1REALM(8)                         User Commands                        REALM(8)
2
3
4

NAME

6       realm - Manage enrollment in realms
7

SYNOPSIS

9       realm discover [realm-name]
10
11       realm join [-U user] [realm-name]
12
13       realm leave [-U user] [realm-name]
14
15       realm list
16
17       realm permit [-ax] [-R realm] {user@domain...}
18
19       realm deny -a [-R realm]
20

DESCRIPTION

22       realm is a command line tool that can be used to manage enrollment in
23       kerberos realms, like Active Directory domains or IPA domains.
24
25       See the various sub commands below. The following global options can be
26       used:
27
28       --install=/path
29           Run in install mode. This makes realmd chroot into the specified
30           directory and place files in appropriate locations for use during
31           an installer. No packages will be installed or services will be
32           started when running in this mode.
33
34       --unattended
35           Run in unattended mode without prompting for input.
36
37       --verbose, -v
38           Display verbose diagnostics while doing running commands.
39

DISCOVER

41       Discover a realm and its capabilities.
42
43           $ realm discover
44
45           $ realm discover domain.example.com
46
47       After discovering a realm, its name, type and capabilities are
48       displayed.
49
50       If no domain is specified, then the domain assigned through DHCP is
51       used as a default.
52
53       The following options can be used:
54
55       --all
56           Show all discovered realms (in various configurations).
57
58       --client-software=xxx
59           Only discover realms for which we can use the given client
60           software. Possible values include sssd or winbind.
61
62       --server-software=xxx
63           Only discover realms which run the given server software. Possible
64           values include active-directory or ipa.
65
66       --membership-software=xxx
67           Only discover realms for which the given membership software can be
68           used to subsequently perform enrollment. Possible values include
69           samba or adcli.
70

JOIN

72       Configure the local machine for use with a realm.
73
74           $ realm join domain.example.com
75
76           $ realm join --user=admin --computer-ou=OU=Special domain.example.com
77
78       The realm is first discovered, as we would with the discover command.
79       If no domain is specified, then the domain assigned through DHCP is
80       used as a default.
81
82       After a successful join, the computer will be in a state where it is
83       able to resolve remote user and group names from the realm. For
84       kerberos realms, a computer account and host keytab is created.
85
86       Joining arbitrary kerberos realms is not supported. The realm must have
87       a supported mechanism for joining from a client machine, such as Active
88       Directory or IPA.
89
90       If the domain has been preconfigured, and unless --user is explicitly
91       specified, an automatic join is attempted first.
92
93       Note that the --user, --no-password, and --one-time-password options
94       are mutually exclusive. At most one of them can be specified.
95
96       It is generally possible to use kerberos credentials to perform a join
97       operation. Use the kinit command to acquire credentials prior to
98       starting the join. Do not specify the --user argument, the user will be
99       selected automatically from the credential cache. The realm respects
100       the KRB5_CCACHE environment variable, but uses the default kerberos
101       credential cache if it's not present. Not all types of servers can be
102       joined using kerberos credentials, some (like IPA) insist on prompting
103       for a password.
104
105       The following options can be used:
106
107       --automatic-id-mapping=no
108           Do not perform UID/GID mapping for users and groups, but expect
109           these identifiers to be present in the domain already.
110
111       --user=xxx
112           The user name to be used to authenticate with when joining the
113           machine to the realm. You will be prompted for a password.
114
115       --computer-ou=OU=xxx
116           The distinguished name of an organizational unit to create the
117           computer account. The exact format of the distinguished name
118           depends on the client software and membership software. You can
119           usually omit the root DSE portion of distinguished name. This is an
120           Active Directory specific option.
121
122       --no-password
123           Perform the join automatically without a password.
124
125       --one-time-password=xxxx
126           Perform the join using a one time password specified on the command
127           line. This is not possible with all types of realms.
128
129       --client-software=xxx
130           Only join realms for which we can use the given client software.
131           Possible values include sssd or winbind. Not all values are
132           supported for all realms. By default the client software is
133           automatically selected.
134
135       --server-software=xxx
136           Only join realms for run the given server software. Possible values
137           include active-directory or ipa.
138
139       --membership-software=xxx
140           The software to use when joining to the realm. Possible values
141           include samba or adcli. Not all values are supported for all
142           realms. By default the membership software is automatically
143           selected.
144
145       --user-principal=host/name@REALM
146           Set the userPrincipalName field of the computer account to this
147           kerberos principal. If you omit the value for this option, then a
148           principal will be set in the form of host/shortname@REALM
149
150       --os-name=xxx
151           The name of the operation system of the client. When joining an AD
152           domain the value is store in the matching AD attribute.
153
154       --os-version=xxx
155           The version of the operation system of the client. When joining an
156           AD domain the value is store in the matching AD attribute.
157

LEAVE

159       Deconfigure the local machine for use with a realm.
160
161           $ realm leave
162
163           $ realm leave domain.example.com
164
165       If no realm name is specified, then the first configured realm will be
166       used.
167
168       The following options can be used:
169
170       --client-software=xxx
171           Only leave the realm which is using the given client software.
172           Possible values include sssd or winbind.
173
174       --server-software=xxx
175           Only leave the realm which is using the given server software.
176           Possible values include active-directory or ipa.
177
178       --remove
179           Remove or disable computer account from the directory while leaving
180           the realm. This will usually prompt for a pasword.
181
182       --user
183           The user name to be used to authenticate with when leaving the
184           realm. You will be prompted for a password. Implies --remove.
185

LIST

187       List all the discovered and configured realms.
188
189           $ realm list
190
191       By default, realms that have been discovered, but not configured (using
192       the join command), are not displayed. Also, by default, the list of
193       realm details displayed is verbose. The options below can be used to
194       change this default behavior
195
196       The following options can be used:
197
198       --all
199           Show all discovered realms (whether or not they have been
200           configured).
201
202       --name-only
203           Display only realm names (as opposed to verbose output).
204

PERMIT

206       Permit local login by users of the realm.
207
208           $ realm permit --all
209           $ realm permit user@example.com
210           $ realm permit DOMAIN\\User2
211           $ realm permit --withdraw user@example.com
212
213       The current login policy and format of the user names can be seen by
214       using the realm list command.
215
216       The following options can be used:
217
218       --all, -a
219           Permit logins using realm accounts on the local machine according
220           to the realm policy.This usually defaults to allowing any realm
221           user to log in.
222
223       --groups, -g
224           Treat the specified names as groups rather than user login names.
225           Permit login by users in the specified groups.
226
227       --realm, -R
228           Specify the of the realm to change login policy for.
229
230       --withdraw, -x
231           Remove a login from the list of realm accounts permitted to log
232           into the machine.
233

DENY

235       Deny local login by realm accounts.
236
237           $ realm deny --all
238
239       This command prevents realm accounts from logging into the local
240       machine. Use realm permit to restrict logins to specific accounts.
241
242       The following options can be used:
243
244       --all, -a
245           This option should be specified
246
247       --realm, -R
248           Specify the name of the realm to deny users login to.
249

AUTHOR

251       Stef Walter <stef@thewalter.net>
252           Maintainer
253
254
255
256realmd                            05/11/2019                          REALM(8)
Impressum