????
Your IP : 216.73.216.67
�� � , � <: �M P �M 6
N � I[ � �m $ �� �� � �� � |� � J� � � � ۲ � �� � �� n� � �� � � 8� � �� T W� � �� t a� �� �� � � G %� F m� �� ( �� ) �� . "� Q� 3 Z� �� �� �� �� �� ��
�� �� ��
� �
� )� 1 5� 5 g� / �� �� �� � � " 6� 8 Y� 0 �� \ �� 0 � $ Q� v� % �� �� �� 0 �� ( $� 5 M� % �� & �� ( ��
�� � $ � 5 E� 1 {� * �� �� �� �� � %� 2 B� u� D �� P �� � J &� L q� �� " �� �� 1 � + 7� 0 c� 7 ��
�� * �� * � -� $ F� k� � �� �� �� �� �� �� 1 � " 8� [� % r� 8 �� �� �� �� � � $� 3� * @� k� ( �� ? �� 3 �� !� -� J� c� t� ( �� �� �� 9 �� � % � H F� ) �� �� �� & �� H � I W� �� �� �� �� " � 5� I� Y� ! v� ) �� �� ��
��
�� � �
"� # -� Q� ^� k� �� ��
�� ��
�� �� �� ��
� � � � 0� B� ? W� �� �� �� 2 �� $ �
=� K� + g� . �� ! �� �� 1 �� 1� E� V� h� x� �� �� �� �� �� �
"� 0� E� ! T�
v� 9 �� �� �� �� �� [ � w� �� �� �� �� �� �� � � .� H� Z� E p� �� �� M �� O %� u� �� ' �� �� �� � - � 2 J� ' }� ' �� / �� 0 �� * .� ) Y� 9 �� - �� W �� ' C� k� �� �� �� �� �� �� �� � � :� Q� e� * k� ) �� �� �� - �� 2 (�
[� , i� : �� ; ��
� � <� W� s� �� �� �� �� �� � ,� C� b� # y� �� $ �� � % �� $� 0 @� , q� �� �� � & � ( � & C� ) j� " �� % �� $ � ! � " $� G� d� k� w�
�� �� �� = �� 5 � 3 � G� V� i� 8 y� 1 �� � s �� T j� ��
� � � �� � $� C� ^� |� ��
�� �� �
� % �� $� 8� M� ^� . j�
�� ! �� * � � $
� 2� O� 3 Y� �� �� �� ( �� � , ��
)� + 4� `� s� �� ��
�� � �
� / � 2� A� P� * `� # ��
�� �� � � 3 + N z � + � � 8 � 2
I
W b
o } D � � I � ' 6 4 ^ % � � � 0 � + 7
C % Q 8 w � � � � � 0 E [ p � �
� � ' � " � $ - 6 J V
c q { �
� H � ( " ) 5 L � � � � � � � ! V < � � � � � " 0 ; l � � � � � & ; K ` ~ � � � � "
*
<
H
T
`
q
�
�
�
�
�
�
�
�
J �
C 4 V � �
' 4 K ' a � � � - � - � 3 '
[
|
) �
8 �
�
+ 7 O i m � � � � = � ! 0 @ R h � �
�
� = � % � ; L b � ' � � � 2 � % , ! E g � � � � � � u d
� � 5 " 3 X � � 7 � �
� C � P < � � � � B � + ( T $ ] / � � 5 � # R % & x � � � �
� � � ) : L ^ n � � � � � � � � & 7 I Y h z � � � � � � � �
= W c o { � : � = � 8 ; W 3 � # � � , � - $ + R ' ~ , � 3 � 1 ' 9 * a / � , � 4 � 5 , T , � - � 1 � - 3 < 8 p * �
� 5 � > W n u % � � � < � 8 ! L! [! p! > �! 9 �! : " = @" ~" J �" + �" 1 # E# ]# d# n# x# �# �# �#
�#
�# �# �# �# $ $$ =$ I$
S$
^$ i$ r$
$
�$
�$ �$ �$ �$ �$ �$ �$ % % 2 /% b% �% # �% �% �% 2 �% ! "& D& ! a& �& �& �& �& . �& + ' , E' 1 r' - �' - �' 1 ( 0 2( : c( �( �( �( �( �( �( W �( [ R) �) 3 �) 2 �) )* =* ) I* # s* �* �* �* �* $ �* �* + + + *+ � A+
�+ �+ * �+ 4 %, Z, n,
s, L ~, �, �, , �, -
2- =- I- Q- i- q- - �- �- �- �- ! �- . %.
8. F. R.
^.
l. w. ~. �. , �. �. b �. ) B/ l/ * �/ P �/ 0 0 4 70 : l0 G �0 M �0 ( =1
f1 q1 �1 % �1 �1 �1 �1 % �1 ' 2 F2 K2 ' e2 " �2 u �2 &3 - D3 # r3 9 �3 W �3 < (4 e4 �4 ' �4 �4 �4 " �4 5 45 N5 X5 d5 w5 �5
�5 ! �5
�5 �5 ! �5
6 6 - )6 W6 ]6 y6 �6 �6 �6 �6 �6 �6 & 7 L 57 �7 1 �7 �7 �7 �7 �7 �7 & 8 08 & 78 + ^8 " �8 , �8 $ �8 �8 ' 9 =9 V9 q9 + �9 �9 ) �9 , �9 : 8: ; A: }:
�: �: �: �: �: �: �:
�: ; # ; @; Y; n; �; 8 �; �; �; < 6< R< p< y< ' �< �< �< �< = = = 0= <= M= \= e= w= % �= + �= �= ( �= > 7> C> % T>
z> �> �> �> �> D �> ? ? #? 2 3? � f? U 5A 7
�A � �N � sa $ t � � � � � � �� � r� � c� � G� � � � � � �� � ƹ � U� Y � � ?� u �� a� r� �� �� D �� G �� ! ;� < ]� : �� D �� � 8 &� _� s� �� �� ��
��
��
�� �� �� �
�
� A -� I o� A �� ) �� %� ! C� e� 2 ~� I �� B �� p >� H �� D �� ' =� 6 e� 2 �� # �� F �� 4 :� N o� - �� 7 �� : $� _� " q� ) �� = �� < �� 9 9� s� �� �� �� �� > ��
&� ? 4� N t�
�� s �� s E� �� , �� ' �� + � # A� ( e� R �� �� �� � $� + ?� k� �� �� �� �� �� �� " � 6 ,� ( c� ( �� = �� Y �� M� _� r� �� �� �� �� @ �� 2 � 9 >� L x� = �� �
� �
7� E� + V�
�� �� B �� �� + � R 2� 4 �� �� 5 �� 3 �� J +� K v� ) �� + �� / � , H� / u� ' �� �� 2 �� / � < C� �� �� �� �� �� ��
�� G � S� `� p�
�� " ��
�� �� �� �� � �
/� =� J� Q� b� t� P �� �� + �� (� ; G� ! ��
�� ( �� 5 �� + � ;� ! Z� > |� ��
��
��
��
�� % � +� 7� W� t� ( ��
�� �� �� + �� � T )� ! ~� �� �� ) �� l �� % f� ( �� $ �� �� �� � �
)�
7� % E� k� % �� R �� � � } 0� s �� "� 7� 9 M� �� ( �� �� 9 �� ? !� + a� 5 �� 8 �� : �� 3 7� 1 k� < �� < �� w � ) �� �� �� �� " �� "� " >� a� y� �� �� $ �� $ �� � : � + N� ' z� �� 8 �� A �� 8� 9 I� ? �� 5 �� �� + � ) ?� i� % �� �� �� / �� $ � % =� ( c� $ �� ( �� $ �� + �� 5 +� 9 a� / �� ; �� � ; (� 9 d� " �� $ �� 1 �� 4 � 5 M� 7 �� 5 �� - �� + � + K� % w� & �� ' �� �� ��
�� � � $� e +� E �� h � @� Q� l� D |� < �� �� � � i �� �
"� 0� E� ^� m� �� % �� % � � �
*� 8� Q� m� : y� �� � � � > � A� - R� : �� * �� 6 � � >� 7 O� �� �� �� 7 �� - �� 2 &� Y� > c� �� �� � - � � � % 3� Y� < h� �� �� � @ � " �
8� F� & Z� % �� �� W �� C � [� ' v� B �� ! � S W l �
� � � � f � $ 1 j V + � B � 2 0
c n 8 � � E �
E ( : n
� � � � � � ) 8
G R
g
u + � & � � � �
�
" 2 ? C ) T
~ I � ! � � ; S q � " � � � � � &
�
� ( � # � ! 7 ! Y - { " � % � � + � ( * - S + � � � � )
" 0
( S
( |
! �
% �
( �
$ 2 B O b v � � � � � � � ` � X ; s � � l
�
�
�
& �
�
) / < B l B � S � < F � 7 � + � ? ` { � � �
� � � F I \ o � � � & � � �
S ! . u ^ � 5 B c w L � 3 � * - * X + � G � � � � � . �
� � 6 � 5 / e � ? � � � Q � _ 6
�
� � � i � B U � � 5 � ( � F $ ( k o � 0 5 B V f z � � � � � � ' < S k � � � � � � ( > U j ~ � � � � � � + A
V A d � � � �
� K � N = � L � I � 9 4! ; n!
�! ? �! D �! = =" : {" ? �" K �" D B# D �# 9 �# = $ + D$ 0 p$ I �$ ? �$ ? +% D k% D �% A �% K 7& Q �& 9 �& ' < ' X ]' �' �' �' ; �' ) 0( Z( E a( 8 �( �( - �( . %) B T) ? �) B �) E * * `* a �* 1 �* 7 + W+ x+
+
�+
�+ �+ % �+ �+
,
,
, ', C, _, ~, �,
�, �,
�,
�, �,
�,
�,
- - '- =- M- `- m- �-
�- L �- * �- . ) 7. a. x. J �. ) �. # / +/ # K/ o/ ~/ ' �/ ; �/ 6 �/ @ 20 C s0 9 �0 9 �0 = +1 9 i1 T �1 �1
2 "2
42
?2 J2 d T2 j �2 $3 ? >3 E ~3 �3
�3 D �3 . )4 X4 g4 q4 �4 - �4 �4 �4 �4 �4 * 5 � .5 �5 ! �5 , 6 ; 66 r6 �6
�6 l �6 7 %7 ; 77 $ s7 �7
�7 �7 �7 �7 �7 . 8 ! 58 W8 d8 s8 �8 �8 �8 �8 �8 �8
�8 9
9 # 9 B ?9 �9 � �9 ? : / [: : �: X �: $ ; V D; > �; Q �; H ,< 7 u<
�< �< �< D �< ' (= P= Z= ; w= = �= �= �= 3 > - M> � {> 1 ? 7 H? 7 �? Z �? � @ a �@ - A 4 0A 4 eA �A �A 8 �A B /B FB ZB nB �B �B �B * �B �B 8 �B % 'C MC dC 8 |C �C $ �C ! �C $ D +D BD WD & wD �D 2 �D ` �D CE F JE �E �E �E �E �E , F -F - 4F 4 bF ) �F @ �F 0 G : 3G 7 nG �G ) �G ! �G > H PH 9 WH : �H # �H �H P �H NI `I wI �I �I �I �I �I J &J 7 AJ yJ �J �J % �J S �J MK gK �K �K �K �K % �K , L <L ]L " vL �L �L �L �L �L M M &M :M N NM > �M �M 7 �M + 1N ]N lN 7 �N �N �N
�N ! �N
O Y O xO |O �O D �O ' % � � � � + � U � � 1 � � a b � � e � | � \ ) � � � 3 � @ , 3 _ � R � � � � V B � � � � � � [ � � X � � � � E � � � ~ � 9 [ � & � � � I � � 1 |
� � N a Y � � h � 2 I � � 8 � � ? M � 6 m � � Z g h E 2 ? 0 < D # C F % ^ Z � 7 x � � � � � = � " � D � � v f a j � � 0 p q h � � � { \ � } � � � � � � � � P � e � d � � � � � P { u � r " L � N V � � & � c � � � � K i � � � � � A ? � U � Q F L � � v � � � ' � � l � W z � � 5 � � c � � T � _ � � A E � � � g I � C � � � � - d K � � � � � � Q i � �
� r T � � � � - � � � � / M f : � # = � S � � � ; � � � � � � : � j B � � n � L � � � q 4 ; � � � � � � N � � � n � $ � � � * O < } � , ` ) ] � � ( � W � y f { � O O � ! � � 7 P � ' � � � 2 j > � � G � � � � � @ � � ! 6 8 | , � � � � J } � \ � E � � ~ ) X � � � 8 z � � � � ! � � � H � � � � l � / � � Q � � a � � �
M ` G � > A 1 W � � ) � � S � ~ $ e � o O � � � � � s �
� � X � � 7 � S \ � u � y � l � G 5 � o n k � m � % | � J � ; � � k � � � Y � [ 7 f � - c k H � � � � { �
� - � � � � � ^ K m C W R � � � � 0 P � � � � � d 9 p � ` C v � q w B D � = u � R 4 . � d � � � b � � 5 � � ` � � % � � , * t S s Z � 8 3 � � 4 ' F � z � A � � q � < [ w � / � � � ? k
R o J m � 3 I z " _ �
n � ^ � ~ l � � � � � � T v g � � � � � � � w Z � � � � � 0 > 5 � � 2 o = � : � $ . t � & D $ � F ( � > U T * � # � ( h c � L � � } + � � K t
B g x p � � � � � � @ � ] � � G ] ( 6 & � : � � � / ] � � � � � � 6 � � � � ! � < � � X � r � � � 1 � � y � b x � � � V � � e s # M Y � � . + x � Y 4 9 r � � � _ � � � t � � � . i � w U � � � j � � b + ; y � 9 � Q � � H s " i u p J � � � � � � � � � � � * � @ � N H ^ V
Add a new token:
ipa otptoken-add-yubikey --owner=jdoe --desc="My YubiKey"
Automount
Stores automount(8) configuration for autofs(8) in IPA.
The base of an automount configuration is the configuration file auto.master.
This is also the base location in IPA. Multiple auto.master configurations
can be stored in separate locations. A location is implementation-specific
with the default being a location named 'default'. For example, you can have
locations by geographic region, by floor, by type, etc.
Automount has three basic object types: locations, maps and keys.
A location defines a set of maps anchored in auto.master. This allows you
to store multiple automount configurations. A location in itself isn't
very interesting, it is just a point to start a new automount map.
A map is roughly equivalent to a discrete automount file and provides
storage for keys.
A key is a mount point associated with a map.
When a new location is created, two maps are automatically created for
it: auto.master and auto.direct. auto.master is the root map for all
automount maps for the location. auto.direct is the default map for
direct mounts and is mounted on /-.
An automount map may contain a submount key. This key defines a mount
location within the map that references another map. This can be done
either using automountmap-add-indirect --parentmap or manually
with automountkey-add and setting info to "-type=autofs :<mapname>".
EXAMPLES:
Locations:
Create a named location, "Baltimore":
ipa automountlocation-add baltimore
Display the new location:
ipa automountlocation-show baltimore
Find available locations:
ipa automountlocation-find
Remove a named automount location:
ipa automountlocation-del baltimore
Show what the automount maps would look like if they were in the filesystem:
ipa automountlocation-tofiles baltimore
Import an existing configuration into a location:
ipa automountlocation-import baltimore /etc/auto.master
The import will fail if any duplicate entries are found. For
continuous operation where errors are ignored, use the --continue
option.
Maps:
Create a new map, "auto.share":
ipa automountmap-add baltimore auto.share
Display the new map:
ipa automountmap-show baltimore auto.share
Find maps in the location baltimore:
ipa automountmap-find baltimore
Create an indirect map with auto.share as a submount:
ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.man
This is equivalent to:
ipa automountmap-add-indirect baltimore --mount=/man auto.man
ipa automountkey-add baltimore auto.man --key=sub --info="-fstype=autofs ldap:auto.share"
Remove the auto.share map:
ipa automountmap-del baltimore auto.share
Keys:
Create a new key for the auto.share map in location baltimore. This ties
the map we previously created to auto.master:
ipa automountkey-add baltimore auto.master --key=/share --info=auto.share
Create a new key for our auto.share map, an NFS mount for man pages:
ipa automountkey-add baltimore auto.share --key=man --info="-ro,soft,rsize=8192,wsize=8192 ipa.example.com:/shared/man"
Find all keys for the auto.share map:
ipa automountkey-find baltimore auto.share
Find all direct automount keys:
ipa automountkey-find baltimore --key=/-
Remove the man key from the auto.share map:
ipa automountkey-del baltimore auto.share --key=man
Directory Server Access Control Instructions (ACIs)
ACIs are used to allow or deny access to information. This module is
currently designed to allow, not deny, access.
The aci commands are designed to grant permissions that allow updating
existing entries or adding or deleting new ones. The goal of the ACIs
that ship with IPA is to provide a set of low-level permissions that
grant access to special groups called taskgroups. These low-level
permissions can be combined into roles that grant broader access. These
roles are another type of group, roles.
For example, if you have taskgroups that allow adding and modifying users you
could create a role, useradmin. You would assign users to the useradmin
role to allow them to do the operations defined by the taskgroups.
You can create ACIs that delegate permission so users in group A can write
attributes on group B.
The type option is a map that applies to all entries in the users, groups or
host location. It is primarily designed to be used when granting add
permissions (to write new entries).
An ACI consists of three parts:
1. target
2. permissions
3. bind rules
The target is a set of rules that define which LDAP objects are being
targeted. This can include a list of attributes, an area of that LDAP
tree or an LDAP filter.
The targets include:
- attrs: list of attributes affected
- type: an object type (user, group, host, service, etc)
- memberof: members of a group
- targetgroup: grant access to modify a specific group. This is primarily
designed to enable users to add or remove members of a specific group.
- filter: A legal LDAP filter used to narrow the scope of the target.
- subtree: Used to apply a rule across an entire set of objects. For example,
to allow adding users you need to grant "add" permission to the subtree
ldap://uid=*,cn=users,cn=accounts,dc=example,dc=com. The subtree option
is a fail-safe for objects that may not be covered by the type option.
The permissions define what the ACI is allowed to do, and are one or
more of:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted
Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.
The bind rule defines who this ACI grants permissions to. The LDAP server
allows this to be any valid LDAP entry but we encourage the use of
taskgroups so that the rights can be easily shared through roles.
For a more thorough description of access controls see
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html
EXAMPLES:
NOTE: ACIs are now added via the permission plugin. These examples are to
demonstrate how the various options work but this is done via the permission
command-line now (see last example).
Add an ACI so that the group "secretaries" can update the address on any user:
ipa group-add --desc="Office secretaries" secretaries
ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses"
Show the new ACI:
ipa aci-show --prefix=none "Secretaries write addresses"
Add an ACI that allows members of the "addusers" permission to add new users:
ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users"
Add an ACI that allows members of the editors manage members of the admins group:
ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins"
Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group:
ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street --attrs=postalcode --prefix=none "admins edit the address of editors"
Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss:
ipa aci-add --permissions=write --group=admins --attrs=street --attrs=postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss"
Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission:
ipa permission-add --permissions=add --subtree="cn=*,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange
The show command shows the raw 389-ds ACI.
IMPORTANT: When modifying the target attributes of an existing ACI you
must include all existing attributes as well. When doing an aci-mod the
targetattr REPLACES the current attributes, it does not add to them.
Directory Server Access Control Instructions (ACIs)
ACIs are used to allow or deny access to information. This module is
currently designed to allow, not deny, access.
The aci commands are designed to grant permissions that allow updating
existing entries or adding or deleting new ones. The goal of the ACIs
that ship with IPA is to provide a set of low-level permissions that
grant access to special groups called taskgroups. These low-level
permissions can be combined into roles that grant broader access. These
roles are another type of group, roles.
For example, if you have taskgroups that allow adding and modifying users you
could create a role, useradmin. You would assign users to the useradmin
role to allow them to do the operations defined by the taskgroups.
You can create ACIs that delegate permission so users in group A can write
attributes on group B.
The type option is a map that applies to all entries in the users, groups or
host location. It is primarily designed to be used when granting add
permissions (to write new entries).
An ACI consists of three parts:
1. target
2. permissions
3. bind rules
The target is a set of rules that define which LDAP objects are being
targeted. This can include a list of attributes, an area of that LDAP
tree or an LDAP filter.
The targets include:
- attrs: list of attributes affected
- type: an object type (user, group, host, service, etc)
- memberof: members of a group
- targetgroup: grant access to modify a specific group. This is primarily
designed to enable users to add or remove members of a specific group.
- filter: A legal LDAP filter used to narrow the scope of the target.
- subtree: Used to apply a rule across an entire set of objects. For example,
to allow adding users you need to grant "add" permission to the subtree
ldap://uid=*,cn=users,cn=accounts,dc=example,dc=com. The subtree option
is a fail-safe for objects that may not be covered by the type option.
The permissions define what the ACI is allowed to do, and are one or
more of:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted
Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.
The bind rule defines who this ACI grants permissions to. The LDAP server
allows this to be any valid LDAP entry but we encourage the use of
taskgroups so that the rights can be easily shared through roles.
For a more thorough description of access controls see
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html
EXAMPLES:
NOTE: ACIs are now added via the permission plugin. These examples are to
demonstrate how the various options work but this is done via the permission
command-line now (see last example).
Add an ACI so that the group "secretaries" can update the address on any user:
ipa group-add --desc="Office secretaries" secretaries
ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses"
Show the new ACI:
ipa aci-show --prefix=none "Secretaries write addresses"
Add an ACI that allows members of the "addusers" permission to add new users:
ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users"
Add an ACI that allows members of the editors manage members of the admins group:
ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins"
Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group:
ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street,postalcode --prefix=none "admins edit the address of editors"
Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss:
ipa aci-add --permissions=write --group=admins --attrs=street,postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss"
Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission:
ipa permission-add --permissions=add --subtree="cn=*,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange
The show command shows the raw 389-ds ACI.
IMPORTANT: When modifying the target attributes of an existing ACI you
must include all existing attributes as well. When doing an aci-mod the
targetattr REPLACES the current attributes, it does not add to them.
Domain Name System (DNS)
Manage DNS zone and resource records.
SUPPORTED ZONE TYPES
* Master zone (dnszone-*), contains authoritative data.
* Forward zone (dnsforwardzone-*), forwards queries to configured forwarders
(a set of DNS servers).
USING STRUCTURED PER-TYPE OPTIONS
There are many structured DNS RR types where DNS data stored in LDAP server
is not just a scalar value, for example an IP address or a domain name, but
a data structure which may be often complex. A good example is a LOC record
[RFC1876] which consists of many mandatory and optional parts (degrees,
minutes, seconds of latitude and longitude, altitude or precision).
It may be difficult to manipulate such DNS records without making a mistake
and entering an invalid value. DNS module provides an abstraction over these
raw records and allows to manipulate each RR type with specific options. For
each supported RR type, DNS module provides a standard option to manipulate
a raw records with format --<rrtype>-rec, e.g. --mx-rec, and special options
for every part of the RR structure with format --<rrtype>-<partname>, e.g.
--mx-preference and --mx-exchanger.
When adding a record, either RR specific options or standard option for a raw
value can be used, they just should not be combined in one add operation. When
modifying an existing entry, new RR specific options can be used to change
one part of a DNS record, where the standard option for raw value is used
to specify the modified value. The following example demonstrates
a modification of MX record preference from 0 to 1 in a record without
modifying the exchanger:
ipa dnsrecord-mod --mx-rec="0 mx.example.com." --mx-preference=1
EXAMPLES:
Add new zone:
ipa dnszone-add example.com --admin-email=admin@example.com
Add system permission that can be used for per-zone privilege delegation:
ipa dnszone-add-permission example.com
Modify the zone to allow dynamic updates for hosts own records in realm EXAMPLE.COM:
ipa dnszone-mod example.com --dynamic-update=TRUE
This is the equivalent of:
ipa dnszone-mod example.com --dynamic-update=TRUE --update-policy="grant EXAMPLE.COM krb5-self * A; grant EXAMPLE.COM krb5-self * AAAA; grant EXAMPLE.COM krb5-self * SSHFP;"
Modify the zone to allow zone transfers for local network only:
ipa dnszone-mod example.com --allow-transfer=192.0.2.0/24
Add new reverse zone specified by network IP address:
ipa dnszone-add --name-from-ip=192.0.2.0/24
Add second nameserver for example.com:
ipa dnsrecord-add example.com @ --ns-rec=nameserver2.example.com
Add a mail server for example.com:
ipa dnsrecord-add example.com @ --mx-rec="10 mail1"
Add another record using MX record specific options:
ipa dnsrecord-add example.com @ --mx-preference=20 --mx-exchanger=mail2
Add another record using interactive mode (started when dnsrecord-add, dnsrecord-mod,
or dnsrecord-del are executed with no options):
ipa dnsrecord-add example.com @
Please choose a type of DNS resource record to be added
The most common types for this type of zone are: NS, MX, LOC
DNS resource record type: MX
MX Preference: 30
MX Exchanger: mail3
Record name: example.com
MX record: 10 mail1, 20 mail2, 30 mail3
NS record: nameserver.example.com., nameserver2.example.com.
Delete previously added nameserver from example.com:
ipa dnsrecord-del example.com @ --ns-rec=nameserver2.example.com.
Add LOC record for example.com:
ipa dnsrecord-add example.com @ --loc-rec="49 11 42.4 N 16 36 29.6 E 227.64m"
Add new A record for www.example.com. Create a reverse record in appropriate
reverse zone as well. In this case a PTR record "2" pointing to www.example.com
will be created in zone 2.0.192.in-addr.arpa.
ipa dnsrecord-add example.com www --a-rec=192.0.2.2 --a-create-reverse
Add new PTR record for www.example.com
ipa dnsrecord-add 2.0.192.in-addr.arpa. 2 --ptr-rec=www.example.com.
Add new SRV records for LDAP servers. Three quarters of the requests
should go to fast.example.com, one quarter to slow.example.com. If neither
is available, switch to backup.example.com.
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="0 3 389 fast.example.com"
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="0 1 389 slow.example.com"
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="1 1 389 backup.example.com"
The interactive mode can be used for easy modification:
ipa dnsrecord-mod example.com _ldap._tcp
No option to modify specific record provided.
Current DNS record contents:
SRV record: 0 3 389 fast.example.com, 0 1 389 slow.example.com, 1 1 389 backup.example.com
Modify SRV record '0 3 389 fast.example.com'? Yes/No (default No):
Modify SRV record '0 1 389 slow.example.com'? Yes/No (default No): y
SRV Priority [0]: (keep the default value)
SRV Weight [1]: 2 (modified value)
SRV Port [389]: (keep the default value)
SRV Target [slow.example.com]: (keep the default value)
1 SRV record skipped. Only one value per DNS record type can be modified at one time.
Record name: _ldap._tcp
SRV record: 0 3 389 fast.example.com, 1 1 389 backup.example.com, 0 2 389 slow.example.com
After this modification, three fifths of the requests should go to
fast.example.com and two fifths to slow.example.com.
An example of the interactive mode for dnsrecord-del command:
ipa dnsrecord-del example.com www
No option to delete specific record provided.
Delete all? Yes/No (default No): (do not delete all records)
Current DNS record contents:
A record: 192.0.2.2, 192.0.2.3
Delete A record '192.0.2.2'? Yes/No (default No):
Delete A record '192.0.2.3'? Yes/No (default No): y
Record name: www
A record: 192.0.2.2 (A record 192.0.2.3 has been deleted)
Show zone example.com:
ipa dnszone-show example.com
Find zone with "example" in its domain name:
ipa dnszone-find example
Find records for resources with "www" in their name in zone example.com:
ipa dnsrecord-find example.com www
Find A records with value 192.0.2.2 in zone example.com
ipa dnsrecord-find example.com --a-rec=192.0.2.2
Show records for resource www in zone example.com
ipa dnsrecord-show example.com www
Delegate zone sub.example to another nameserver:
ipa dnsrecord-add example.com ns.sub --a-rec=203.0.113.1
ipa dnsrecord-add example.com sub --ns-rec=ns.sub.example.com.
Delete zone example.com with all resource records:
ipa dnszone-del example.com
If a global forwarder is configured, all queries for which this server is not
authoritative (e.g. sub.example.com) will be routed to the global forwarder.
Global forwarding configuration can be overridden per-zone.
Semantics of forwarding in IPA matches BIND semantics and depends on the type
of zone:
* Master zone: local BIND replies authoritatively to queries for data in
the given zone (including authoritative NXDOMAIN answers) and forwarding
affects only queries for names below zone cuts (NS records) of locally
served zones.
* Forward zone: forward zone contains no authoritative data. BIND forwards
queries, which cannot be answered from its local cache, to configured
forwarders.
Semantics of the --forward-policy option:
* none - disable forwarding for the given zone.
* first - forward all queries to configured forwarders. If they fail,
do resolution using DNS root servers.
* only - forward all queries to configured forwarders and if they fail,
return failure.
Disable global forwarding for given sub-tree:
ipa dnszone-mod example.com --forward-policy=none
This configuration forwards all queries for names outside the example.com
sub-tree to global forwarders. Normal recursive resolution process is used
for names inside the example.com sub-tree (i.e. NS records are followed etc.).
Forward all requests for the zone external.example.com to another forwarder
using a "first" policy (it will send the queries to the selected forwarder
and if not answered it will use global root servers):
ipa dnsforwardzone-add external.example.com --forward-policy=first --forwarder=203.0.113.1
Change forward-policy for external.example.com:
ipa dnsforwardzone-mod external.example.com --forward-policy=only
Show forward zone external.example.com:
ipa dnsforwardzone-show external.example.com
List all forward zones:
ipa dnsforwardzone-find
Delete forward zone external.example.com:
ipa dnsforwardzone-del external.example.com
Resolve a host name to see if it exists (will add default IPA domain
if one is not included):
ipa dns-resolve www.example.com
ipa dns-resolve www
GLOBAL DNS CONFIGURATION
DNS configuration passed to command line install script is stored in a local
configuration file on each IPA server where DNS service is configured. These
local settings can be overridden with a common configuration stored in LDAP
server:
Show global DNS configuration:
ipa dnsconfig-show
Modify global DNS configuration and set a list of global forwarders:
ipa dnsconfig-mod --forwarder=203.0.113.113
EXAMPLES:
Group to Group Delegation
A permission enables fine-grained delegation of permissions. Access Control
Rules, or instructions (ACIs), grant permission to permissions to perform
given tasks such as adding a user, modifying a group, etc.
Group to Group Delegations grants the members of one group to update a set
of attributes of members of another group.
EXAMPLES:
Add a delegation rule to allow managers to edit employee's addresses:
ipa delegation-add --attrs=street --group=managers --membergroup=employees "managers edit employees' street"
When managing the list of attributes you need to include all attributes
in the list, including existing ones. Add postalCode to the list:
ipa delegation-mod --attrs=street --attrs=postalCode --group=managers --membergroup=employees "managers edit employees' street"
Display our updated rule:
ipa delegation-show "managers edit employees' street"
Delete a rule:
ipa delegation-del "managers edit employees' street"
Group to Group Delegation
A permission enables fine-grained delegation of permissions. Access Control
Rules, or instructions (ACIs), grant permission to permissions to perform
given tasks such as adding a user, modifying a group, etc.
Group to Group Delegations grants the members of one group to update a set
of attributes of members of another group.
EXAMPLES:
Add a delegation rule to allow managers to edit employee's addresses:
ipa delegation-add --attrs=street --group=managers --membergroup=employees "managers edit employees' street"
When managing the list of attributes you need to include all attributes
in the list, including existing ones. Add postalCode to the list:
ipa delegation-mod --attrs=street,postalCode --group=managers --membergroup=employees "managers edit employees' street"
Display our updated rule:
ipa delegation-show "managers edit employees' street"
Delete a rule:
ipa delegation-del "managers edit employees' street"
Groups of hosts.
Manage groups of hosts. This is useful for applying access control to a
number of hosts by using Host-based Access Control.
EXAMPLES:
Add a new host group:
ipa hostgroup-add --desc="Baltimore hosts" baltimore
Add another new host group:
ipa hostgroup-add --desc="Maryland hosts" maryland
Add members to the hostgroup (using Bash brace expansion):
ipa hostgroup-add-member --hosts={box1,box2,box3} baltimore
Add a hostgroup as a member of another hostgroup:
ipa hostgroup-add-member --hostgroups=baltimore maryland
Remove a host from the hostgroup:
ipa hostgroup-remove-member --hosts=box2 baltimore
Display a host group:
ipa hostgroup-show baltimore
Add a member manager:
ipa hostgroup-add-member-manager --users=user1 baltimore
Remove a member manager
ipa hostgroup-remove-member-manager --users=user1 baltimore
Delete a hostgroup:
ipa hostgroup-del baltimore
Groups of hosts.
Manage groups of hosts. This is useful for applying access control to a
number of hosts by using Host-based Access Control.
EXAMPLES:
Add a new host group:
ipa hostgroup-add --desc="Baltimore hosts" baltimore
Add another new host group:
ipa hostgroup-add --desc="Maryland hosts" maryland
Add members to the hostgroup (using Bash brace expansion):
ipa hostgroup-add-member --hosts={box1,box2,box3} baltimore
Add a hostgroup as a member of another hostgroup:
ipa hostgroup-add-member --hostgroups=baltimore maryland
Remove a host from the hostgroup:
ipa hostgroup-remove-member --hosts=box2 baltimore
Display a host group:
ipa hostgroup-show baltimore
Delete a hostgroup:
ipa hostgroup-del baltimore
HBAC Service Groups
HBAC service groups can contain any number of individual services,
or "members". Every group must have a description.
EXAMPLES:
Add a new HBAC service group:
ipa hbacsvcgroup-add --desc="login services" login
Add members to an HBAC service group:
ipa hbacsvcgroup-add-member --hbacsvcs=sshd --hbacsvcs=login login
Display information about a named group:
ipa hbacsvcgroup-show login
Delete an HBAC service group:
ipa hbacsvcgroup-del login
HBAC Services
The PAM services that HBAC can control access to. The name used here
must match the service name that PAM is evaluating.
EXAMPLES:
Add a new HBAC service:
ipa hbacsvc-add tftp
Modify an existing HBAC service:
ipa hbacsvc-mod --desc="TFTP service" tftp
Search for HBAC services. This example will return two results, the FTP
service and the newly-added tftp service:
ipa hbacsvc-find ftp
Delete an HBAC service:
ipa hbacsvc-del tftp
HBAC Services
The PAM services that HBAC can control access to. The name used here
must match the service name that PAM is evaluating.
EXAMPLES:
Add a new HBAC service:
ipa hbacsvc-add tftp
Modify an existing HBAC service:
ipa hbacsvc-mod --desc="TFTP service" tftp
Search for HBAC services. This example will return two results, the FTP
service and the newly-added tftp service:
ipa hbacsvc-find ftp
Delete an HBAC service:
ipa hbacsvc-del tftp
Host-based access control
Control who can access what services on what hosts. You
can use HBAC to control which users or groups can
access a service, or group of services, on a target host.
You can also specify a category of users and target hosts.
This is currently limited to "all", but might be expanded in the
future.
Target hosts in HBAC rules must be hosts managed by IPA.
The available services and groups of services are controlled by the
hbacsvc and hbacsvcgroup plug-ins respectively.
EXAMPLES:
Create a rule, "test1", that grants all users access to the host "server" from
anywhere:
ipa hbacrule-add --usercat=all test1
ipa hbacrule-add-host --hosts=server.example.com test1
Display the properties of a named HBAC rule:
ipa hbacrule-show test1
Create a rule for a specific service. This lets the user john access
the sshd service on any machine from any machine:
ipa hbacrule-add --hostcat=all john_sshd
ipa hbacrule-add-user --users=john john_sshd
ipa hbacrule-add-service --hbacsvcs=sshd john_sshd
Create a rule for a new service group. This lets the user john access
the FTP service on any machine from any machine:
ipa hbacsvcgroup-add ftpers
ipa hbacsvc-add sftp
ipa hbacsvcgroup-add-member --hbacsvcs=ftp --hbacsvcs=sftp ftpers
ipa hbacrule-add --hostcat=all john_ftp
ipa hbacrule-add-user --users=john john_ftp
ipa hbacrule-add-service --hbacsvcgroups=ftpers john_ftp
Disable a named HBAC rule:
ipa hbacrule-disable test1
Remove a named HBAC rule:
ipa hbacrule-del allow_server
Hosts/Machines
A host represents a machine. It can be used in a number of contexts:
- service entries are associated with a host
- a host stores the host/ service principal
- a host can be used in Host-based Access Control (HBAC) rules
- every enrolled client generates a host entry
ENROLLMENT:
There are three enrollment scenarios when enrolling a new client:
1. You are enrolling as a full administrator. The host entry may exist
or not. A full administrator is a member of the hostadmin role
or the admins group.
2. You are enrolling as a limited administrator. The host must already
exist. A limited administrator is a member a role with the
Host Enrollment privilege.
3. The host has been created with a one-time password.
RE-ENROLLMENT:
Host that has been enrolled at some point, and lost its configuration (e.g. VM
destroyed) can be re-enrolled.
For more information, consult the manual pages for ipa-client-install.
A host can optionally store information such as where it is located,
the OS that it runs, etc.
EXAMPLES:
Add a new host:
ipa host-add --location="3rd floor lab" --locality=Dallas test.example.com
Delete a host:
ipa host-del test.example.com
Add a new host with a one-time password:
ipa host-add --os='Fedora 12' --password=Secret123 test.example.com
Add a new host with a random one-time password:
ipa host-add --os='Fedora 12' --random test.example.com
Modify information about a host:
ipa host-mod --os='Fedora 12' test.example.com
Remove SSH public keys of a host and update DNS to reflect this change:
ipa host-mod --sshpubkey= --updatedns test.example.com
Disable the host Kerberos key, SSL certificate and all of its services:
ipa host-disable test.example.com
Add a host that can manage this host's keytab and certificate:
ipa host-add-managedby --hosts=test2 test
Allow user to create a keytab:
ipa host-allow-create-keytab test2 --users=tuser1
Manage YubiKey tokens.
Plugin to make multiple ipa calls via one remote procedure call
To run this code in the lite-server
curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json
where the contents of the file batch_request.json follow the below example
{"method":"batch","params":[[
{"method":"group_find","params":[[],{}]},
{"method":"user_find","params":[[],{"whoami":"true","all":"true"}]},
{"method":"user_show","params":[["admin"],{"all":true}]}
],{}],"id":1}
The format of the response is nested the same way. At the top you will see
"error": null,
"id": 1,
"result": {
"count": 3,
"results": [
And then a nested response for each IPA command method sent in the request
Plugin to make multiple ipa calls via one remote procedure call
To run this code in the lite-server
curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json
where the contents of the file batch_request.json follow the below example
{"method":"batch","params":[[
{"method":"group_find","params":[[],{}]},
{"method":"user_find","params":[[],{"whoami":"true","all":"true"}]},
{"method":"user_show","params":[["admin"],{"all":true}]}
],{}],"id":1}
The format of the response is nested the same way. At the top you will see
"error": null,
"id": 1,
"result": {
"count": 3,
"results": [
And then a nested response for each IPA command method sent in the request
Search for ACIs.
Returns a list of ACIs
EXAMPLES:
To find all ACIs that apply directly to members of the group ipausers:
ipa aci-find --memberof=ipausers
To find all ACIs that grant add access:
ipa aci-find --permissions=add
Note that the find command only looks for the given text in the set of
ACIs, it does not evaluate the ACIs to see if something would apply.
For example, searching on memberof=ipausers will find all ACIs that
have ipausers as a memberof. There may be other ACIs that apply to
members of that group indirectly.
Server configuration
Manage the default values that IPA uses and some of its tuning parameters.
NOTES:
The password notification value (--pwdexpnotify) is stored here so it will
be replicated. It is not currently used to notify users in advance of an
expiring password.
Some attributes are read-only, provided only for information purposes. These
include:
Certificate Subject base: the configured certificate subject base,
e.g. O=EXAMPLE.COM. This is configurable only at install time.
Password plug-in features: currently defines additional hashes that the
password will generate (there may be other conditions).
When setting the order list for mapping SELinux users you may need to
quote the value so it isn't interpreted by the shell.
EXAMPLES:
Show basic server configuration:
ipa config-show
Show all configuration options:
ipa config-show --all
Change maximum username length to 99 characters:
ipa config-mod --maxusername=99
Increase default time and size limits for maximum IPA server search:
ipa config-mod --searchtimelimit=10 --searchrecordslimit=2000
Set default user e-mail domain:
ipa config-mod --emaildomain=example.com
Enable migration mode to make "ipa migrate-ds" command operational:
ipa config-mod --enable-migration=TRUE
Define SELinux user map order:
ipa config-mod --ipaselinuxusermaporder='guest_u:s0$xguest_u:s0$user_u:s0-s0:c0.c1023$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'
This code is an extension to the otptoken plugin and provides support for
reading/writing YubiKey tokens directly.
YubiKey Tokens
${product}, version: ${version} A Create reverse A IP Address A comma-separated list of fields to search in when searching for groups A comma-separated list of fields to search in when searching for users A description of this host A host willing to act as a key exchanger A host willing to act as a mail exchanger A hostname which this alias hostname points to A record A string searched in all relevant object attributes A6 Record data A6 record AAAA Create reverse AAAA IP Address AAAA record ACI name ACI prefix ACL name AFSDB Hostname AFSDB Subtype AFSDB record APL record Active zone Add HBAC services into HBAC rule '${primary_key}' Add RunAs user groups into sudo rule '${primary_key}' Add RunAs users into sudo rule '${primary_key}' Add a new HBAC service group. Add a new HBAC service. Add a new YubiKey OTP token. Add a new delegation. Add a new self-service permission. Add a permission for per-forward zone access delegation. Add a permission for per-zone access delegation. Add an attribute/value pair. Format is attr=value. The attribute
must be part of the schema. Add host groups into host group '${primary_key}' Add hosts that can manage this host. Add members to a hostgroup. Add members to an HBAC service group. Add new DNS resource record. Add services to an HBAC rule. Add target hosts and hostgroups to an HBAC rule. Add the host to DNS with this IP address Add user ID override into user group '${primary_key}' Add users and groups to an HBAC rule. Add users into CA ACL '${primary_key}' Add users into netgroup '${primary_key}' Added %(map)s Added %(src)s to %(dst)s Added automount location "%(value)s" Added new resource delegation to the host "%(value)s" Added option "%(option)s" to Sudo Rule "%(rule)s" Added passkey mappings to user "%(value)s" Administrator e-mail address Algorithm Allow PTR sync Allow dynamic updates. Allow in-line DNSSEC signing Allow inline DNSSEC signing of records in the zone Allow query Allow synchronization of forward (A, AAAA) and reverse (PTR) records Allow synchronization of forward (A, AAAA) and reverse (PTR) records in the zone Allow transfer Allow users, groups, hosts or host groups to create a keytab of this host. Allow users, groups, hosts or host groups to retrieve a keytab of this host. Altitude Apply ACI to your own entry (self) Archive data into a vault. Are you sure you want to activate selected users? Are you sure you want to disable ${object}? Are you sure you want to restore selected users? Asks for a non-random password to use for the principal Attributes Attributes to which the delegation applies Attributes to which the permission applies Authoritative nameserver Authoritative nameserver domain name Automount key name. Automount location name. Automount map name. Automount master file. Available BIND update policy Base DN Base DN on remote LDAP server Base for certificate subjects (OU=Test,O=Example) Base-64 encoded server certificate Binary data to archive Bind password already provided (-w).
Bind password required when using a bind DN (-w or -W).
CERT Algorithm CERT Certificate Type CERT Certificate/CRL CERT Key Tag CERT record CNAME Hostname CNAME record Cannot decode file '%(filename)s': %(exc)s Cannot get host's FQDN!
Cannot read file '%(filename)s': %(exc)s Cannot specify both SASL mechanism and bind DN simultaneously.
Cannot specify server and LDAP uri simultaneously.
Certificate Certificate Association Data Certificate Subject base Certificate Type Certificate Usage Certificate(s) stored in file '%(file)s' Certificate/CRL Change password Checks if any of the servers has the DNS service enabled. Closing keytab failed
Comma separated encryption types list Comma-separated list of attributes to be ignored for group entries in DS Comma-separated list of raw NAPTR records Confirmation Contact this specific KDC Server Continuous mode: Don't stop on errors. Continuous operation mode. Errors are reported but the process continues Continuous operation mode. Errors are reported but the process continues. Create a new HBAC rule. Create a new automount key. Create a new automount location. Create a new automount map. Create a new indirect mount point. Create a new vault. Create new ACI. Create new DNS forward zone. Create new DNS zone (SOA record). Create reverse record for this IP Address Current DNS record contents:
DHCID record DLV Algorithm DLV Digest DLV Digest Type DLV Key Tag DLV record DN to bind as if not using kerberos DNAME Target DNAME record DNS Discovery failed
DNS Servers DNS discovery for domain %s
DNS forwarder DNS resource record type DNSKEY record DS Algorithm DS Digest DS Digest Type DS Key Tag DS record Data Debugging output Default PAC types Default SELinux user Default SELinux user when no match is found in SELinux map rule Default e-mail domain Default group for new users Default group objectclasses Default group objectclasses (comma-separated list) Default location of home directories Default shell Default shell for new users Default types of PAC supported for services Default types of supported user authentication Default user authentication types Default user objectclasses Default user objectclasses (comma-separated list) Default users group Degrees Latitude Degrees Longitude Delegation name Delegation principal Delete %(name)s '%(value)s'? Delete ACI. Delete DNS forward zone. Delete DNS record entry. Delete DNS resource record. Delete DNS zone (SOA record). Delete Server Delete a delegation. Delete a host. Delete a self-service permission. Delete a user Delete a user, keeping the entry available for future use Delete all associated records Delete all? Delete an HBAC rule. Delete an HBAC service group. Delete an attribute/value pair. The option will be evaluated
last, after all sets and adds. Delete an automount key. Delete an automount location. Delete an automount map. Delete an existing HBAC service. Description Digest Digest Type Direction Latitude Direction Longitude Disable DNS Forward Zone. Disable DNS Zone. Disable an HBAC rule. Disable the Kerberos key, SSL certificate and all services of a host. Disabled Disabled Sudo Rule "%s" Disallow users, groups, hosts or host groups to create a keytab of this host. Disallow users, groups, hosts or host groups to retrieve a keytab of this host. Discovered server %s
Display DNS resource. Display a single ACI given an ACI name. Display an automount key. Display an automount location. Display an automount map. Display information about a DNS forward zone. Display information about a DNS zone (SOA record). Display information about a delegation. Display information about a help topic. Display information about an Group ID override. Display information about an HBAC service group. Display information about an HBAC service. Display information about an ID override. Display information about an Identity Provider reference. Display information about an automember rule. Display the access rights of this entry (requires --all). See ipa man page for details. Display the properties of an HBAC rule. Duplicate keys skipped: Duplicate maps skipped: Dynamic update Enable DNS Forward Zone. Enable DNS Zone. Enable an HBAC rule. Enable migration mode Enabled Enabled Sudo Rule "%s" Encryption types to request Enrollment failed. %s
Enter LDAP password Error Error getting default Kerberos realm: %s.
Error obtaining initial credentials: %s.
Error parsing "%1$s": %2$s.
Error resolving keytab: %s.
Error storing creds in credential cache: %s.
Expanding buffer in jsonrpc_handle_response failed External host Extra hashes to generate in password plug-in Extracting the data from the JSON-RPC response failed: %s
Extracting the error from the JSON-RPC response failed: %s
Failed to add Failed to add key to the keytab
Failed to bind to server!
Failed to close the keytab
Failed to create control!
Failed to create key material
Failed to create key!
Failed to decode control reply!
Failed to get keytab
Failed to get keytab!
Failed to get result: %s
Failed to open Keytab
Failed to open config file %s
Failed to open keytab
Failed to open keytab '%1$s': %2$s
Failed to parse config file %s
Failed to parse extended result: %s
Failed to parse result: %s
Failed to resolve symlink to keytab.
Failed to retrieve any keys Failed to retrieve encryption type %1$s (#%2$d)
Failed to retrieve encryption type type #%d
Failed to set cursor '%1$s'
File %(file)s not found File containing data to archive File containing the new vault password File containing the new vault public key File containing the old vault password File containing the old vault private key File containing the vault password File containing the vault private key File containing the vault public key File to load the certificate from File to load the certificate from. File to store retrieved data Filter Fingerprint Fingerprint Type First Code Flags Force Force DNS zone creation even if nameserver is not resolvable. Force nameserver change even if nameserver not in DNS Force the host join. Rejoin even if already joined. Forward policy Forward zones only GSSAPI|EXTERNAL Generate a random password to be used in bulk enrollment Generate automount files for a specific location. Global forwarders Global forwarders. A custom port can be specified for each forwarder using a standard format "IP_ADDRESS port PORT" Global forwarding policy. Set to "none" to disable any configured global forwarders. Google Group Options Group search fields Group to apply ACI to HBAC service HBAC service description HBAC service group description HBAC service groups to add HBAC service groups to remove HBAC services to add HBAC services to remove HIP record HOTP authentication skip-ahead HOTP synchronization skip-ahead HTTP Error Hardware MAC address(es) on this host Home directory base Horizontal Precision Host Certificate Host Groups Host Groups allowed to add resource delegation Host category Host category the rule applies to Host hardware platform (e.g. "Lenovo T61") Host is already joined.
Host locality (e.g. "Baltimore, MD") Host location (e.g. "Lab 2") Host name Host operating system and version (e.g. "Fedora 9") Hostname Hostname of this server Hosts Hosts allowed to add resource delegation Hosts allowed to create keytab How long should negative responses be cached IP Address IP network to create reverse zone name from IPA CA certificate IPA Location description IPA Server to use IPA namingContext not found
IPA role name IPSECKEY record Ignored %(src)s to %(dst)s Ignored keys: Import automount files for a specific location. Imported keys: Imported maps: Include Enabled Incompatible options provided (-r and -P)
Input data specified multiple times Input file Input filename Invalid SASL bind mechanism
Invalid Service Principal Name
Invalid credentials Invalid or unsupported type. Allowed values are: %s Invalid or unsupported vault public key: %s Invalid vault type Is zone active? JSON-RPC call failed with status code: %li
JSON-RPC call failed: %s
JSON-RPC call was unauthorized. Check your credentials.
JSON-RPC request:
%s
JSON-RPC response:
%s
KEY Algorithm KEY record KX Exchanger KX Preference KX record Kerberos Credential Cache not found. Do you have a Kerberos Ticket?
Kerberos Service Principal Name Kerberos User Principal not found. Do you have a valid Credential Cache?
Kerberos context initialization failed
Kerberos context initialization failed: %1$s (%2$d)
Kerberos principal name for this host Key Tag Keytab File Name Keytab successfully retrieved and stored in: %s
LDAP DN LDAP SASL bind mechanism if no bindd/bindpw LDAP basedn LDAP password LDAP password (if not using Kerberos) LDAP uri to connect to. Mutually exclusive with --server LOC Altitude LOC Degrees Latitude LOC Degrees Longitude LOC Direction Latitude LOC Direction Longitude LOC Horizontal Precision LOC Minutes Latitude LOC Minutes Longitude LOC Seconds Latitude LOC Seconds Longitude LOC Size LOC Vertical Precision LOC record Left node Legal LDAP filter (e.g. ou=Engineering) Length of TOTP token code validity List of deletions that failed Locality Location Location of the ACI MAC address MX Exchanger MX Preference MX record Map Master file Match cn attribute in subject Matching Type Maximum amount of time (seconds) for a search (> 0, or -1 for unlimited) Maximum number of agreements per replica Maximum number of entries returned Maximum number of records to search (-1 is unlimited) Maximum username length Member HBAC service Member of Member of HBAC service groups Member of a group Member user group Members that could not be added Members that could not be removed Migration mode is disabled.
Use 'ipa config-mod --enable-migration=TRUE' to enable it. Minutes Latitude Minutes Longitude Missing new vault public key Missing reply control list!
Missing reply control!
Missing vault private key Missing vault public key Modified Identity Provider reference "%(value)s" Modified netgroup "%(value)s" Modify %(name)s '%(value)s'? Modify ACI. Modify DNS forward zone. Modify DNS zone (SOA record). Modify Passkey configuration. Modify a DNS resource record. Modify a delegation. Modify a vault. Modify an HBAC rule. Modify an HBAC service group. Modify an HBAC service. Modify an automount key. Modify an automount map. Modify configuration options. Modify global DNS configuration. Modify global trust configuration. Mount information Mount point NAPTR Flags NAPTR Order NAPTR Preference NAPTR Regular Expression NAPTR Replacement NAPTR Service NAPTR record NS Hostname NS record NSEC record NSEC3 record NSEC3PARAM record NSEC3PARAM record for zone in format: hash_algorithm flags iterations salt Name of host-group Name of parent automount map (default: auto.master). Neither --del-all nor options to delete a specific record provided.
Command help may be consulted for all supported record types. Nested Methods to execute New ACI name New Principal Password New mount information New public key specified multiple times New vault password No free YubiKey slot! No keys accepted by KDC
No option to delete specific record provided. No option to modify specific record provided. No permission to join this host to the IPA domain.
No system preferred enctypes ?!
No values for %s No write permissions on keytab file '%s'
Number of days's notice of impending password expiration Number of entries returned Number of hosts the ID View was applied to: Number of members added Number of members removed OTP Old vault password Old vault private key Operating system Operation failed: %s
Order Order in increasing priority of SELinux users, delimited by $ Out of Memory!
Out of memory
Out of memory! Out of memory!
Output debug info Output only on errors Override existing password Owner PTR Hostname PTR record Parent map Parse all raw DNS records and return them in a structured way Parsing JSON-RPC response failed: %s
Parsing JSON-RPC response failed: no 'result' value found.
Passkey Configuration Passkey configuration options Password Password Expiration Notification (days) Password Policies Password Policy Password can be specified only for symmetric vault Password migration was not successful Password plugin features Password specified multiple times Password used in bulk enrollment Passwords do not match!
Passwords have been migrated in pre-hashed format.
IPA is unable to generate Kerberos keys unless provided
with clear text passwords. All migrated users need to
login at https://your.domain/ipa/migration/ before they
can use their Kerberos accounts. Path to the IPA CA certificate Per-zone conditional forwarding policy. Set to "none" to disable forwarding to global forwarder for this zone. In that case, conditional zone forwarders are disregarded. Per-zone forwarders. A custom port can be specified for each forwarder using a standard format "IP_ADDRESS port PORT" Permission Permission ACI grants access to Permission value Permissions Permissions to grant (read, write). Default is write. Permissions to grant(read, write, add, delete, all) Permitted Encryption Types Platform Please choose a type of DNS resource record to be added Port Preference Preference given to this exchanger. Lower values are more preferred Prefix used to distinguish ACI types (permission, delegation, selfservice, none) Primary key only Principal name Print as little as possible Print debugging information Print entries as stored on the server. Only affects output format. Print the raw XML-RPC output in GSSAPI mode Priority Private key specified multiple times Profile configuration stored in file '%(file)s' Prompt for LDAP password Public key can be specified only for asymmetric vault Public key specified multiple times QR code width is greater than that of the output tty. Please resize your terminal. Quiet mode. Only errors are displayed. RP record RRSIG Type Covered RRSIG record Random password Raw A records Raw A6 records Raw AAAA records Raw AFSDB records Raw APL records Raw CERT records Raw CNAME records Raw DHCID records Raw DLV records Raw DNAME records Raw DNSKEY records Raw DS records Raw HIP records Raw IPSECKEY records Raw KEY records Raw KX records Raw LOC records Raw MX records Raw NAPTR records Raw NS records Raw NSEC records Raw NSEC3 records Raw PTR records Raw RP records Raw RRSIG records Raw SIG records Raw SPF records Raw SRV records Raw SSHFP records Raw TA records Raw TKEY records Raw TLSA records Raw TSIG records Raw TXT records Realm name Recommended maximum number of agreements per replica exceeded Record data Record name Record type Records Regular Expression Remove HBAC service groups from HBAC rule '${primary_key}' Remove HBAC services from HBAC service group '${primary_key}' Remove Passkey Remove RunAs user groups from sudo rule '${primary_key}' Remove a permission for per-forward zone access delegation. Remove a permission for per-zone access delegation. Remove all principals in this realm Remove hold Remove host '${primary_key}' from HBAC rules Remove host '${primary_key}' from host groups Remove host '${primary_key}' from netgroups Remove host '${primary_key}' from roles Remove host '${primary_key}' from sudo rules Remove host group '${primary_key}' from host groups Remove host group '${primary_key}' from netgroups Remove hosts that can manage this host. Remove members from an HBAC service group. Remove netgroup '${primary_key}' from netgroups Remove roles from privilege '${primary_key}' Remove service and service groups from an HBAC rule. Remove target hosts and hostgroups from an HBAC rule. Remove user '${primary_key}' from HBAC rules Remove user '${primary_key}' from sudo rules Remove user '${primary_key}' from user groups Remove user group '${primary_key}' from netgroups Remove user group '${primary_key}' from roles Remove user group '${primary_key}' from user groups Remove user groups from owners of vault '${primary_key}' Remove users and groups from an HBAC rule. Remove vaults Removed option "%(option)s" from Sudo Rule "%(rule)s" Removing %(servers)s from replication topology, please wait... Removing principal %s
Rename Rename an ACI. Rename the DNS resource record object Rename the automount key object Replacement Replication topology of suffix "%(suffix)s" contains errors. Replication topology of suffix "%(suffix)s" is in order. Reset Password Reset your password. Resolve a host name in DNS. Results should contain primary key attribute only ("location") Results should contain primary key attribute only ("map") Results should contain primary key attribute only ("name") Results should contain primary key attribute only ("service") Retrieve a data from a vault. Retrieve and print all attributes from the server. Affects command output. Retrieve current keys without changing them Retrying with pre-4.0 keytab retrieval method...
Reverse zone IP network Rights Role name Rule name Rule type Rule type (allow) SASL Bind failed
SELinux user map order SIG record SOA expire SOA minimum SOA record expire time SOA record refresh time SOA record retry time SOA record serial number SOA refresh SOA retry SOA serial SPF record SRV Port SRV Priority SRV Target SRV Weight SRV record SSH public key SSH public key fingerprint SSH public key: SSHFP Algorithm SSHFP Fingerprint SSHFP Fingerprint Type SSHFP record Search Options Search for %1$s on rootdse failed with error %2$d
Search for DNS forward zones. Search for DNS resources. Search for DNS zones (SOA records). Search for HBAC rules. Search for HBAC services. Search for IPA namingContext failed with error %d
Search for an HBAC service group. Search for an automount key. Search for an automount location. Search for an automount map. Search for classes. Search for delegations. Search for forward zones only Search for hosts with these enrolled by users. Search for hosts with these managing hosts. Search for hosts with these member of roles. Search for hosts without these enrolled by users. Search for netgroups with these member hosts. Search for netgroups with these member users. Search for netgroups without these member groups. Search for netgroups without these member users. Search for stage users without these member of HBAC rules. Search size limit Search time limit Second Code Seconds Latitude Seconds Longitude Selector Semicolon separated list of IP addresses or networks which are allowed to issue queries Semicolon separated list of IP addresses or networks which are allowed to transfer the zone Serial number (hex) Server "%(srv)s" has %(n)d agreements with servers: Server %(srv)s can't contact servers: %(replicas)s Server DNS location Server Name Server name not provided and unavailable
Server will check DNS forwarder(s). Servers details: Service Service Groups Service category Service category the rule applies to Service group name Service name Services Set SSH key Set a user's password. Set an attribute to a name/value pair. Format is attr=value.
For multi-valued attributes, the command replaces the values already present. Shared Vaults Show the current configuration. Show the current global DNS configuration. Show the list of permitted encryption types and exit Simple bind failed
Size Size Limit Size of data exceeds the limit. Current vault data size limit is %(limit)d B Skipped %(key)s Skipped %(map)s Specifies where to store keytab information. Split DNS record to parts Structured Subject OID Subtree Subtree to apply ACI to Subtype Supported encryption types:
Suppress processing of membership attributes. Synchronize an OTP token. TA record TKEY record TLSA Certificate Association Data TLSA Certificate Usage TLSA Matching Type TLSA Selector TLSA record TSIG record TXT Text Data TXT record Target Target group Target your own entry (self) Test the ACI syntax but don't write anything Text Data The domain name of the target host or '.' if the service is decidedly not available at this domain The hostname must be fully-qualified: %s
The hostname must not be: %s
The hostname this reverse record points to The keytab file to append the new key to (will be created if it does not exist). The keytab file to remove the principcal(s) from The most common types for this type of zone are: %s
The primary_key value of the entry, e.g. 'jdoe' for a user The principal to get a keytab for (ex: ftp/ftp.example.com@EXAMPLE.COM) The principal to remove from the keytab (ex: ftp/ftp.example.com@EXAMPLE.COM) This may take some time, please wait ... Time Limit Time limit of search in seconds Time to live Time to live for records at zone apex Timeout exceeded. Token ID Topology is disconnected True if not all results were returned True means the operation was successful Type Unable to archive key: %s Unable to determine IPA server from %s
Unable to determine root DN of %s
Unable to display QR code using the configured output encoding. Please use the token URI to configure your OTP device Unable to enable SSL in LDAP
Unable to generate Kerberos Credential Cache
Unable to initialize ldap library!
Unable to join host: Kerberos Credential Cache not found
Unable to join host: Kerberos User Principal not found and host password not provided.
Unable to join host: Kerberos context initialization failed
Unable to parse principal
Unable to parse principal name
Unable to parse principal: %1$s (%2$d)
Unable to remove entry
Unable to retrieve key: %s Unenroll this host from IPA server Unenrollment failed.
Unenrollment successful.
Unrevoked Unspecified Update DNS entries User Groups User ID User category User category the rule applies to User group User group ACI grants access to User group to apply delegation to User password User search fields User-friendly description of action performed Users Using discovered server %s
Using provided server %s
Using server from config %s
Vault password Vault private key Verify Password Verify Principal Password Vertical Precision Warning: failed to convert type (#%d)
Warning: salt types are not honored with randomized passwords (see opt. -P)
Weight Write certificate (chain if --chain used) to file YubiKey slot Zone forwarders Zone name Zone name (FQDN) Zone refresh interval access() on %1$s failed: errno = %2$d
basedn ber_init() failed, Invalid control ?!
ber_scanf() failed, unable to find kvno ?!
cannot open configuration file %s
cannot specify both raw certificate and file cannot stat() configuration file %s
child exited with %d
comma-separated list of hosts to remove curl_easy_init() failed
curl_easy_setopt() failed
curl_global_init() failed
curl_slist_append() failed for value: '%s'
description executing ipa-getkeytab failed, errno %d
file to store DNS records in nsupdate format file to store certificate in filename force NS record creation even if its hostname is not in DNS fork() failed
groups to add groups to remove host groups to add host groups to remove hostname hosts to add hosts to remove id range type invalid domain name ipa-getkeytab has bad permissions?
ipa-getkeytab not found
json_dumps() failed
json_pack_ex() failed: %s
key %(key)s already exists keytab is a dangling symlink and owned by another user.
krb5_kt_close %1$d: %2$s
krb5_kt_get_entry %1$d: %2$s
krb5_kt_remove_entry %1$d: %2$s
krb5_parse_name %1$d: %2$s
krb5_unparse_name %1$d: %2$s
kvno %d
map %(map)s already exists maps not connected to /etc/auto.master: member Certificate Profile member HBAC service member HBAC service group member group member host member host group member user netgroups to add out of memory
password password policies password policy password to use if not using kerberos preserve and no-preserve cannot be both set principal not found
principal not found in XML-RPC response
python-yubico is not installed. read error
realm not found
result not found in XML-RPC response
runAs user runAs users server roles skip reverse DNS detection trust configuration type of IPA object (user, group, host, hostgroup, service, netgroup) url users to add users to remove {algo} is not a supported vault wrapping algorithm Project-Id-Version: freeipa 4.10.0.dev202206291425+git9a97f9b40
Report-Msgid-Bugs-To: https://pagure.io/freeipa/new_issue
PO-Revision-Date: 2024-09-27 09:59+0000
Last-Translator: 김인수 <simmon@nplob.com>
Language-Team: Korean <https://translate.fedoraproject.org/projects/freeipa/master/ko/>
Language: ko
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=1; plural=0;
X-Generator: Weblate 5.7.2
신규 토큰 추가:
ipa otptoken-add-yubikey --owner=jdoe --desc="My YubiKey"
Automount
IPA에서 autofs(8)을 위한 저장소 자동적재(8) 구성
The base of an automount configuration is the configuration file auto.master.
This is also the base location in IPA. Multiple auto.master configurations
can be stored in separate locations. A location is implementation-specific
with the default being a location named 'default'. For example, you can have
locations by geographic region, by floor, by type, etc.
Automount has three basic object types: locations, maps and keys.
A location defines a set of maps anchored in auto.master. This allows you
to store multiple automount configurations. A location in itself isn't
very interesting, it is just a point to start a new automount map.
A map is roughly equivalent to a discrete automount file and provides
storage for keys.
A key is a mount point associated with a map.
When a new location is created, two maps are automatically created for
it: auto.master and auto.direct. auto.master is the root map for all
automount maps for the location. auto.direct is the default map for
direct mounts and is mounted on /-.
An automount map may contain a submount key. This key defines a mount
location within the map that references another map. This can be done
either using automountmap-add-indirect --parentmap or manually
with automountkey-add and setting info to "-type=autofs :<mapname>".
예제:
위치:
Create a named location, "Baltimore":
ipa automountlocation-add baltimore
Display the new location:
ipa automountlocation-show baltimore
Find available locations:
ipa automountlocation-find
Remove a named automount location:
ipa automountlocation-del baltimore
Show what the automount maps would look like if they were in the filesystem:
ipa automountlocation-tofiles baltimore
Import an existing configuration into a location:
ipa automountlocation-import baltimore /etc/auto.master
The import will fail if any duplicate entries are found. For
continuous operation where errors are ignored, use the --continue
option.
Maps:
Create a new map, "auto.share":
ipa automountmap-add baltimore auto.share
Display the new map:
ipa automountmap-show baltimore auto.share
Find maps in the location baltimore:
ipa automountmap-find baltimore
Create an indirect map with auto.share as a submount:
ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.man
This is equivalent to:
ipa automountmap-add-indirect baltimore --mount=/man auto.man
ipa automountkey-add baltimore auto.man --key=sub --info="-fstype=autofs ldap:auto.share"
Remove the auto.share map:
ipa automountmap-del baltimore auto.share
키:
Create a new key for the auto.share map in location baltimore. This ties
the map we previously created to auto.master:
ipa automountkey-add baltimore auto.master --key=/share --info=auto.share
Create a new key for our auto.share map, an NFS mount for man pages:
ipa automountkey-add baltimore auto.share --key=man --info="-ro,soft,rsize=8192,wsize=8192 ipa.example.com:/shared/man"
Find all keys for the auto.share map:
ipa automountkey-find baltimore auto.share
Find all direct automount keys:
ipa automountkey-find baltimore --key=/-
Remove the man key from the auto.share map:
ipa automountkey-del baltimore auto.share --key=man
Directory Server Access Control Instructions (ACIs)
ACIs are used to allow or deny access to information. This module is
currently designed to allow, not deny, access.
The aci commands are designed to grant permissions that allow updating
existing entries or adding or deleting new ones. The goal of the ACIs
that ship with IPA is to provide a set of low-level permissions that
grant access to special groups called taskgroups. These low-level
permissions can be combined into roles that grant broader access. These
roles are another type of group, roles.
For example, if you have taskgroups that allow adding and modifying users you
could create a role, useradmin. You would assign users to the useradmin
role to allow them to do the operations defined by the taskgroups.
You can create ACIs that delegate permission so users in group A can write
attributes on group B.
The type option is a map that applies to all entries in the users, groups or
host location. It is primarily designed to be used when granting add
permissions (to write new entries).
An ACI consists of three parts:
1. target
2. permissions
3. bind rules
The target is a set of rules that define which LDAP objects are being
targeted. This can include a list of attributes, an area of that LDAP
tree or an LDAP filter.
The targets include:
- attrs: list of attributes affected
- type: an object type (user, group, host, service, etc)
- memberof: members of a group
- targetgroup: grant access to modify a specific group. This is primarily
designed to enable users to add or remove members of a specific group.
- filter: A legal LDAP filter used to narrow the scope of the target.
- subtree: Used to apply a rule across an entire set of objects. For example,
to allow adding users you need to grant "add" permission to the subtree
ldap://uid=*,cn=users,cn=accounts,dc=example,dc=com. The subtree option
is a fail-safe for objects that may not be covered by the type option.
The permissions define what the ACI is allowed to do, and are one or
more of:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted
Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.
The bind rule defines who this ACI grants permissions to. The LDAP server
allows this to be any valid LDAP entry but we encourage the use of
taskgroups so that the rights can be easily shared through roles.
For a more thorough description of access controls see
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html
EXAMPLES:
NOTE: ACIs are now added via the permission plugin. These examples are to
demonstrate how the various options work but this is done via the permission
command-line now (see last example).
Add an ACI so that the group "secretaries" can update the address on any user:
ipa group-add --desc="Office secretaries" secretaries
ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses"
Show the new ACI:
ipa aci-show --prefix=none "Secretaries write addresses"
Add an ACI that allows members of the "addusers" permission to add new users:
ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users"
Add an ACI that allows members of the editors manage members of the admins group:
ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins"
Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group:
ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street --attrs=postalcode --prefix=none "admins edit the address of editors"
Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss:
ipa aci-add --permissions=write --group=admins --attrs=street --attrs=postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss"
Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission:
ipa permission-add --permissions=add --subtree="cn=*,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange
The show command shows the raw 389-ds ACI.
IMPORTANT: When modifying the target attributes of an existing ACI you
must include all existing attributes as well. When doing an aci-mod the
targetattr REPLACES the current attributes, it does not add to them.
디렉토리 서버 접근 제어 지시(ACIs)
ACIs are used to allow or deny access to information. This module is
currently designed to allow, not deny, access.
The aci commands are designed to grant permissions that allow updating
existing entries or adding or deleting new ones. The goal of the ACIs
that ship with IPA is to provide a set of low-level permissions that
grant access to special groups called taskgroups. These low-level
permissions can be combined into roles that grant broader access. These
roles are another type of group, roles.
For example, if you have taskgroups that allow adding and modifying users you
could create a role, useradmin. You would assign users to the useradmin
role to allow them to do the operations defined by the taskgroups.
You can create ACIs that delegate permission so users in group A can write
attributes on group B.
The type option is a map that applies to all entries in the users, groups or
host location. It is primarily designed to be used when granting add
permissions (to write new entries).
An ACI consists of three parts:
1. target
2. permissions
3. bind rules
The target is a set of rules that define which LDAP objects are being
targeted. This can include a list of attributes, an area of that LDAP
tree or an LDAP filter.
The targets include:
- attrs: list of attributes affected
- type: an object type (user, group, host, service, etc)
- memberof: members of a group
- targetgroup: grant access to modify a specific group. This is primarily
designed to enable users to add or remove members of a specific group.
- filter: A legal LDAP filter used to narrow the scope of the target.
- subtree: Used to apply a rule across an entire set of objects. For example,
to allow adding users you need to grant "add" permission to the subtree
ldap://uid=*,cn=users,cn=accounts,dc=example,dc=com. The subtree option
is a fail-safe for objects that may not be covered by the type option.
The permissions define what the ACI is allowed to do, and are one or
more of:
1. write - write one or more attributes
2. read - read one or more attributes
3. add - add a new entry to the tree
4. delete - delete an existing entry
5. all - all permissions are granted
Note the distinction between attributes and entries. The permissions are
independent, so being able to add a user does not mean that the user will
be editable.
The bind rule defines who this ACI grants permissions to. The LDAP server
allows this to be any valid LDAP entry but we encourage the use of
taskgroups so that the rights can be easily shared through roles.
For a more thorough description of access controls see
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Control.html
EXAMPLES:
NOTE: ACIs are now added via the permission plugin. These examples are to
demonstrate how the various options work but this is done via the permission
command-line now (see last example).
Add an ACI so that the group "secretaries" can update the address on any user:
ipa group-add --desc="Office secretaries" secretaries
ipa aci-add --attrs=streetAddress --memberof=ipausers --group=secretaries --permissions=write --prefix=none "Secretaries write addresses"
Show the new ACI:
ipa aci-show --prefix=none "Secretaries write addresses"
Add an ACI that allows members of the "addusers" permission to add new users:
ipa aci-add --type=user --permission=addusers --permissions=add --prefix=none "Add new users"
Add an ACI that allows members of the editors manage members of the admins group:
ipa aci-add --permissions=write --attrs=member --targetgroup=admins --group=editors --prefix=none "Editors manage admins"
Add an ACI that allows members of the admins group to manage the street and zip code of those in the editors group:
ipa aci-add --permissions=write --memberof=editors --group=admins --attrs=street,postalcode --prefix=none "admins edit the address of editors"
Add an ACI that allows the admins group manage the street and zipcode of those who work for the boss:
ipa aci-add --permissions=write --group=admins --attrs=street,postalcode --filter="(manager=uid=boss,cn=users,cn=accounts,dc=example,dc=com)" --prefix=none "Edit the address of those who work for the boss"
Add an entirely new kind of record to IPA that isn't covered by any of the --type options, creating a permission:
ipa permission-add --permissions=add --subtree="cn=*,cn=orange,cn=accounts,dc=example,dc=com" --desc="Add Orange Entries" add_orange
The show command shows the raw 389-ds ACI.
IMPORTANT: When modifying the target attributes of an existing ACI you
must include all existing attributes as well. When doing an aci-mod the
targetattr REPLACES the current attributes, it does not add to them.
도메인 이름 체계 (DNS)
Manage DNS zone and resource records.
SUPPORTED ZONE TYPES
* Master zone (dnszone-*), contains authoritative data.
* Forward zone (dnsforwardzone-*), forwards queries to configured forwarders
(a set of DNS servers).
USING STRUCTURED PER-TYPE OPTIONS
There are many structured DNS RR types where DNS data stored in LDAP server
is not just a scalar value, for example an IP address or a domain name, but
a data structure which may be often complex. A good example is a LOC record
[RFC1876] which consists of many mandatory and optional parts (degrees,
minutes, seconds of latitude and longitude, altitude or precision).
It may be difficult to manipulate such DNS records without making a mistake
and entering an invalid value. DNS module provides an abstraction over these
raw records and allows to manipulate each RR type with specific options. For
each supported RR type, DNS module provides a standard option to manipulate
a raw records with format --<rrtype>-rec, e.g. --mx-rec, and special options
for every part of the RR structure with format --<rrtype>-<partname>, e.g.
--mx-preference and --mx-exchanger.
When adding a record, either RR specific options or standard option for a raw
value can be used, they just should not be combined in one add operation. When
modifying an existing entry, new RR specific options can be used to change
one part of a DNS record, where the standard option for raw value is used
to specify the modified value. The following example demonstrates
a modification of MX record preference from 0 to 1 in a record without
modifying the exchanger:
ipa dnsrecord-mod --mx-rec="0 mx.example.com." --mx-preference=1
EXAMPLES:
Add new zone:
ipa dnszone-add example.com --admin-email=admin@example.com
Add system permission that can be used for per-zone privilege delegation:
ipa dnszone-add-permission example.com
Modify the zone to allow dynamic updates for hosts own records in realm EXAMPLE.COM:
ipa dnszone-mod example.com --dynamic-update=TRUE
This is the equivalent of:
ipa dnszone-mod example.com --dynamic-update=TRUE --update-policy="grant EXAMPLE.COM krb5-self * A; grant EXAMPLE.COM krb5-self * AAAA; grant EXAMPLE.COM krb5-self * SSHFP;"
Modify the zone to allow zone transfers for local network only:
ipa dnszone-mod example.com --allow-transfer=192.0.2.0/24
Add new reverse zone specified by network IP address:
ipa dnszone-add --name-from-ip=192.0.2.0/24
Add second nameserver for example.com:
ipa dnsrecord-add example.com @ --ns-rec=nameserver2.example.com
Add a mail server for example.com:
ipa dnsrecord-add example.com @ --mx-rec="10 mail1"
Add another record using MX record specific options:
ipa dnsrecord-add example.com @ --mx-preference=20 --mx-exchanger=mail2
Add another record using interactive mode (started when dnsrecord-add, dnsrecord-mod,
or dnsrecord-del are executed with no options):
ipa dnsrecord-add example.com @
Please choose a type of DNS resource record to be added
The most common types for this type of zone are: NS, MX, LOC
DNS resource record type: MX
MX Preference: 30
MX Exchanger: mail3
Record name: example.com
MX record: 10 mail1, 20 mail2, 30 mail3
NS record: nameserver.example.com., nameserver2.example.com.
Delete previously added nameserver from example.com:
ipa dnsrecord-del example.com @ --ns-rec=nameserver2.example.com.
Add LOC record for example.com:
ipa dnsrecord-add example.com @ --loc-rec="49 11 42.4 N 16 36 29.6 E 227.64m"
Add new A record for www.example.com. Create a reverse record in appropriate
reverse zone as well. In this case a PTR record "2" pointing to www.example.com
will be created in zone 2.0.192.in-addr.arpa.
ipa dnsrecord-add example.com www --a-rec=192.0.2.2 --a-create-reverse
Add new PTR record for www.example.com
ipa dnsrecord-add 2.0.192.in-addr.arpa. 2 --ptr-rec=www.example.com.
Add new SRV records for LDAP servers. Three quarters of the requests
should go to fast.example.com, one quarter to slow.example.com. If neither
is available, switch to backup.example.com.
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="0 3 389 fast.example.com"
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="0 1 389 slow.example.com"
ipa dnsrecord-add example.com _ldap._tcp --srv-rec="1 1 389 backup.example.com"
The interactive mode can be used for easy modification:
ipa dnsrecord-mod example.com _ldap._tcp
No option to modify specific record provided.
Current DNS record contents:
SRV record: 0 3 389 fast.example.com, 0 1 389 slow.example.com, 1 1 389 backup.example.com
Modify SRV record '0 3 389 fast.example.com'? Yes/No (default No):
Modify SRV record '0 1 389 slow.example.com'? Yes/No (default No): y
SRV Priority [0]: (keep the default value)
SRV Weight [1]: 2 (modified value)
SRV Port [389]: (keep the default value)
SRV Target [slow.example.com]: (keep the default value)
1 SRV record skipped. Only one value per DNS record type can be modified at one time.
Record name: _ldap._tcp
SRV record: 0 3 389 fast.example.com, 1 1 389 backup.example.com, 0 2 389 slow.example.com
After this modification, three fifths of the requests should go to
fast.example.com and two fifths to slow.example.com.
An example of the interactive mode for dnsrecord-del command:
ipa dnsrecord-del example.com www
No option to delete specific record provided.
Delete all? Yes/No (default No): (do not delete all records)
Current DNS record contents:
A record: 192.0.2.2, 192.0.2.3
Delete A record '192.0.2.2'? Yes/No (default No):
Delete A record '192.0.2.3'? Yes/No (default No): y
Record name: www
A record: 192.0.2.2 (A record 192.0.2.3 has been deleted)
Show zone example.com:
ipa dnszone-show example.com
Find zone with "example" in its domain name:
ipa dnszone-find example
Find records for resources with "www" in their name in zone example.com:
ipa dnsrecord-find example.com www
Find A records with value 192.0.2.2 in zone example.com
ipa dnsrecord-find example.com --a-rec=192.0.2.2
Show records for resource www in zone example.com
ipa dnsrecord-show example.com www
Delegate zone sub.example to another nameserver:
ipa dnsrecord-add example.com ns.sub --a-rec=203.0.113.1
ipa dnsrecord-add example.com sub --ns-rec=ns.sub.example.com.
Delete zone example.com with all resource records:
ipa dnszone-del example.com
If a global forwarder is configured, all queries for which this server is not
authoritative (e.g. sub.example.com) will be routed to the global forwarder.
Global forwarding configuration can be overridden per-zone.
Semantics of forwarding in IPA matches BIND semantics and depends on the type
of zone:
* Master zone: local BIND replies authoritatively to queries for data in
the given zone (including authoritative NXDOMAIN answers) and forwarding
affects only queries for names below zone cuts (NS records) of locally
served zones.
* Forward zone: forward zone contains no authoritative data. BIND forwards
queries, which cannot be answered from its local cache, to configured
forwarders.
Semantics of the --forward-policy option:
* none - disable forwarding for the given zone.
* first - forward all queries to configured forwarders. If they fail,
do resolution using DNS root servers.
* only - forward all queries to configured forwarders and if they fail,
return failure.
Disable global forwarding for given sub-tree:
ipa dnszone-mod example.com --forward-policy=none
This configuration forwards all queries for names outside the example.com
sub-tree to global forwarders. Normal recursive resolution process is used
for names inside the example.com sub-tree (i.e. NS records are followed etc.).
Forward all requests for the zone external.example.com to another forwarder
using a "first" policy (it will send the queries to the selected forwarder
and if not answered it will use global root servers):
ipa dnsforwardzone-add external.example.com --forward-policy=first --forwarder=203.0.113.1
Change forward-policy for external.example.com:
ipa dnsforwardzone-mod external.example.com --forward-policy=only
Show forward zone external.example.com:
ipa dnsforwardzone-show external.example.com
List all forward zones:
ipa dnsforwardzone-find
Delete forward zone external.example.com:
ipa dnsforwardzone-del external.example.com
Resolve a host name to see if it exists (will add default IPA domain
if one is not included):
ipa dns-resolve www.example.com
ipa dns-resolve www
GLOBAL DNS CONFIGURATION
DNS configuration passed to command line install script is stored in a local
configuration file on each IPA server where DNS service is configured. These
local settings can be overridden with a common configuration stored in LDAP
server:
Show global DNS configuration:
ipa dnsconfig-show
Modify global DNS configuration and set a list of global forwarders:
ipa dnsconfig-mod --forwarder=203.0.113.113
예제:
그룹간 위임
A permission enables fine-grained delegation of permissions. Access Control
Rules, or instructions (ACIs), grant permission to permissions to perform
given tasks such as adding a user, modifying a group, etc.
Group to Group Delegations grants the members of one group to update a set
of attributes of members of another group.
예제:
Add a delegation rule to allow managers to edit employee's addresses:
ipa delegation-add --attrs=street --group=managers --membergroup=employees "managers edit employees' street"
When managing the list of attributes you need to include all attributes
in the list, including existing ones. Add postalCode to the list:
ipa delegation-mod --attrs=street --attrs=postalCode --group=managers --membergroup=employees "managers edit employees' street"
Display our updated rule:
ipa delegation-show "managers edit employees' street"
Delete a rule:
ipa delegation-del "managers edit employees' street"
그룹간 위임
A permission enables fine-grained delegation of permissions. Access Control
Rules, or instructions (ACIs), grant permission to permissions to perform
given tasks such as adding a user, modifying a group, etc.
Group to Group Delegations grants the members of one group to update a set
of attributes of members of another group.
EXAMPLES:
Add a delegation rule to allow managers to edit employee's addresses:
ipa delegation-add --attrs=street --group=managers --membergroup=employees "managers edit employees' street"
When managing the list of attributes you need to include all attributes
in the list, including existing ones. Add postalCode to the list:
ipa delegation-mod --attrs=street,postalCode --group=managers --membergroup=employees "managers edit employees' street"
Display our updated rule:
ipa delegation-show "managers edit employees' street"
Delete a rule:
ipa delegation-del "managers edit employees' street"
호스트 그룹.
호스트 그룹을 관리합니다. 이는 호스트-기반 접근 제어를 사용하여
여러 호스트에 접근 제어를 적용하는 데 유용합니다.
예제:
Add a new host group:
ipa hostgroup-add --desc="Baltimore hosts" baltimore
Add another new host group:
ipa hostgroup-add --desc="Maryland hosts" maryland
Add members to the hostgroup (using Bash brace expansion):
ipa hostgroup-add-member --hosts={box1,box2,box3} baltimore
Add a hostgroup as a member of another hostgroup:
ipa hostgroup-add-member --hostgroups=baltimore maryland
Remove a host from the hostgroup:
ipa hostgroup-remove-member --hosts=box2 baltimore
Display a host group:
ipa hostgroup-show baltimore
Add a member manager:
ipa hostgroup-add-member-manager --users=user1 baltimore
Remove a member manager
ipa hostgroup-remove-member-manager --users=user1 baltimore
Delete a hostgroup:
ipa hostgroup-del baltimore
호스트 그룹.
Manage groups of hosts. This is useful for applying access control to a
number of hosts by using Host-based Access Control.
예제:
Add a new host group:
ipa hostgroup-add --desc="Baltimore hosts" baltimore
Add another new host group:
ipa hostgroup-add --desc="Maryland hosts" maryland
Add members to the hostgroup (using Bash brace expansion):
ipa hostgroup-add-member --hosts={box1,box2,box3} baltimore
Add a hostgroup as a member of another hostgroup:
ipa hostgroup-add-member --hostgroups=baltimore maryland
Remove a host from the hostgroup:
ipa hostgroup-remove-member --hosts=box2 baltimore
Display a host group:
ipa hostgroup-show baltimore
Delete a hostgroup:
ipa hostgroup-del baltimore
HBAC 서비스 그룹
HBAC service groups can contain any number of individual services,
or "members". Every group must have a description.
예제:
Add a new HBAC service group:
ipa hbacsvcgroup-add --desc="login services" login
Add members to an HBAC service group:
ipa hbacsvcgroup-add-member --hbacsvcs=sshd --hbacsvcs=login login
Display information about a named group:
ipa hbacsvcgroup-show login
Delete an HBAC service group:
ipa hbacsvcgroup-del login
HBAC 서비스
The PAM services that HBAC can control access to. The name used here
must match the service name that PAM is evaluating.
예제:
Add a new HBAC service:
ipa hbacsvc-add tftp
Modify an existing HBAC service:
ipa hbacsvc-mod --desc="TFTP service" tftp
Search for HBAC services. This example will return two results, the FTP
service and the newly-added tftp service:
ipa hbacsvc-find ftp
Delete an HBAC service:
ipa hbacsvc-del tftp
HBAC 서비스
The PAM services that HBAC can control access to. The name used here
must match the service name that PAM is evaluating.
예제:
Add a new HBAC service:
ipa hbacsvc-add tftp
Modify an existing HBAC service:
ipa hbacsvc-mod --desc="TFTP service" tftp
Search for HBAC services. This example will return two results, the FTP
service and the newly-added tftp service:
ipa hbacsvc-find ftp
Delete an HBAC service:
ipa hbacsvc-del tftp
호스트-기반 접근 제어
Control who can access what services on what hosts. You
can use HBAC to control which users or groups can
access a service, or group of services, on a target host.
You can also specify a category of users and target hosts.
This is currently limited to "all", but might be expanded in the
future.
Target hosts in HBAC rules must be hosts managed by IPA.
The available services and groups of services are controlled by the
hbacsvc and hbacsvcgroup plug-ins respectively.
EXAMPLES:
Create a rule, "test1", that grants all users access to the host "server" from
anywhere:
ipa hbacrule-add --usercat=all test1
ipa hbacrule-add-host --hosts=server.example.com test1
Display the properties of a named HBAC rule:
ipa hbacrule-show test1
Create a rule for a specific service. This lets the user john access
the sshd service on any machine from any machine:
ipa hbacrule-add --hostcat=all john_sshd
ipa hbacrule-add-user --users=john john_sshd
ipa hbacrule-add-service --hbacsvcs=sshd john_sshd
Create a rule for a new service group. This lets the user john access
the FTP service on any machine from any machine:
ipa hbacsvcgroup-add ftpers
ipa hbacsvc-add sftp
ipa hbacsvcgroup-add-member --hbacsvcs=ftp --hbacsvcs=sftp ftpers
ipa hbacrule-add --hostcat=all john_ftp
ipa hbacrule-add-user --users=john john_ftp
ipa hbacrule-add-service --hbacsvcgroups=ftpers john_ftp
Disable a named HBAC rule:
ipa hbacrule-disable test1
Remove a named HBAC rule:
ipa hbacrule-del allow_server
호스트/장비(machines)
A host represents a machine. It can be used in a number of contexts:
- service entries are associated with a host
- a host stores the host/ service principal
- a host can be used in Host-based Access Control (HBAC) rules
- every enrolled client generates a host entry
등록:
There are three enrollment scenarios when enrolling a new client:
1. You are enrolling as a full administrator. The host entry may exist
or not. A full administrator is a member of the hostadmin role
or the admins group.
2. You are enrolling as a limited administrator. The host must already
exist. A limited administrator is a member a role with the
Host Enrollment privilege.
3. The host has been created with a one-time password.
재-등록:
Host that has been enrolled at some point, and lost its configuration (e.g. VM
destroyed) can be re-enrolled.
For more information, consult the manual pages for ipa-client-install.
A host can optionally store information such as where it is located,
the OS that it runs, etc.
예제:
Add a new host:
ipa host-add --location="3rd floor lab" --locality=Dallas test.example.com
Delete a host:
ipa host-del test.example.com
Add a new host with a one-time password:
ipa host-add --os='Fedora 12' --password=Secret123 test.example.com
Add a new host with a random one-time password:
ipa host-add --os='Fedora 12' --random test.example.com
Modify information about a host:
ipa host-mod --os='Fedora 12' test.example.com
Remove SSH public keys of a host and update DNS to reflect this change:
ipa host-mod --sshpubkey= --updatedns test.example.com
Disable the host Kerberos key, SSL certificate and all of its services:
ipa host-disable test.example.com
Add a host that can manage this host's keytab and certificate:
ipa host-add-managedby --hosts=test2 test
Allow user to create a keytab:
ipa host-allow-create-keytab test2 --users=tuser1
YubiKey 토큰 관리.
Plugin to make multiple ipa calls via one remote procedure call
To run this code in the lite-server
curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json
where the contents of the file batch_request.json follow the below example
{"method":"batch","params":[[
{"method":"group_find","params":[[],{}]},
{"method":"user_find","params":[[],{"whoami":"true","all":"true"}]},
{"method":"user_show","params":[["admin"],{"all":true}]}
],{}],"id":1}
The format of the response is nested the same way. At the top you will see
"error": null,
"id": 1,
"result": {
"count": 3,
"results": [
And then a nested response for each IPA command method sent in the request
Plugin to make multiple ipa calls via one remote procedure call
To run this code in the lite-server
curl -H "Content-Type:application/json" -H "Accept:application/json" -H "Accept-Language:en" --negotiate -u : --cacert /etc/ipa/ca.crt -d @batch_request.json -X POST http://localhost:8888/ipa/json
where the contents of the file batch_request.json follow the below example
{"method":"batch","params":[[
{"method":"group_find","params":[[],{}]},
{"method":"user_find","params":[[],{"whoami":"true","all":"true"}]},
{"method":"user_show","params":[["admin"],{"all":true}]}
],{}],"id":1}
The format of the response is nested the same way. At the top you will see
"error": null,
"id": 1,
"result": {
"count": 3,
"results": [
And then a nested response for each IPA command method sent in the request
ACIs 검색.
ACIs의 목록을 반환합니다
예제:
To find all ACIs that apply directly to members of the group ipausers:
ipa aci-find --memberof=ipausers
To find all ACIs that grant add access:
ipa aci-find --permissions=add
Note that the find command only looks for the given text in the set of
ACIs, it does not evaluate the ACIs to see if something would apply.
For example, searching on memberof=ipausers will find all ACIs that
have ipausers as a memberof. There may be other ACIs that apply to
members of that group indirectly.
서버 구성
Manage the default values that IPA uses and some of its tuning parameters.
NOTES:
The password notification value (--pwdexpnotify) is stored here so it will
be replicated. It is not currently used to notify users in advance of an
expiring password.
Some attributes are read-only, provided only for information purposes. These
include:
Certificate Subject base: the configured certificate subject base,
e.g. O=EXAMPLE.COM. This is configurable only at install time.
Password plug-in features: currently defines additional hashes that the
password will generate (there may be other conditions).
When setting the order list for mapping SELinux users you may need to
quote the value so it isn't interpreted by the shell.
예제:
Show basic server configuration:
ipa config-show
Show all configuration options:
ipa config-show --all
Change maximum username length to 99 characters:
ipa config-mod --maxusername=99
Increase default time and size limits for maximum IPA server search:
ipa config-mod --searchtimelimit=10 --searchrecordslimit=2000
Set default user e-mail domain:
ipa config-mod --emaildomain=example.com
Enable migration mode to make "ipa migrate-ds" command operational:
ipa config-mod --enable-migration=TRUE
Define SELinux user map order:
ipa config-mod --ipaselinuxusermaporder='guest_u:s0$xguest_u:s0$user_u:s0-s0:c0.c1023$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'
이 코드는 otptoken 플러그인의 확장과 YubiKey 토큰을 직접
읽고/쓸 수 있도록 지원합니다.
YubiKey 토큰
${product}, 버전: ${version} A 역방향 생성 IP 주소 그룹을 찾을 때에 검색 할 쉼표로-구분된 부분 목록 사용자를 찾을 때에 검색 할 쉼표로-구분된 부분 목록 이와 같은 호스트의 설명 키 교환기와 같은 역할을 하고자 하는 호스트 전자우편 교환기로 동작하고자 하는 호스트 이와 같은 별칭 호스트이름을 지칭하는 호스트이름 A 레코드 모든 연관된 객체 속성에서 검색된 문자열 A6 레코드 자료 A6 레코드 AAAA 역방향 생성 AAAA IP 주소 AAAA 레코드 ACI 이름 ACI 접두사 ACL 이름 AFSDB 호스트이름 AFSDB 하위유형 AFSDB 레코드 APL 레코드 활성 영역 HBAC 규칙 '${primary_key}'에 HBAC 서비스를 추가합니다 sudo 규칙 '${primary_key}'에 RunAS 사용자 그룹을 추가합니다 sudo 규칙'${primary_key}'애 RunAS 사용자를 추가합니다 신규 HBAC 서비스를 추가합니다. 신규 HBAC 서비스 추가. 신규 Yubikey OTP 토큰 추가. 새로운 위임 추가. 신규 셀프-서비스 권한을 추가합니다. 전달 영역(zone)별 접근 위임을 위한 권한을 추가합니다. 영역(zone)별 접근 위임을 위한 권한을 추가합니다. 속성/값 쌍을 추가합니다. 형식은 속성=값입니다. 속성은
스키마의 일부여야 합니다. 호스트 그룹 '${primary_key}'에 호스트 그룹을 추가합니다 이 호스트를 관리 할 수 있는 호스트를 추가합니다. 구성원을 호스트그룹에 추가. 구성원을 HBAC 서비스 그룹에 추가합니다. 신규 DNS 리소스 레코드를 추가합니다. 서비스를 HBAC 규칙에 추가. HBAC 규칙에 대상 호스트와 호스트그룹을 추가합니다. 이 IP 주소인 DNS에 호스트를 추가합니다 사용자 그룹 '${primary_key}'에 사용자 ID 재정의를 추가합니다 사용자와 그룹을 HBAC 규칙에 추가. CA ACL '${primary_key}'에 사용자를 추가합니다 넷그룹 '${primary_key}'에 사용자를 추가합니다 추가된 %(map)s %(src)s를 %(dst)s으로 추가함 추가된 자동적재 위치 "%(value)s" 신규 리소스 위임을 호스트 "%(value)s"로 추가됨 옵션 "%(option)s"이 추가됨 (sudo 규칙 "%(rule)s"에) 사용자 "%(value)s"에게 통과키 대응이 추가됨 관리자 전자우편 주소 알고리즘 PTR sync 허용 동적 최신화 허용. 인-라인 DNSSEC 서명 허용 영역(zone)에서 레코드의 인라인 DNSSEC 서명 허용 질의 허용 포워드(A, AAAA)와 역(PTR) 레코드의 동기화를 허용 영역(zone)에서 순방향(A, AAAA)와 역방향(PTR)의 동기화를 허용 전송 허용 사용자, 그룹, 호스트 또는 호스트 그룹이 이 호스트의 키탭을 생성하도록 허용합니다. 사용자, 그룹, 호스트 또는 호스트 그룹이 이 호스트의 키탭을 검색하도록 허용합니다. 고도 ACI를 자신의 항목(자신)으로 적용 자료를 저장소에 보관합니다. 선택된 사용자를 활성화 할까요? ${object}를 비활성화할까요? 선택된 사용자를 복구 할까요? 보안 주체에 사용 할 임의적이지 않은 비밀번호를 요청합니다 속성 위임이 적용되는 속성 권한이 적용되는 속성 권한 있는 네임서버 권한 있는 네임서버 도메인 이름 자동적재 키 이름. 자동적재 위치 이름. 자동적재 맵 이름. 자동적재 마스터 파일. 사용 가능한 BIND 최신화 정책 기본 DN 원격 LDAP 서버에서 기본 DN 인증서 주제에 대한 기반 (OU=시험,O=예제) Base-64로 인코딩된 서버 인증서 보관 해야 하는 바이너리 자료 바인드 비밀번호는 이미 제공되었습니다 (-w).
바인드 비밀번호는 바인드 DN (-w 또는 -W) 사용 할 때에 필요합니다.
CERT 알고리즘 CERT 인증 유형 CERT 인증서/CRL CERT 키 태그 CERT 레코드 CNAME 호스트이름 CNAME 레코드 파일을 디코드 할 수 없습니다 '%(filename)s': %(exc)s 호스트의 FQDN을 가져 올 수 없습니다!
파일을 읽을 수 없습니다 '%(filename)s': %(exc)s SASL 동작원리와 바인드 DN을 동시에 지정 할 수 없습니다.
서버와 LDAP uri를 동시에 지정 할 수 없습니다.
인증 인증 연관 자료 인증서 주제 기반 인증 유형 인증 사용법 파일 '%(file)s'에서 저장된 인증서 인증서/CRL 비밀번호 변경 DNS 서비스가 활성화된 서버가 있는지 확인합니다. 키탭을 닫는데 실패함
쉼표로 구분된 암호화 유형 목록 DS에서 그룹 항목을 위해 무시되는 속성의 쉼표로-구분된 목록 단순 NAPTR 레코드의 쉼표로-구분된 목록 확인 이와 같은 지정된 KDC 서버와 연락합니다 연속된 방식: 오류에 멈추지 않습니다. 연속 동작 방식. 오류는 보고 되지만 처리는 계속됩니다 연속 동작 방식. 오류는 보고 되지만 처리는 계속됩니다. 새로운 HBAC 규칙을 생성합니다. 신규 자동적재 키를 생성합니다. 신규 자동 적재 위치를 생성합니다. 신규 자동 적재 맵를 생성합니다. 새로운 간접 적재 지점을 만듭니다. 새로운 저장소를 생성합니다. 신규 ACI 생성. 신규 DNS 전달 영역(zone)을 생성합니다. 신규 DNS 영역(zone) 생성 (SOA 레코드). 이와 같은 IP 주소를 위한 역방향 레코드 생성 현재 DNS 레코드 내용:
DHCID 레코드 DLV 알고리즘 DLV 다이제스트 DLV 다이제스트 유형 DLV 키 태그 DLV 레코드 만약 커버러스를 사용하지 않는 것같이 바인드하는 DN DNAME 대상 DNAME 레코드 DNS 검색 실패함
DNS 서버 도메인 %s를 위한 DNS 검색
DNS 전달자 DNS 리소스 레코드 유형 DNSKEY 레코드 DS 알고리즘 DS 다이제스트 DS 다이제스트 유형 DS 키 태그 DS 레코드 자료 디버깅 출력 기본 PAC 유형 기본 SELinux 사용자 SELinux 맵 규칙에 일치하는 항목이 없을 때 기본 SELinux 사용자 기본 전자우편 도메인 새로운 사용자를 위한 기본 그룹 기본 그룹 객체 클래스 기본 그룹 객체 클래스 (쉼표로-구분된 목록) 홈 디렉토리의 기본 위치 기본 쉘 새로운 사용자를 위한 기본 쉘 서비스를 위해 지원되는 PAC의 기본 유형 지원되는 사용자 인증 기본 유형 기본 사용자 인증 유형 기본 사용자 객체 클래스 기본 사용자 객체 클래스 (쉼표로-구분된 목록) 기본 사용자 그룹 도 위도 도 위도 위임 이름 위임 주체 %(name)s '%(value)s' 삭제할까요? ACI 삭제. DNS 전달 영역(zone) 삭제. DNS 레코드 항목 삭제. DNS 리소스 레코드 삭제. DNS 영역(zone) 삭제 (SOA 레코드). 서버 삭제 위임 삭제. 호스트 삭제. 셀프-서비스 권한을 삭제합니다. 사용자 삭제 사용자를 삭제하고, 다음에 사용 할 수 있도록 항목을 유지하기 모든 연관 레코드를 삭제 모두 삭제? HBAC 규칙을 삭제합니다. HBAC 서비스 그룹을 삭제합니다. 속성/값 쌍을 삭제합니다. 옵션이 모든 설정과 추가 후에
마지막으로 평가됩니다. 자동 적재 키를 삭제합니다. 자동 적재 위치를 삭제합니다. 자동적재 맵을 삭제합니다. 기존 HBAC 서비스를 삭제. 설명 다이제스트 다이제스트 유형 방향 위도 방향 위도 DNS 전달 영역(zone) 비활성화. DNS 영역(zone) 비활성화. HBAC 규칙을 비활성화합니다. 커버러스 키, SSL 인증서 및 호스트의 모든 서비스를 비활성화. 사용불가 비활성화된 suo 규칙 "%s" 사용자, 그룹, 호스트 또는 호스트 그룹을 이 호스트의 키탭을 생성하도록 허용하지 않습니다. 사용자, 그룹, 또는 호스트 그룹을 이 호스트의 키탭을 검색하도록 허용하지 않습니다. 검색된 서버 %s
DNS 리소스 표시. ACI 이름으로 주어진 단인 ACI를 표시합니다. 자동 적재 키 표시. 자동 적재 위치를 표시합니다. 자동 적재 맵을 표시. DNS 전달 영역에 대하여 정보를 표시합니다. DNS 영역(zone)에 대하여 정보를 표시 (SOA 레코드). 위임에 대한 정보를 표시합니다. 도움말 주제에 대한 정보를 표시합니다. 그룹 ID 재정의에 대해 정보를 표시합니다. HBAC 서비스 그룹에 대해 정보를 표시합니다. HBAC 서비스에 대해 정보를 표시합니다. ID 재정의에 대한 정보를 표시합니다. 식별 공급자 참조에 대한 정보를 표시합니다. 자동 구성원 규칙에 대해 정보를 표시합니다. 이 항목(--all가 필요)의 접근 권한을 표시합니다. 자세한 내용은 ipa man 부분을 참조하세요. HBAC 규칙의 속성을 표시합니다. 중복된 키 건너뜀: 중복된 맵 건너띄기: 동적 최신화 DNS 전달 영역(zone) 활성화. DNS 영역(zone) 활성화. HBAC 규칙을 활성화합니다. 이전 방식 활성화 활성화됨 활성화된 sudo 규칙 "%s" 요청하는 암호화 유형 등록에 실패하였습니다. %s
LDAP 비밀번호를 입력합니다 오류 기본 커버러스 realm을 가져오는 중 오류: %s.
초기 인증서를 획득 중 오류: %s.
구문 분석 중 오류 "%1$s": %2$s.
키탭 해석 오류: %s.
인증서 캐쉬에서 인증서 저장 중 오류: %s.
jsonrpc_handle_response에서 버퍼 확장이 실패했습니다 외부 호스트 비밀번호 플러그-인에서 생성 할 추가 해쉬 JSON-RPC 응답에서 자료를 추출 하는데 실패함: %s
JSON-RPC 응답에서 오류 추출이 실패함: %s
추가하는데 실패함 키를 키탭에 추가하는데 실패함
서버로 바인드 하는데 실패함!
키탭을 닫는데 실패함
제어를 생성하는데 실패함!
키 재료 생성에 실패함
키 생성에 실패함!
제어 응답을 디코드 하는데 실패함
키탭을 가져오는데 실패함
키탭을 가져오는데 실패함!
결과를 가져오는데 실패함: %s
키탭을 가져오는데 실패함
구성 파일 %s를 여는데 실패함
키탭을 가져오는데 실패함
키탭을 여는데 실패함 '%1$s': %2$s
구성 파일 %s를 구문 분석하는데 실패함
확장된 결과를 구문 분석하는데 실패함: %s
결과를 구문 분석하는데 실패함: %s
심볼릭링크를 키탭으로 결정 하는데 실패함
키를 검색하는데 실패함 암호화 유형 %1$s (#%2$d)를 검색하는데 실패함
암호화 형태 유형 #%d를 검색하는데 실패함
커서 '%1$s' 설정에 실패함
파일 %(file)s을 찾을 수 없음 보관해야 하는 자료를 포함하는 파일 신규 저장소 비밀번호를 포함하는 파일 새로운 저장소 공용 키를 포함하는 파일 오래된 저장소 비밀번호를 포함하는 파일 오래된 저장소 개인 키를 포함하는 파일 저장소 비밀번호를 포함하는 파일 저장소 개인 키를 포함하는 파일 저장소 공용 키를 포함하는 파일 해당 인증서에 적재 할 파일 해당 인증서에 적재 할 파일. 검색된 자료를 저장하는 파일 필터 지문 지문 유형 첫 번째 코드 플래그 강제 만약 네임서버를 확인 할 수 없는 경우에도 DNS 영역(zone) 생성을 강제합니다. 만약 네임서버가 DNS가 아니라면 네임서버 변경 강제 호스트 참여를 강제합니다. 만약 이미 참여 중이라 할지라도 다시 참여합니다. 포워드 정책 전달 영역(zone) 전용 GSSAPI|EXTERNAL 대량 등록에 사용되는 임의 비밀번호를 생성합니다 지정된 위치로 자동 적재 파일을 발생합니다. 전역 전달자 전역 전달자. 사용자 지정 포트는 표준 형식 "IP_주소 포트용 포트"를 사용하여 각각의 전달자에 대해 지정 할 수 있습니다 전역 포워딩 정책. 구성된 전역 전달자를 비활성하려면 "없음"으로 설정합니다. 구글 그룹 옵션 그룹 검색 부분 ACI를 적용 할 그룹 HBAC 서비스 HBAC 서비스 설명 HBAC 서비스 그룹 설명 추가하려는 HBAC 서비스 그룹 제거하려는 HBAC 서비스 그룹 추가하려는 HBAC 서비스 제거하려는 HBAC 서비스 HIP 레코드 HOTP 인증 건너뛰기 HOTP 동기화 건너뛰기 HTTP 오류 이와 같은 호스트에서 하드웨어 맥(mac) 주소 홈 디렉토리 기반 수평 정밀도 호스트 인증서 호스트 그룹 리소스 위임을 추가하도록 허용된 호스트 그룹 호스트 범주 호스트 범주를 규칙에 적용합니다 호스트 하드웨어 기술환경 (예: "레노버 T61") 호스트는 이미 참여되었습니다
호스트 지역 (예: "메릴랜드주 볼티모어") 호스트 위치 (예: " Lab 2") 호스트 이름 호스트 운영 체제 및 버전 (예: "페도라 9") 호스트이름 이 서버의 호스트 이름 호스트 리소스 위임을 추가하도록 허용된 호스트 키탭을 생성하는데 허용된 호스트 부정적인 응답을 캐쉬 해야 하는 시간 IP 주소 역방향 영역 이름으로 생성해야 할 IP 네트워크 IPA CA 인증서 IPA 위치 설명 사용하려는 IPA 서버 IPA namingContext를 찾을 수 없습니다
IPA 역할 이름 IPSECKEY 레코드 %(src)s에서 %(dst)s까지 무시함 무시된 키: 지정된 위치로 자동 적재 파일을 가져옵니다. 가져온 키: 가져온 맵: 활성화 포함 호환되지 않는 옵션이 제공되었습니다 (-r 과 -P)
여러 번 지정된 입력 자료 입력 파일 파일이름 입력 잘못된 SASL 바인드 동작원리
잘못된 서비스 사용자 이름
잘못된 인증 정보 잘못되거나 지원되지 않는 유형. 허용된 값은 다음과 같습니다: %s 유효하지 않거나 지원되지 않는 저장소 공용 키: %s 잘못된 저장소 유형 영역(zone)이 활성화 되었나요? JSON-RPC 호출은 상태 코드에서 실패하였습니다: %li
JSON-RPC 호출이 실패함: %s
JSON-RPC 호출은 허용되지 않습니다. 자신의 인증을 점검하세요.
JSON-RPC 요청:
%s
JSON-RPC 응답:
%s
키 알고리즘 키 레코드 KX 교환기 KX 기본설정 KX 레코드 커버러스 인증된 캐쉬는 찾을 수 없습니다. 커버러스 티켓을 가지고 있나요?
커버러스 서비스 주체 이름 커버러스 사용자 주체를 찾을 수 없습니다. 유효한 인증 캐쉬를 가지고 있나요?
커버러스 문맥 초기화에 실패함
커버러스 문맥을 초기화 하는데 실패함: %1$s (%2$d)
이 호스트를 위한 커버러스 주체 이름 키 태그 키탭 파일 이름 키탭은 성공적으로 검색되었고 저장됨: %s
LDAP DN 만약 bindd/bindpw가 없는 경우 LDAP SASL 바인드 동작원리 LDAP basedn LDAP 비밀번호 LDAP 비밀번호 (만약 커버로스를 사용 중이 아니라면) 연결 할 LDAP URI입니다. --server와 상호 배타적 LOC 고도 LOC 도 위도 LOC 도 위도 LOC 방향 위도 LOC 방향 위도 LOC 수평 정밀도 LOC 분 위도 LOC 분 위도 LOC 초 위도 LOC 초 위도 LOC 크기 LOC 수직 정밀도 LOC 레코드 왼쪽 노드 적절한 LDAP 필터 (예: ou=Engineering) TOTP 토큰 코드 유효성의 길이 실패한 삭제 목록 지역 위치 ACI의 위치 MAC 주소 MX 교환기 MX 기본설정 MX 레코드 맵 마스터 파일 주제에서 cn 속성을 일치합니다 일치 유형 검색(> 0, 또는 제한 없는 -1)을 위한 최대 적재 시간 (초) 복제본당 계약의 최대 수 반환된 항목의 최대 수 검색 할 최대 레코드의 수 (-1은 제한이 없음) 최대 사용자이름 길이 구성원 HBAC 서비스 구성원 HBAC 서비스 그룹의 구성원 그룹의 구성원 사용자 그룹 구성원 추가 할 수 없는 구성원 제거 할 수 없는 구성원 이전 방식(migration mode)이 비활성화 되었습니다.
이를 활성화 하도록 'ipa config-mod --enable-migration=TRUE'를 사용하세요. 분 위도 분 위도 신규 저장소 공용 키가 누락됨 응답 제어 목록이 누락됨!
응답 제어 누락!
저장소 개인 키가 누락됨 저장소 공용 키가 누락됨 수정된 식별 공급자 참조 "%(value)s" 넷그룹 "%(value)s"가 수정됨 %(name)s '%(value)s' 수정할까요? ACI 수정. DNS 전달 영역(zone)을 수정합니다. DNS 영역(zone) 수정 (SOA 레코드). 통과키(passkey) 구성을 수정합니다. DNS 리소스 레코드를 수정합니다. 위임을 수정합니다. 저장소를 수정합니다. HBAC 규칙을 수정합니다. HBAC 서비스 그룹을 수정합니다. HBAC 서비스를 수정합니다. 자동 적재된 키를 수정합니다. 자동 적재된 맵을 수정합니다. 구성 옵션을 수정합니다. 전역 DNS 구성을 수정합니다. 전역 신뢰 구성을 수정합니다. 적재 정보 적재 지점 NAPTR 플래그 NAPTR 순서 NAPTR 환경설정 NAPTR 정규 표현 NAPTR 교체 NAPTR 서비스 NAPTR 레코드 NS 호스트이름 NS 레코드 NSEC 레코드 NSEC3 레코드 NSEC3PARAM 레코드 형식에서 영역(zone)을 위한 NSEC3PARAM 레코드: hash_algorithm 플래그 반복 솔트 호스트-그룹의 이름 상위 자동 적재 맵의 이름(기본값: auto.master). --del-all 또는 특정한 레코드를 삭제하는 선택이 제공되지 않았습니다.
명령 도움말은 지원되는 모든 레코드 유형을 위해 참조 할 수 있습니다. 실행 할 중첩 방법 새로운 ACI 이름 신규 주체 비밀번호 새로운 적재 정보 여러 번 지정된 신규 공용 키 신규 저장소 비밀번호 Yubikey 슬롯은 무료가 아닙니다! KDC에 의해 허용하는 키가 없습니다
제공된 특정 레코드를 삭제하는 옵션이 없습니다. 제공된 특정 레코드를 수정하는 옵션이 없습니다. 이 호스트를 IPA 도메인으로 가입 할 수 있는 권한이 없습니다.
시스템에 선호하는 암호화유형이 없습니다?!
%s를 위한 값이 없습니다 키탭 파일 '%s'에서 쓰기 권한이 없습니다
임박한 비밀번호 만료 통지 일수 반환된 항목의 수 호스트 ID 보기의 수는 다음과 같이 적용됩니다: 추가된 구성원의 수 제거된 구성원의 수 OTP 오래된 저장소 비밀번호 오래된 저장소 개인 키 운영 체제 작업 실패: %s
순서 SELinux 사용자의 우선 순위가 높은 순서로, $로 구분됨 메모리 부족!
메모리 부족
메모리 부족! 메모리 부족!
디버그 정보 출력 오류에서만 출력 기존 비밀번호를 무시합니다 소유자 PTR 호스트이름 PTR 레코드 상위 맵 모든 단순 DNS 레코드 구문분석과 구조화된 방식에서 이를 반환 JSON-RPC 응답 구문분석이 실패함: %s
JSON-RPC 응답을 구문 분석하는데 실패함: '결과' 값을 찾을 수 없습니다.
통과키(passkey) 구성 통과키 구성 옵션 비밀번호 비밀번호 만료 통지 (일) 비밀번호 정책 비밀번호 정책 비밀번호는 대칭 저장소를 위해서만 지정 될 수 있습니다 비밀번호 이전이 성공하지 못했습니다 비밀번호 플러그인 기능 비밀번호는 여러 번 지정됩니다 대량 등록에 사용되는 비밀번호 비밀번호가 일치하지 않습니다!
비밀번호는 사전-해시된 형식으로 이전되었습니다.
IPA는 일반 텍스트 비밀번호로 제공되지 않는 한 커버러스 키를
생성 할 수 없습니다. 모든 이전된 사용자는 이들 커버러스
계정을 사용하기 전에 https://your.domain/ipa/migration/에
로그인 해야 합니다. IPA CA 인증서 경로 영역(zone) 별 상태에 따른 전달 정책. 이와 같은 영역에 대해 전역 전달자로의 전달을 비활성화하려면 "없음"으로 설정합니다. 이와 같은 경우에, 상태에 따른 영역 전달자는 무시됩니다. 영역(zone)별 전달자. 사용자 지정 포트는 표준 형식 "IP_주소 포트용 포트"를 사용하여 각각의 전달자에 대해 지정 할 수 있습니다 권한 권한 ACI가 접근 권한을 부여합니다 권한 값 권한 권한을 부여함(읽기, 쓰기). 기본은 쓰기. 권한(일기, 쓰기, 추가, 삭제, 모두) 부여 허용되는 암호화 유형 기술환경 추가 되는 DNS 자원 레코드의 유형을 선택하세요 포트 환경설정 이와 같은 교환기에 주어진 우선권. 낮은 값이 더 선호됩니다 ACI 유형(권한, 위임, 셀프 서비스, 없음)을 구별하는 데 사용되는 접두사 기본 키만 주체 이름 가능한 작게 출력합니다 디버깅 정보 인쇄 서버에서 저장된 것 같은 항목을 출력합니다. 단지 출력 형식에 영향을 줍니다. GSSAPI 방식에서 단순 XML-RPC 표준출력을 인쇄합니다 우선순위 여러 번 지정된 개인 키 파일 '%(file)s'에서 저장된 프로파일 구성 LDAP 비밀번호를 위한 프롬프트 공용 키는 비대칭 저장소에서만 지정 될 수 있습니다 공용 키는 여러 번 지정됩니다 QR 코드 폭이 출력 tty의 너비보다 큽니다. 사용하고 있는 터미널 크기를 조정하세요. 정숙 방식. 단지 오류만 표시됩니다. RP 레코드 RRSIG 유형 적용 RRSIG 레코드 임의 비밀번호 단순 A 레코드 단순 A6 레코드 단순 AAAA 레코드 단순 AFSDB 레코드 단순 APL 레코드 단순 CERT 레코드 단순 CNAME 레코드 단순 DHCID 레코드 단순 DLV 레코드 단순 DNAME 레코드 단순 DNSKEY 레코드 단순 DS 레코드 단순 힙 레코드 단순 IPSECKEY 레코드 단순 키 레코드 단순 KX 기록 단순 LOC 레코드 단순 MX 레코드 단순 NAPTR 레코드 단순 NS 레코드 단순 NSEC 레코드 단순 NSEC3 레코드 단순 PTR 레코드 단순 RP 레코드 단순 RRSIG 레코드 단순 SIG 레코드 단순 SPF 레코드 단순 SRV 레코드 단순 SSHFP 레코드 단순 TA 레코드 단순 TKEY 레코드 단순 TLSA 레코드 단순 TSIG 레코드 단순 TXT 레코드 영역 이름 복제본당 추천되는 최대 계약 수를 초과했습니다 레코드 자료 레코드 이름 레코드 유형 레코드 정규 표현 HBAC 규칙 '${primary_key}'에서 HBAC 서비스 그룹을 제거합니다 HBAC 서비스 그룹 '${primary_key}'에서 HBAC 서비스를 제거합니다 통과키 제거 sudo 규칙 '${primary_key}'에서 RunAS 사용자 그룹을 제거합니다 전달 영역(zone)별 접근 위임을 위한 권한을 제거합니다. 영역(zone)별 접근 위임을 위한 권한을 제거. 이와 같은 영역에서 모든 주체를 제거합니다 보류 제거 HBAC 규칙에서 호스트 '${primary_key}'를 제거합니다 호스트 그룹에서 호스트 '${primary_key}'를 제거합니다 넷그룹에서 호스트 '${primary_key}'를 제거합니다 역할에서 호스트 '${primary_key}'를 제거합니다 sudo 규칙에서 호스트 '${primary_key}'를 제거합니다 호스트 그룹에서 호스트 그룹 '${primary_key}'를 제거합니다 넷그룹에서 호스트 그룹 '${primary_key}'를 제거합니다 이 호스트를 관리 할 수 있는 호스트를 제거합니다. HBAC 서비스 그룹에서 구성원을 제거합니다. 넷그룹에서 넷그룹 '${primary_key}'를 제거합니다 권한 '${primary_key}'에서 역할 제거 HBAC 규칙에서 서비스와 그룹을 제거. HBAC 규칙에서 대상 호스트와 호스트그룹을 제거합니다. HBAC 규칙에서 사용자 '${primary_key}'를 제거합니다 sudo 역할에서 사용자 '${primary_key}'를 제거합니다 사용자 그룹에서 사용자 '${primary_key}'를 제거합니다 넷그룹에서 사용자 그룹 '${primary_key}'를 제거합니다 역할에서 사용자 그룹 '${primary_key}'를 제거합니다 사용자 그룹에서 사용자 그룹 '${primary_key}'를 제거합니다 저장소 '${primary_key}'의 소유자에서 사용자 그룹을 제거합니다 HABC 규칙에서 사용자와 그룹을 제거합니다. 저장소 제거 제거된 option "%(option)s" (sudo 규칙 "%(rule)s"에서) 복제된 형상에서 %(servers)s를 제거하는 중임. 잠시 기다려 주세요... 주체 %s를 제거하기
이름변경 ACI 이름 재지정. DNS 리소스 레코드 객체 이름을 재지정합니다 자동 적재 키 객체 이름 바꾸기 교체 접미사 "%(suffix)s"의 복제 형상은 오류를 포함합니다. 접미사 "%(suffix)s"의 복제 형상 순서입니다. 비밀번호 재설정 자신의 비밀번호를 초기화합니다. DNS에서 호스트 이름을 확인합니다. 결과는 기본 키 속성("위치")만 포함되어야 합니다 결과는 기본 키 속성("맵")만 포함되어야 합니다 결과는 기본 키 속성("이름")만 포함되어야 합니다 결과는 기본 키 속성("서비스")만 포함되어야 합니다 저장소에서 자료를 검색합니다. 서버에서 모든 속성을 검색하고 출력합니다. 명령 출력에 영향을 줍니다. 변경하지 않고 현재 키를 검색합니다 이전-4.0 키탭 검색 방법으로 재시도 중...
역방향 영역 IP 네트워크 권한 역할 이름 규칙 이름 규칙 유형 규칙 유형 (허용) SASL 바인드가 실패했습니다
SELinux 사용자 맵 순서 SIG 레코드 SOA 만료 SOA 최소 SOA 레코드 만료 시간 SOA 레코드 갱신 시간 SOA 레코드 재시도 시간 SOA 레코드 일련 번호 SOA 새로고침 SOA 재시도 SOA 일련번호 SPF 레코드 SRV 포트 SRV 우선순위 SRV 대상 SRV 무게 SRV 레코드 SSH 공개 키 SSH 공유 키 지문 SSH 공용 키: SSHFP 알고리즘 SSHFP 지문 SSHFP 지문 유형 SSHFP 레코드 검색 옵션 rootdse에서 %1$s를 위한 검색은 오류 %2$d로 실패하였습니다
DNS 전달 영역(zones)을 위한 검색. DNS 리소스를 위한 검색. DNS 존을 위한 검사 (SOA 레코드). HBAC 규칙을 검색. HBAC 서비스를 검색. IPA namingContext를 위한 검색은 오류 %d 로 실패하였습니다
HBAC 서비스 그룹을 조사합니다. 자동 적재 키를 위한 검색. 자동 적재 위치를 검색. 자동 적재 맵을 위한 검색. 등급 검색. 위임을 위한 검색. 전달 영역(zone)만을 위한 검색 사용자에 의해 등록된 호스트를 검색합니다. 이들 관리 호스트가 있는 호스트를 검색. 역할의 이들 구성원과 함께 호스트를 위한 검색. 사용자에 의해 등록되지 않은 호스트를 위한 검색. 이들 구성원 호스트와 함께 넷그룹을 검색. 이들 구성원 사용자와 함께 넷그룹을 검색. 이들 구성원 그룹이 없이 넷그룹를 위한 검색. 이들 구성원 사용자가 없는 넷그룹을 검색. HBAC 규칙의 이들 구성원이 없이 스테이지 사용자를 검색합니다. 검색 크기 제한 검색 시간 제한 두 번째 코드 초 위도 초 위도 선택기 질의를 실행 할 수 있는 IP 주소 또는 네트워크의 쌍반점(;)으로 구분된 목록 영역(zone)을 전송 할 수 있는 IP 주소 또는 네트워크의 쌍반점(;)으로 구분된 목록 일련 번호 (16 진수) 서버 "%(srv)s"는 서버 %(n)d 계약을 갖고 있습니다: 서버 %(srv)s는 서버와 연락 할 수 없습니다: %(replicas)s 서버 DNS 위치 서버 이름 서버 이름은 제공되지 않으며 사용 할 수 없습니다
서버는 DNS 전달자(s)를 점검합니다. 서버 상세: 서비스 서비스 그룹 서비스 종류 서비스 범주를 규칙에 적용합니다 서비스 그룹 이름 서비스 이름 서비스 SSH 키 설정 사용자 비밀번호를 설정합니다. 속성을 이름/값의 쌍으로 설정합니다. 형식은 attr=value입니다.
다중-값 속성을 위해, 명령은 이미 존재하는 값으로 교체합니다. 공유 저장소 현재 구성을 보여줍니다. 현재 전역 DNS 구성을 보여줍니다. 허용된 암호화 유형의 목록을 표시하고 종료 단순 바인드에 실패함
크기 크기 제한 자료 크기가 제한을 초과했습니다. 현재 저장소 자료 크기 제한은 %(limit)d B입니다 %(key)s 건너뜀 %(map)s 건너뜀 키탭 정보를 저장하려는 장소를 지정합니다. DNS 레코드를 부분으로 분할 구조화 대상 OID 하위구조 ACI를 적용 할 하위구조 하위유형 지원되는 암호화 유형:
멤버쉽 속성의 처리를 억제합니다. OTP 토큰을 동기화합니다. TA 레코드 TKEY 레코드 TLSA 인증 연관 자료 TLSA 인증 사용법 TLSA 일치 유형 TLSA 선택기 TLSA 레코드 TSIG 레코드 TXT 텍스트 자료 TXT 레코드 대상 대상 그룹 자신의 항목을 대상 (자신) ACI 구문을 시험하지만 아무 것도 작성하지 마세요 텍스트 자료 만약 서비스가 이와 같은 도메인에서 사용 할 수 없다고 판단되는 대상 호스트 또는 '.'의 도메인 이름 호스트 이름은 완전하게-검증되어야 합니다: %s
호스트 이름이 아니어야 합니다: %s
이 역(reverse) 레코드가 지시하는 호스트이름 신규 키를 (만약 존재 한다면 생성 될 것임)로 확장하는 키탭 파일. 주체를 제거하는 키탭 파일 이 유형의 zone을 위해 가장 일반적인 유형은 다음과 같습니다: %s
사용자를 위한 예제. 'jdoe'인 항목의 기본_키 값 (예제: ftp/ftp.example.com@EXAMPLE.COM)를 위해 키탭에서 가져올 주체 keytab에서 제거 할 주체 (예제: ftp/ftp.example.com@EXAMPLE.COM) 시간이 걸립니다, 잠시만 기다려주세요... 시간 제한 검색 시간 제한 (초) 유효기간 영역 정점(zone apex)에서 레코드를 위한 유효시간(TTL) 제한시간이 초과 되었습니다. 토큰 ID 형상이 끊어졌습니다 모든 결과가 반환되지 않은 경우라면 참(true) 참(True)은 작업이 성공했다는 것을 의미합니다 유형 키를 보관 할 수 없음: %s %s에서 IPA 서버를 결정 할 수 없습니다
%s의 root DN을 결정 할 수 없습니다
구성된 출력 인코딩을 사용하여 QR 코드를 표시 할 수 없습니다. 자신의 OTP 장치를 구성하려면 토큰 URI를 사용하세요 LDAP에서 SSL을 활성화 할 수 없습니다
커버러스 인증서 캐쉬를 생성 할 수 없음
ldap 라이브러리를 초기화 할 수 없습니다
호스트에 참여 할 수 없음: 커버러스 인증 캐쉬를 찾을 수 없습니다
호스에 참여 할 수 없음: 커버러스 사용자 주체를 찾을 수 없고 호스트 비밀번호가 제공되지 않았습니다.
호스트에 참여 할 수 없습니다: 커버러스 문맥 초기화가 실패하였습니다
주체를 구문 분석 할 수 없습니다
주요 이름을 구문 분석 할 수 없습니다
주체를 구문 분석 할 수 없음: %1$s (%2$d)
항목을 제거 할 수 없음
키를 검색 할 수 없음: %s IPA 서버에서 이 호스트를 등록 취소합니다 등록 취소 실패함.
등록 취소 성공.
취소되지 않음 지정되지 않음 DNS 항목 최신화 사용자 그룹 사용자 ID 사용자 범주 사용자 범주 규칙을 적용합니다 사용자 그룹 사용자 그룹 ACI가 접근 권한을 부여합니다 위임을 적용 할 사용자 그룹 사용자 비밀번호 사용자 검색 부분 수행된 동작에 대한 사용자 친화적인 설명 사용자 검색된 서버 %s를 사용하기
제공된 서버 %s 사용하기
config %s에서 서버 사용하기
저장소 비밀번호 저장소 개인 키 비밀번호를 확인합니다 주체 비밀번호를 확인합니다 수직 정밀도 경고: 유형 (#%d)를 전환하는데 실패함
경고: 임의의 비밀번호는 솔트 유형을 지원하지 않습니다 (-P 옵션 참조)
무게 파일에 인증서 쓰기 (만약 --chain이 사용된 경우 체인) YubiKey 슬롯 영역(zone) 전달자 영역(zone) 이름 영역(zone) 이름(FQDN) 영역(zone) 갱신 간격 %1$s에서 access() 실패함: errno = %2$d
basedn ber_init() 실패하고, 잘못된 제어 ?!
ber_scanf() 실패하고, kvno 찾을 수 없음 ?!
구성 파일 %s를 열 수 없습니다
단순 인증서와 파일 모두 상세화 할 수 없습니다 구성 파일 %s을 stat() 할 수 없습니다
자식 프로세서가 %d와 힘께 종료되었습니다
제거하려는 호스트의 쉼표로-구분된 목록 curl_easy_init()가 실패함
curl_easy_setopt()가 실패했습니다
curl_global_init() 가 실패함
값에 대한 curl_slist_append()가 실패했습니다: '%s'
설명 ipa-getkeytab 실행하는데 실패함, 오류번호 %d
nsupdate 형식에서 DNS 레코드를 저장하는 파일 인증서를 저장하려는 파일 파일이름 만약 호스트 이름이 DNS에 없는 경우에도 강제 NS 레코드 생성 fork() 실패함
추가하려는 그룹 제거하려는 그룹 추가하려는 호스트 그룹 제거하려는 호스트 그룹 호스트 이름 추가하려는 호스트 제거하려는 호스트 id 범위 유형 잘못된 도메인 이름 ipa-getkeytab은 잘못된 권한을 갖고 있나요?
ipa-getkeytab 찾을 수 없음
json_dumps()가 실패함
json_pack_ex() 실패함: %s
키 %(key)s가 이미 존재합니다 키탭은 매달린 심볼릭 링크와 다른 사용자에 의해 소유됩니다
krb5_kt_close %1$d: %2$s
krb5_kt_get_entry %1$d: %2$s
krb5_kt_remove_entry %1$d: %2$s
krb5_parse_name %1$d: %2$s
krb5_unparse_name %1$d: %2$s
kvno %d
맵 %(map)s이 이미 존재합니다 /etc/auto.master로 연결되지 않은 맵: 구성원 인증서 프로파일 구성원 HBAC 서비스 HBAC 서비스 그룹의 구성원 구성원 그룹 구성원 호스트 호스트 그룹 구성원 구성원 사용자 추가하려는 넷그룹 메모리 부족
비밀번호 비밀번호 정책 비밀번호 정책 만약 커버러스를 사용하지 않는 것을 사용하려는 비밀번호 보존과 보존-없음을 둘 다 설정 할 수 없습니다 주체를 찾을 수 없음
XML-RPC 응답에서 주체를 찾을 수 없습니다
python-yubico은 설치되지 않습니다. 읽기 오류
realm을 찾을 수 없음
결과는 XML-RPC 응답에서 찾을 수 없습니다
runAs 사용자 runAs 사용자 서버 역할 역 DNS 탐지를 건너뜁니다 신뢰 구성 IPA 객체(사용자, 그룹, 호스트, 호스트그룹, 서비스, 넷그룹)의 유형 url 추가하려는 사용자 제거하려는 사용자 {algo}는 지원되는 저장소 포장 알고리즘이 아닙니다