40.9. Disabling and Re-enabling Host Entries

Procedure

• Disable a host using the host-disable command. Disabling a host kills the host’s current, active keytabs. For example:

  $ kinit admin
  $ ipa host-disable client.example.com

  As a result of disabling a host, the host becomes unavailable to all IdM users, hosts and services.

  重要

  Disabling a host entry not only disables that host. It disables every configured service on that host as well.

Procedure

• To re-enable a host, use the ipa-getkeytab command, adding:

  • the -s option to specify which IdM server to request the keytab from
  • the -p option to specify the principal name

  • the -k option to specify the file to which to save the keytab.

    For example, to request a new host keytab from server.example.com for client.example.com, and store the keytab in the /etc/krb5.keytab file:

    $  ipa-getkeytab -s server.example.com -p host/client.example.com -k /etc/krb5.keytab -D "cn=directory manager" -w password

    注意

    You can also use the administrator’s credentials, specifying -D "uid=admin,cn=users,cn=accounts,dc=example,dc=com". It is important that the credentials correspond to a user allowed to create the keytab for the host.

  If the ipa-getkeytab command is run on an active IdM client or server, then it can be run without any LDAP credentials (-D and -w) if the user has a TGT obtained using, for example, kinit admin. To run the command directly on the disabled host, supply LDAP credentials to authenticate to the IdM server.