![]() |
![]() |
![]() |
realmd | ![]() |
---|
realmrealm — Manage enrollment in realms |
realm discover
[realm-name]
realm join
[-U user] [realm-name]
realm leave
[-U user] [realm-name]
realm list
realm permit
[-a] [-R realm] {user...}
realm deny
[-a] [-R realm] {user...}
realm is a command line tool that can be used to manage enrollment in kerberos realms, like Active Directory domains or IPA domains.
See the various sub commands below. The following global options can be used:
|
Run in install mode. This makes realmd chroot into the specified directory and place files in appropriate locations for use during an installer. No packages will be installed or services will be started when running in this mode. |
|
Display verbose diagnostics while doing running commands. |
Discover a realm and its capabilities.
$ realm discover
$ realm discover domain.example.com
After discovering a realm, its name, type and capabilities are displayed.
If no domain is specified, then the domain assigned through DHCP is used as a default.
The following options can be used:
|
Only discover realms for which we can
use the given client software. Possible values include
|
|
Only discover realms which run the
given server software. Possible values include
|
|
Only discover realms for which the given
membership software can be used to subsequently perform enrollment.
Possible values include |
Configure the local machine for use with a realm.
$ realm join domain.example.com
$ realm join --user=admin --computer-ou=OU=Special domain.example.com
The realm is first discovered, as we would with the
discover
command. If no domain is specified, then the
domain assigned through DHCP is used as a default.
After a successful join, the computer will be in a state where it is able to resolve remote user and group names from the realm. For kerberos realms, a computer account and host keytab is created.
Joining arbitrary kerberos realms is not supported. The realm must have a supported mechanism for joining from a client machine, such as Active Directory or FreeIPA.
Unless a --user
is explicitly specified, an automatic join is attempted first.
Note that the --user
, --no-password
,
and --one-time-password
options are mutually exclusive.
At most one of them can be specified.
The following options can be used:
|
The user name to be used to authenticate with when joining the machine to the realm. You will be prompted for a password. |
|
The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on the client software and membership software. You can usually omit the root DSE portion of distinguished name. |
|
Perform the join automatically without a password. |
|
Perform the join using a one time password specified on the command line. This is not possible with all types of realms. |
|
Only join realms for which we can
use the given client software. Possible values include
|
|
Only join realms for run the
given server software. Possible values include
|
|
The software to use when joining to the
realm. Possible values include |
Deconfigure the local machine for use with a realm.
$ realm leave
$ realm leave domain.example.com
If no realm name is specified, then the first configured realm will be used.
The following options can be used:
|
Only leave the realm which is using
the given client software. Possible values include
|
|
Only leave the realm which is using the
given server software. Possible values include
|
|
Remove or disable computer account from the directory while leaving the realm. This will usually prompt for a pasword. |
|
The user name to be used to authenticate
with when leaving the realm. You will be prompted for a
password. Implies |
List all the discovered and configured realms.
$ realm list
By default, realms that have been discovered, but not configured (using
the join
command), are not displayed. Also, by default, the
list of realm details displayed is verbose. The options below can be used to
change this default behavior
The following options can be used:
|
Show all discovered realms (whether or not they have been configured). |
|
Display only realm names (as opposed to verbose output). |
Permit local login by users of the realm.
$ realm permit -a
$ realm permit DOMAIN\User
If more than one realm is configured, then use the --realm
option to specify which realm to permit the users on.
The format of the user name can be seen by using the
list
command.
The following options can be used:
|
Permit login by any valid user of the realm. |
|
Specify the name of the realm to permit users to log into. |
Deny local login by users of the realm.
$ realm deny -a
$ realm deny DOMAIN\User
If more than one realm is configured, then use the --realm
option to specify which realm to deny the users' login via.
The format of the user name can be seen by using the
list
command.
The following options can be used:
|
Deny login by any valid user of the realm. |
|
Specify the name of the realm to deny users login to. |