93 lines
3.4 KiB
Bash
Executable File
93 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Exit on error
|
|
set -e
|
|
|
|
# Variables
|
|
DOMAIN=$(hostname -d) # Holt sich die Domain des Systems
|
|
REALM=$(echo $DOMAIN | tr 'a-z' 'A-Z') # Realm ist die Domain in Großbuchstaben
|
|
HOSTNAME=$(hostname -f) # Holt den vollständigen Hostnamen (FQDN)
|
|
IP_ADDRESS=$(hostname -I | awk '{print $1}') # Holt die primäre IP-Adresse des Systems
|
|
DNS_FORWARDER="192.168.1.1" # Externer DNS-Forwarder (Google in diesem Fall)
|
|
EXTERNAL_CA="true" # Setzt das Skript auf externe CA
|
|
PASSWORD="P@ssw0rd1234" # Admin-Passwort (in der Praxis sicher speichern)
|
|
DIRMAN_PASSWORD="P@ssw0rd12345" # Directory Manager Passwort
|
|
IPA_PASS="P@ssw0rdIPA" # IPA Password
|
|
|
|
# Name der Zertifikatsdateien
|
|
#ROOT_CERT="CERT_HEIMLAN_RootCA.crt"
|
|
SUBCA_CERT="CERT_HEIMLAN_SubCA.crt"
|
|
#SERVER_CERT="CERT_${HOST_FQDN}.crt"
|
|
SERVER_KEY="KEY_${HOST_FQDN}.pem"
|
|
SERVER_FULLCHAIN="fullchain_${HOST_FQDN}.crt"
|
|
|
|
|
|
# Read IP address dynamically from active network interface
|
|
IP_ADDRESS=$(nmcli -t -f IP4.ADDRESS device show | awk -F: '{split($2,a,"/"); print a[1]; exit}')
|
|
echo "IP Address: $IP_ADDRESS"
|
|
|
|
# Eintragung in die HOSTS
|
|
echo -e "$IP_ADDRESS\t$HOSTNAME\t ipa" | sudo tee -a /etc/hosts
|
|
|
|
# System aktualisieren
|
|
echo "Aktualisiere das System..."
|
|
sudo yum update -y
|
|
|
|
# Erforderliche Pakete installieren
|
|
echo "Installiere erforderliche Pakete..."
|
|
subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
|
|
yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
|
|
sudo dnf -y install @idm:DL1
|
|
|
|
# Erforderliche Pakete installieren
|
|
echo "Installiere erforderliche Pakete..."
|
|
sudo yum install -y ipa-server ipa-server-dns
|
|
|
|
# FreeIPA-Server ohne CA installieren
|
|
sudo ipa-server-install --no-pki \
|
|
--http-cert-file "${TMP_CERT}/${SERVER_FULLCHAIN}" \
|
|
--http-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
|
--http-pin "${HTTP_PASS}" \
|
|
--dirsrv-cert-file "$(TMP_CERT)/${SERVER_FULLCHAIN}" \
|
|
--dirsrv-cert-file "${TMP_KEY}/${SERVER_KEY}" \
|
|
--dirsrv-pin $DIRSRV_PASS \
|
|
--ca-cert-file $TMP_CERT/$SUBCA_CERT \
|
|
--hostname=$HOSTNAME \
|
|
--domain=$DOMAIN \
|
|
--realm=$REALM \
|
|
--ds-password=$ADMIN_PASS \
|
|
--admin-password=$IPA_PASS \
|
|
--no-ntp
|
|
|
|
# CSR von der Root CA signieren lassen
|
|
#echo "Signiere CSR mit der Root CA..."
|
|
#openssl ca -in $CSR_FILE -out $SIGNED_CERT -cert $ROOT_CERT -keyfile $ROOT_CA_KEY -extensions v3_req -config $OPENSSL_CONFIG
|
|
hour=0
|
|
min=6
|
|
sec=0
|
|
echo " Sie haben $hour h $min min $sec sek zeit um das Zeit das Zertifikat zu signieren."
|
|
while [ $hour -ge 0 ]; do
|
|
while [ $min -ge 0 ]; do
|
|
while [ $sec -ge 0 ]; do
|
|
echo -ne "$hour:$min:$sec\033[0K\r"
|
|
let "sec=sec-1"
|
|
sleep 1
|
|
done
|
|
sec=59
|
|
let "min=min-1"
|
|
done
|
|
min=59
|
|
let "hour=hour-1"
|
|
done
|
|
|
|
|
|
# FreeIPA-Dienste neu starten
|
|
echo "Starte FreeIPA-Dienste neu..."
|
|
sudo ipactl restart
|
|
|
|
# FreeIPA-Dienste Status prüfen
|
|
sudo ipactl status
|
|
|
|
echo "Redhat Identity Management erfolgreich Installiert und eingerichtet !!"
|
|
echo "Sie können die Admnistration über die WebGui https://${HOST_FQDN} fortsetzen !!"
|