ipa-client-install(1) FreeIPA Manual Pages ipa-client-install(1)NAMEipa-client-install - Configure an IPA client
SYNOPSISipa-client-install [OPTION]...
DESCRIPTION
Configures a client machine to use IPA for authentication and identity
services.
By default this configures SSSD to connect to an IPA server for authen‐
tication and authorization. Optionally one can instead configure PAM
and NSS (Name Switching Service) to work with an IPA server over Ker‐
beros and LDAP.
An authorized user is required to join a client machine to IPA. This
can take the form of a kerberos principal or a one-time password asso‐
ciated with the machine.
This same tool is used to unconfigure IPA and attempts to return the
machine to its previous state. Part of this process is to unenroll the
host from the IPA server. Unenrollment consists of disabling the
prinicipal key on the IPA server so that it may be re-enrolled. The
machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to
authenticate to the IPA server to unenroll itself. If this principal
does not exist then unenrollment will fail and an administrator will
need to disable the host principal (ipa host-disable <fqdn>).
HOSTNAME REQUIREMENTS
Client must use a static hostname. If the machine hostname changes for
example due to a dynamic hostname assignment by a DHCP server, client
enrollment to IPA server breaks and user then would not be able to per‐
form Kerberos authentication.
--hostname option may be used to specify a static hostname that per‐
sists over reboot.
OPTIONS
BASIC OPTIONS
--domain=DOMAIN
Set the domain name to DOMAIN
--server=SERVER
Set the IPA server to connect to. May be specified multiple
times to add multiple servers to ipa_server value in sssd.conf.
Only the first value is considered when used with --no-sssd.
--realm=REALM_NAME
Set the IPA realm name to REALM_NAME
--fixed-primary
Configure sssd to use a fixed server as the primary IPA server.
The default is to use DNS SRV records to determine the primary
server to use and fall back to the server the client is enrolled
with. When used in conjunction with --server then no _srv_ value
is set in the ipa_server option in sssd.conf.
-p, --principal
Authorized kerberos principal to use to join the IPA realm.
-w PASSWORD, --password=PASSWORD
Password for joining a machine to the IPA realm. Assumes bulk
password unless principal is also set.
-W Prompt for the password for joining a machine to the IPA realm.
--mkhomedir
Configure PAM to create a users home directory if it does not
exist.
--hostname
The hostname of this machine (FQDN). If specified, the hostname
will be set and the system configuration will be updated to per‐
sist over reboot. By default a nodename result from uname(2) is
used.
--force-join
Join the host even if it is already enrolled.
--ntp-server=NTP_SERVER
Configure ntpd to use this NTP server.
-N, --no-ntp
Do not configure or enable NTP.
--ssh-trust-dns
Configure OpenSSH client to trust DNS SSHFP records.
--no-ssh
Do not configure OpenSSH client.
--no-sshd
Do not configure OpenSSH server.
--no-dns-sshfp
Do not automatically create DNS SSHFP records.
--noac Do not use Authconfig to modify the nsswitch.conf and PAM con‐
figuration.
-f, --force
Force the settings even if errors occur
-d, --debug
Print debugging information to stdout
-U, --unattended
Unattended installation. The user will not be prompted.
--ca-cert-file=CA_FILE
Do not attempt to acquire the IPA CA certificate via automated
means, instead use the CA certificate found locally in in
CA_FILE. The CA_FILE must be an absolute path to a PEM format‐
ted certificate file. The CA certificate found in CA_FILE is
considered authoritative and will be installed without checking
to see if it's valid for the IPA domain.
SSSD OPTIONS
--permit
Configure SSSD to permit all access. Otherwise the machine will
be controlled by the Host-based Access Controls (HBAC) on the
IPA server.
--enable-dns-updates
This option tells SSSD to automatically update DNS with the IP
address of this client.
--no-krb5-offline-passwords
Configure SSSD not to store user password when the server is
offline.
-S, --no-sssd
Do not configure the client to use SSSD for authentication, use
nss_ldap instead.
--preserve-sssd
Disabled by default. When enabled, preserves old SSSD configura‐
tion if it is not possible to merge it with a new one. Effec‐
tively, if the merge is not possible due to SSSDConfig reader
encountering unsupported options, ipa-client-install will not
run further and ask to fix SSSD config first. When this option
is not specified, ipa-client-install will back up SSSD config
and create new one. The back up version will be restored during
uninstall.
UNINSTALL OPTIONS
--uninstall
Remove the IPA client software and restore the configuration to
the pre-IPA state.
-U, --unattended
Unattended uninstallation. The user will not be prompted.
FILES
Files that will be replaced if SSSD is configured (default):
/etc/sssd/sssd.conf
Files that will be replaced if they exist and SSSD is not configured
(--no-sssd):
/etc/ldap.conf
/etc/nss_ldap.conf
/etc/libnss-ldap.conf
/etc/pam_ldap.conf
/etc/nslcd.conf
Files replaced if NTP is enabled:
/etc/ntp.conf
/etc/sysconfig/ntpd
/etc/ntp/step-tickers
Files always created (replacing existing content):
/etc/krb5.conf
/etc/ipa/ca.crt
/etc/ipa/default.conf
/etc/openldap/ldap.conf
Files updated, existing content is maintained:
/etc/pki/nssdb
/etc/krb5.keytab
/etc/sysconfig/network
EXIT STATUS
0 if the installation was successful
1 if an error occurred
2 if uninstalling and the client is not configured
3 if installing and the client is already configured
4 if an uninstall error occurred
FreeIPA Sep 5 2011 ipa-client-install(1)
