service
|
|
firewall-cmd --add-port=139/tcp --permanent # NetBIOS Session Service
|
|
firewall-cmd --add-port=445/tcp --permanent # Microsoft-DS Active Directory, Windows shares
|
|
firewall-cmd --add-port=1024-1300/tcp --permanent # High ports for AD trust
|
|
firewall-cmd --add-port=1024-1300/udp --permanent # High ports for AD trust
|
|
firewall-cmd --reload | tee -a $LOGFILE
|
|
}
|
|
|
|
# Main function
|
|
function main {
|
|
check_root
|
|
install_packages
|
|
install_idm_server
|
|
configure_ad_trust
|
|
configure_firewall
|
|
echo "IdM-Server mit DNS und AD-Trust Installation abgeschlossen." | tee -a $LOGFILE
|
|
}
|
|
|
|
# Run the script
|
|
main
|