72 lines
2.4 KiB
Bash
Executable File
72 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Set hostname
|
|
hostnamectl set-hostname ds389.heim.lan
|
|
DOMAIN=$(hostname -d)
|
|
# Set IP address (Assuming RHEL 8+ with NetworkManager)
|
|
nmcli connection modify eth0 ipv4.addresses 192.168.44.200/24
|
|
nmcli connection up eth0
|
|
|
|
# Install required packages
|
|
dnf install epel-release -y
|
|
dnf install 389-ds-base -y
|
|
|
|
# Angaben für erstellung CSR
|
|
C="DE" # Country ANgabe
|
|
ST="TH" # State Angabe
|
|
L="ILM" # Location Angabe
|
|
# Extrahiere OU (Organizational Unit) und O (Organization) und wandele sie in Großbuchstaben um
|
|
O=$(echo "${DOMAIN#*.}" | tr '[:lower:]' '[:upper:]') # Organisation Angabe
|
|
OU=$(echo "${DOMAIN%%.*}" | tr '[:lower:]' '[:upper:]') # Organisation Unit Angaben
|
|
|
|
|
|
# Read IP address dynamically from active network interface
|
|
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
|
echo "IP Address: ${IP_ADDRESS}"
|
|
|
|
# Read DNS name dynamically
|
|
HOST_FQDN=$(hostname -f)
|
|
echo "DNS Name: ${HOST_FQDN}"
|
|
|
|
# Read Hostname dynamically
|
|
HOST_NORMAL=$(hostname -s)
|
|
echo "Hostname: ${HOST_NORMAL}"
|
|
|
|
# Set paths to your CA certificates and CSR files
|
|
CA_ROOT_CERT="/path/to/root_ca.crt"
|
|
CA_INTERMEDIATE_CERT="/path/to/intermediate_ca.crt"
|
|
SERVER_CERT="/path/to/server_cert.crt"
|
|
CSR_FILE="/tmp/ds389.heim.lan.csr"
|
|
KEY_FILE="/tmp/ds389.heim.lan.key"
|
|
|
|
# Generate CSR and private key with IP address as SAN
|
|
openssl req -new -newkey rsa:4096 -nodes \
|
|
-keyout "$KEY_FILE" -out "$CSR_FILE" \
|
|
-subj "/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${HOST_FQDN}" \
|
|
-reqexts SAN -config <(cat /etc/pki/tls/openssl.cnf \
|
|
<(printf "[SAN]\nsubjectAltName=IP:${IP_ADDRESS},DNS:${HOST_FQDN}"))
|
|
|
|
# Install CA certificates
|
|
cp "$CA_ROOT_CERT" /etc/pki/ca-trust/source/anchors/
|
|
cp "$CA_INTERMEDIATE_CERT" /etc/pki/ca-trust/source/anchors/
|
|
update-ca-trust extract
|
|
|
|
# Setup Directory Server
|
|
setup-ds-admin --silent \
|
|
--hostname ${HOST_FQDN} \
|
|
--domain "$DOMAIN" \
|
|
--rootdn "cn=Directory Manager" \
|
|
--rootpw your_password_here \
|
|
--admin "admin" \
|
|
--enable ldaps \
|
|
--fips off \
|
|
--addn add
|
|
|
|
# Configure SSL/TLS for Directory Server using CSR
|
|
dsconf -D "cn=Directory Manager" ldap://localhost ssl import-cert "$SERVER_CERT" "$CA_INTERMEDIATE_CERT" "$CA_ROOT_CERT"
|
|
dsconf -D "cn=Directory Manager" ldap://localhost ssl on
|
|
|
|
# Start and enable Directory Server
|
|
systemctl start dirsrv@ds389
|
|
systemctl enable dirsrv@ds389
|