> For the complete documentation index, see [llms.txt](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://linux-tutorial-cli.gitbook.io/linux-cli-tutorial/txt-files/file-systems-cocepts/lpic3-300/ipa-including-relevant-user-stageuser-and-group-and-idview-subcommands.md). # IPA The The `ipa` command in **FreeIPA** (Identity, Policy, Audit) is a robust tool for managing users, hosts, services, and policies in a centralized manner. It provides subcommands that are essential for managing **hosts**, **hostgroups**, **services**, and **keytab files**—important components in managing a secure, identity-based infrastructure. Below are detailed descriptions of these subcommands, including commands for **hosts**, **hostgroups**, **services**, and **keytabs**: *** ## Key Subcommands: `host`, `hostgroup`, `service`, and `getkeytab` ### 1. **Host Subcommands** These commands allow the management of hosts (servers or systems) within the FreeIPA domain. Hosts are enrolled to gain authentication and policy-based access control. #### Common Commands: * **Add a Host**: ```bash ipa host-add [options] ``` Adds a new host to the domain (e.g., `ipa host-add server1.example.com`). * **Find Hosts**: ```bash ipa host-find ``` Lists all enrolled hosts in the domain. * **Show Host Details**: ```bash ipa host-show ``` Displays detailed information about a specific host. * **Modify a Host**: ```bash ipa host-mod [options] ``` Modifies attributes of an existing host, such as its description or principal. * **Delete a Host**: ```bash ipa host-del ``` Removes a host from the domain. * **Disable/Enable a Host**: * Disable: Temporarily removes the host from active use. ```bash ipa host-disable ``` * Enable: Restores the host to active use. ```bash ipa host-enable ``` *** ### 2. **Hostgroup Subcommands** Hostgroups provide an easy way to manage multiple hosts together by grouping them logically, often for policy or access control purposes. #### Common Commands: * **Add a Hostgroup**: ```bash ipa hostgroup-add --desc="Description" ``` Creates a new hostgroup with a given description. * **Find Hostgroups**: ```bash ipa hostgroup-find ``` Lists all existing hostgroups. * **Show Hostgroup Details**: ```bash ipa hostgroup-show ``` Displays detailed information about a specific hostgroup. * **Add Hosts to a Hostgroup**: ```bash ipa hostgroup-add-member --hosts= ``` Adds one or more hosts to a hostgroup. * **Remove Hosts from a Hostgroup**: ```bash ipa hostgroup-remove-member --hosts= ``` Removes one or more hosts from a hostgroup. * **Delete a Hostgroup**: ```bash ipa hostgroup-del ``` Deletes a hostgroup from the domain. *** ### 3. **Service Subcommands** Services represent applications (such as web services, mail services, etc.) running on hosts that require secure authentication through IPA. These commands manage such services. #### Common Commands: * **Add a Service**: ```bash ipa service-add ``` Adds a new service to the domain, enabling it to interact with the IPA environment (e.g., `HTTP/webserver01.example.com`). * **Find Services**: ```bash ipa service-find ``` Lists all services available in the domain. * **Show Service Details**: ```bash ipa service-show ``` Displays detailed information about a specific service. * **Delete a Service**: ```bash ipa service-del ``` Removes a service from the domain. * **Enable/Disable a Service**: * Enable: ```bash ipa service-enable ``` * Disable: ```bash ipa service-disable ``` *** ### 4. **Getkeytab Subcommands** Keytabs are files that store service or host credentials used for secure authentication, specifically with Kerberos. The `ipa-getkeytab` command fetches and manages keytab files. #### Common Commands: * **Obtain a Keytab for a Host**: ```bash ipa-getkeytab -s -p host/ -k /etc/krb5.keytab ``` Fetches the keytab for a specified host and stores it in the default Kerberos keytab location. * **Obtain a Keytab for a Service**: ```bash ipa-getkeytab -s -p -k /etc/krb5.keytab ``` Retrieves the keytab for a service running on a host. * **Force a New Keytab**: ```bash ipa-getkeytab -s -p -k /etc/krb5.keytab -f ``` Forces the retrieval of a new keytab, overwriting any existing keytab. * **Remove a Keytab**: ```bash ipa service-remove-keytab --keytab= ``` Deletes a keytab for a specific service, revoking its credentials. *** ## Example Scenario: Adding and Securing a Host with a Service 1. **Add the Host**: ```bash ipa host-add server1.example.com --force ``` 2. **Create a Hostgroup** (e.g., all web servers): ```bash ipa hostgroup-add WebServers --desc="All web servers" ipa hostgroup-add-member WebServers --hosts=server1.example.com ``` 3. **Add and Configure a Service**: For example, you may want to add an HTTP service for `server1`: ```bash ipa service-add HTTP/server1.example.com ``` 4. **Obtain the Keytab for the HTTP Service**: ```bash ipa-getkeytab -s ipa.example.com -p HTTP/server1.example.com -k /etc/krb5.keytab ``` This ensures that the host and the service are authenticated and secure within the FreeIPA domain, with keytab-based Kerberos authentication. *** ### Conclusion Using the `ipa` command with subcommands for **hosts**, **hostgroups**, **services**, and **keytabs**, administrators can efficiently manage identity, authentication, and policies in a secure FreeIPA environment. These tools are critical in environments that require centralized management of users, machines, services, and access control in enterprise systems.\` command in **FreeIPA** (Identity, Policy, Audit) is a robust tool for managing users, hosts, services, and policies in a centralized manner. It provides subcommands that are essential for managing **hosts**, **hostgroups**, **services**, and **keytab files**—important components in managing a secure, identity-based infrastructure. Below are detailed descriptions of these subcommands, including commands for **hosts**, **hostgroups**, **services**, and **keytabs**: *** ## Key Subcommands: `host`, `hostgroup`, `service`, and `getkeytab` ### 1. **Host Subcommands** These commands allow the management of hosts (servers or systems) within the FreeIPA domain. Hosts are enrolled to gain authentication and policy-based access control. #### Common Commands: * **Add a Host**: ```bash ipa host-add [options] ``` Adds a new host to the domain (e.g., `ipa host-add server1.example.com`). * **Find Hosts**: ```bash ipa host-find ``` Lists all enrolled hosts in the domain. * **Show Host Details**: ```bash ipa host-show ``` Displays detailed information about a specific host. * **Modify a Host**: ```bash ipa host-mod [options] ``` Modifies attributes of an existing host, such as its description or principal. * **Delete a Host**: ```bash ipa host-del ``` Removes a host from the domain. * **Disable/Enable a Host**: * Disable: Temporarily removes the host from active use. ```bash ipa host-disable ``` * Enable: Restores the host to active use. ```bash ipa host-enable ``` *** ### 2. **Hostgroup Subcommands** Hostgroups provide an easy way to manage multiple hosts together by grouping them logically, often for policy or access control purposes. #### Common Commands: * **Add a Hostgroup**: ```bash ipa hostgroup-add --desc="Description" ``` Creates a new hostgroup with a given description. * **Find Hostgroups**: ```bash ipa hostgroup-find ``` Lists all existing hostgroups. * **Show Hostgroup Details**: ```bash ipa hostgroup-show ``` Displays detailed information about a specific hostgroup. * **Add Hosts to a Hostgroup**: ```bash ipa hostgroup-add-member --hosts= ``` Adds one or more hosts to a hostgroup. * **Remove Hosts from a Hostgroup**: ```bash ipa hostgroup-remove-member --hosts= ``` Removes one or more hosts from a hostgroup. * **Delete a Hostgroup**: ```bash ipa hostgroup-del ``` Deletes a hostgroup from the domain. *** ### 3. **Service Subcommands** Services represent applications (such as web services, mail services, etc.) running on hosts that require secure authentication through IPA. These commands manage such services. #### Common Commands: * **Add a Service**: ```bash ipa service-add ``` Adds a new service to the domain, enabling it to interact with the IPA environment (e.g., `HTTP/webserver01.example.com`). * **Find Services**: ```bash ipa service-find ``` Lists all services available in the domain. * **Show Service Details**: ```bash ipa service-show ``` Displays detailed information about a specific service. * **Delete a Service**: ```bash ipa service-del ``` Removes a service from the domain. * **Enable/Disable a Service**: * Enable: ```bash ipa service-enable ``` * Disable: ```bash ipa service-disable ``` *** ### 4. **Getkeytab Subcommands** Keytabs are files that store service or host credentials used for secure authentication, specifically with Kerberos. The `ipa-getkeytab` command fetches and manages keytab files. #### Common Commands: * **Obtain a Keytab for a Host**: ```bash ipa-getkeytab -s -p host/ -k /etc/krb5.keytab ``` Fetches the keytab for a specified host and stores it in the default Kerberos keytab location. * **Obtain a Keytab for a Service**: ```bash ipa-getkeytab -s -p -k /etc/krb5.keytab ``` Retrieves the keytab for a service running on a host. * **Force a New Keytab**: ```bash ipa-getkeytab -s -p -k /etc/krb5.keytab -f ``` Forces the retrieval of a new keytab, overwriting any existing keytab. * **Remove a Keytab**: ```bash ipa service-remove-keytab --keytab= ``` Deletes a keytab for a specific service, revoking its credentials. *** ## Example Scenario: Adding and Securing a Host with a Service 1. **Add the Host**: ```bash ipa host-add server1.example.com --force ``` 2. **Create a Hostgroup** (e.g., all web servers): ```bash ipa hostgroup-add WebServers --desc="All web servers" ipa hostgroup-add-member WebServers --hosts=server1.example.com ``` 3. **Add and Configure a Service**: For example, you may want to add an HTTP service for `server1`: ```bash ipa service-add HTTP/server1.example.com ``` 4. **Obtain the Keytab for the HTTP Service**: ```bash ipa-getkeytab -s ipa.example.com -p HTTP/server1.example.com -k /etc/krb5.keytab ``` This ensures that the host and the service are authenticated and secure within the FreeIPA domain, with keytab-based Kerberos authentication. *** ### Conclusion Using the `ipa` command with subcommands for **hosts**, **hostgroups**, **services**, and **keytabs**, administrators can efficiently manage identity, authentication, and policies in a secure FreeIPA environment. These tools are critical in environments that require centralized management of users, machines, services, and access control in enterprise systems.