linux manpages
{"type":"documentation"}

ipa-client-install

Section: FreeIPA Manual Pages (1)
Updated: Sep 5 2011
Index Return to Main Contents
 

NAME

ipa-client-install - Configure an IPA client  

SYNOPSIS

ipa-client-install [OPTION]...  

DESCRIPTION

Configures a client machine to use IPA for authentication and identity services.

By default this configures SSSD to connect to an IPA server for authentication and authorization. Optionally one can instead configure PAM and NSS (Name Switching Service) to work with an IPA server over Kerberos and LDAP.

An authorized user is required to join a client machine to IPA. This can take the form of a kerberos principal or a one-time password associated with the machine.

This same tool is used to unconfigure IPA and attemps to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host-disable <fqdn>).

 

HOSTNAME REQUIREMENTS

Client must use a static hostname. If the machine hostname changes for example due to a dynamic hostname assignment by a DHCP server, client enrollment to IPA server breaks and user then would not be able to perform Kerberos authentication.

--hostname option may be used to specify a static hostname that is set in machine system configuration and persist over reboot.

 

OPTIONS

 

BASIC OPTIONS

--domain=DOMAIN
Set the domain name to DOMAIN
--server=SERVER
Set the IPA server to connect to
--realm=REALM_NAME
Set the IPA realm name to REALM_NAME
-p, --principal
Authorized kerberos principal to use to join the IPA realm.
-w PASSWORD, --password=PASSWORD
Password for joining a machine to the IPA realm. Assumes bulk password unless principal is also set.
-W
Prompt for the password for joining a machine to the IPA realm.
--mkhomedir
Configure PAM to create a users home directory if it does not exist.
--hostname
The hostname of this machine (FQDN). If specified, the hostname will be set and the system configuration will be updated to persist over reboot. By default a nodename result from uname(2) is used.
--ntp-server=NTP_SERVER
Configure ntpd to use this NTP server.
-N, --no-ntp
Do not configure or enable NTP.
--configure-ssh
Configure OpenSSH client to use SSH features provided by IPA server. This allows the ssh client to look up host keys in IPA.
--configure-sshd
Configure OpenSSH server to use SSH features provided by IPA server. This config ures sshd to use GSSAPI and to use sssd to look up user's keys in IPA.
--ssh-trust-dns
Configure OpenSSH client to trust DNS SSHFP records.
--no-dns-sshfp
Do not automatically create DNS SSHFP records.
--noac
Do not use Authconfig to modify the nsswitch.conf and PAM configuration.
-f, --force
Force the settings even if errors occur
-d, --debug
Print debugging information to stdout
-U, --unattended
Unattended installation. The user will not be prompted.

 

SSSD OPTIONS

--permit
Configure SSSD to permit all access. Otherwise the machine will be controlled by the Host-based Access Controls (HBAC) on the IPA server.
--enable-dns-updates
This option tells SSSD to automatically update DNS with the IP address of this client.
--no-krb5-offline-passwords
Configure SSSD not to store user password when the server is offline.
-S, --no-sssd
Do not configure the client to use SSSD for authentication, use nss_ldap instead.
--preserve-sssd
Disabled by default. When enabled, preserves old SSSD configuration if it is not possible to merge it with a new one. Effectively, if the merge is not possible due to SSSDConfig reader encountering unsupported options, ipa-client-install will not run further and ask to fix SSSD config first. When this option is not specified, ipa-client-install will back up SSSD config and create new one. The back up version will be restored during uninstall.

 

UNINSTALL OPTIONS

--uninstall
Remove the IPA client software and restore the configuration to the pre-IPA state.
-U, --unattended
Unattended uninstallation. The user will not be prompted.

 

EXIT STATUS

0 if the installation was successful

1 if an error occurred

2 if uninstalling and the client is not configured

 

Index

NAME
SYNOPSIS
DESCRIPTION
HOSTNAME REQUIREMENTS
OPTIONS
BASIC OPTIONS
SSSD OPTIONS
UNINSTALL OPTIONS
EXIT STATUS
This document was created by man2html, using the manual pages.
Time: 05:29:05 GMT, December 24, 2015