6.8. Renaming Machines and Reconfiguring IPA Client Configuration

The hostname of a system is critical for the correct operation of Kerberos and SSL. Both of these security mechanisms rely on the hostname to ensure that communication is occurring between the specified hosts. Infrastructures which use virtual machines or clustered servers will commonly have hosts which are renamed because systems are copied, moved, or renamed.

Red Hat Enterprise Linux does not provide a simple rename command to facilitate the renaming of an IPA host. Renaming a host in an IPA domain involves deleting the entry in IPA, uninstalling the client software, changing the hostname, and re-enrolling using the new name. Additionally, part of renaming hosts requires regenerating service principals.

To reconfigure the client:

Identify which services are running on the machine. These need to be re-created when the machine is re-enrolled.
```
# ipa service-find server.example.com
```
Each host has a default service which does not appear in the list of services. This service can be referred to as the "host service". The service principal for the host service is host/<hostname>, such as host/server.example.com. This principal can also be referred to as the host principal.
Identify all host groups to which the machine belongs.
```
# ipa hostgroup-find server.example.com
```
Identify which of the services have certificates associated with them. This can be done using the ldapsearch command to check the entries in the IPA LDAP database directly:
```
# ldapsearch -x -b "cn=accounts,dc=example,dc=com" "(&(objectclass=ipaservice)(userCertificate=*))" krbPrincipalName
```
For any service principals (in addition to the host principal), determine the location of the corresponding keytabs on server.example.com. The keytab location is different for each service, and IPA does not store this information.
Each service on the client system has a Kerberos principal in the form service name/hostname@REALM, such as ldap/server.example.com@EXAMPLE.COM.
Unenroll the client machine from the IPA domain:
```
# ipa-client-install --uninstall
```
For each identified keytab other than /etc/krb5.keytab, remove the old principals:
```
# ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM
```
On another IPA machine, as an IPA administrator, remove the host entry. This removes all services and revokes all certificates issued for that host:
```
# ipa host-del server.example.com
```
At this point, the host is completely removed from IPA.
Rename the machine.
Re-enroll the system with IPA:
```
# ipa-client-install
```
This generates a host principal for with the new hostname in /etc/krb5.keytab.
For every service that needs a new keytab, run the following command:
```
# ipa service-add serviceName/new-hostname
```
To generate certificates for services, use either certmonger or the IPA administration tools.
Re-add the host to any applicable host groups.