Build a production IPA server without integrate DNS and NTP with client

Question

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's more secure, it has better sudo and HBAC rules, ability to set password polices, it can be integrated with Windows Active Directory, and others.

However, I have issue with NTP and DNS, we already have our DNS and NTP clusters in DC environment. I believe I can make IPA as DNS forwarder, but it will still a middleware. Moreover, we are not going to have the IPA server as cluster, so it would be risky somehow to be a centralized DNS and NTP server.

My questions here: 1. Why should I have DNS & NTP are centralized from IPA? 2. Can I avoid configuring DNS & NTP and satisfy by my existing DNS & NTP servers for my IPA clients? Also, avoid to have IPA as a middleware for DNS & NTP? 3. Is there a better alternative than IPA, stable, scalable and easy configuration server?

Thanks..

Solution 1

you don't have to. You can use your existing dns and ntp server infrastructure but you will need to manage the ipa records on your on your own instead of having ipa take care of it.

In fact it does not really matter what servers run the dns service as long as the clients get their answers from you the infrastructure in place. You can, for instance, delegate a sub domain in your main dns server to the ipa domain controllers. You do not need to change anything on the clients, they will still query your dns servers, which in turn will poll the ipa domain controllers caching the info like they would do with any other external domain.

As to the ntp infrastructure, the same applies. What is important is the existence of a canonical time source on the network. Which one it is is not so important. Deploy the configs using your favourite config management tool.

Solution 2

DNS and NTP being synced between your IPA server and clients is critical for kerberos tickets to be issued and considered valid. That is why it is recommended by RedHat to set up your IPA server as an NTP server. DNS is more optional; the critical part of DNS is that forward and reverse lookups succeed and match.

The RedHat published guide on IdM (built on IPA) can be found here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/#dns-reqs See section 2.4.6 for NTP more detailed explanation, and 3.5 for DNS.

The short overview of the two services: "Multiple DNS servers are usually configured, each one working as an authoritative resource for machines within a specific domain. Having the IdM server also be a DNS server is optional, but it is strongly recommended. When the IdM server also manages DNS, there is tight integration between the DNS zones and the IdM clients and the DNS configuration can be managed using native IdM tools. Even if an IdM server is a DNS server, other external DNS servers can still be used." (1.2.4, para 3)

"When the IdM server is the NTP server for the domain, all times and dates are synchronized before any other operations are performed. This allows all of the date-related services — including password expirations, ticket and certificate expirations, account lockout settings, and entry creation dates — to function as expected." (1.2.6, para 3)

Comments

[Hatem Mashaqi]

I am planning to configure IPA with DNS, but I am wondering can I add IPA service records to my current DNS server, so the client when it needs to use krbs, ldap the DNS server will use the service records and send forward it to IPA ? _ldap._tcp IN SRV 0 100 389 ipa _kerberos IN TXT EXAMPLE.COM _kerberos._tcp IN SRV 0 100 88 ipa _kerberos._udp IN SRV 0 100 88 ipa _kerberos-master._tcp IN SRV 0 100 88 ipa .... _ntp._udp IN SRV 0 100 123 ipa

[Hatem Mashaqi]

I am planning to configure IPA with DNS, but I am wondering can I add IPA service records to my current DNS server, so the client when it needs to use krbs, ldap the DNS server will use the service records and send forward it to IPA ? _ldap._tcp IN SRV 0 100 389 ipa _kerberos IN TXT EXAMPLE.COM _kerberos._tcp IN SRV 0 100 88 ipa _kerberos._udp IN SRV 0 100 88 ipa _kerberos-master._tcp IN SRV 0 100 88 ipa .... _ntp._udp IN SRV 0 100 123 ipa

[natxo asenjo]

sure, that is how the kerberos autodiscovery is configured

[Hatem Mashaqi]

Thanks ,, I am planning to do this serverfault.com/questions/772428/…