# FreeIPA installation bzw. der Versuch davon
**URL:** https://forum.makerspace-gt.de/t/freeipa-installation-bzw-der-versuch-davon/353
**Category:** Computer
**Created:** [10. Mai 2020 um 17:21 UTC](https://forum.makerspace-gt.de/t/freeipa-installation-bzw-der-versuch-davon/353 "2020-05-10T17:21:07Z")
**Posts on this page:** 1
**Showing post:** 3
### Author:  [@igami](https://forum.makerspace-gt.de/u/igami)
#### Post date: [16. Mai 2020 um 11:37 UTC](https://forum.makerspace-gt.de/t/freeipa-installation-bzw-der-versuch-davon/353/3 "2020-05-16T11:37:30Z")
Neues Wochenende neues Spiel
heute richte ich mich nach der Anleitung von Computing for Geeks
# [https://vmbs.uk/t/how-to-install-freeipa-server-lets-encrypt-on-centos-7/69](https://vmbs.uk/t/how-to-install-freeipa-server-lets-encrypt-on-centos-7/69)
1. VM wird wie gehabt eingerichtet, nur diesmal ein CentOS 8 anstelle eines CentOS 7, 2 vCPUs und 4 gb RAM
2. `yum -y upgrade`
3. Hostname setzen
- `hostnamectl set-hostname ipa.makerspace-gt.de`
- `echo "192.251.226.18 ipa.makerspace-gt.de ipa" | sudo tee -a /etc/hosts`
1. `timedatectl set-timeone Europe/Berlin`
2.
> I had failed installation with SELinux in enforcing mode, I recommend you set it to permissive or disabled.
- `setenforce 0`
- `sed -i 's/^SELINUX=.*/SELINUX=permissive/g' /etc/selinux/config`
3.
> Since this is FreeIPA Server installation, install DL1 stream and then freeipa-server.
- `yum -y install @idm:DL1`
- `yum -y install freeipa-server`
4. Dann ist soweit alles vorbereitet und der Server wird konfiguriert
- `ipa-server-install`
```auto
The ipa-client-install command was successful
Please add records in this file to your DNS system: /tmp/ipa.system.records.fr5e7ngf.db
==============================================================================
Setup complete
Next steps:
1. You must make sure these network ports are open:
TCP Ports:
* 80, 443: HTTP/HTTPS
* 389, 636: LDAP/LDAPS
* 88, 464: kerberos
UDP Ports:
* 88, 464: kerberos
* 123: ntp
2. You can now obtain a kerberos ticket using the command: 'kinit admin'
This ticket will allow you to use the IPA tools (e.g., ipa user-add)
and the web user interface.
Be sure to back up the CA certificates stored in /root/cacert.p12
These files are required to create replicas. The password for these
files is the Directory Manager password
The ipa-server-install command was successful
```
5. ich bekomme in Firefox immer noch die Warnung
```auto
Fehler: Gesicherte Verbindung fehlgeschlagen
Beim Verbinden mit ipa.makerspace-gt.de trat ein Fehler auf. Sie haben ein ungültiges Zertifikat erhalten. Bitte kontaktieren Sie den Server-Administrator oder E-Mail-Korrespondenten und geben Sie diesen die folgenden Informationen: Ihr Zertifikat enthält die gleiche Seriennummer wie ein anderes Zertifikat dieser Zertifizierungsstelle. Bitte erwerben Sie ein neues Zertifikat mit einer eindeutigen Seriennummer. Fehlercode:
SEC_ERROR_REUSED_ISSUER_AND_SERIAL
Die Website kann nicht angezeigt werden, da die Authentizität der erhaltenen Daten nicht verifiziert werden konnte.
Kontaktieren Sie bitte den Inhaber der Website, um ihn über dieses Problem zu informieren.
```
6. Ich versuche mich noch einmal an der Installtion von letsencrypt
- [GitHub - freeipa/freeipa-letsencrypt: A quick hack allowing to use Let's Encrypt certificates for FreeIPA web interface. · GitHub](https://github.com/freeipa/freeipa-letsencrypt)
7. `yum -y install git`
8. `yum config-manager --set-enabled PowerTools`
9. `cp -r /etc/httpd/alias /etc/httpd/alias_backup`
10. `git clone https://github.com/freeipa/freeipa-letsencrypt.git`
11. `cd freeipa-letsencrypt/`
12. `vi renew-le.sh`
```auto
#!/usr/bin/bash
set -o nounset -o errexit
WORKDIR=$(dirname "$(realpath $0)")
EMAIL="info@makerspace-gt.de"
### cron
# check that the cert will last at least 2 days from now to prevent too frequent renewal
# comment out this line for the first run
if ["${1:-renew}" != "--first-time"]
then
start_timestamp=`date +%s --date="$(openssl x509 -startdate -noout -in /var/lib/ipa/certs/httpd.crt | cut -d= -f2)"`
now_timestamp=`date +%s`
let diff=($now_timestamp-$start_timestamp)/86400
if ["$diff" -lt "2"]; then
exit 0
fi
fi
cd "$WORKDIR"
# cert renewal is needed if we reached this line
# cleanup
rm -f "$WORKDIR"/*.pem
rm -f "$WORKDIR"/httpd-csr.*
# generate CSR
openssl req -new -sha256 -config "$WORKDIR/ipa-httpd.cnf" -key /var/lib/ipa/private/httpd.key -out "$WORKDIR/httpd-csr.der"
# httpd process prevents letsencrypt from working, stop it
service httpd stop
# get a new cert
letsencrypt certonly --standalone --csr "$WORKDIR/httpd-csr.der" --email "$EMAIL" --agree-tos
# replace the cert
cp /var/lib/ipa/certs/httpd.crt /var/lib/ipa/certs/httpd.crt.bkp
mv -f "$WORKDIR/0000_cert.pem" /var/lib/ipa/certs/httpd.crt
restorecon -v /var/lib/ipa/certs/httpd.crt
# start httpd with the new cert
service httpd start
```
13. vi ipa-httpd.cnf
```auto
# the fully qualified server (or service) name
FQDN = ipa.makerspace-gt.de
ALTNAMES = DNS:$FQDN
# --- no modifications required below ---
[req]
default_bits = 2048
default_md = sha256
prompt = no
encrypt_key = no
distinguished_name = dn
req_extensions = req_ext
[dn]
CN = $FQDN
[req_ext]
subjectAltName = $ALTNAMES
```
14. `bash -x setup-le.sh`
15. Auf einmal soll ich ein Passwort eingeben
```auto
+ openssl req -new -sha256 -config /root/freeipa-letsencrypt/ipa-httpd.cnf -key /var/lib/ipa/private/httpd.key -out /root/freeipa-letsencrypt/httpd-csr.der
Enter pass phrase for /var/lib/ipa/private/httpd.key:
```
16. Der Fehler ist bekannt! Und zum Glück auch ein Workaround
- [First run - "Enter pass phrase for /var/lib/ipa/private/httpd.key" ? · Issue #18 · freeipa/freeipa-letsencrypt · GitHub](https://github.com/freeipa/freeipa-letsencrypt/issues/18#issuecomment-618139020)
- `bash -x /usr/libexec/ipa/ipa-httpd-pwdreader $HOSTNAME:443 RSA`
17. Danach läuft das Scipt weiter nur um dann mit einem anderen Fehler abzubrechen
```auto
+ letsencrypt certonly --standalone --csr /root/freeipa-letsencrypt/httpd-csr.der --email info@makerspace-gt.de --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Performing the following challenges:
http-01 challenge for ipa.makerspace-gt.de
Waiting for verification...
Cleaning up challenges
An unexpected error occurred:
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 384, in _make_request
six.raise_from(e, None)
File "", line 3, in raise_from
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 380, in _make_request
httplib_response = conn.getresponse()
File "/usr/lib64/python3.6/http/client.py", line 1346, in getresponse
response.begin()
File "/usr/lib64/python3.6/http/client.py", line 307, in begin
version, status, reason = self._read_status()
File "/usr/lib64/python3.6/http/client.py", line 268, in _read_status
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/lib64/python3.6/socket.py", line 586, in readinto
return self._sock.recv_into(b)
File "/usr/lib64/python3.6/ssl.py", line 968, in recv_into
return self.read(nbytes, buffer)
File "/usr/lib64/python3.6/ssl.py", line 830, in read
return self._sslobj.read(len, buffer)
File "/usr/lib64/python3.6/ssl.py", line 587, in read
v = self._sslobj.read(len, buffer)
socket.timeout: The read operation timed out
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
timeout=timeout
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 638, in urlopen
_stacktrace=sys.exc_info()[2])
File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 368, in increment
raise six.reraise(type(error), error, _stacktrace)
File "/usr/lib/python3.6/site-packages/urllib3/packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
chunked=chunked)
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 386, in _make_request
self._raise_timeout(err=e, url=url, timeout_value=read_timeout)
File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 306, in _raise_timeout
raise ReadTimeoutError(self, url, "Read timed out. (read timeout=%s)" % timeout_value)
urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out. (read timeout=45)
During handling of the above exception, another exception occurred:
requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out. (read timeout=45)
Please see the logfiles in /var/log/letsencrypt for more details.
```
18. Etwas Recherche führt mich hierher
- [HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Read timed out - #4 by Brian\_Peach - Help - Let's Encrypt Community Support](https://community.letsencrypt.org/t/httpsconnectionpool-host-acme-v02-api-letsencrypt-org-port-443-read-timed-out/95354/4)
- und weiter zu diesem hier
[Cannot get new certificate, readtimeout error - #10 by \_az - Help - Let's Encrypt Community Support](https://community.letsencrypt.org/t/cannot-get-new-certificate-readtimeout-error/94586/10)
19. `ifconfig eth0 mtu 1300`
20. Dann noch einmal `bash -x renew-le.sh --first-time`
```auto
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/root/freeipa-letsencrypt/0001_chain.pem
Your cert will expire on 2020-08-14. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
```
21. Wir haben nun eine FreeIpa Instanz [ipa.makerspace-gt.de](http://ipa.makerspace-gt.de) 🥳
Wer hilft mit beim Einrichten der Benutzen? @CommanderRiker?
---
_[View the full topic](https://forum.makerspace-gt.de/t/freeipa-installation-bzw-der-versuch-davon/353)._