mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
parent
f695f79748
commit
8bbb42b410
@ -22,7 +22,7 @@ ipa\-adtrust\-install \- Prepare an IPA server to be able to establish trust rel
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-adtrust\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Adds all necesary objects and configuration to allow an IPA server to create a
|
||||
Adds all necessary objects and configuration to allow an IPA server to create a
|
||||
trust to an Active Directory domain. This requires that the IPA server is
|
||||
already installed and configured.
|
||||
.SH "OPTIONS"
|
||||
|
@ -157,7 +157,7 @@ A special user entry is created for the PassSync service. The DN of this entry i
|
||||
The following examples use the AD administrator account as the synchronization user. This is not mandatory but the user must have read\-access to the subtree.
|
||||
|
||||
.TP
|
||||
1. Transfer the base64\-encoded Windows AD CA Certficate to your IPA Server
|
||||
1. Transfer the base64\-encoded Windows AD CA Certificate to your IPA Server
|
||||
.TP
|
||||
2. Remove any existing kerberos credentials
|
||||
# kdestroy
|
||||
|
@ -110,7 +110,7 @@
|
||||
"refresh": "Refresh the page.",
|
||||
"reload": "Reload the browser.",
|
||||
"main_page": "Return to the main page and retry the operation",
|
||||
"title": "An error has occured (${error})"
|
||||
"title": "An error has occurred (${error})"
|
||||
},
|
||||
"errors": {
|
||||
"error": "Error",
|
||||
|
@ -16780,9 +16780,9 @@
|
||||
},
|
||||
{
|
||||
"class": "Password",
|
||||
"doc": "Active directory domain adminstrator's password",
|
||||
"doc": "Active directory domain administrator's password",
|
||||
"flags": [],
|
||||
"label": "Active directory domain adminstrator's password",
|
||||
"label": "Active directory domain administrator's password",
|
||||
"name": "realm_passwd",
|
||||
"noextrawhitespace": true,
|
||||
"type": "unicode"
|
||||
|
@ -110,7 +110,7 @@ test("Testing successful IPA.command().", function() {
|
||||
|
||||
var xhr = {};
|
||||
var text_status = null;
|
||||
var error_thrown = {name:'ERROR', message:'An error has occured'};
|
||||
var error_thrown = {name:'ERROR', message:'An error has occurred'};
|
||||
|
||||
var ajax_counter = 0;
|
||||
|
||||
@ -186,7 +186,7 @@ test("Testing unsuccessful IPA.command().", function() {
|
||||
|
||||
var xhr = {};
|
||||
var text_status = null;
|
||||
var error_thrown = {name:'ERROR', message:'An error has occured'};
|
||||
var error_thrown = {name:'ERROR', message:'An error has occurred'};
|
||||
|
||||
var ajax_counter = 0;
|
||||
|
||||
|
@ -90,7 +90,7 @@ When True provides detailed information. Specifically this set the global log le
|
||||
loggers matching regexp will be assigned XXX level.
|
||||
.IP
|
||||
Logger levels can be explicitly specified for specific loggers as
|
||||
opposed to a global logging level. Specific loggers are indiciated
|
||||
opposed to a global logging level. Specific loggers are indicated
|
||||
by a list of regular expressions bound to a level. If a logger's
|
||||
name matches the regexp then it is assigned that level. This config item
|
||||
must begin with "log_logger_level_" and then be
|
||||
|
@ -28,7 +28,7 @@ By default this configures SSSD to connect to an IPA server for authentication a
|
||||
|
||||
An authorized user is required to join a client machine to IPA. This can take the form of a kerberos principal or a one\-time password associated with the machine.
|
||||
|
||||
This same tool is used to unconfigure IPA and attemps to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>).
|
||||
This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>).
|
||||
|
||||
.SS "HOSTNAME REQUIREMENTS"
|
||||
Client must use a \fBstatic hostname\fR. If the machine hostname changes for example due to a dynamic hostname assignment by a DHCP server, client enrollment to IPA server breaks and user then would not be able to perform Kerberos authentication.
|
||||
|
@ -47,7 +47,7 @@ example above).
|
||||
\fBWARNING:\fR retrieving the keytab resets the secret for the Kerberos principal.
|
||||
This renders all other keytabs for that principal invalid.
|
||||
|
||||
This is used during IPA client enrollement to retrieve a host service principal and store it in /etc/krb5.keytab. It is possible to retrieve the keytab without Kerberos credentials if the host was pre\-created with a one\-time password. The keytab can be retrieved by binding as the host and authenticating with this one\-time password. The \fB\-D|\-\-binddn\fR and \fB\-w|\-\-bindpw\fR options are used for this authentication.
|
||||
This is used during IPA client enrollment to retrieve a host service principal and store it in /etc/krb5.keytab. It is possible to retrieve the keytab without Kerberos credentials if the host was pre\-created with a one\-time password. The keytab can be retrieved by binding as the host and authenticating with this one\-time password. The \fB\-D|\-\-binddn\fR and \fB\-w|\-\-bindpw\fR options are used for this authentication.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-s ipaserver\fR
|
||||
|
@ -136,4 +136,4 @@ The exit status is 0 on success, nonzero on error.
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa-rmkeytab (1)
|
||||
.BR ipa-client-instal (1)
|
||||
.BR ipa-client-install (1)
|
||||
|
2
ipa.1
2
ipa.1
@ -139,7 +139,7 @@ Display a high\-level list of help topics
|
||||
Display documentation and list of commands in the "user" topic.
|
||||
.TP
|
||||
\fBipa env\fR
|
||||
List IPA enviromental variables and their values.
|
||||
List IPA environmental variables and their values.
|
||||
.TP
|
||||
\fBipa user\-add foo \-\-first foo \-\-last bar\fR
|
||||
Create a new user with username "foo", first name "foo" and last name "bar".
|
||||
|
@ -446,7 +446,7 @@ class XMLRPCMarshallError(PublicError):
|
||||
|
||||
class RefererError(PublicError):
|
||||
"""
|
||||
**911** Raised when the the request does not contain an HTTP referer
|
||||
**911** Raised when the request does not contain an HTTP referer
|
||||
|
||||
For example:
|
||||
|
||||
|
@ -29,7 +29,7 @@ __doc__ = _("""
|
||||
Auto Membership Rule.
|
||||
|
||||
Bring clarity to the membership of hosts and users by configuring inclusive
|
||||
or exclusive regex paterns, you can automatically assign a new entries into
|
||||
or exclusive regex patterns, you can automatically assign a new entries into
|
||||
a group or hostgroup based upon attribute information.
|
||||
|
||||
A rule is directly associated with a group by name, so you cannot create
|
||||
|
@ -63,7 +63,7 @@ value can be used, they just should not be combined in one add operation. When
|
||||
modifying an existing entry, new RR specific options can be used to change
|
||||
one part of a DNS record, where the standard option for raw value is used
|
||||
to specify the modified value. The following example demonstrates
|
||||
a modification of MX record preference form 0 to 1 in a record without
|
||||
a modification of MX record preference from 0 to 1 in a record without
|
||||
modifying the exchanger:
|
||||
ipa dnsrecord-mod --mx-rec="0 mx.example.com." --mx-preference=1
|
||||
|
||||
@ -120,7 +120,7 @@ EXAMPLES:
|
||||
ipa dnsrecord-add example.com @ --loc-rec="49 11 42.4 N 16 36 29.6 E 227.64m"
|
||||
|
||||
Add new A record for www.example.com. Create a reverse record in appropriate
|
||||
reverse zone as well. In this case a PTR record "2" pointing to www.example.com.
|
||||
reverse zone as well. In this case a PTR record "2" pointing to www.example.com
|
||||
will be created in zone 15.142.80.in-addr.arpa.
|
||||
ipa dnsrecord-add example.com www --a-rec=80.142.15.2 --a-create-reverse
|
||||
|
||||
@ -182,7 +182,7 @@ EXAMPLES:
|
||||
Show records for resource www in zone example.com
|
||||
ipa dnsrecord-show example.com www
|
||||
|
||||
Forward all request for a zone external.com to another nameserver using
|
||||
Forward all requests for the zone external.com to another nameserver using
|
||||
a "first" policy (it will send the queries to the selected forwarder and if
|
||||
not answered it will use global resolvers):
|
||||
ipa dnszone-add external.com
|
||||
|
@ -104,7 +104,7 @@ and the base-id has to be added to get the Posix ID.
|
||||
Typically the creation of ID ranges happens behind the scenes and this CLI
|
||||
must not be used at all. The ID range for the local domain will be created
|
||||
during installation or upgrade from an older version. The ID range for a
|
||||
trusted domain will be create together with the trust by 'ipa trust-add ...'.
|
||||
trusted domain will be created together with the trust by 'ipa trust-add ...'.
|
||||
The use cases for this CLI are
|
||||
|
||||
USE CASES:
|
||||
@ -119,7 +119,7 @@ USE CASES:
|
||||
|
||||
If the ID range of the local domain is exhausted, i.e. no new IDs can be
|
||||
assigned to Posix users or groups by the DNA plugin, a new range has to be
|
||||
created to allow new users an groups to be added. (Currently there is no
|
||||
created to allow new users and groups to be added. (Currently there is no
|
||||
connection between this range CLI and the DNA plugin, but a future version
|
||||
might be able to modify the configuration of the DNS plugin as well)
|
||||
|
||||
@ -261,7 +261,7 @@ class idrange_add(LDAPCreate):
|
||||
Additionally
|
||||
|
||||
--rid-base
|
||||
--econdary-rid-base
|
||||
--secondary-rid-base
|
||||
|
||||
may be given for a new ID range for the local domain while
|
||||
|
||||
|
@ -245,7 +245,7 @@ class i18n_messages(Command):
|
||||
"refresh": _("Refresh the page."),
|
||||
"reload": _("Reload the browser."),
|
||||
"main_page": _("Return to the main page and retry the operation"),
|
||||
"title": _("An error has occured (${error})"),
|
||||
"title": _("An error has occurred (${error})"),
|
||||
},
|
||||
"errors": {
|
||||
"error": _("Error"),
|
||||
|
@ -32,9 +32,9 @@ commands as root or another user while providing an audit trail of the
|
||||
commands and their arguments.
|
||||
|
||||
FreeIPA provides a means to configure the various aspects of Sudo:
|
||||
Users: The user(s)/group(s) allowed to envoke Sudo.
|
||||
Users: The user(s)/group(s) allowed to invoke Sudo.
|
||||
Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
|
||||
Allow Command: The specific command(s) permited to be run via Sudo.
|
||||
Allow Command: The specific command(s) permitted to be run via Sudo.
|
||||
Deny Command: The specific command(s) prohibited to be run via Sudo.
|
||||
RunAsUser: The user(s) or group(s) of users whose rights Sudo will be invoked with.
|
||||
RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.
|
||||
|
@ -138,7 +138,7 @@ class trust_add(LDAPCreate):
|
||||
),
|
||||
Password('realm_passwd?',
|
||||
cli_name='password',
|
||||
label=_("Active directory domain adminstrator's password"),
|
||||
label=_("Active directory domain administrator's password"),
|
||||
confirm=False,
|
||||
),
|
||||
Str('realm_server?',
|
||||
@ -299,7 +299,7 @@ class trust_mod(LDAPUpdate):
|
||||
__doc__ = _("""
|
||||
Modify a trust (for future use).
|
||||
|
||||
Currently only the default option to modify the LDAP attributes are
|
||||
Currently only the default option to modify the LDAP attributes is
|
||||
available. More specific options will be added in coming releases.
|
||||
""")
|
||||
|
||||
|
@ -56,7 +56,7 @@ about this topic please see: ipa help passwd
|
||||
|
||||
Account lockout on password failure happens per IPA master. The user-status
|
||||
command can be used to identify which master the user is locked out on.
|
||||
It is on that master the the administrator must unlock the user.
|
||||
It is on that master the administrator must unlock the user.
|
||||
|
||||
EXAMPLES:
|
||||
|
||||
|
@ -230,7 +230,7 @@ Proposed Solution
|
||||
|
||||
Our interface to the web server is via WSGI which invokes a callback
|
||||
per request passing us an environmental context for the request. For
|
||||
this discussion we'll name the the WSGI callback "application()", a
|
||||
this discussion we'll name the WSGI callback "application()", a
|
||||
conventional name in WSGI parlance.
|
||||
|
||||
Shared session data will be handled by memcached. We will create one
|
||||
@ -304,7 +304,7 @@ in the future. Session data may not be available because:
|
||||
Cookie manipulation is done via the standard Python Cookie module.
|
||||
|
||||
Session cookies will be set to only persist as long as the browser has
|
||||
the session open. They will be tagged so the the browser only returns
|
||||
the session open. They will be tagged so the browser only returns
|
||||
the session ID on SSL secured HTTP requests. They will not be visible
|
||||
to Javascript in the browser.
|
||||
|
||||
|
@ -877,7 +877,7 @@ class LogManager(object):
|
||||
The regular expression comparision is performed with the
|
||||
re.search() function which means the match can be located
|
||||
anywhere in the name string (as opposed to the start of
|
||||
the the string). Do not forget to escape regular
|
||||
the string). Do not forget to escape regular
|
||||
expression metacharacters when appropriate. For example
|
||||
dot ('.') is used to seperate loggers in a logging
|
||||
hierarchy path (e.g. a.b.c)
|
||||
|
@ -313,7 +313,7 @@ class test_attr(Declarative):
|
||||
|
||||
|
||||
dict(
|
||||
desc='Set and delete the a phone number for %r' % user1,
|
||||
desc='Set and delete a phone number for %r' % user1,
|
||||
command=(
|
||||
'user_mod', [user1], dict(setattr=(u'telephoneNumber=301-555-1212',
|
||||
u'telephoneNumber=202-888-9833'),
|
||||
|
Loading…
Reference in New Issue
Block a user