1ipa-replica-install(1) FreeIPA Manual Pages ipa-replica-install(1)
2
3
4
6 ipa-replica-install - Create an IPA replica
7
9 ipa-replica-install [OPTION]...
10
12 Configures a new IPA server that is a replica of the server. Once it
13 has been created it is an exact copy of the original IPA server and is
14 an equal master. Changes made to any master are automatically repli‐
15 cated to other masters.
16
17 Domain level 0 is not supported anymore.
18
19 To create a replica, the machine only needs to be enrolled in the
20 FreeIPA domain first. This process of turning the IPA client into a
21 replica is also referred to as replica promotion.
22
23 If you're starting with an existing IPA client, simply run
24 ipa-replica-install to have it promoted into a replica. The NTP config‐
25 uration cannot be updated during client promotion.
26
27 To promote a blank machine into a replica, you have two options, you
28 can either run ipa-client-install in a separate step, or pass the
29 enrollment related options to the ipa-replica-install (see CLIENT
30 ENROLLMENT OPTIONS). In the latter case, ipa-replica-install will join
31 the machine to the IPA realm automatically and will proceed with the
32 promotion step.
33
34 If the installation fails you may need to run ipa-server-install
35 --uninstall and ipa-client-install before running ipa-replica-install
36 again.
37
38 The installation will fail if the host you are installing the replica
39 on exists as a host in IPA or an existing replication agreement exists
40 (for example, from a previously failed installation).
41
42 A replica should only be installed on the same or higher version of IPA
43 on the remote system.
44
46 OPTIONS
47 -P, --principal
48 The user principal which will be used to promote the client to
49 the replica and enroll the client itself, if necessary.
50
51 -w, --admin-password
52 The Kerberos password for the given principal.
53
54
55 CLIENT ENROLLMENT OPTIONS
56 To install client and promote it to replica using a host keytab or One
57 Time Password, the host needs to be a member of ipaservers group. This
58 requires to create a host entry and add it to the host group prior
59 replica installation.
60
61 --server, --domain, --realm options are autodiscovered via DNS records
62 by default. See manual page ipa-client-install(1) for further details
63 about these options.
64
65
66 -p PASSWORD, --password=PASSWORD
67 One Time Password for joining a machine to the IPA realm.
68
69 -k, --keytab
70 Path to host keytab.
71
72 --server
73 The fully qualified domain name of the IPA server to enroll to.
74
75 -n, --domain=DOMAIN
76 The primary DNS domain of an existing IPA deployment, e.g. exam‐
77 ple.com. This DNS domain should contain the SRV records gener‐
78 ated by the IPA server installer.
79
80 -r, --realm=REALM_NAME
81 The Kerberos realm of an existing IPA deployment.
82
83 --hostname
84 The hostname of this machine (FQDN). If specified, the hostname
85 will be set and the system configuration will be updated to per‐
86 sist over reboot.
87
88 --force-join
89 Join the host even if it is already enrolled.
90
91
92 BASIC OPTIONS
93 --ip-address=IP_ADDRESS
94 The IP address of this server. If this address does not match
95 the address the host resolves to and --setup-dns is not selected
96 the installation will fail. If the server hostname is not
97 resolvable, a record for the hostname and IP_ADDRESS is added to
98 /etc/hosts. This option can be used multiple times to specify
99 more IP addresses of the server (e.g. multihomed and/or dual‐
100 stacked server).
101
102 --mkhomedir
103 Create home directories for users on their first login
104
105 --ntp-server=NTP_SERVER
106 Configure chronyd to use this NTP server. This option can be
107 used multiple times and it is used to specify exactly one time
108 server.
109
110 --ntp-pool=NTP_SERVER_POOL
111 Configure chronyd to use this NTP server pool. This option is
112 meant to be pool of multiple servers resolved as one host name.
113 This pool's servers may vary but pool address will be still same
114 and chrony will choose only one server from this pool.
115
116 -N, --no-ntp
117 Do not configure NTP client (chronyd).
118
119 --no-ui-redirect
120 Do not automatically redirect to the Web UI.
121
122 --ssh-trust-dns
123 Configure OpenSSH client to trust DNS SSHFP records.
124
125 --no-ssh
126 Do not configure OpenSSH client.
127
128 --no-sshd
129 Do not configure OpenSSH server.
130
131 --skip-conncheck
132 Skip connection check to remote master
133
134 -d, --debug
135 Enable debug logging when more verbose output is needed
136
137 -U, --unattended
138 An unattended installation that will never prompt for user input
139
140 --dirsrv-config-file
141 The path to LDIF file that will be used to modify configuration
142 of dse.ldif during installation of the directory server instance
143
144
145 CERTIFICATE SYSTEM OPTIONS
146 --setup-ca
147 Install and configure a CA on this replica. If a CA is not con‐
148 figured then certificate operations will be forwarded to a mas‐
149 ter with a CA installed.
150
151 --no-pkinit
152 Disables pkinit setup steps.
153
154 --dirsrv-cert-file=FILE
155 File containing the Directory Server SSL certificate and private
156 key
157
158 --http-cert-file=FILE
159 File containing the Apache Server SSL certificate and private
160 key
161
162 --pkinit-cert-file=FILE
163 File containing the Kerberos KDC SSL certificate and private key
164
165 --dirsrv-pin=PIN
166 The password to unlock the Directory Server private key
167
168 --http-pin=PIN
169 The password to unlock the Apache Server private key
170
171 --pkinit-pin=PIN
172 The password to unlock the Kerberos KDC private key
173
174 --dirsrv-cert-name=NAME
175 Name of the Directory Server SSL certificate to install
176
177 --http-cert-name=NAME
178 Name of the Apache Server SSL certificate to install
179
180 --pkinit-cert-name=NAME
181 Name of the Kerberos KDC SSL certificate to install
182
183 --skip-schema-check
184 Skip check for updated CA DS schema on the remote master
185
186
187 SECRET MANAGEMENT OPTIONS
188 --setup-kra
189 Install and configure a KRA on this replica. If a KRA is not
190 configured then vault operations will be forwarded to a master
191 with a KRA installed.
192
193
194 DNS OPTIONS
195 --setup-dns
196 Configure an integrated DNS server, create a primary DNS zone
197 (name specified by --domain or taken from an existing deploy‐
198 ment), and fill it with service records necessary for IPA
199 deployment. In cases where the IPA server name does not belong
200 to the primary DNS domain and is not resolvable using DNS, cre‐
201 ate a DNS zone containing the IPA server name as well.
202
203 This option requires that you either specify at least one DNS
204 forwarder through the --forwarder option or use the --no-for‐
205 warders option.
206
207 Note that you can set up a DNS at any time after the initial IPA
208 server install by running ipa-dns-install (see ipa-dns-
209 install(1)). IPA DNS cannot be uninstalled.
210
211 --forwarder=IP_ADDRESS
212 Add a DNS forwarder to the DNS configuration. You can use this
213 option multiple times to specify more forwarders, but at least
214 one must be provided, unless the --no-forwarders option is spec‐
215 ified.
216
217 --no-forwarders
218 Do not add any DNS forwarders. Root DNS servers will be used
219 instead.
220
221 --auto-forwarders
222 Add DNS forwarders configured in /etc/resolv.conf to the list of
223 forwarders used by IPA DNS.
224
225 --forward-policy=first|only
226 DNS forwarding policy for global forwarders specified using
227 other options. Defaults to first if no IP address belonging to
228 a private or reserved ranges is detected on local interfaces
229 (RFC 6303). Defaults to only if a private IP address is
230 detected.
231
232 --reverse-zone=REVERSE_ZONE
233 The reverse DNS zone to use. This option can be used multiple
234 times to specify multiple reverse zones.
235
236 --no-reverse
237 Do not create new reverse DNS zone. If a reverse DNS zone
238 already exists for the subnet, it will be used.
239
240 --auto-reverse
241 Create necessary reverse zones
242
243 --allow-zone-overlap
244 Create DNS zone even if it already exists
245
246 --no-host-dns
247 Do not use DNS for hostname lookup during installation
248
249 --no-dns-sshfp
250 Do not automatically create DNS SSHFP records.
251
252 --no-dnssec-validation
253 Disable DNSSEC validation on this server.
254
255
256 AD TRUST OPTIONS
257 --setup-adtrust
258 Configure AD Trust capability on a replica.
259
260 --netbios-name=NETBIOS_NAME
261 The NetBIOS name for the IPA domain. If not provided then this
262 is determined based on the leading component of the DNS domain
263 name. Running ipa-adtrust-install for a second time with a dif‐
264 ferent NetBIOS name will change the name. Please note that
265 changing the NetBIOS name might break existing trust relation‐
266 ships to other domains.
267
268 --add-sids
269 Add SIDs to existing users and groups as on of final steps of
270 the ipa-adtrust-install run. If there a many existing users and
271 groups and a couple of replicas in the environment this opera‐
272 tion might lead to a high replication traffic and a performance
273 degradation of all IPA servers in the environment. To avoid this
274 the SID generation can be run after ipa-adtrust-install is run
275 and scheduled independently. To start this task you have to load
276 an edited version of ipa-sidgen-task-run.ldif with the ldapmod‐
277 ify command info the directory server.
278
279 --add-agents
280 Add IPA masters to the list that allows to serve information
281 about users from trusted forests. Starting with FreeIPA 4.2, a
282 regular IPA master can provide this information to SSSD clients.
283 IPA masters aren't added to the list automatically as restart of
284 the LDAP service on each of them is required. The host where
285 ipa-adtrust-install is being run is added automatically.
286
287 Note that IPA masters where ipa-adtrust-install wasn't run, can
288 serve information about users from trusted forests only if they
289 are enabled via ipa-adtrust-install run on any other IPA master.
290 At least SSSD version 1.13 on IPA master is required to be able
291 to perform as a trust agent.
292
293 --rid-base=RID_BASE
294 First RID value of the local domain. The first Posix ID of the
295 local domain will be assigned to this RID, the second to RID+1
296 etc. See the online help of the idrange CLI for details.
297
298 --secondary-rid-base=SECONDARY_RID_BASE
299 Start value of the secondary RID range, which is only used in
300 the case a user and a group share numerically the same Posix ID.
301 See the online help of the idrange CLI for details.
302
303 --enable-compat
304 Enables support for trusted domains users for old clients
305 through Schema Compatibility plugin. SSSD supports trusted
306 domains natively starting with version 1.9. For platforms that
307 lack SSSD or run older SSSD version one needs to use this
308 option. When enabled, slapi-nis package needs to be installed
309 and schema-compat-plugin will be configured to provide lookup of
310 users and groups from trusted domains via SSSD on IPA server.
311 These users and groups will be available under cn=users,cn=com‐
312 pat,$SUFFIX and cn=groups,cn=compat,$SUFFIX trees. SSSD will
313 normalize names of users and groups to lower case.
314
315 In addition to providing these users and groups through the com‐
316 pat tree, this option enables authentication over LDAP for
317 trusted domain users with DN under compat tree, i.e. using bind
318 DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.
319
320 LDAP authentication performed by the compat tree is done via PAM
321 'system-auth' service. This service exists by default on Linux
322 systems and is provided by pam package as /etc/pam.d/sys‐
323 tem-auth. If your IPA install does not have default HBAC rule
324 'allow_all' enabled, then make sure to define in IPA special
325 service called 'system-auth' and create an HBAC rule to allow
326 access to anyone to this rule on IPA masters.
327
328 As 'system-auth' PAM service is not used directly by any other
329 application, it is safe to use it for trusted domain users via
330 compatibility path.
331
333 0 if the command was successful
334
335 1 if an error occurred
336
337 3 if the host exists in the IPA server or a replication agreement to
338 the remote master already exists
339
340
341
342FreeIPA Dec 19 2016 ipa-replica-install(1)