Product SiteDocumentation Site

3.6. Setting up a Linux Client Through Kickstart

A kickstart enrollment automatically adds a new system to the FreeIPA domain at the time it is provisioned.
This requires pre-creating the hosts on the FreeIPA server, with a predefined password that can be used to authenticate to complete the enrollment operation.
  1. Create the host entry on the FreeIPA server and set a temporary Kerberos password for the entry.
    When the ipa-client-install script is run normally (interactively), it prompts for authentication credentials to access the FreeIPA domain. However, when the script is run automatically, the system has to have some way to access the FreeIPA domain without using an existing FreeIPA user; this is done by setting the host principal in the script and using a Kerberos password (configured for the host account) to access the FreeIPA domain.
    For example:
    [jsmith@ipaserver ~]$ ipa host-add kickstart-server.example.com --password=secret
    The password expires after the first authentication attempt. After enrollment completes, the host is authenticated using its keytab.
  2. Include the ipa-client package with the other install packages.
    %packages
    @ X Window System 
    @ Desktop 
    @ Sound and Video					
    ipa-client
    ...
  3. Create a post-install instruction that runs the ipa-client-install script, passes all the required information to access and configure the FreeIPA domain services, and specifies the pre-set password. Use the --unattended option to instruct the script to run non-interactively.
    %post --log=/root/ks-post.log
    
    # Get the hostname to set as the host principal	
    /bin/hostname > /tmp/hostname.txt
    
    # Run the client install script
    /usr/sbin/ipa-client-install --domain=EXAMPLEDOMAIN --enable-dns-updates --mkhomedir -w secret --realm=EXAMPLEREALM --server=ipaserver.example.com --unattended
  4. Run the kickstart script.