yabhinav/ansible-role-ipaserver

Ansible Role - IPAServer

IPA Server

A role that installs and configures IPA server.

Requirements

• Requires your Linux machine doesn't have other kerberos installations and configurations like MIT-KDC and ActiveDirectory, krb5.conf will be over written by IPA installation.
• If mod_ssl is configured to listen to port 443 it will be reconfigured to use port 10443 as a direct conflict with mod_nss installation.

Role Variables

Mandatory variable are listed here with default values :

ipaserver_realm: "EXAMPLE.COM"
ipaserver_domain: "example.com"

ipaserver_admin_password : * * * * * * * * * * * 
ipaserver_dir_admin_password : * * * * * * * * * * * 

Optional variables are listed here with default values :

ipaserver_configure_ssh: True
ipaserver_configure_sshd: True
ipaserver_hbac_allow: True

ipaserver_idstart: 5000
ipaserver_idmax: False

ipaserver_setup_ntp: True 

ipaserver_setup_dns: False
ipaserver_ssh_trust_dns: False
ipaserver_dns_forwarder: 8.8.8.8

ipaserver_ui_redirect: True

Other variables that should not be changed :

ipaserver_admin_username: admin

Dependencies

None.

Example Playbook

- hosts: localhost
  become_user: True
  gather_facts: True
  
  roles:
    - yabhinav.ipaserver

Issues

• It is not advised to execute this role from ansible running on python-virtualenv on Ubuntu16.04 locally due to this issue . Also have a look at same issue here
• Freeipa-admintools is available only in Ubuntu16.04, So Debian 7,8 and Ubuntu 12.04 and 14.04 support not present for this role

License

MIT

Author Information

Created by Abhinav Yalamanchili

ansible-role-ipaserver's Issues

Debian Support

Support Ubuntu and Debian for FreeIPA server installation

RPM Packages "ipa-server-dns" is not getting installed if "setup_dns" is selected

In my RHEL7/CentOS7 installation the IPA setup failed due to the package "ipa-server-dns" missing
The same probably applies to ipa-server-ad-trust - the same is valid for "fedora" but packages are named "freeipa-...:" there

Fedora Support

Add support for Fedora into the yabhinav.ipaserver ansible role

CentOS7 : IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned

TASK [role_under_test : Run the IPA Server installer] **************************
fatal: [localhost]: FAILED! => {"changed": true, "cmd": "ipa-server-install -U --realm EXAMPLE.COM --domain example.com -a Secret123 -p Secret123 --hostname=testlab.example.com --ip-address=172.17.0.2 --idstart=5000 ", "delta": "0:00:00.670820", "end": "2018-07-18 14:12:37.104935", "msg": "non-zero return code", "rc": 1, "start": "2018-07-18 14:12:36.434115", "stderr": "ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf.\nipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information", "stderr_lines": ["ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR IPv6 stack is enabled in the kernel but there is no interface that has ::1 address assigned. Add ::1 address resolution to 'lo' interface. You might need to enable IPv6 on the interface 'lo' in sysctl.conf.", "ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information"], "stdout": "", "stdout_lines": []}

IPA Replica mode

Installing a IPA replica would be a handy secondary-mode for this. It would need access to much of the same data. What's your feeling on this, could it be done here or would it make more sense as a separate role? I'm willing to do the work/submit a PR.