Unix/Linux Go Back    


CentOS 7.0 - man page for ipa-adtrust-install (centos section 1)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)


ipa-adtrust-install(1)			 IPA Manual Pages		   ipa-adtrust-install(1)

NAME
       ipa-adtrust-install  -  Prepare	an IPA server to be able to establish trust relationships
       with AD domains

SYNOPSIS
       ipa-adtrust-install [OPTION]...

DESCRIPTION
       Adds all necessary objects and configuration to allow an IPA server to create a	trust  to
       an  Active  Directory  domain.  This requires that the IPA server is already installed and
       configured.

       Please note you will not be able to estabilish an trust	to  an	Active	Directory  domain
       unless the realm name of the IPA server matches its domain name.

       ipa-adtrust-install  can be run multiple times to reinstall deleted objects or broken con-
       figuration files. E.g. a fresh samba configuration (smb.conf file and registry based  con-
       figuration can be created. Other items like e.g. the configuration of the local range can-
       not be changed by running ipa-adtrust-install a second  time  because  with  changes  here
       other objects might be affected as well.

OPTIONS
       -d, --debug
	      Enable debug logging when more verbose output is needed

       --ip-address=IP_ADDRESS
	      The  IP address of the IPA server. If not provided then this is determined based on
	      the hostname of the server.

       --netbios-name=NETBIOS_NAME
	      The NetBIOS name for the IPA domain. If not provided then this is determined  based
	      on  the leading component of the DNS domain name. Running ipa-adtrust-install for a
	      second time with a different NetBIOS name will change the name.  Please  note  that
	      changing	the  NetBIOS  name  might  break  existing  trust  relationships to other
	      domains.

       --no-msdcs
	      Do not create DNS service records for Windows in managed DNS  server.  Since  those
	      DNS  service  records  are  the  only  way  to discover domain controllers of other
	      domains they must be added manually to a different DNS server to allow trust reala-
	      tionships   work	 properly.   All   needed   service   records	are  listed  when
	      ipa-adtrust-install finishes and either --no-msdcs was given or no IPA DNS  service
	      is configured. Typically service records for the following service names are needed
	      for the IPA domain which should point to all IPA servers:

	      o _ldap._tcp

	      o _kerberos._tcp

	      o _kerberos._udp

	      o _ldap._tcp.dc._msdcs

	      o _kerberos._tcp.dc._msdcs

	      o _kerberos._udp.dc._msdcs

	      o _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs

	      o _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs

	      o _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs

       --add-sids
	      Add SIDs to existing users and groups as a final step  of  the  ipa-adtrust-install
	      run.  If	there  a  many	existing users and groups and a couple of replicas in the
	      environment this operation might lead to a high replication traffic and  a  perfor-
	      mance degradation of all IPA servers in the environment. To avoid this the SID gen-
	      eration can be run after ipa-adtrust-install is run and scheduled independently. To
	      start this task you have to load an edited version of ipa-sidgen-task-run.ldif with
	      the ldapmodify command info the directory server.

       -U, --unattended
	      An unattended installation that will never prompt for user input

       -U, --rid-base=RID_BASE
	      First RID value of the local domain. The first Posix ID of the local domain will be
	      assigned	to  this RID, the second to RID+1 etc. See the online help of the idrange
	      CLI for details.

       -U, --secondary-rid-base=SECONDARY_RID_BASE
	      Start value of the secondary RID range, which is only used in the case a user and a
	      group  share  numerically the same Posix ID. See the online help of the idrange CLI
	      for details.

       -A, --admin-name=ADMIN_NAME
	      The name of the user with administrative privileges for this IPA	server.  Defaults
	      to 'admin'.

       -a, --admin-password=password
	      The  password  of the user with administrative privileges for this IPA server. Will
	      be asked interactively if -U is not specified.

       The credentials of the admin user will be used to obtain Kerberos ticket before	configur-
       ing  cross-realm  trusts support and afterwards, to ensure that the ticket contains MS-PAC
       information required to actually add a trust with Active Directory domain via 'ipa  trust-
       add --type=ad' command.

       --enable-compat
	      Enables  support	for trusted domains users for old clients through Schema Compati-
	      bility plugin.  SSSD supports trusted domains natively starting with  version  1.9.
	      For  platforms  that  lack  SSSD	or  run  older SSSD version one needs to use this
	      option. When enabled, slapi-nis package  needs  to  be  installed  and  schema-com-
	      pat-plugin  will	be  configured to provide lookup of users and groups from trusted
	      domains via SSSD on IPA server. These users and  groups  will  be  available  under
	      cn=users,cn=compat,$SUFFIX  and  cn=groups,cn=compat,$SUFFIX trees.  SSSD will nor-
	      malize names of users and groups to lower case.

	      In addition to providing these users and	groups	through  the  compat  tree,  this
	      option enables authentication over LDAP for trusted domain users with DN under com-
	      pat tree, i.e. using bind  DN  uid=administrator@ad.domain,cn=users,cn=compat,$SUF-
	      FIX.

	      LDAP authentication performed by the compat tree is done via PAM 'system-auth' ser-
	      vice.  This service exists by default on Linux systems and is provided by pam pack-
	      age as /etc/pam.d/system-auth.  If your IPA install does not have default HBAC rule
	      'allow_all' enabled, then make sure to define in IPA special service  called  'sys-
	      tem-auth'  and  create  an  HBAC rule to allow access to anyone to this rule on IPA
	      masters.

	      As 'system-auth' PAM service is not used directly by any other application,  it  is
	      safe to use it for trusted domain users via compatibility path.

       EXIT STATUS
	      0 if the installation was successful

	      1 if an error occurred

IPA					   Aug 23 2011			   ipa-adtrust-install(1)
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums


All times are GMT -4. The time now is 06:57 AM.