11 April,19 at 11:49 AM
What: A method for manual installation of the Centrify agent.
Why: Because some of us just want to install the agent and get going with minimal Windows exposure and components being installed while using the OS native installer.
Estimated Duration: Less than 5 minutes if you have what you'll need.
What you'll need to know and do prior to going to the UNIX/Linux system:
nameserver 192.168.81.10
dig engcen5.centrifyimage.vms ;; QUESTION SECTION: ;engcen5.centrifyimage.vms. IN A ;; ANSWER SECTION: engcen5.centrifyimage.vms. 1200 IN A 192.168.81.25
Implementation steps:
$ tar zxvf centrify-suite-2014.1-rhel3-x86_64.tgzThe only two files you should be concerned with should be adcheck- and centrifydc-; the rest is just icing on the cake or commercial version bits. Centrify always packs the bits with the native installer of the platfrom (E.g. RPM, DEB)
./adcheck-rhel3-x86_64 centrifyimage.vms
$ sudo yum install centrifydc-5.2.1-rhel3-x86_64.rpm
Note - this only puts the bits in place, the fact that the agent is in the system does not mean that it's active (you can confirm with the adinfo command) for this you need to join the domain and that's where most of the gathered information comes in play.
sudo adjoin -w -c "ou=servers,ou=centrifyse" -V -u dwirth centrifyimage.vms
This means, with elevation join in workstation (-w) mode, put the computer in /centrifyse/servers container OU (-c), do a verbose (-V) output, use dwirth's credentials (-u) and join the AD domain centrifyimage.vms. The output of adinfo should change.
At this point you should be able to log in with any AD user to the system. Workstation (express) mode means that anyone should be able to log in, and their Unix identity is generated for them. There are ways to limit access leveraging SSH directives, access.conf and others.
Tools that are good to know:
adcheck - checks if all systems are a go to join a domain or to diagnose domain connectivity
adinfo - shows you what's up with the AD client
adjoin/adleave - joins, leaves AD domains
adquery (user | group) - shows you all unix-enabled AD users and groups
addns - to perform dynamic DNS updates
adsmb - a rudimentary SMB client provided by Centrify.
adcert - available in Express mode in some platforms, a PKI client for the Microsoft CA.
For a Centrify Command Line Cheat Sheet - Click here.
A video that shows you all this (6 minutes):
And that's it, a quick and dirty manual installation without the need of DirectManage bits on Windows or Centrify OpenSSH.
R.P