diff options
| author | Tomas Babej <tbabej@redhat.com> | 2013-11-27 09:49:32 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-03-05 12:47:47 +0100 |
| commit | 6b94f959a4d41b62ca6c2b273633880bbfab8b49 (patch) | |
| tree | 83f4fba43af7912e61d5ccfb1f1e9b2d548e438a /ipa-client | |
| parent | 6b45ec3f31773ee7a229d5bb56675badc2d8fd55 (diff) | |
| download | freeipa-6b94f959a4d41b62ca6c2b273633880bbfab8b49.tar.gz freeipa-6b94f959a4d41b62ca6c2b273633880bbfab8b49.tar.xz freeipa-6b94f959a4d41b62ca6c2b273633880bbfab8b49.zip | |
man: sshd should be run at least once before client enrollment
If SSH keys have not been generated prior to enrolling the client to the
IPA server, they will not be uploaded to the server, since they're not
present. Clarify this issue in the man pages.
https://fedorahosted.org/freeipa/ticket/4055
Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
Diffstat (limited to 'ipa-client')
| -rw-r--r-- | ipa-client/man/ipa-client-install.1 | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ipa-client/man/ipa-client-install.1 b/ipa-client/man/ipa-client-install.1 index 51a276202..3d72b0c9f 100644 --- a/ipa-client/man/ipa-client-install.1 +++ b/ipa-client/man/ipa-client-install.1 @@ -30,6 +30,9 @@ An authorized user is required to join a client machine to IPA. This can take th This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>). +.SS "Assumptions" +The ipa\-client\-install script assumes that the machine has already generated SSH keys. It will not generate SSH keys of its own accord. If SSH keys are not present (e.g when running the ipa\-client\-install in a kickstart, before ever running sshd), they will not be uploaded to the client host entry on the server. + .SS "Hostname Requirements" Client must use a \fBstatic hostname\fR. If the machine hostname changes for example due to a dynamic hostname assignment by a DHCP server, client enrollment to IPA server breaks and user then would not be able to perform Kerberos authentication. |