IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-02 12:16:56 -06:00
Code Issues Packages Projects Releases Wiki Activity
3d2feac0e4
freeipa/install/tools/man/ipa-replica-install.1

119 lines
4.6 KiB
Groff
Raw Normal View History

Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.\" A man page for ipa-replica-install
During replication installation see if an agreement already exists. We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
2012-05-16 17:11:11 -05:00
.\" Copyright (C) 2008-2012 Red Hat, Inc.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.\"
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.\"
Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.\"
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.\"
Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.\" Author: Rob Crittenden <rcritten@redhat.com>
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.\"
During replication installation see if an agreement already exists. We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
2012-05-16 17:11:11 -05:00
.TH "ipa-replica-install" "1" "May 16 2012" "FreeIPA" "FreeIPA Manual Pages"
Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.SH "NAME"
ipa\-replica\-install \- Create an IPA replica
.SH "SYNOPSIS"
ipa\-replica\-install [\fIOPTION\fR]... replica_file
.SH "DESCRIPTION"
Configures a new IPA server that is a replica of the server that generated it. Once it has been created it is an exact copy of the original IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
The replica_file is created using the ipa\-replica\-prepare utility.
During replication installation see if an agreement already exists. We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
2012-05-16 17:11:11 -05:00
If the installation fails you may need to run ipa\-server\-install \-\-uninstall before running ipa\-replica\-install again.
The installation will fail if the host you are installing the replica on exists as a host in IPA or an existing replication agreement exists (for example, from a previously failed installation).
Add version to replica prepare file, prevent installing to older version
2012-08-29 10:32:03 -05:00
A replica should only be installed on the same or higher version of IPA on the remote system.
Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.SH "OPTIONS"
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
.SS "BASIC OPTIONS"
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.TP
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
\fB\-\-setup\-ca\fR
Install and configure a CA on this replica. If a CA is not configured then
certificate operations will be forwarded to a master with a CA installed.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.TP
Let replicas install without DNS Let ipa-replica-prepare and ipa-replica-install work without proper DNS records as records in /etc/hosts are sufficient for DS replication. 1) ipa-replica-prepare now just checks if the replica hostname is resolvable (DNS records are not required). It is now able to prepare a replica file even when the replica IP address is present in /etc/hosts only. 2) ipa-replica-install is now able to proceed when the hostname is not resolvable. It uses an IP address passed in a new option --ip-address to create a record in /etc/hosts in the same way as ipa-server-install does. https://fedorahosted.org/freeipa/ticket/2139
2012-01-04 13:04:21 -06:00
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
During replication installation see if an agreement already exists. We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
2012-05-16 17:11:11 -05:00
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
Use singular in help metavars + update man pages. https://fedorahosted.org/freeipa/ticket/4695 Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-11-24 07:49:05 -06:00
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
Let replicas install without DNS Let ipa-replica-prepare and ipa-replica-install work without proper DNS records as records in /etc/hosts are sufficient for DS replication. 1) ipa-replica-prepare now just checks if the replica hostname is resolvable (DNS records are not required). It is now able to prepare a replica file even when the replica IP address is present in /etc/hosts only. 2) ipa-replica-install is now able to proceed when the hostname is not resolvable. It uses an IP address passed in a new option --ip-address to create a record in /etc/hosts in the same way as ipa-server-install does. https://fedorahosted.org/freeipa/ticket/2139
2012-01-04 13:04:21 -06:00
.TP
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
Add -p/--password option so the DM password can be passed on the command-line. The import for version moved from ipaserver to ipa, fix that as well. 449858
2008-06-04 14:37:12 -05:00
Directory Manager (existing master) password
Make --setup-dns work on replica installation The ipa-replica-install script will setup the DNS if user specifies the --setup-dns option. It will only add the zone into LDAP if the cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add the records.
2009-06-26 12:37:49 -05:00
.TP
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
\fB\-w\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
Admin user Kerberos password used for connection check
.TP
Add mkhomedir option to ipa-server-install and ipa-replica-install Add the option to create home directories for users on their first login to ipa-server-install and ipa-replica-install. https://fedorahosted.org/freeipa/ticket/3515
2013-03-27 07:48:01 -05:00
\fB\-\-mkhomedir\fR
Create home directories for users on their first login
.TP
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
\fB\-N\fR, \fB\-\-no\-ntp\fR
Do not configure NTP
.TP
\fB\-\-no\-ui\-redirect\fR
Do not automatically redirect to the Web UI.
.TP
Configure ssh and sshd during ipa-client-install. For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns ipa-client-install option is used. For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM options are enabled (this can be disabled using --no-sshd ipa-client-install option). ticket 1634
2011-12-07 02:49:09 -06:00
\fB\-\-ssh\-trust\-dns\fR
Configure OpenSSH client to trust DNS SSHFP records.
.TP
Add --no-ssh option to ipa-client-install to disable OpenSSH client configuration. If both --no-ssh and --no-sshd are specified, do not configure the SSH service in SSSD. ticket 3070
2012-09-12 08:19:26 -05:00
\fB\-\-no\-ssh\fR
Do not configure OpenSSH client.
.TP
Configure ssh and sshd during ipa-client-install. For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns ipa-client-install option is used. For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM options are enabled (this can be disabled using --no-sshd ipa-client-install option). ticket 1634
2011-12-07 02:49:09 -06:00
\fB\-\-no\-sshd\fR
Do not configure OpenSSH server.
.TP
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
\fB\-\-skip\-conncheck\fR
Skip connection check to remote master
.TP
\fB\-d\fR, \fB\-\-debug
Enable debug logging when more verbose output is needed
.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended installation that will never prompt for user input
.SS "CERTIFICATE SYSTEM OPTIONS"
.TP
\fB\-\-no\-pkinit\fR
Disables pkinit setup steps
Fix schema replication from old masters The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
2012-10-24 03:37:16 -05:00
.TP
\fB\-\-skip\-schema\-check\fR
Skip check for updated CA DS schema on the remote master
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
.SS "DNS OPTIONS"
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
.TP
Make --setup-dns work on replica installation The ipa-replica-install script will setup the DNS if user specifies the --setup-dns option. It will only add the zone into LDAP if the cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add the records.
2009-06-26 12:37:49 -05:00
\fB\-\-setup\-dns\fR
Add forgotten chunks from commit 4e5a68397a102f0be I accidentally pushed the older patch that didn't contain bits for ipa-replica-install.
2009-09-01 16:28:52 -05:00
Generate a DNS zone if it does not exist already and configure the DNS server.
This option requires that you either specify at least one DNS forwarder through
the \fB\-\-forwarder\fR option or use the \fB\-\-no\-forwarders\fR option.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.TP
Add forgotten chunks from commit 4e5a68397a102f0be I accidentally pushed the older patch that didn't contain bits for ipa-replica-install.
2009-09-01 16:28:52 -05:00
\fB\-\-forwarder\fR=\fIIP_ADDRESS\fR
Add a DNS forwarder to the DNS configuration. You can use this option multiple
times to specify more forwarders, but at least one must be provided, unless
the \fB\-\-no\-forwarders\fR option is specified.
.TP
\fB\-\-no\-forwarders\fR
Do not add any DNS forwarders. Root DNS servers will be used instead.
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
.TP
Fix creation of reverse DNS zones. Create reverse DNS zone for /24 IPv4 subnet and /64 IPv6 subnet by default instead of using the netmask from the --ip-address option. Custom reverse DNS zone can be specified using new --reverse-zone option, which replaces the old --ip-address netmask way of creating reverse zones. The reverse DNS zone name is printed to the user during the install. ticket 1398
2011-07-11 03:14:53 -05:00
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
Use singular in help metavars + update man pages. https://fedorahosted.org/freeipa/ticket/4695 Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-11-24 07:49:05 -06:00
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
Fix creation of reverse DNS zones. Create reverse DNS zone for /24 IPv4 subnet and /64 IPv6 subnet by default instead of using the netmask from the --ip-address option. Custom reverse DNS zone can be specified using new --reverse-zone option, which replaces the old --ip-address netmask way of creating reverse zones. The reverse DNS zone name is printed to the user during the install. ticket 1398
2011-07-11 03:14:53 -05:00
.TP
Consolidate man pages and IPA tools help IPA tools options are not consistent with information in man pages. https://fedorahosted.org/freeipa/ticket/1163 https://fedorahosted.org/freeipa/ticket/1178
2011-05-04 03:09:44 -05:00
\fB\-\-no\-reverse\fR
Fix 'no-reverse' option description The description of 'no-reverse' option was fixed in both code and manpages of ipa-replica-install and ipa-dns-install. https://fedorahosted.org/freeipa/ticket/2161
2012-01-31 08:16:56 -06:00
Do not create new reverse DNS zone. If a reverse DNS zone already exists for the subnet, it will be used.
Consolidate man pages and IPA tools help IPA tools options are not consistent with information in man pages. https://fedorahosted.org/freeipa/ticket/1163 https://fedorahosted.org/freeipa/ticket/1178
2011-05-04 03:09:44 -05:00
.TP
Add --no-host-dns argument to ipa-replica-install The server installer has this option, the replica installer should have it too. ticket 146
2010-09-10 16:51:08 -05:00
\fB\-\-no\-host\-dns\fR
Do not use DNS for hostname lookup during installation
Update host SSH public keys on the server during client install. This is done by calling host-mod to update the keys on IPA server and nsupdate to update DNS SSHFP records. DNS update can be disabled using --no-dns-sshfp ipa-client-install option. https://fedorahosted.org/freeipa/ticket/1634
2011-12-07 02:40:51 -06:00
.TP
\fB\-\-no\-dns\-sshfp\fR
Do not automatically create DNS SSHFP records.
Improve man pages structure There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
2011-09-05 04:04:17 -05:00
Add some missing man pages 436501
2008-03-17 17:04:49 -05:00
.SH "EXIT STATUS"
0 if the command was successful
1 if an error occurred
During replication installation see if an agreement already exists. We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
2012-05-16 17:11:11 -05:00
3 if the host exists in the IPA server or a replication agreement to the remote master already exists
Reference in New Issue Copy Permalink