Section 1: user commands and tools
NAME ipa-ldap-updater – Update the IPA LDAP configuration SYNOPSIS ipa-ldap-updater [options] input_file(s) DESCRIPTION ipa-ldap-updater is utility which can be used to update the IPA LDAP server. An update file describes an LDAP entry and a set of operations to be performed on that entry. It can be used to add new entries or modify existing…
NAME ipa-kra-install – Install a KRA on a server SYNOPSIS ipa-kra-install [OPTION]… [replica_file] DESCRIPTION Adds a KRA as an IPA-managed service. This requires that the IPA server is already installed and configured, including a CA. The KRA (Key Recovery Authority) is a component used to securely store secrets such as passwords, symmetric keys and private…
NAME ipa-join – Join a machine to an IPA realm and get a keytab for the host service principal SYNOPSIS ipa-join [-d|–debug] [-q|–quiet] [-u|–unenroll] [-h|–hostname hostname] [-s|–server hostname] [-k|–keytab filename] [-w|–bindpw password] [-b|–basedn basedn] [-?|–help] [–usage] DESCRIPTION Joins a host to an IPA realm and retrieves a kerberos keytab for the host service principal, or…
NAME ipa-getkeytab – Get a keytab for a Kerberos principal SYNOPSIS ipa-getkeytab -p principal-name -k keytab-file [ -e encryption-types ] [ -s ipaserver ] [ -q ] [ -D|–binddn BINDDN ] [ -w|–bindpw ] [ -P|–password PASSWORD ] [ –cacert CACERT ] [ -H|–ldapuri URI ] [ -Y|–mech GSSAPI|EXTERNAL ] [ -r ] DESCRIPTION Retrieves…
NAME ipa-getcert SYNOPSIS ipa-getcert request [options] ipa-getcert resubmit [options] ipa-getcert start-tracking [options] ipa-getcert status [options] ipa-getcert stop-tracking [options] ipa-getcert list [options] ipa-getcert list-cas [options] ipa-getcert refresh-cas [options] DESCRIPTION The ipa-getcert tool issues requests to a org.fedorahosted.certmonger service on behalf of the invoking user. It can ask the service to begin enrollment, optionally generating a key pair to use, it can ask the service…
NAME ipa-finduser – Find a user SYNOPSIS ipa-finduser [OPTION]… string DESCRIPTION Searches for a user that contains string. The search is a substring search in the username, given name, family name, telephone number, organization and title attributes. All entries that match are displayed. OPTIONS -a, –all Display all attributes -n, –notranslate Don’t translate the LDAP…
NAME ipa-findservice – Find a service principal SYNOPSIS ipa-findservice string DESCRIPTION Searches for a service principal that contains string. The search is a substring search in the service principal. You can search for all principals for a given host, by service or a substring. All entries that match are displayed. OPTIONS -v, –verbose Display the…
NAME ipa-dns-install – Add DNS as a service to an IPA server SYNOPSIS ipa-dns-install [OPTION]… DESCRIPTION Adds DNS as an IPA-managed service. This requires that the IPA server is already installed and configured. OPTIONS -d, –debug Enable debug logging when more verbose output is needed –ip-address=IP_ADDRESS The IP address of the IPA server. If not…
NAME ipa-defaultoptions – Display or modify the IPA Search and User Policies SYNOPSIS ipa-defaultoptions [–maxusername number] [–homedir directory] [–defaultshell shell] [–defaultgroup group] [–emaildomain domain] [–searchtimelimit number] [–searchrecordslimit number] [–usersearch fields] [–groupsearch fields] [-v|–verbose] ipa-defaultoptions –show DESCRIPTION Displays or updates the IPA Search and User Policy. OPTIONS –maxusername=MAXUSERNAME Max. Length of a username –homedir=HOMEDIR Default location…
NAME ipa-csreplica-manage – Manage an IPA CS replica SYNOPSIS ipa-csreplica-manage [OPTION]… [connect|disconnect|del|list|re-initialize|force-sync] DESCRIPTION Manages the CA replication agreements of an IPA server for domain at domain level 0. To manage CA replication agreements in a domain at domain level 1, use IPA CLI or Web UI, see `ipa help topology` for additional information. connect [SERVER_A]…
NAME ipa-compat-manage – Enables or disables the schema compatibility plugin SYNOPSIS ipa-compat-manage [options] <enable|disable|status> DESCRIPTION Run the command with the enable option to enable the compat plugin. Run the command with the disable option to disable the compat plugin. Run the command with the status to determine the current status of the compat plugin. In…
NAME ipa-client-install – Configure an IPA client SYNOPSIS ipa-client-install [OPTION]… DESCRIPTION Configures a client machine to use IPA for authentication and identity services. By default this configures SSSD to connect to an IPA server for authentication and authorization. Optionally one can instead configure PAM and NSS (Name Switching Service) to work with an IPA server…
NAME ipa-client-automount – Configure automount and NFS for IPA SYNOPSIS ipa-client-automount [OPTION]… <location> DESCRIPTION Configures automount for IPA. The automount configuration consists of three files: o /etc/nsswitch.conf o /etc/sysconfig/autofs o /etc/autofs_ldap_auth.conf By default this will use DNS discovery to attempt to determine the IPA server(s) to use. If IPA servers are discovered then the automount…
NAME ipa-certupdate – Update local IPA certificate databases with certificates from the server SYNOPSIS ipa-certupdate [OPTIONS…] DESCRIPTION ipa-certupdate can be used to update local IPA certificate databases with certificates from the server. OPTIONS -v, –verbose Print debugging information. -q, –quiet Output only errors. –log-file=FILE Log to the given file. EXIT STATUS 0 if the command…
NAME ipa-cacert-manage – Manage CA certificates in IPA SYNOPSIS ipa-cacert-manage [OPTIONS…] renew ipa-cacert-manage [OPTIONS…] install CERTFILE DESCRIPTION ipa-cacert-manage can be used to manage CA certificates in IPA. COMMANDS renew – Renew the IPA CA certificate This command can be used to manually renew the CA certificate of the IPA CA. When the IPA CA is…
NAME ipa-backup – Back up an IPA master SYNOPSIS ipa-backup [OPTION]… DESCRIPTION Two kinds of backups: full and data-only. The back up is optionally encrypted using either the default root GPG key or a named key. No passphrase is supported. Backups are stored in a subdirectory in /var/lib/ipa/backup. The naming convention for full backups is…
NAME ipa-advise – Provide configurations advice for various use cases. SYNOPSIS ipa-advise ADVICE DESCRIPTION Provides customized advice for various IPA configuration issues. For the list of possible ADVICEs available, run the ipa-advise with no arguments. OPTIONS –v, –verbose Print debugging information -d, –debug Alias for –verbose -q, –quiet Output only errors –log-file=FILE Log to the…
NAME ipa-adtrust-install – Prepare an IPA server to be able to establish trust relationships with AD domains SYNOPSIS ipa-adtrust-install [OPTION]… DESCRIPTION Adds all necessary objects and configuration to allow an IPA server to create a trust to an Active Directory domain. This requires that the IPA server is already installed and configured. Please note you…
NAME ipa-adduser – Add a user SYNOPSIS ipa-adduser [OPTION]… user DESCRIPTION Adds a user with username user. OPTIONS -c, –gecos=gecos Set the SM]GECOS field to gecos. The SM]GECOS field is traditionally used to store user’s real name and other information. -d, –directory=directory Set user’s home directory to directory. If this option is not present, a…
NAME ipa-addservice – Add a service principal SYNOPSIS ipa-addservice [OPTION]… principal DESCRIPTION Adds a service principal principal. The principal takes the form of: service/fully-qualified-hostname The list of possible services is too extensive to list here but a short list is: cifs dns host HTTP ldap nfs The IPA server automatically appends the Kerberos realm for…