SSSD and Kerberos 5 configuration) on the machine. The discovered domain is then used to configure client components (e.g. For example, if a client machine has a hostname '', the installer will try to retrieve an IPA server hostname from _ldap._, _ldap._ and _ldap._tcp.com DNS SRV records, respectively. hostname option may be used to specify a static hostname that persists over reboot.Ĭlient installer by default tries to search for _ldap._tcp.DOMAIN DNS SRV records for all domains that are parent to its hostname. If the machine hostname changes for example due to a dynamic hostname assignment by a DHCP server, client enrollment to IPA server breaks and user then would not be able to perform Kerberos authentication. If SSH keys are not present (e.g when running the ipa-client-install in a kickstart, before ever running sshd), they will not be uploaded to the client host entry on the server.Ĭlient must use a static hostname. It will not generate SSH keys of its own accord. The ipa-client-install script assumes that the machine has already generated SSH keys. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host-disable ). The machine principal in /etc/krb5.keytab is used to authenticate to the IPA server to unenroll itself. Unenrollment consists of disabling the principal key on the IPA server so that it may be re-enrolled. Part of this process is to unenroll the host from the IPA server. This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. This can take the form of a kerberos principal or a one-time password associated with the machine. Optionally one can instead configure PAM and NSS (Name Switching Service) to work with an IPA server over Kerberos and LDAP.Īn authorized user is required to join a client machine to IPA. By default this configures SSSD to connect to an IPA server for authentication and authorization.

Active client installer