[root@node102 ~]# ipa-client-install --domain=YINZHENGJIE.COM --server=node100.yinzhengjie.com --realm=YINZHENGJIE.COM --principal=admin@YINZHENGJIE.COM --enable-dns-updates　　　　#开始安装客户端程序，参数意思下面会详细解释！

WARNING: ntpd time&date synchronization service will not be configured as

conflicting service (chronyd) is enabled

Use --force-ntpd option to disable it and force configuration of ntpd

Autodiscovery of servers for failover cannot work with this configuration.

If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.

Proceed with fixed values and no DNS discovery? [no]: yes　　　　#注意，这里需要输入的是yes哟！

Client hostname: node102.yinzhengjie.org.cn

Realm: YINZHENGJIE.COM

DNS Domain: yinzhengjie.com

IPA Server: node100.yinzhengjie.com

BaseDN: dc=yinzhengjie,dc=com

Continue to configure the system with these values? [no]: yes　　　　#注意，这里需要输入的是yes哟！

Skipping synchronizing time with NTP server.

Password for admin@YINZHENGJIE.COM: 　　#对面的小哥哥小姐姐往这里看，这里是需要你输入管理员的用户名密码，也就是你在安装IPA-Server时配置的密码！现在知道为什么我当时如此强调要记住他的原因了吧！

Successfully retrieved CA cert

    Subject:     CN=Certificate Authority,O=YINZHENGJIE.COM

    Issuer:      CN=Certificate Authority,O=YINZHENGJIE.COM

    Valid From:  -- ::

    Valid Until: -- ::

Enrolled in IPA realm YINZHENGJIE.COM

Created /etc/ipa/default.conf

New SSSD config will be created

Configured sudoers in /etc/nsswitch.conf

Configured /etc/sssd/sssd.conf

Configured /etc/krb5.conf for IPA realm YINZHENGJIE.COM

trying https://node100.yinzhengjie.com/ipa/json

[try ]: Forwarding 'schema' to json server 'https://node100.yinzhengjie.com/ipa/json'

trying https://node100.yinzhengjie.com/ipa/session/json

[try ]: Forwarding 'ping' to json server 'https://node100.yinzhengjie.com/ipa/session/json'

[try ]: Forwarding 'ca_is_enabled' to json server 'https://node100.yinzhengjie.com/ipa/session/json'

Systemwide CA database updated.

Hostname (node102.yinzhengjie.org.cn) does not have A/AAAA record.

Failed to update DNS records.

Missing A/AAAA record(s) for host node102.yinzhengjie.org.cn: 172.30.1.102.

Missing reverse record(s) for address(es): 172.30.1.102.

Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub

Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub

Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub

[try ]: Forwarding 'host_mod' to json server 'https://node100.yinzhengjie.com/ipa/session/json'

Could not update DNS SSHFP records.

SSSD enabled

Configured /etc/openldap/ldap.conf

Configured /etc/ssh/ssh_config

Configured /etc/ssh/sshd_config

Configuring yinzhengjie.com as NIS domain.

Client configuration complete.

The ipa-client-install command was successful

You have new mail in /var/spool/mail/root

[root@node102 ~]#

[root@node100 named]# cat /etc/named.conf

options {

        // turns on IPv6 for port 53, IPv4 is on by default for all ifaces

        listen-on-v6 {any;};

        listen-on port  { any; };

        // Put files that named is allowed to write in the data/ directory:

        directory "/var/named"; // the default

        dump-file               "data/cache_dump.db";

        statistics-file         "data/named_stats.txt";

        memstatistics-file      "data/named_mem_stats.txt";

        // Any host is permitted to issue recursive queries

        #allow-recursion { any; };

        allow-query     { any; };

        tkey-gssapi-keytab "/etc/named.keytab";

        pid-file "/run/named/named.pid";

        dnssec-enable yes;

        dnssec-validation no;

        /* Path to ISC DLV key */

        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

};

/* If you want to enable debugging, eg. using the 'rndc trace' command,

 * By default, SELinux policy does not allow named to modify the /var/named directory,

 * so put the default debug log file in data/ :

 */

logging {

        channel default_debug {

                file "data/named.run";

                severity dynamic;

                print-time yes;

        };

};

zone "." IN {

        type hint;

        file "named.ca";

};

include "/etc/named.rfc1912.zones";

include "/etc/named.root.key";

/* WARNING: This part of the config file is IPA-managed.

 * Modifications may break IPA setup or upgrades.

 */

dyndb "ipa" "/usr/lib64/bind/ldap.so" {

        uri "ldapi://%2fvar%2frun%2fslapd-YINZHENGJIE-COM.socket";

        base "cn=dns, dc=yinzhengjie,dc=com";

        server_id "node100.yinzhengjie.com";

        auth_method "sasl";

        sasl_mech "GSSAPI";

        sasl_user "DNS/node100.yinzhengjie.com";

};

/* End of IPA-managed part. */

[root@node100 named]# 

[root@node100 named]# cat /etc/named.rfc1912.zones

// named.rfc1912.zones:

//

// Provided by Red Hat caching-nameserver package

//

// ISC BIND named zone configuration for zones recommended by

// RFC 1912 section 4.1 : localhost TLDs and address zones

// and http://www.ietf.org/internet-drafts/draft-ietf-dnsop-default-local-zones-02.txt

// (c)2007 R W Franks

//

// See /usr/share/doc/bind*/sample/ for example named configuration files.

//

zone "localhost.localdomain" IN {

        type master;

        file "named.localhost";

        allow-update { none; };

};

zone "localhost" IN {

        type master;

        file "named.localhost";

        allow-update { none; };

};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {

        type master;

        file "named.loopback";

        allow-update { none; };

};

zone "1.0.0.127.in-addr.arpa" IN {

        type master;

        file "named.loopback";

        allow-update { none; };

};

zone "0.in-addr.arpa" IN {

        type master;

        file "named.empty";

        allow-update { none; };

};

zone "yinzhengjie.org.cn" IN {

        type master;

        file "yinzhengjie.org.cn.zone";

};

zone "1.30.172.in-addr.arpa" IN {

        type master;

        file "172.30.1.zone";

};

[root@node100 named]#

[root@node100 named]# cat 172.30..zone

$TTL 1D

@       IN SOA  @ node100.yinzhengjie.org.cn (

                                        ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H )    ; minimum

        NS      @

        A       127.0.0.1

        AAAA    ::

     IN      PTR     node101.yinzhengjie.org.cn.

     IN      PTR     node102.yinzhengjie.org.cn.

     IN      PTR     node103.yinzhengjie.org.cn.

[root@node100 named]# 

[root@node100 named]# cat yinzhengjie.org.cn.zone

$TTL 1D

@       IN SOA  @ yinzhengjie.org.cn. (

                                        ; serial

                                        1D      ; refresh

                                        1H      ; retry

                                        1W      ; expire

                                        3H )    ; minimum

        NS      ns.yinzhengjie.org.cn.

ns IN      A       172.30.1.100

node101 IN      A       172.30.1.101

node102 IN      A       172.30.1.102

node103 IN      A       172.30.1.103

[root@node100 named]#