Buscar

Este contenido no está disponible en el idioma seleccionado.

5.7. Manually Unconfiguring Client Machines

download PDF
A machine may need to be removed from one IdM domain and moved to another domain or a virtual machine may be copied. There are a number of different situations where an IdM client needs to be reconfigured. The easiest solution is to uninstall the client and then configure it afresh. Use the --updatedns option, as when installing a client, to update the domain DNS configuration automatically.
[root@server ~]# ipa-client-install --uninstall --updatedns
If it is not possible to uninstall the client directly, then the IdM configuration can be manually removed from the client system.

Warning

When a machine is unenrolled, the procedure cannot be undone. The machine can only be enrolled again.
  1. On the client, remove the old hostname from the main keytab. This can be done by removing every principal in the realm or by removing specific principals. For example, to remove all principals:
    [jsmith@client ~]$ ipa-rmkeytab -k /etc/krb5.keytab -r EXAMPLE.COM
    To remove specific principals:
    [jsmith@client ~]$ ipa-rmkeytab -k /etc/krb5.keytab -p host/server.example.com@EXAMPLE.COM
  2. On the client system, disable tracking in certmonger for every certificate. Each certificate must be removed from tracking individually.
    First, list every certificate being tracked, and extract the database and nickname for each certificate. The number of certificates depends on the configured services for the host.
    [jsmith@client ~]$ ipa-getcert list
    Then, disable tracking for each. For example:
    [jsmith@client ~]$ ipa-getcert stop-tracking -n "Server-Cert" -d /etc/httpd/alias
  3. On the IdM server, remove the old host from the IdM DNS domain. While this is optional, it cleans up the old IdM entries associated with the system and allows it to be re-enrolled cleanly at a later time.
    [jsmith@server ~]$ kinit admin
    [jsmith@server ~]$ ipa host-del server.example.com
  4. If the system should be re-added to a new IdM domain — such as a virtual machine which was moved from one location to another — then the system can be rejoined to IdM using the ipa-join command on the client system.
    [jsmith@client ~]$ ipa-join
Red Hat logoGithubRedditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

© 2024 Red Hat, Inc.