commit 4c3edbd9891ef73d0ee53f982ddd841acdd65221
Author: Deon Lackey <dlackey(a)redhat.com>
Date: Tue Jun 28 17:52:35 2011 -0400
adding gid and uid information for freeipa ticket 1183
fedoradocs.db | Bin 530432 -> 530432 bytes
public_html/Sitemap | 34 +-
public_html/as-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/as-IN/opds-Fedora_Core.xml | 2 +-
.../as-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/as-IN/opds.xml | 10 +-
public_html/as-IN/toc.html | 8 +-
public_html/bg-BG/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/bg-BG/opds-Fedora_Core.xml | 2 +-
.../bg-BG/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/bg-BG/opds.xml | 10 +-
public_html/bg-BG/toc.html | 8 +-
public_html/bn-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/bn-IN/opds-Fedora_Core.xml | 2 +-
.../bn-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/bn-IN/opds.xml | 10 +-
public_html/bn-IN/toc.html | 8 +-
public_html/bs-BA/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/bs-BA/opds-Fedora_Core.xml | 2 +-
.../bs-BA/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/bs-BA/opds.xml | 10 +-
public_html/bs-BA/toc.html | 8 +-
public_html/ca-ES/opds-Fedora.xml | 14 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/ca-ES/opds-Fedora_Core.xml | 2 +-
.../ca-ES/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ca-ES/opds.xml | 10 +-
public_html/ca-ES/toc.html | 8 +-
public_html/cs-CZ/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/cs-CZ/opds-Fedora_Core.xml | 2 +-
.../cs-CZ/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/cs-CZ/opds.xml | 10 +-
public_html/cs-CZ/toc.html | 8 +-
public_html/da-DK/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/da-DK/opds-Fedora_Core.xml | 2 +-
.../da-DK/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/da-DK/opds.xml | 10 +-
public_html/da-DK/toc.html | 8 +-
public_html/de-DE/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/de-DE/opds-Fedora_Core.xml | 2 +-
.../de-DE/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/de-DE/opds.xml | 10 +-
public_html/de-DE/toc.html | 10 +-
public_html/el-GR/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/el-GR/opds-Fedora_Core.xml | 2 +-
.../el-GR/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/el-GR/opds.xml | 10 +-
public_html/el-GR/toc.html | 6 +-
.../Fedora-15-FreeIPA_Guide-en-US.epub | Bin 827209 -> 933586 bytes
.../html-single/FreeIPA_Guide/images/IPA_arch.png | Bin 62304 -> 129820 bytes
.../html-single/FreeIPA_Guide/images/IPA_arch.svg | 4075 ++++++++++++++++++++
.../Fedora/15/html-single/FreeIPA_Guide/index.html | 2863 +++++++++------
...g_Certificates_and_Certificate_Authorities.html | 42 +
...-Activating_and_Deactivating_User_Accounts.html | 22 +
.../Configuring_IPA_Users-Deleting_IPA_Users.html | 30 +
...IPA_Users-Specifying_Default_User_Settings.html | 43 +
.../Configuring_Microsoft_Windows.html | 32 +
.../Configuring_an_IPA_Client_on_AIX.html | 152 +-
.../Configuring_an_IPA_Client_on_HP_UX.html | 244 +-
...onfiguring_an_IPA_Client_on_Macintosh_OS_X.html | 190 +-
...the_IPA_Client_on_Red_Hat_Enterprise_Linux.html | 80 +
.../Configuring_an_IPA_Client_on_Solaris.html | 132 +-
.../html/FreeIPA_Guide/Document_Conventions.html | 2 +-
...nding_the_Permissions_of_IPA_Managed_Hosts.html | 57 +
...neral_Troubleshooting_Tips-Client_Problems.html | 14 +
.../Fedora/15/html/FreeIPA_Guide/Glossary.html | 6 +-
.../Installing_the_IPA_Server_Packages.html | 10 +-
.../Managing-Unique_UID_and_GID_Attributes.html | 39 +
.../Migrating_from_a_Directory_Server_to_IPA.html | 28 +-
.../Fedora/15/html/FreeIPA_Guide/Preface.html | 2 +-
.../Preparing_for_an_IPA_Installation.html | 13 +-
.../FreeIPA_Guide/Uninstalling_IPA_Servers.html | 6 +-
..._DNS-Creating_DNS_Entries_for_IPA_Replicas.html | 14 +
.../15/html/FreeIPA_Guide/active-directory.html | 8 +-
.../Fedora/15/html/FreeIPA_Guide/adding-users.html | 18 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/authz.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/automount.html | 10 +-
.../Fedora/15/html/FreeIPA_Guide/basic-usage.html | 38 +-
.../15/html/FreeIPA_Guide/certmonger-tools.html | 72 +
.../en-US/Fedora/15/html/FreeIPA_Guide/certs.html | 40 +-
...anagement_Guide-Frequently_Asked_Questions.html | 30 +-
...y_Management_Guide-Setting_up_IPA_Replicas.html | 16 +-
.../Fedora/15/html/FreeIPA_Guide/client-tools.html | 132 +
.../html/FreeIPA_Guide/config-virt-machines.html | 8 +-
.../configuring-active-directory.html | 8 +-
.../html/FreeIPA_Guide/configuring-automount.html | 24 +-
.../15/html/FreeIPA_Guide/configuring-sudo.html | 14 +-
.../15/html/FreeIPA_Guide/creating-roles.html | 11 +-
.../15/html/FreeIPA_Guide/creating-server.html | 56 +-
.../html/FreeIPA_Guide/deployment-scenarios.html | 9 +-
.../html/FreeIPA_Guide/disabling-anon-binds.html | 12 +-
.../Fedora/15/html/FreeIPA_Guide/doc-history.html | 6 +-
.../15/html/FreeIPA_Guide/editing-users.html | 14 +-
.../15/html/FreeIPA_Guide/enrolling-machines.html | 14 +-
.../Fedora/15/html/FreeIPA_Guide/feedback.html | 2 +-
.../Fedora/15/html/FreeIPA_Guide/host-groups.html | 11 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/hosts.html | 9 +-
.../15/html/FreeIPA_Guide/images/IPA_arch.png | Bin 62304 -> 129820 bytes
.../15/html/FreeIPA_Guide/images/IPA_arch.svg | 4075 ++++++++++++++++++++
.../en-US/Fedora/15/html/FreeIPA_Guide/index.html | 8 +-
.../15/html/FreeIPA_Guide/installing-ipa.html | 46 +-
.../Fedora/15/html/FreeIPA_Guide/introduction.html | 118 +-
.../Fedora/15/html/FreeIPA_Guide/ipa-apache.html | 26 +-
.../Fedora/15/html/FreeIPA_Guide/ipa-cluster.html | 30 +-
.../15/html/FreeIPA_Guide/ipa-components.html | 16 +-
.../Fedora/15/html/FreeIPA_Guide/ipa-domains.html | 46 +
.../Fedora/15/html/FreeIPA_Guide/ipa-files.html | 11 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/ix01.html | 4 +-
.../15/html/FreeIPA_Guide/kerb-policies.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/kerberos.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/logging-in.html | 25 +-
.../Fedora/15/html/FreeIPA_Guide/logging.html | 16 +-
.../15/html/FreeIPA_Guide/managing-clients.html | 22 +-
.../15/html/FreeIPA_Guide/migrintg-from-nis.html | 14 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/nis.html | 16 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/policy.html | 14 +-
.../15/html/FreeIPA_Guide/promoting-replica.html | 16 +-
.../15/html/FreeIPA_Guide/renaming-machines.html | 8 +-
.../15/html/FreeIPA_Guide/rotating-keys.html | 6 +-
.../15/html/FreeIPA_Guide/search-limits.html | 24 +-
.../Fedora/15/html/FreeIPA_Guide/searching.html | 10 +-
...Authentication-Refreshing_Kerberos_Tickets.html | 8 +-
...g_Certificates_and_Certificate_Authorities.html | 23 +-
...-Activating_and_Deactivating_User_Accounts.html | 15 +-
...e-Configuring_IPA_Users-Deleting_IPA_Users.html | 19 +-
...IPA_Users-Specifying_Default_User_Settings.html | 13 +-
...pals-Creating_and_Using_Service_Principals.html | 20 +-
...guring_the_Network_Information_Service_NIS.html | 10 +-
...neral_Troubleshooting_Tips-Client_Problems.html | 11 +-
...neral_Troubleshooting_Tips-Kerberos_Errors.html | 6 +-
...ccess_Control_Policies-HBAC_Service_Groups.html | 6 +-
...ased_Access_Control_Policies-HBAC_Services.html | 6 +-
...Implementing_Unique_UID_and_GID_Attributes.html | 17 +-
...to_IPA-Performing_a_Client_based_Migration.html | 16 +-
...to_IPA-Performing_a_Server_based_Migration.html | 20 +-
...-Prerequisites-Setting_up_Active_Directory.html | 10 +-
...ectory-Creating_Synchronization_Agreements.html | 8 +-
...ectory-Deleting_Synchronization_Agreements.html | 6 +-
...ctory-Modifying_Synchronization_Agreements.html | 10 +-
...ing_IPA_Servers-Winsync_Agreement_Failures.html | 6 +-
..._DNS-Creating_DNS_Entries_for_IPA_Replicas.html | 13 +-
...e-Working_with_certmonger-Using_certmonger.html | 6 +-
..._with_certmonger-Using_certmonger_with_IPA.html | 6 +-
..._with_certmonger-Using_certmonger_with_NSS.html | 6 +-
...y_Management_Guide-Working_with_certmonger.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/self-service.html | 11 +-
.../15/html/FreeIPA_Guide/server-config.html | 137 +-
.../Fedora/15/html/FreeIPA_Guide/server-tools.html | 432 +++
.../15/html/FreeIPA_Guide/setting-up-clients.html | 121 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/sudo.html | 14 +-
.../15/html/FreeIPA_Guide/switching-users.html | 22 +-
.../15/html/FreeIPA_Guide/tools-reference.html | 114 +
.../html/FreeIPA_Guide/uninstalling-clients.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/user-groups.html | 30 +-
.../15/html/FreeIPA_Guide/user-pwdpolicy.html | 104 +-
.../en-US/Fedora/15/html/FreeIPA_Guide/users.html | 6 +-
.../Fedora/15/html/FreeIPA_Guide/using-the-ui.html | 144 +
.../Fedora-15-FreeIPA_Guide-en-US.pdf | Bin 1193843 -> 1474094 bytes
public_html/en-US/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/en-US/opds-Fedora_Core.xml | 2 +-
.../en-US/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/en-US/opds.xml | 10 +-
public_html/en-US/toc.html | 8 +-
public_html/es-ES/opds-Fedora.xml | 30 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/es-ES/opds-Fedora_Core.xml | 2 +-
.../es-ES/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/es-ES/opds.xml | 10 +-
public_html/es-ES/toc.html | 6 +-
public_html/fa-IR/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/fa-IR/opds-Fedora_Core.xml | 2 +-
.../fa-IR/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/fa-IR/opds.xml | 10 +-
public_html/fa-IR/toc.html | 8 +-
public_html/fi-FI/opds-Fedora.xml | 14 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/fi-FI/opds-Fedora_Core.xml | 2 +-
.../fi-FI/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/fi-FI/opds.xml | 10 +-
public_html/fi-FI/toc.html | 12 +-
public_html/fr-FR/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/fr-FR/opds-Fedora_Core.xml | 2 +-
.../fr-FR/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/fr-FR/opds.xml | 10 +-
public_html/fr-FR/toc.html | 8 +-
public_html/gu-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/gu-IN/opds-Fedora_Core.xml | 2 +-
.../gu-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/gu-IN/opds.xml | 10 +-
public_html/gu-IN/toc.html | 8 +-
public_html/he-IL/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/he-IL/opds-Fedora_Core.xml | 2 +-
.../he-IL/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/he-IL/opds.xml | 10 +-
public_html/he-IL/toc.html | 8 +-
public_html/hi-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/hi-IN/opds-Fedora_Core.xml | 2 +-
.../hi-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/hi-IN/opds.xml | 10 +-
public_html/hi-IN/toc.html | 8 +-
public_html/hu-HU/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/hu-HU/opds-Fedora_Core.xml | 2 +-
.../hu-HU/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/hu-HU/opds.xml | 10 +-
public_html/hu-HU/toc.html | 8 +-
public_html/id-ID/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/id-ID/opds-Fedora_Core.xml | 2 +-
.../id-ID/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/id-ID/opds.xml | 10 +-
public_html/id-ID/toc.html | 8 +-
public_html/it-IT/opds-Fedora.xml | 16 +-
.../opds-Fedora_Contributor_Documentation.xml | 4 +-
public_html/it-IT/opds-Fedora_Core.xml | 2 +-
.../it-IT/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/it-IT/opds.xml | 10 +-
public_html/it-IT/toc.html | 14 +-
public_html/ja-JP/opds-Fedora.xml | 20 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/ja-JP/opds-Fedora_Core.xml | 2 +-
.../ja-JP/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ja-JP/opds.xml | 10 +-
public_html/ja-JP/toc.html | 8 +-
public_html/kn-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/kn-IN/opds-Fedora_Core.xml | 2 +-
.../kn-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/kn-IN/opds.xml | 10 +-
public_html/kn-IN/toc.html | 8 +-
public_html/ko-KR/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/ko-KR/opds-Fedora_Core.xml | 2 +-
.../ko-KR/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ko-KR/opds.xml | 10 +-
public_html/ko-KR/toc.html | 8 +-
public_html/ml-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/ml-IN/opds-Fedora_Core.xml | 2 +-
.../ml-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ml-IN/opds.xml | 10 +-
public_html/ml-IN/toc.html | 8 +-
public_html/mr-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/mr-IN/opds-Fedora_Core.xml | 2 +-
.../mr-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/mr-IN/opds.xml | 10 +-
public_html/mr-IN/toc.html | 8 +-
public_html/nb-NO/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/nb-NO/opds-Fedora_Core.xml | 2 +-
.../nb-NO/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/nb-NO/opds.xml | 10 +-
public_html/nb-NO/toc.html | 8 +-
public_html/nl-NL/opds-Fedora.xml | 8 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/nl-NL/opds-Fedora_Core.xml | 2 +-
.../nl-NL/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/nl-NL/opds.xml | 10 +-
public_html/nl-NL/toc.html | 6 +-
public_html/opds.xml | 86 +-
public_html/or-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/or-IN/opds-Fedora_Core.xml | 2 +-
.../or-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/or-IN/opds.xml | 10 +-
public_html/or-IN/toc.html | 8 +-
public_html/pa-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/pa-IN/opds-Fedora_Core.xml | 2 +-
.../pa-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/pa-IN/opds.xml | 10 +-
public_html/pa-IN/toc.html | 8 +-
public_html/pl-PL/opds-Fedora.xml | 22 +-
.../opds-Fedora_Contributor_Documentation.xml | 6 +-
public_html/pl-PL/opds-Fedora_Core.xml | 2 +-
.../pl-PL/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/pl-PL/opds.xml | 10 +-
public_html/pl-PL/toc.html | 10 +-
public_html/pt-BR/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/pt-BR/opds-Fedora_Core.xml | 2 +-
.../pt-BR/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/pt-BR/opds.xml | 10 +-
public_html/pt-BR/toc.html | 6 +-
public_html/pt-PT/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/pt-PT/opds-Fedora_Core.xml | 2 +-
.../pt-PT/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/pt-PT/opds.xml | 10 +-
public_html/pt-PT/toc.html | 8 +-
public_html/ru-RU/opds-Fedora.xml | 18 +-
.../opds-Fedora_Contributor_Documentation.xml | 6 +-
public_html/ru-RU/opds-Fedora_Core.xml | 2 +-
.../ru-RU/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ru-RU/opds.xml | 10 +-
public_html/ru-RU/toc.html | 10 +-
public_html/sk-SK/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/sk-SK/opds-Fedora_Core.xml | 2 +-
.../sk-SK/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/sk-SK/opds.xml | 10 +-
public_html/sk-SK/toc.html | 8 +-
public_html/sr-Latn-RS/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/sr-Latn-RS/opds-Fedora_Core.xml | 2 +-
.../sr-Latn-RS/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/sr-Latn-RS/opds.xml | 10 +-
public_html/sr-Latn-RS/toc.html | 6 +-
public_html/sr-RS/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/sr-RS/opds-Fedora_Core.xml | 2 +-
.../sr-RS/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/sr-RS/opds.xml | 10 +-
public_html/sr-RS/toc.html | 6 +-
public_html/sv-SE/opds-Fedora.xml | 18 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/sv-SE/opds-Fedora_Core.xml | 2 +-
.../sv-SE/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/sv-SE/opds.xml | 10 +-
public_html/sv-SE/toc.html | 10 +-
public_html/ta-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/ta-IN/opds-Fedora_Core.xml | 2 +-
.../ta-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/ta-IN/opds.xml | 10 +-
public_html/ta-IN/toc.html | 8 +-
public_html/te-IN/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/te-IN/opds-Fedora_Core.xml | 2 +-
.../te-IN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/te-IN/opds.xml | 10 +-
public_html/te-IN/toc.html | 8 +-
public_html/toc.html | 26 +-
public_html/uk-UA/opds-Fedora.xml | 30 +-
.../opds-Fedora_Contributor_Documentation.xml | 6 +-
public_html/uk-UA/opds-Fedora_Core.xml | 2 +-
.../uk-UA/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/uk-UA/opds.xml | 10 +-
public_html/uk-UA/toc.html | 10 +-
public_html/zh-CN/opds-Fedora.xml | 14 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/zh-CN/opds-Fedora_Core.xml | 2 +-
.../zh-CN/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/zh-CN/opds.xml | 10 +-
public_html/zh-CN/toc.html | 12 +-
public_html/zh-TW/opds-Fedora.xml | 10 +-
.../opds-Fedora_Contributor_Documentation.xml | 2 +-
public_html/zh-TW/opds-Fedora_Core.xml | 2 +-
.../zh-TW/opds-Fedora_Draft_Documentation.xml | 2 +-
public_html/zh-TW/opds.xml | 10 +-
public_html/zh-TW/toc.html | 8 +-
366 files changed, 12990 insertions(+), 3339 deletions(-)
---
diff --git a/fedoradocs.db b/fedoradocs.db
index 2e1c27f..f414530 100644
Binary files a/fedoradocs.db and b/fedoradocs.db differ
diff --git a/public_html/Sitemap b/public_html/Sitemap
index 8645c43..3c30fb8 100644
--- a/public_html/Sitemap
+++ b/public_html/Sitemap
@@ -1496,25 +1496,25 @@
</url>
<url>
<
loc>http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Guide/F...
- <lastmod>2011-06-13</lastmod>
+ <lastmod>2011-06-28</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<
loc>http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/i...
- <lastmod>2011-06-13</lastmod>
+ <lastmod>2011-06-28</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<
loc>http://docs.fedoraproject.org/en-US/Fedora/15/html-single/FreeIPA_...
- <lastmod>2011-06-13</lastmod>
+ <lastmod>2011-06-28</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/en-US/Fedora/15/pdf/FreeIPA_Guide/Fe...
- <lastmod>2011-06-13</lastmod>
+ <
loc>http://docs.fedoraproject.org/en-US/Fedora/15/pdf/FreeIPA_Guide/Dr...
+ <lastmod>2011-06-28</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
@@ -2743,7 +2743,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/en-US/Fedora/11/pdf/Security_Guide/F...
+ <
loc>http://docs.fedoraproject.org/en-US/Fedora/11/pdf/Security_Guide/f...
<lastmod>2009-11-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -3007,7 +3007,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/en-US/Fedora/8/pdf/Installation_Guid...
+ <
loc>http://docs.fedoraproject.org/en-US/Fedora/8/pdf/Installation_Guid...
<lastmod>2008-05-13</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -3175,7 +3175,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/en-US/Fedora/0.1/pdf/Amateur_Radio_G...
+ <
loc>http://docs.fedoraproject.org/en-US/Fedora/0.1/pdf/Amateur_Radio_G...
<lastmod>2010-11-16</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -3901,7 +3901,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/es-ES/Fedora/14/pdf/Software_Managem...
+ <
loc>http://docs.fedoraproject.org/es-ES/Fedora/14/pdf/Software_Managem...
<lastmod>2010-10-08</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -5317,7 +5317,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/fi-FI/Fedora/11/pdf/Fedora_Live_imag...
+ <
loc>http://docs.fedoraproject.org/fi-FI/Fedora/11/pdf/Fedora_Live_imag...
<lastmod>2010-06-14</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -5341,7 +5341,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/fi-FI/Fedora/10/pdf/Fedora_Live_Imag...
+ <
loc>http://docs.fedoraproject.org/fi-FI/Fedora/10/pdf/Fedora_Live_Imag...
<lastmod>2010-06-14</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -6541,7 +6541,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/it-IT/Fedora/13/pdf/Accessibility_Gu...
+ <
loc>http://docs.fedoraproject.org/it-IT/Fedora/13/pdf/Accessibility_Gu...
<lastmod>2010-05-22</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -9157,7 +9157,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/nl-NL/Fedora/11/pdf/Security_Guide/F...
+ <
loc>http://docs.fedoraproject.org/nl-NL/Fedora/11/pdf/Security_Guide/f...
<lastmod>2010-06-13</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -11053,7 +11053,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/pt-PT/Fedora/13/pdf/Accessibility_Gu...
+ <
loc>http://docs.fedoraproject.org/pt-PT/Fedora/13/pdf/Accessibility_Gu...
<lastmod>2010-05-22</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -11833,7 +11833,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/ru-RU/Fedora/13/pdf/Accessibility_Gu...
+ <
loc>http://docs.fedoraproject.org/ru-RU/Fedora/13/pdf/Accessibility_Gu...
<lastmod>2010-05-22</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -14149,7 +14149,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/uk-UA/Fedora/13/pdf/Accessibility_Gu...
+ <
loc>http://docs.fedoraproject.org/uk-UA/Fedora/13/pdf/Accessibility_Gu...
<lastmod>2010-05-22</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
@@ -14689,7 +14689,7 @@
<priority>0.8</priority>
</url>
<url>
- <
loc>http://docs.fedoraproject.org/zh-CN/Fedora/13/pdf/Accessibility_Gu...
+ <
loc>http://docs.fedoraproject.org/zh-CN/Fedora/13/pdf/Accessibility_Gu...
<lastmod>2010-05-22</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
diff --git a/public_html/as-IN/opds-Fedora.xml b/public_html/as-IN/opds-Fedora.xml
index 7902fa2..5954945 100644
--- a/public_html/as-IN/opds-Fedora.xml
+++ b/public_html/as-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/as-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:42</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>as-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>as-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/as-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/as-IN/opds-Fedora_Contributor_Documentation.xml
index 39947c6..6201ab1 100644
--- a/public_html/as-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/as-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/as-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/as-IN/opds-Fedora_Core.xml
b/public_html/as-IN/opds-Fedora_Core.xml
index 5ddcca8..f9a2db5 100644
--- a/public_html/as-IN/opds-Fedora_Core.xml
+++ b/public_html/as-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/as-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/as-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/as-IN/opds-Fedora_Draft_Documentation.xml
index 85caca4..f862a6c 100644
--- a/public_html/as-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/as-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/as-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/as-IN/opds.xml b/public_html/as-IN/opds.xml
index ad06e57..acf2cea 100644
--- a/public_html/as-IN/opds.xml
+++ b/public_html/as-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/as-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/as-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>as-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/as-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>as-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/as-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>as-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/as-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>as-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/as-IN/toc.html b/public_html/as-IN/toc.html
index 9edba22..b0512e6 100644
--- a/public_html/as-IN/toc.html
+++ b/public_html/as-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/bg-BG/opds-Fedora.xml b/public_html/bg-BG/opds-Fedora.xml
index 9b754c1..6a2bda3 100644
--- a/public_html/bg-BG/opds-Fedora.xml
+++ b/public_html/bg-BG/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bg-BG/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>bg-BG</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>bg-BG</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/bg-BG/opds-Fedora_Contributor_Documentation.xml
b/public_html/bg-BG/opds-Fedora_Contributor_Documentation.xml
index 2900629..4ff03d6 100644
--- a/public_html/bg-BG/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/bg-BG/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bg-BG/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bg-BG/opds-Fedora_Core.xml
b/public_html/bg-BG/opds-Fedora_Core.xml
index d16b44e..053c204 100644
--- a/public_html/bg-BG/opds-Fedora_Core.xml
+++ b/public_html/bg-BG/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bg-BG/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bg-BG/opds-Fedora_Draft_Documentation.xml
b/public_html/bg-BG/opds-Fedora_Draft_Documentation.xml
index 5337502..3673981 100644
--- a/public_html/bg-BG/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/bg-BG/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bg-BG/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bg-BG/opds.xml b/public_html/bg-BG/opds.xml
index fbb2145..5b61dd3 100644
--- a/public_html/bg-BG/opds.xml
+++ b/public_html/bg-BG/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/bg-BG/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/bg-BG/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bg-BG</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/bg-BG/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bg-BG</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/bg-BG/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bg-BG</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/bg-BG/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bg-BG</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/bg-BG/toc.html b/public_html/bg-BG/toc.html
index 23f489b..48dc8fa 100644
--- a/public_html/bg-BG/toc.html
+++ b/public_html/bg-BG/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/bn-IN/opds-Fedora.xml b/public_html/bn-IN/opds-Fedora.xml
index 629ba6b..6f7f039 100644
--- a/public_html/bn-IN/opds-Fedora.xml
+++ b/public_html/bn-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bn-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>bn-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>bn-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/bn-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/bn-IN/opds-Fedora_Contributor_Documentation.xml
index 3035dd4..742463b 100644
--- a/public_html/bn-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/bn-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bn-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bn-IN/opds-Fedora_Core.xml
b/public_html/bn-IN/opds-Fedora_Core.xml
index 4abc457..8b61fa0 100644
--- a/public_html/bn-IN/opds-Fedora_Core.xml
+++ b/public_html/bn-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bn-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bn-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/bn-IN/opds-Fedora_Draft_Documentation.xml
index e9fadf7..c053050 100644
--- a/public_html/bn-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/bn-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bn-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bn-IN/opds.xml b/public_html/bn-IN/opds.xml
index 7c5d49c..5dce3a1 100644
--- a/public_html/bn-IN/opds.xml
+++ b/public_html/bn-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/bn-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/bn-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/bn-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/bn-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/bn-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/bn-IN/toc.html b/public_html/bn-IN/toc.html
index 6a49bc9..2e08956 100644
--- a/public_html/bn-IN/toc.html
+++ b/public_html/bn-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/bs-BA/opds-Fedora.xml b/public_html/bs-BA/opds-Fedora.xml
index 92a94e4..d923cd5 100644
--- a/public_html/bs-BA/opds-Fedora.xml
+++ b/public_html/bs-BA/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bs-BA/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>bs-BA</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>bs-BA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/bs-BA/opds-Fedora_Contributor_Documentation.xml
b/public_html/bs-BA/opds-Fedora_Contributor_Documentation.xml
index 6fe614a..8a94a6e 100644
--- a/public_html/bs-BA/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/bs-BA/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bs-BA/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bs-BA/opds-Fedora_Core.xml
b/public_html/bs-BA/opds-Fedora_Core.xml
index f8327b7..d5a5a64 100644
--- a/public_html/bs-BA/opds-Fedora_Core.xml
+++ b/public_html/bs-BA/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bs-BA/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bs-BA/opds-Fedora_Draft_Documentation.xml
b/public_html/bs-BA/opds-Fedora_Draft_Documentation.xml
index 9b14e51..2a1980e 100644
--- a/public_html/bs-BA/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/bs-BA/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/bs-BA/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/bs-BA/opds.xml b/public_html/bs-BA/opds.xml
index 4b67a8d..de2a375 100644
--- a/public_html/bs-BA/opds.xml
+++ b/public_html/bs-BA/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/bs-BA/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/bs-BA/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bs-BA</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/bs-BA/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bs-BA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/bs-BA/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bs-BA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/bs-BA/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bs-BA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/bs-BA/toc.html b/public_html/bs-BA/toc.html
index 8e9c784..81cc05a 100644
--- a/public_html/bs-BA/toc.html
+++ b/public_html/bs-BA/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -618,7 +618,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ca-ES/opds-Fedora.xml b/public_html/ca-ES/opds-Fedora.xml
index 5e925ef..ef7fd4d 100644
--- a/public_html/ca-ES/opds-Fedora.xml
+++ b/public_html/ca-ES/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ca-ES/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ca-ES</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>ca-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Com utilitzar la imatge autònoma de Fedora
+ <summary>Com utilitzar la imatge autònoma de Fedora
</summary>
- <content type="text">Com utilitzar la imatge autònoma de
Fedora</content>
+ <content type="text">Com utilitzar la imatge autònoma de
Fedora</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ca-ES/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ca-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ca-ES/opds-Fedora_Contributor_Documentation.xml
b/public_html/ca-ES/opds-Fedora_Contributor_Documentation.xml
index 15bf6d1..4339d6c 100644
--- a/public_html/ca-ES/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ca-ES/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ca-ES/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ca-ES/opds-Fedora_Core.xml
b/public_html/ca-ES/opds-Fedora_Core.xml
index 06dc073..08d4580 100644
--- a/public_html/ca-ES/opds-Fedora_Core.xml
+++ b/public_html/ca-ES/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ca-ES/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ca-ES/opds-Fedora_Draft_Documentation.xml
b/public_html/ca-ES/opds-Fedora_Draft_Documentation.xml
index e4972e8..8df95f9 100644
--- a/public_html/ca-ES/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ca-ES/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ca-ES/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ca-ES/opds.xml b/public_html/ca-ES/opds.xml
index 30bcf9f..f128180 100644
--- a/public_html/ca-ES/opds.xml
+++ b/public_html/ca-ES/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ca-ES/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ca-ES/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>ca-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/ca-ES/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>ca-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ca-ES/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>ca-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ca-ES/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>ca-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ca-ES/toc.html b/public_html/ca-ES/toc.html
index dc43627..b13a05a 100644
--- a/public_html/ca-ES/toc.html
+++ b/public_html/ca-ES/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/cs-CZ/opds-Fedora.xml b/public_html/cs-CZ/opds-Fedora.xml
index e4a9bab..165a279 100644
--- a/public_html/cs-CZ/opds-Fedora.xml
+++ b/public_html/cs-CZ/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/cs-CZ/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>cs-CZ</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>cs-CZ</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/cs-CZ/opds-Fedora_Contributor_Documentation.xml
b/public_html/cs-CZ/opds-Fedora_Contributor_Documentation.xml
index 3c4e08a..2ac71e0 100644
--- a/public_html/cs-CZ/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/cs-CZ/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/cs-CZ/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/cs-CZ/opds-Fedora_Core.xml
b/public_html/cs-CZ/opds-Fedora_Core.xml
index 414875e..6a4ec8d 100644
--- a/public_html/cs-CZ/opds-Fedora_Core.xml
+++ b/public_html/cs-CZ/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/cs-CZ/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/cs-CZ/opds-Fedora_Draft_Documentation.xml
b/public_html/cs-CZ/opds-Fedora_Draft_Documentation.xml
index 1ecc7c6..84886a4 100644
--- a/public_html/cs-CZ/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/cs-CZ/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/cs-CZ/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/cs-CZ/opds.xml b/public_html/cs-CZ/opds.xml
index a273920..58a20bc 100644
--- a/public_html/cs-CZ/opds.xml
+++ b/public_html/cs-CZ/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/cs-CZ/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/cs-CZ/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>cs-CZ</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/cs-CZ/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>cs-CZ</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/cs-CZ/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>cs-CZ</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/cs-CZ/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>cs-CZ</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/cs-CZ/toc.html b/public_html/cs-CZ/toc.html
index ce60b32..f395278 100644
--- a/public_html/cs-CZ/toc.html
+++ b/public_html/cs-CZ/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/da-DK/opds-Fedora.xml b/public_html/da-DK/opds-Fedora.xml
index b5be382..febaca6 100644
--- a/public_html/da-DK/opds-Fedora.xml
+++ b/public_html/da-DK/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/da-DK/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>da-DK</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>da-DK</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/da-DK/opds-Fedora_Contributor_Documentation.xml
b/public_html/da-DK/opds-Fedora_Contributor_Documentation.xml
index 5fb0012..a246514 100644
--- a/public_html/da-DK/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/da-DK/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/da-DK/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/da-DK/opds-Fedora_Core.xml
b/public_html/da-DK/opds-Fedora_Core.xml
index fd07702..13e666e 100644
--- a/public_html/da-DK/opds-Fedora_Core.xml
+++ b/public_html/da-DK/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/da-DK/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/da-DK/opds-Fedora_Draft_Documentation.xml
b/public_html/da-DK/opds-Fedora_Draft_Documentation.xml
index a908b38..b09e6e3 100644
--- a/public_html/da-DK/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/da-DK/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/da-DK/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/da-DK/opds.xml b/public_html/da-DK/opds.xml
index 48d1303..580993e 100644
--- a/public_html/da-DK/opds.xml
+++ b/public_html/da-DK/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/da-DK/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/da-DK/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>da-DK</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/da-DK/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>da-DK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/da-DK/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>da-DK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/da-DK/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>da-DK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/da-DK/toc.html b/public_html/da-DK/toc.html
index 7b533fd..811abf2 100644
--- a/public_html/da-DK/toc.html
+++ b/public_html/da-DK/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/de-DE/opds-Fedora.xml b/public_html/de-DE/opds-Fedora.xml
index 6950f76..4c56c13 100644
--- a/public_html/de-DE/opds-Fedora.xml
+++ b/public_html/de-DE/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/de-DE/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>de-DE</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>de-DE</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/de-DE/opds-Fedora_Contributor_Documentation.xml
b/public_html/de-DE/opds-Fedora_Contributor_Documentation.xml
index afa7e2c..2451a1e 100644
--- a/public_html/de-DE/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/de-DE/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/de-DE/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/de-DE/opds-Fedora_Core.xml
b/public_html/de-DE/opds-Fedora_Core.xml
index dc2e496..6192393 100644
--- a/public_html/de-DE/opds-Fedora_Core.xml
+++ b/public_html/de-DE/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/de-DE/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/de-DE/opds-Fedora_Draft_Documentation.xml
b/public_html/de-DE/opds-Fedora_Draft_Documentation.xml
index b0bb1df..77cc6a1 100644
--- a/public_html/de-DE/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/de-DE/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/de-DE/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/de-DE/opds.xml b/public_html/de-DE/opds.xml
index e0f4486..3d95740 100644
--- a/public_html/de-DE/opds.xml
+++ b/public_html/de-DE/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/de-DE/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/de-DE/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>de-DE</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/de-DE/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>de-DE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/de-DE/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>de-DE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/de-DE/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>de-DE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/de-DE/toc.html b/public_html/de-DE/toc.html
index 1e11098..fd8a85f 100644
--- a/public_html/de-DE/toc.html
+++ b/public_html/de-DE/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -708,7 +708,7 @@
<a class="type"
href="../en-US/./Fedora/10/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/10/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/10/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.10.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.10.User_Guide.types');">
@@ -809,7 +809,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.SELinux_FAQ' class="book collapsed"
onclick="toggle(event, 'Fedora.8.SELinux_FAQ.types');">
@@ -872,7 +872,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/el-GR/opds-Fedora.xml b/public_html/el-GR/opds-Fedora.xml
index 0161c20..a0327bd 100644
--- a/public_html/el-GR/opds-Fedora.xml
+++ b/public_html/el-GR/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/el-GR/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>el-GR</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>el-GR</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/el-GR/opds-Fedora_Contributor_Documentation.xml
b/public_html/el-GR/opds-Fedora_Contributor_Documentation.xml
index 65393d4..33bee34 100644
--- a/public_html/el-GR/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/el-GR/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/el-GR/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/el-GR/opds-Fedora_Core.xml
b/public_html/el-GR/opds-Fedora_Core.xml
index 4f1d293..bd82120 100644
--- a/public_html/el-GR/opds-Fedora_Core.xml
+++ b/public_html/el-GR/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/el-GR/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/el-GR/opds-Fedora_Draft_Documentation.xml
b/public_html/el-GR/opds-Fedora_Draft_Documentation.xml
index 9d8fa37..9832864 100644
--- a/public_html/el-GR/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/el-GR/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/el-GR/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/el-GR/opds.xml b/public_html/el-GR/opds.xml
index e36fe78..7dffdbe 100644
--- a/public_html/el-GR/opds.xml
+++ b/public_html/el-GR/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/el-GR/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/el-GR/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>el-GR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/el-GR/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>el-GR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/el-GR/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>el-GR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/el-GR/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>el-GR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/el-GR/toc.html b/public_html/el-GR/toc.html
index eae3e08..b19b632 100644
--- a/public_html/el-GR/toc.html
+++ b/public_html/el-GR/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git
a/public_html/en-US/Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub
b/public_html/en-US/Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub
index b021c88..c745639 100644
Binary files
a/public_html/en-US/Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub and
b/public_html/en-US/Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub
differ
diff --git a/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.png
b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.png
index 7fc4bc1..78c6e73 100644
Binary files a/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.png
and b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.png differ
diff --git a/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.svg
b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.svg
new file mode 100644
index 0000000..5b93d60
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/images/IPA_arch.svg
@@ -0,0 +1,4075 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!-- Created with Inkscape (
http://www.inkscape.org/) -->
+<svg
+
xmlns:a="http://ns.adobe.com/AdobeSVGViewerExtensions/3.0/"
+
xmlns:ns="http://creativecommons.org/ns#"
+
xmlns:dc="http://purl.org/dc/elements/1.1/"
+
xmlns:cc="http://web.resource.org/cc/"
+
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+
xmlns:svg="http://www.w3.org/2000/svg"
+
xmlns="http://www.w3.org/2000/svg"
+
xmlns:xlink="http://www.w3.org/1999/xlink"
+
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd&q...
+
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+ width="1771.6536"
+ height="2505.1182"
+ id="svg2"
+ version="1.1"
+ inkscape:version="0.45"
+ sodipodi:docname="IPA_arch.svg"
+
inkscape:export-filename="/home/dlackey/NotBackedUp/freeipa-guide/ipa-admin/en-US/images/IPA_arch.png"
+ inkscape:export-xdpi="90"
+ inkscape:export-ydpi="90"
+ sodipodi:version="0.32"
+ inkscape:output_extension="org.inkscape.output.svg.inkscape"
+
sodipodi:docbase="/home/dlackey/NotBackedUp/freeipa-guide/ipa-admin/en-US/images"
+ sodipodi:modified="TRUE">
+ <sodipodi:namedview
+ id="base"
+ pagecolor="#ffffff"
+ bordercolor="#666666"
+ borderopacity="1.0"
+ inkscape:pageopacity="0.0"
+ inkscape:pageshadow="2"
+ inkscape:zoom="1"
+ inkscape:cx="467.40385"
+ inkscape:cy="1838.6964"
+ inkscape:document-units="px"
+ inkscape:current-layer="layer1"
+ showgrid="false"
+ inkscape:window-width="1680"
+ inkscape:window-height="975"
+ inkscape:window-x="0"
+ inkscape:window-y="25"
+ inkscape:window-maximized="1" />
+ <defs
+ id="defs4">
+ <marker
+ inkscape:stockid="TriangleInM"
+ orient="auto"
+ refY="0.0"
+ refX="0.0"
+ id="marker13197"
+ style="overflow:visible">
+ <path
+ id="path13100"
+ d="M 5.77,0.0 L -2.88,5.0 L -2.88,-5.0 L 5.77,0.0 z "
+
style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none"
+ transform="scale(-0.4)" />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow2Mend"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mend"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+ id="path4731"
+ transform="scale(0.6) rotate(180) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow1Mend"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow1Mend"
+ refX="0.0">
+ <path
+
style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+ id="path4713"
+ transform="scale(0.4) rotate(180) translate(10,0)"
+ d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+ id="path4728"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Lstart"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Lstart"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+ id="path4722"
+ transform="scale(1.1) translate(1,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart9"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart9"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#cc0000;stroke-width:0.62500000;fill:#cc0000"
+ id="path5720"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow2MendZ"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2MendZ"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#cc0000;stroke-width:0.62500000;fill:#cc0000"
+ id="path5723"
+ transform="scale(0.6) rotate(180) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7555"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7553"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7551"
+ fx="544.67078"
+ fy="121.54527"
+ gradientUnits="userSpaceOnUse"
+ cy="121.54527"
+ cx="544.67078"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(0.5604948,1.2174777,3.3361275,-0.1439944,-164.90878,-535.94519)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7549"
+ fx="-9.7009583"
+ fy="49.478912"
+ gradientUnits="userSpaceOnUse"
+ cy="49.478912"
+ cx="-9.7009583"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(-2.5380798,-1.9868115,-7.6428562,-0.5295237,895.73911,119.97539)"
/>
+ <linearGradient
+ id="linearGradient7547"
+ gradientUnits="userSpaceOnUse"
+ y2="57.699898"
+ x2="-17.546682"
+ xlink:href="#linearGradient5797"
+ y1="35.501328"
+ x1="-50.000641" />
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7545"
+ fx="548.88446"
+ fy="124.24792"
+ gradientUnits="userSpaceOnUse"
+ cy="124.24792"
+ cx="548.88446"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(-0.2726891,1.9344663,-1.6230761,-0.2287946,890.03812,-924.13616)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7543"
+ fx="-11.992359"
+ fy="49.12331"
+ gradientUnits="userSpaceOnUse"
+ cy="49.12331"
+ cx="-11.992359"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(1.2348139,-3.1568708,3.7183643,-0.8413672,374.017,118.06465)"
/>
+ <linearGradient
+ id="linearGradient7541"
+ gradientUnits="userSpaceOnUse"
+ y2="19.587532"
+ x2="-33.330555"
+ xlink:href="#linearGradient5557"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="64.869919"
+ x1="-33.330555" />
+ <linearGradient
+ id="linearGradient7539"
+ gradientUnits="userSpaceOnUse"
+ y2="57.769058"
+ x2="777.69415"
+ xlink:href="#linearGradient5931"
+ y1="67.561554"
+ x1="806.19238" />
+ <linearGradient
+ id="linearGradient7537"
+ gradientUnits="userSpaceOnUse"
+ y2="87.987663"
+ x2="553.82892"
+ xlink:href="#linearGradient8317"
+ y1="143.48891"
+ x1="498.3277" />
+ <linearGradient
+ id="linearGradient7535"
+ gradientUnits="userSpaceOnUse"
+ y2="69.928268"
+ x2="-32.08812"
+ xlink:href="#linearGradient5813"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="73.162025"
+ x1="-31.529013" />
+ <linearGradient
+ id="linearGradient7533"
+ gradientUnits="userSpaceOnUse"
+ y2="66.058411"
+ x2="-33.10799"
+ xlink:href="#linearGradient5805"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="68.874535"
+ x1="-32.349804" />
+ <linearGradient
+ id="linearGradient7531"
+ gradientUnits="userSpaceOnUse"
+ y2="57.699898"
+ x2="-17.546682"
+ xlink:href="#linearGradient5797"
+ y1="35.501328"
+ x1="-50.000641" />
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7529"
+ fx="548.88446"
+ fy="124.24792"
+ gradientUnits="userSpaceOnUse"
+ cy="124.24792"
+ cx="548.88446"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(-0.2726891,1.9344663,-1.6230761,-0.2287946,890.03812,-924.13616)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7527"
+ fx="-11.992359"
+ fy="49.12331"
+ gradientUnits="userSpaceOnUse"
+ cy="49.12331"
+ cx="-11.992359"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(1.2348139,-3.1568708,3.7183643,-0.8413672,374.017,118.06465)"
/>
+ <linearGradient
+ id="linearGradient7525"
+ gradientUnits="userSpaceOnUse"
+ y2="19.587532"
+ x2="-33.330555"
+ xlink:href="#linearGradient5557"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="64.869919"
+ x1="-33.330555" />
+ <linearGradient
+ id="linearGradient7523"
+ gradientUnits="userSpaceOnUse"
+ y2="57.769058"
+ x2="777.69415"
+ xlink:href="#linearGradient8317"
+ y1="70.580994"
+ x1="802.88586" />
+ <linearGradient
+ id="linearGradient7521"
+ gradientUnits="userSpaceOnUse"
+ y2="87.987663"
+ x2="553.82892"
+ xlink:href="#linearGradient8317"
+ y1="143.48891"
+ x1="498.3277" />
+ <linearGradient
+ id="linearGradient7519"
+ gradientUnits="userSpaceOnUse"
+ y2="66.058411"
+ x2="-33.10799"
+ xlink:href="#linearGradient5805"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="68.874535"
+ x1="-32.349804" />
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7517"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7515"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7513"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7511"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <linearGradient
+ id="linearGradient7509"
+ gradientUnits="userSpaceOnUse"
+ y2="33.083126"
+ x2="37.686401"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.5872951,1.7391712,2.827181,-0.6473735,475.35417,90.180114)"
+ y1="35.072224"
+ x1="55.874207" />
+ <linearGradient
+ id="linearGradient7507"
+ gradientUnits="userSpaceOnUse"
+ y2="36.286098"
+ x2="40.255276"
+ xlink:href="#linearGradient6478"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.187798"
+ x1="45.470558" />
+ <linearGradient
+ id="linearGradient7505"
+ gradientUnits="userSpaceOnUse"
+ y2="144.12111"
+ x2="603.7171"
+ xlink:href="#linearGradient6414"
+ y1="140.36218"
+ x1="603.25" />
+ <linearGradient
+ id="linearGradient7503"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7501"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7499"
+ gradientUnits="userSpaceOnUse"
+ y2="33.830193"
+ x2="35.096169"
+ xlink:href="#linearGradient10554"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.527008"
+ x1="48.126881" />
+ <linearGradient
+ id="linearGradient7497"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7495"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7493"
+ gradientUnits="userSpaceOnUse"
+ y2="28.369732"
+ x2="48.511173"
+ xlink:href="#linearGradient5669"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="33.643894"
+ x1="23.121851" />
+ <linearGradient
+ id="linearGradient7491"
+ gradientUnits="userSpaceOnUse"
+ y2="38.493023"
+ x2="13.912579"
+ xlink:href="#linearGradient5677"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.069866"
+ x1="19.892136" />
+ <linearGradient
+ id="linearGradient7489"
+ gradientUnits="userSpaceOnUse"
+ y2="25.829727"
+ x2="6.7207007"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="50.84045"
+ x1="16.030468" />
+ <linearGradient
+ id="linearGradient7487"
+ gradientUnits="userSpaceOnUse"
+ y2="33.722939"
+ x2="20.776503"
+ xlink:href="#linearGradient5573"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="46.597134"
+ x1="27.247866" />
+ <linearGradient
+ id="linearGradient7485"
+ gradientUnits="userSpaceOnUse"
+ y2="37.98819"
+ x2="17.47529"
+ xlink:href="#linearGradient7808"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="27.37009"
+ x1="37.260498" />
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7483"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7481"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <linearGradient
+ id="linearGradient7479"
+ gradientUnits="userSpaceOnUse"
+ y2="33.830193"
+ x2="35.096169"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.5872951,1.7391712,2.827181,-0.6473735,475.35417,64.680114)"
+ y1="36.17104"
+ x1="53.072731" />
+ <linearGradient
+ id="linearGradient7477"
+ gradientUnits="userSpaceOnUse"
+ y2="35.376236"
+ x2="44.599358"
+ xlink:href="#linearGradient6478"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,55.780107)"
+ y1="36.09766"
+ x1="41.126476" />
+ <linearGradient
+ id="linearGradient7475"
+ gradientUnits="userSpaceOnUse"
+ y2="141.11491"
+ x2="603.48352"
+ xlink:href="#linearGradient6414"
+ gradientTransform="translate(0,-29.000003)"
+ y1="145.48944"
+ x1="603.48352" />
+ <linearGradient
+ id="linearGradient7473"
+ gradientUnits="userSpaceOnUse"
+ y2="124.13597"
+ x2="610.89215"
+ xlink:href="#linearGradient6398"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7471"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7469"
+ gradientUnits="userSpaceOnUse"
+ y2="124.13597"
+ x2="610.89215"
+ xlink:href="#linearGradient6414"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7467"
+ gradientUnits="userSpaceOnUse"
+ y2="30.0221"
+ x2="42.382099"
+ xlink:href="#linearGradient5685"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,59.28011)"
+ y1="42.648251"
+ x1="42.074207" />
+ <linearGradient
+ id="linearGradient7465"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7463"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7461"
+ gradientUnits="userSpaceOnUse"
+ y2="28.369732"
+ x2="48.511173"
+ xlink:href="#linearGradient5669"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="33.643894"
+ x1="23.121851" />
+ <linearGradient
+ id="linearGradient7459"
+ gradientUnits="userSpaceOnUse"
+ y2="38.493023"
+ x2="13.912579"
+ xlink:href="#linearGradient5677"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.069866"
+ x1="19.892136" />
+ <linearGradient
+ id="linearGradient7457"
+ gradientUnits="userSpaceOnUse"
+ y2="25.829727"
+ x2="6.7207007"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="51.641129"
+ x1="17.246363" />
+ <linearGradient
+ id="linearGradient7455"
+ gradientUnits="userSpaceOnUse"
+ y2="30.312105"
+ x2="34.585835"
+ xlink:href="#linearGradient5573"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="44.46735"
+ x1="21.322929" />
+ <linearGradient
+ id="linearGradient7453"
+ gradientUnits="userSpaceOnUse"
+ y2="19.512289"
+ x2="46.277946"
+ xlink:href="#linearGradient7576"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="49.1087"
+ x1="33.149971" />
+ <linearGradient
+ id="linearGradient6398">
+ <stop
+ offset="0"
+ style="stop-color:#333333;stop-opacity:1"
+ id="stop6400" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop6402" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6392"
+ gradientUnits="userSpaceOnUse"
+ y2="33.279999"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ x1="234.81" />
+ <mask
+ id="mask7570">
+ <rect
+ style="fill:url(#linearGradient7574);fill-opacity:1"
+ id="rect7572"
+ width="86"
+ y="60.362179"
+ x="536"
+ height="111" />
+ </mask>
+ <linearGradient
+ id="linearGradient7574"
+ gradientUnits="userSpaceOnUse"
+ y2="460.97229"
+ x2="596.48529"
+ xlink:href="#linearGradient8481"
+ gradientTransform="translate(0,-337)"
+ y1="416.72614"
+ x1="596.48529" />
+ <linearGradient
+ id="linearGradient8481">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop8483" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop8485" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7576">
+ <stop
+ offset="0"
+ style="stop-color:#898989;stop-opacity:1"
+ id="stop7578" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7580" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5573">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5575" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5577" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5565">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5567" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5569" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5677">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5679" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5681" />
+ </linearGradient>
+ <filter
+ id="filter8351">
+ <feGaussianBlur
+ stdDeviation="0.21855907"
+ id="feGaussianBlur8353"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5669">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5671" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5673" />
+ </linearGradient>
+ <filter
+ height="1.0124482"
+ id="filter8323"
+ y="-0.0062240968"
+ width="1.3332899"
+ x="-0.16664496">
+ <feGaussianBlur
+ stdDeviation="0.15442502"
+ id="feGaussianBlur8325"
+ inkscape:collect="always" />
+ </filter>
+ <filter
+ id="filter10486">
+ <feGaussianBlur
+ stdDeviation="0.36649474"
+ id="feGaussianBlur10488"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient10566">
+ <stop
+ offset="0"
+ style="stop-color:#666666;stop-opacity:1"
+ id="stop10568" />
+ <stop
+ offset="1"
+ style="stop-color:#888a85;stop-opacity:0"
+ id="stop10570" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5685">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5687" />
+ <stop
+ offset="1"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5689" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6414">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop6416" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop6418" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6478">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop6480" />
+ <stop
+ offset="1"
+ style="stop-color:#d3d7cf;stop-opacity:0"
+ id="stop6482" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7359">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7361" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7363" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7808">
+ <stop
+ offset="0"
+ style="stop-color:#ababab;stop-opacity:1"
+ id="stop7810" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7812" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient10554">
+ <stop
+ offset="0"
+ style="stop-color:#a8a8a8;stop-opacity:1"
+ id="stop10556" />
+ <stop
+ offset="1"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop10558" />
+ </linearGradient>
+ <filter
+ id="filter10534">
+ <feGaussianBlur
+ stdDeviation="0.50670758"
+ id="feGaussianBlur10536"
+ inkscape:collect="always" />
+ </filter>
+ <mask
+ id="mask7729">
+ <rect
+ style="fill:url(#linearGradient7733);fill-opacity:1"
+ id="rect7731"
+ width="103.35121"
+ y="71.481766"
+ x="483.75613"
+ height="123.26292" />
+ </mask>
+ <linearGradient
+ id="linearGradient7733"
+ gradientUnits="userSpaceOnUse"
+ y2="595.06226"
+ x2="20.999998"
+ xlink:href="#linearGradient7584"
+
gradientTransform="matrix(0.9481763,0,0,0.9481763,560.55843,-440.53343)"
+ y1="539.95715"
+ x1="20.999998" />
+ <linearGradient
+ id="linearGradient7584">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7586" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7588" />
+ </linearGradient>
+ <filter
+ height="1.4388067"
+ id="filter9847"
+ y="-0.21940336"
+ width="1.2520971"
+ x="-0.12604854">
+ <feGaussianBlur
+ stdDeviation="1.7113675"
+ id="feGaussianBlur9849"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5805">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5807" />
+ <stop
+ offset="1"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5809" />
+ </linearGradient>
+ <filter
+ height="1.3127669"
+ id="filter5917"
+ y="-0.15638345"
+ width="1.1948662"
+ x="-0.09743309">
+ <feGaussianBlur
+ stdDeviation="0.60257196"
+ id="feGaussianBlur5919"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5813">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5815" />
+ <stop
+ offset="1"
+ style="stop-color:#eeeeee;stop-opacity:1"
+ id="stop5817" />
+ </linearGradient>
+ <filter
+ height="1.233731"
+ id="filter9827"
+ y="-0.11686549"
+ width="1.2466146"
+ x="-0.12330729">
+ <feGaussianBlur
+ stdDeviation="13.567379"
+ id="feGaussianBlur9829"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient8317">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop8319" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop8321" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5557">
+ <stop
+ offset="0"
+ style="stop-color:#0093d9;stop-opacity:1"
+ id="stop5559" />
+ <stop
+ offset="1"
+ style="stop-color:#7bd5ff;stop-opacity:1"
+ id="stop5561" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5541">
+ <stop
+ offset="0"
+ style="stop-color:#7bd5ff;stop-opacity:1"
+ id="stop5543" />
+ <stop
+ offset="1"
+ style="stop-color:#7bd5ff;stop-opacity:0"
+ id="stop5545" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient10494">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:0.75490195"
+ id="stop10496" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop10498" />
+ </linearGradient>
+ <filter
+ id="filter10668">
+ <feGaussianBlur
+ stdDeviation="0.40041338"
+ id="feGaussianBlur10670"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5797">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5799" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5801" />
+ </linearGradient>
+ <filter
+ id="filter8391">
+ <feGaussianBlur
+ stdDeviation="0.23516584"
+ id="feGaussianBlur8393"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5931">
+ <stop
+ offset="0"
+ style="stop-color:#a2a2a2;stop-opacity:1"
+ id="stop5933" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5935" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3766"
+ gradientUnits="userSpaceOnUse"
+ y2="412.13812"
+ x2="252.93071"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,19.68022,-347.67491)"
+ y1="411.73941"
+ x1="277.4801" />
+ <linearGradient
+ id="linearGradient3746"
+ gradientUnits="userSpaceOnUse"
+ y2="33.279999"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ x1="234.81" />
+ <filter
+ height="1.5162802"
+ id="filter3712"
+ y="-0.25814009"
+ width="1.2335186"
+ x="-0.11675928">
+ <feGaussianBlur
+ stdDeviation="2.4864777"
+ id="feGaussianBlur3714"
+ inkscape:collect="always" />
+ </filter>
+ <radialGradient
+ r="19.990965"
+ id="radialGradient3628"
+ fx="31.988766"
+ fy="61.259193"
+ gradientUnits="userSpaceOnUse"
+ cy="61.259193"
+ cx="31.988766"
+ xlink:href="#linearGradient3931"
+
gradientTransform="matrix(-5.1508322e-2,0.977161,-2.2237504,-0.1172188,164.9592,23.790713)"
/>
+ <radialGradient
+ r="24"
+ id="radialGradient3626"
+ fx="948"
+ fy="209.00021"
+ gradientUnits="userSpaceOnUse"
+ cy="209.00021"
+ cx="948"
+ xlink:href="#linearGradient7126" />
+ <linearGradient
+ id="linearGradient3624"
+ gradientUnits="userSpaceOnUse"
+ y2="41.366924"
+ x2="37.213612"
+ xlink:href="#linearGradient3534"
+ gradientTransform="matrix(0.9077599,0,0,0.9071973,3.9015111,3.6781471)"
+ y1="26.265114"
+ x1="37.213612" />
+ <linearGradient
+ id="linearGradient3622"
+ gradientUnits="userSpaceOnUse"
+ y2="39.879005"
+ x2="500.77838"
+ xlink:href="#linearGradient3335"
+
gradientTransform="matrix(0.6231149,0,0,0.7353233,-280.80293,-9.807703)"
+ y1="78.13385"
+ x1="500.77838" />
+ <radialGradient
+ r="20.016653"
+ id="radialGradient3620"
+ fx="29.256323"
+ fy="34.171967"
+ gradientUnits="userSpaceOnUse"
+ cy="34.171967"
+ cx="29.256323"
+ xlink:href="#linearGradient7126"
+ gradientTransform="matrix(1,0,0,0.4522501,0,18.71769)" />
+ <linearGradient
+ id="linearGradient3618"
+ gradientUnits="userSpaceOnUse"
+ y2="151.51437"
+ x2="605.57886"
+ xlink:href="#linearGradient16859"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="158.12231"
+ x1="599.39917" />
+ <linearGradient
+ id="linearGradient3616"
+ gradientUnits="userSpaceOnUse"
+ y2="170.16"
+ x2="613.84003"
+ xlink:href="#x5002_"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="170.77318"
+ x1="600.74371" />
+ <linearGradient
+ id="linearGradient3614"
+ gradientUnits="userSpaceOnUse"
+ y2="174.23"
+ x2="609.98999"
+ xlink:href="#x5004_"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="156.45"
+ x1="592.20001" />
+ <radialGradient
+ r="14.494606"
+ id="radialGradient3576"
+ fx="22.315165"
+ fy="28.67547"
+ gradientUnits="userSpaceOnUse"
+ cy="28.67547"
+ cx="22.315165"
+ xlink:href="#linearGradient7322"
+ gradientTransform="matrix(1.9021006,0,0,0.538973,-18.842698,6.3225458)"
/>
+ <linearGradient
+ id="linearGradient3574"
+ gradientUnits="userSpaceOnUse"
+ y2="18.02874"
+ x2="208.65283"
+ xlink:href="#XMLID_419_"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.2,-5.2)"
+ y1="37.113522"
+ x1="240.48146" />
+ <linearGradient
+ id="linearGradient3570"
+ gradientUnits="userSpaceOnUse"
+ y2="33.29771"
+ x2="212.93233"
+ xlink:href="#linearGradient7484"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.2,-5.2)"
+ y1="33.29771"
+ x1="231.07658" />
+ <linearGradient
+ id="linearGradient2466"
+ gradientUnits="userSpaceOnUse"
+ y2="383.08859"
+ x2="246.338"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,-137.09795,-315.67491)"
+ y1="382.31308"
+ x1="294.08597" />
+ <linearGradient
+ id="linearGradient2462"
+ gradientUnits="userSpaceOnUse"
+ y2="371.83398"
+ x2="257.22992"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,84.01832,-264.05611)"
+ y1="371.49814"
+ x1="277.90814" />
+ <linearGradient
+ id="linearGradient6596"
+ gradientUnits="userSpaceOnUse"
+ y2="264.5452"
+ x2="529.6897"
+ xlink:href="#linearGradient5721"
+ gradientTransform="matrix(0.944077,0,0,1.2450981,37.731315,12.80904)"
+ y1="294.61005"
+ x1="529.6897" />
+ <linearGradient
+ id="linearGradient5934"
+ gradientUnits="userSpaceOnUse"
+ y2="264.5452"
+ x2="529.6897"
+ xlink:href="#linearGradient5721"
+ gradientTransform="matrix(0.944077,0,0,1.2450981,37.731315,12.80904)"
+ y1="294.61005"
+ x1="529.6897" />
+ <linearGradient
+ id="linearGradient5932"
+ gradientUnits="userSpaceOnUse"
+ y2="311.5975"
+ x2="500.71109"
+ xlink:href="#linearGradient3518"
+
gradientTransform="matrix(1.2450981,0,0,1.2450981,-93.721513,10.007569)"
+ y1="244.95538"
+ x1="500.71109" />
+ <filter
+ height="1.2029091"
+ id="filter5126"
+ y="-0.10145455"
+ x="-0.021882353"
+ width="1.0437647">
+ <feGaussianBlur
+ stdDeviation="1.1579412"
+ id="feGaussianBlur5128"
+ inkscape:collect="always" />
+ </filter>
+ <radialGradient
+ r="265"
+ id="radialGradient4153"
+ fx="146.23947"
+ fy="830.26575"
+ gradientUnits="userSpaceOnUse"
+ cy="830.26575"
+ cx="146.23947"
+ xlink:href="#linearGradient3987"
+
gradientTransform="matrix(2.0005884,0,0,0.5009881,-214.15585,-66.462114)" />
+ <linearGradient
+ id="x5004_"
+ gradientUnits="userSpaceOnUse"
+ y2="174.23"
+ x2="609.98999"
+ gradientTransform="matrix(1.12,0,0,1.12,-649.08,-160.62)"
+ y1="156.45"
+ x1="592.20001">
+ <stop
+ offset="0"
+ style="stop-color:#d9d9d9;stop-opacity:1"
+ id="stop29157" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop29159" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#FFFFFF" />
+ </linearGradient>
+ <linearGradient
+ id="x5002_"
+ gradientUnits="userSpaceOnUse"
+ x1="601.48999"
+ x2="613.84003"
+ y1="170.16"
+ y2="170.16">
+ <stop
+ offset="0"
+ style="stop-color:#d9d9d9;stop-opacity:1"
+ id="stop29134" />
+ <stop
+ offset="0.2"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop29136" />
+ <stop
+ offset="1"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop29138" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.20"
+ style="stop-color:#FFFFFF" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#FFFFFF" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#999999" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient16859"
+ gradientUnits="userSpaceOnUse"
+ x1="592.31"
+ x2="609.32001"
+ y1="162.60001"
+ y2="145.59">
+ <stop
+ offset="0"
+ style="stop-color:#f2f2f2;stop-opacity:1"
+ id="stop16861" />
+ <stop
+ offset="1"
+ style="stop-color:#b5b5b5;stop-opacity:1"
+ id="stop16863" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#F2F2F2" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#F2F2F2" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#E5E5E5" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7126">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7128" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7130" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3335">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop3337" />
+ <stop
+ offset="1"
+ style="stop-color:#eeeeec;stop-opacity:0"
+ id="stop3339" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3534">
+ <stop
+ offset="0"
+ style="stop-color:#888a85;stop-opacity:1"
+ id="stop3536" />
+ <stop
+ offset="1"
+ style="stop-color:#888a85;stop-opacity:0"
+ id="stop3538" />
+ </linearGradient>
+ <filter
+ height="1.2617458"
+ id="filter3605"
+ y="-0.13087288"
+ x="-0.093524978"
+ width="1.18705">
+ <feGaussianBlur
+ stdDeviation="8.2187489"
+ id="feGaussianBlur3607"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient7484"
+ gradientUnits="userSpaceOnUse"
+ x1="228.35001"
+ x2="215.42999"
+ y1="33.279999"
+ y2="33.279999">
+ <stop
+ offset="0"
+ style="stop-color:#858882;stop-opacity:1"
+ id="stop7486" />
+ <stop
+ offset="0.36000001"
+ style="stop-color:#6e6f6b;stop-opacity:1"
+ id="stop3939" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7490" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#D3D3D3" />
+ </linearGradient>
+ <linearGradient
+ id="lg1900"
+ gradientUnits="userSpaceOnUse"
+ x1="228.35001"
+ x2="215.42999"
+ y1="33.279999"
+ y2="33.279999">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="s1902" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="s1906" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#D3D3D3" />
+ </linearGradient>
+ <clipPath
+ id="clipPath17035">
+ <path
+ style="opacity:1;fill:#2e3436"
+ id="path17037"
+ d="M 9,14.568887 L 9,20.015678 C 9,23.815678 15.49,26.895678
23.49,26.895678 C 31.49,26.895678 37.97,23.815678 37.97,20.015678 L 37.97,14.568887 L
9,14.568887 z" />
+ </clipPath>
+ <filter
+ height="1.3295043"
+ id="filter7696"
+ y="-0.16475213"
+ x="-0.12240516"
+ width="1.2448103">
+ <feGaussianBlur
+ stdDeviation="0.82797329"
+ id="feGaussianBlur7698"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="XMLID_419_"
+ gradientUnits="userSpaceOnUse"
+ x1="224.31"
+ x2="214.33"
+ y1="19.450001"
+ y2="11.46">
+ <stop
+ offset="0"
+ style="stop-color:#666666;stop-opacity:1"
+ id="s1903" />
+ <stop
+ offset="0.33000001"
+ style="stop-color:#6d6d6d;stop-opacity:1"
+ id="s1905" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="s1907" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#404040" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#404040" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#E9E9E9" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7322">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7324" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7326" />
+ </linearGradient>
+ <filter
+ id="filter3968">
+ <feGaussianBlur
+ stdDeviation="0.10634363"
+ id="feGaussianBlur3970"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient3931">
+ <stop
+ offset="0"
+ style="stop-color:#2e3436;stop-opacity:1"
+ id="stop3933" />
+ <stop
+ offset="1"
+ style="stop-color:#2e3436;stop-opacity:0"
+ id="stop3935" />
+ </linearGradient>
+ <filter
+ height="1.5828062"
+ id="filter16947"
+ y="-0.29140311"
+ x="-0.093153283"
+ width="1.1863066">
+ <feGaussianBlur
+ stdDeviation="1.5518534"
+ id="feGaussianBlur16949"
+ inkscape:collect="always" />
+ </filter>
+ <pattern
+ patternTransform="matrix(1.0388269,0,0,1.7996829,-2437.2069,574.63695)"
+ id="pattern18092"
+ xlink:href="#pattern2491" />
+ <pattern
+ patternTransform="matrix(0.9061767,0,0,0.9061767,-1355.2548,122.94984)"
+ id="pattern2491"
+ xlink:href="#pattern2509" />
+ <pattern
+ patternTransform="matrix(0.3312501,0,0,0.4963236,0.6164603,638.17579)"
+ id="pattern2509"
+ xlink:href="#pattern6159" />
+ <pattern
+ patternTransform="matrix(0.349912,0,0,0.5273435,0.6511897,640.41412)"
+ id="pattern6159"
+ xlink:href="#pattern4062" />
+ <pattern
+ patternTransform="matrix(0.349912,0,0,0.4713685,-128.11646,125.58505)"
+ id="pattern4062"
+ xlink:href="#pattern4015" />
+ <pattern
+ patternTransform="matrix(0.375,0,0,0.375,379,437.7952)"
+ id="pattern4015"
+ xlink:href="#white-spots" />
+ <pattern
+ height="32"
+ id="white-spots"
+ patternUnits="userSpaceOnUse"
+ patternTransform="matrix(0.375,0,0,0.375,379,400)"
+ width="32">
+ <g
+ inkscape:label="#g3035"
+ transform="translate(-484.3997,-513.505)"
+ id="white-spot">
+ <path
+ style="opacity:0.3;fill:white"
+ id="path3033"
+ sodipodi:nodetypes="czzzz"
+ d="M 509.39967,529.50504 C 509.39967,534.47304 505.36767,538.50504
500.39967,538.50504 C 495.43167,538.50504 491.39967,534.47304 491.39967,529.50504 C
491.39967,524.53704 495.43167,520.50504 500.39967,520.50504 C 505.36767,520.50504
509.39967,524.53704 509.39967,529.50504 z " />
+ </g>
+ </pattern>
+ <linearGradient
+ id="linearGradient3987">
+ <stop
+ offset="0"
+ style="stop-color:#e3dcc0;stop-opacity:0"
+ id="stop3989" />
+ <stop
+ offset="1"
+ style="stop-color:#e3dcc0;stop-opacity:1"
+ id="stop3991" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(0.4083909,0,0,0.356123,-354.11689,547.24482)"
+ id="pattern4156"
+ xlink:href="#pattern18092" />
+ <filter
+ height="1.8680604"
+ id="filter4009"
+ y="-0.43403015"
+ width="1.1872287"
+ x="-0.093614347">
+ <feGaussianBlur
+ stdDeviation="3.9786096"
+ id="feGaussianBlur4011"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient3518">
+ <stop
+ offset="0"
+ style="stop-color:#000000;stop-opacity:1"
+ id="stop3520" />
+ <stop
+ offset="1"
+ style="stop-color:#000000;stop-opacity:0"
+ id="stop3522" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6075">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop6077" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop6079" />
+ </linearGradient>
+ <marker
+ style="overflow:visible"
+ id="TriangleInM"
+ refY="0"
+ orient="auto"
+ refX="0">
+ <path
+ transform="scale(-0.5,-0.5)"
+ style="fill:#555753"
+ d="M 5.77,0 L -2.88,5 L -2.88,-5 L 5.77,0 z"
+ id="path4167" />
+ </marker>
+ <linearGradient
+ id="linearGradient5721">
+ <stop
+ offset="0"
+ style="stop-color:#ac0000;stop-opacity:1"
+ id="stop5723" />
+ <stop
+ offset="1"
+ style="stop-color:#f50606;stop-opacity:1"
+ id="stop5725" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(-0.5192722,0,0,0.2435722,255.93517,810.58927)"
+ id="pattern18096"
+ xlink:href="#pattern4829" />
+ <pattern
+
patternTransform="matrix(-0.4861985,0,0,0.2614488,-192.25611,762.71923)"
+ id="pattern4829"
+ xlink:href="#pattern2505" />
+ <pattern
+
patternTransform="matrix(-0.3479763,0,0,0.1472112,-35.000248,822.25127)"
+ id="pattern2505"
+ xlink:href="#pattern6248" />
+ <pattern
+ patternTransform="matrix(-0.3479763,0,0,0.1472112,-21.53871,822.25127)"
+ id="pattern6248"
+ xlink:href="#pattern3587" />
+ <pattern
+ patternTransform="matrix(-0.369281,0,0,0.1304123,49.607712,674.9142)"
+ id="pattern3587"
+ xlink:href="#pattern4704" />
+ <pattern
+ patternTransform="matrix(0.369281,0,0,0.167673,358.678,807.3634)"
+ id="pattern4704"
+ xlink:href="#pattern4396" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,41.1944,774.2561)"
+ id="pattern4396"
+ xlink:href="#pattern4315" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,253.6944,752.2561)"
+ id="pattern4315"
+ xlink:href="#pattern4038" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,-33.80556,922.2561)"
+ id="pattern4038"
+ xlink:href="#black-spots" />
+ <pattern
+ height="32"
+ id="black-spots"
+ patternUnits="userSpaceOnUse"
+ patternTransform="matrix(0.455007,0,0,0.455007,20.99995,116)"
+ width="32">
+ <g
+ inkscape:label="#g3039"
+ transform="translate(-448.3997,-513.505)"
+ id="black-spot">
+ <path
+ style="opacity:0.1;fill:black"
+ d="M 473.39967,529.50504 C 473.39967,534.47304 469.36767,538.50504
464.39967,538.50504 C 459.43167,538.50504 455.39967,534.47304 455.39967,529.50504 C
455.39967,524.53704 459.43167,520.50504 464.39967,520.50504 C 469.36767,520.50504
473.39967,524.53704 473.39967,529.50504 z "
+ sodipodi:nodetypes="czzzz"
+ id="path2961" />
+ </g>
+ </pattern>
+ <radialGradient
+ r="75"
+ id="radialGradient18146"
+ fx="55.217297"
+ fy="846.34479"
+ gradientUnits="userSpaceOnUse"
+ cy="846.42249"
+ cx="99.411484"
+ xlink:href="#linearGradient3579"
+
gradientTransform="matrix(1.8817339,4.3553205e-6,-8.3755671e-5,12.649087,-349.11235,-9832.1102)"
/>
+ <linearGradient
+ id="linearGradient3579">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop3581" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop3583" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(-0.4732794,0,0,0.2435722,245.17945,810.58927)"
+ id="pattern7559"
+ xlink:href="#pattern18096" />
+ <linearGradient
+ id="linearGradient4899"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5175"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5199"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5372"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5478"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart9v"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart9v"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#0093d9;stroke-width:0.62500000;fill:#0093d9"
+ id="path10095"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ </defs>
+ <metadata
+ id="metadata7">
+ <rdf:RDF>
+ <ns:Work
+ rdf:about="">
+ <dc:format>image/svg+xml</dc:format>
+ <dc:type
+
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+ <dc:title />
+ </ns:Work>
+ <cc:Work
+ rdf:about="">
+ <dc:format>image/svg+xml</dc:format>
+ <dc:type
+
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+ </cc:Work>
+ </rdf:RDF>
+ </metadata>
+ <g
+ inkscape:label="Layer 1"
+ transform="translate(0,1452.7559)"
+ inkscape:groupmode="layer"
+ id="layer1">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ transform="matrix(0.6271072,0,0,0.7145671,376.72591,-255.70746)"
+ id="g5534">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,573.78795,-1052.4741)"
+ id="g5536">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5538"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5540" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-1.685529e-2,-4.746485e-2,-0.224161,7.960202e-2,621.66584,-999.13082)"
+ id="g5542">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5544"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5546" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5548"
+
transform="matrix(-2.921073e-2,-4.103348e-2,-0.1937877,0.1379527,598.97529,-1030.6012)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5550"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5552" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,636.18656,-959.07472)"
+ id="g5554">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5556"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5558" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5560"
+
transform="matrix(5.036077e-2,8.978861e-4,-4.24042e-3,0.2378374,494.60965,-1079.7903)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5562"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5564" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.020022e-2,4.11723e-3,-1.944433e-2,0.2370792,513.08159,-1076.323)"
+ id="g5566">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g5568">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5570"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5572" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5574"
+
transform="matrix(-4.958209e-2,8.86732e-3,4.187746e-2,0.23416,451.60934,-1076.4369)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5576"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5578" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,546.6803,-1065.9821)"
+ id="g5580">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g5582">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5584"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5586" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-4.26541e-2,-2.678882e-2,0.1265148,-0.2014414,398.28257,-798.80129)"
+ id="g5588">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5590"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5592" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(1.533881e-2,4.797639e-2,0.2265768,-7.24402e-2,350.59028,-853.23898)"
+ id="g5594">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5596"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5598" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5600"
+
transform="matrix(2.921073e-2,4.103348e-2,0.1937877,-0.1379527,373.09523,-820.67414)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5602"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5604" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-8.25158e-3,-4.968827e-2,0.2346615,-3.896948e-2,337.38396,-890.70066)"
+ id="g5606">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5608"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5610" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5612"
+
transform="matrix(-5.036077e-2,-8.978861e-4,4.24042e-3,-0.2378374,477.46087,-771.4851)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5614"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5616" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.020022e-2,-4.11723e-3,1.944433e-2,-0.2370792,458.98893,-774.95242)"
+ id="g5618">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g5620">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5622"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5624" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5626"
+
transform="matrix(4.958209e-2,-8.86732e-3,-4.187746e-2,-0.23416,520.46118,-774.83848)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5628"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5630" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-4.892827e-2,-1.195983e-2,5.648239e-2,-0.2310722,425.39022,-785.29326)"
+ id="g5632">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g5634">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5636"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5638" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.1370167,0.9905687,-0.9905687,0.1370167,791.30445,-1278.2371)"
+ id="g5640">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5642"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5644"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5646" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5648"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5650"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5652" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)"
+ id="g5654">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5656"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5658" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5660"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5662"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5664" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)"
+ id="g5666">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5668"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5670" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5672"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5674"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5676"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5678" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)"
+ id="g5680">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5682"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5684" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5686"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5688"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5690"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5692" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5694"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5696"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5698" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-0.1370167,-0.9905687,0.9905687,-0.1370167,180.69554,-573.19557)"
+ id="g5700">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5702"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5704"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5706" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5708"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5710"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5712" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)"
+ id="g5714">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5716"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5718" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5720"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5722"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5724" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)"
+ id="g5726">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5728"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5730" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5732"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5734"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5736"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5738" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)"
+ id="g5740">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5742"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5744" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5746"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5748"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5750"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5752" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5754"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5756"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5758" />
+ </g>
+ </g>
+ </g>
+ <g
+ id="g5205"
+ transform="matrix(0.7656945,0,0,0.8407731,-91.12755,-100.88643)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3759"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,573.78795,-1052.4741)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3775"
+
transform="matrix(-1.685529e-2,-4.746485e-2,-0.224161,7.960202e-2,621.66584,-999.13082)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.921073e-2,-4.103348e-2,-0.1937877,0.1379527,598.97529,-1030.6012)"
+ id="g3781">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3787"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,636.18656,-959.07472)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.036077e-2,8.978861e-4,-4.24042e-3,0.2378374,494.60965,-1079.7903)"
+ id="g3835">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3841"
+
transform="matrix(5.020022e-2,4.11723e-3,-1.944433e-2,0.2370792,513.08159,-1076.323)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3875"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-4.958209e-2,8.86732e-3,4.187746e-2,0.23416,451.60934,-1076.4369)"
+ id="g3847">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3853"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,546.6803,-1065.9821)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3871"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3759-2"
+
transform="matrix(-4.26541e-2,-2.678882e-2,0.1265148,-0.2014414,398.28257,-798.80129)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-8"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3775-1"
+
transform="matrix(1.533881e-2,4.797639e-2,0.2265768,-7.24402e-2,350.59028,-853.23898)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(2.921073e-2,4.103348e-2,0.1937877,-0.1379527,373.09523,-820.67414)"
+ id="g3781-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-6"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-3" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3787-2"
+
transform="matrix(-8.25158e-3,-4.968827e-2,0.2346615,-3.896948e-2,337.38396,-890.70066)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-3"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-5.036077e-2,-8.978861e-4,4.24042e-3,-0.2378374,477.46087,-771.4851)"
+ id="g3835-1">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-3"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3841-7"
+
transform="matrix(-5.020022e-2,-4.11723e-3,1.944433e-2,-0.2370792,458.98893,-774.95242)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3875-6"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-2"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-3" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.958209e-2,-8.86732e-3,-4.187746e-2,-0.23416,520.46118,-774.83848)"
+ id="g3847-2">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-8" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3853-5"
+
transform="matrix(-4.892827e-2,-1.195983e-2,5.648239e-2,-0.2310722,425.39022,-785.29326)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3871-2"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-9"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-6" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g4029"
+
transform="matrix(0.1370167,0.9905687,-0.9905687,0.1370167,791.30445,-1278.2371)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)"
+ id="g3759-1">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-0"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)"
+ id="g3775-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-4" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3781-2"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-1"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)"
+ id="g3787-25">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-1"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-0" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3835-7"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-8"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-66" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)"
+ id="g3841-5">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g3875-3">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-2" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3847-4"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-2"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-0" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)"
+ id="g3853-2">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g3871-28">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-5"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-60" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)"
+ id="g4057">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path4059"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path4061" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g4029-2"
+
transform="matrix(-0.1370167,-0.9905687,0.9905687,-0.1370167,180.69554,-573.19557)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)"
+ id="g3759-1-8">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-0-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-6-2" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)"
+ id="g3775-7-6">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-4-7"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-4-4" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3781-2-4"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-1-5"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-1-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)"
+ id="g3787-25-3">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-1-1"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-0-9" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3835-7-1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-8-3"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-66-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)"
+ id="g3841-5-3">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g3875-3-2">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-0-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-2-5" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3847-4-5"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-2-9"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-0-2" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)"
+ id="g3853-2-2">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g3871-28-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-5-6"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-60-8" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)"
+ id="g4057-8">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path4059-0"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path4061-3" />
+ </g>
+ </g>
+ </g>
+ <g
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-803.55188)"
+ id="g3769-8">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2985-39"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3759-2"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3761-57"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect3763-1"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3765-2"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3767-8"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <g
+ transform="matrix(0.7309234,0,0,0.7309234,-1132.9133,-954.93068)"
+ id="g4113" />
+ <g
+ transform="translate(-1309.0315,-1084.2958)"
+ id="g6262" />
+ <g
+ id="g2415"
+ transform="translate(118,-135)">
+ <g
+ id="g3769"
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2985"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3759"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3761"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect3763"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3765"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3767"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text3777"
+ sodipodi:linespacing="89.999998%"
+ y="-893.63776"
+ x="85"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan3787"
+ y="-893.63776"
+ x="85">KERBEROS</tspan><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan2403"
+ y="-872.03776"
+ x="85">KDC</tspan></text>
+ </g>
+ <rect
+
style="fill:none;stroke:#000000;stroke-width:5.43862295;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect4636-0"
+ width="327.00906"
+ ry="0"
+ y="-1130.9185"
+ x="112.21931"
+ height="579.91339" />
+ <g
+ transform="translate(-284.99996,-670)"
+ id="g4694">
+ <rect
+ style="fill:#ffffff;fill-opacity:1;stroke:none"
+ id="rect4664-5"
+ width="160"
+ y="-476.63776"
+ x="406"
+ height="32" />
+ <text
+
style="font-size:25px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text4666-4"
+ sodipodi:linespacing="125%"
+ y="-453.63776"
+ x="411"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+ style="font-weight:bold;font-family:Liberation Sans"
+ id="tspan4668-7"
+ y="-453.63776"
+ x="411">IPA SERVER</tspan></text>
+ </g>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 329.024,-942.99127 L 300.976,-998.28421"
+ sodipodi:nodetypes="cc"
+ id="path4699" />
+ <g
+ id="g2427"
+ transform="translate(118,37)">
+ <g
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)"
+ id="g2429">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2431"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2433"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2435"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2437"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2439"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2441"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text2443"
+ sodipodi:linespacing="89.999998%"
+ y="-893.63776"
+ x="85"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ id="tspan2447"
+ y="-893.63776"
+ x="85">DIRECTORY</tspan><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ id="tspan2451"
+ y="-872.03776"
+ x="85">SERVER</tspan></text>
+ </g>
+ <g
+ transform="translate(118,209)"
+ id="g2453">
+ <g
+ id="g2455"
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2457"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2459"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2461"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2463"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2465"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2467"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text2469"
+ sodipodi:linespacing="89.999998%"
+ y="-885.63776"
+ x="81"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan2473"
+ y="-885.63776"
+ x="81">DNS</tspan></text>
+ </g>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:none;marker-end:url(#Arrow2MendZ);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 282.82016,-753.19511 L 315.17984,-806.08037"
+ sodipodi:nodetypes="cc"
+ id="path3458" />
+ <g
+ transform="matrix(0.5093683,0,0,0.3913042,1644.9712,-1251.712)"
+ id="g7496">
+ <use
+ id="use7494"
+ width="1000"
+ transform="translate(0,73)"
+ y="0"
+ xlink:href="#g7452"
+ x="0"
+ height="700" />
+ <g
+ style="opacity:1"
+ transform="matrix(0.8937066,0,0,0.8937066,-85.24089,192.26027)"
+ id="g7452">
+ <g
+ transform="matrix(7.659747,0,0,7.659747,-3413.2328,-6201.7396)"
+ id="g7454">
+ <g
+ transform="matrix(1.0634304,0,0,1.1520362,59.093881,903.66323)"
+ id="g7456">
+ <path
+
transform="matrix(0.1373667,0,0,0.1268015,-199.43287,-50.397161)"
+
style="opacity:1;fill:#000000;fill-opacity:1;filter:url(#filter3605)"
+ id="path14856"
+ d="M 1622.8438,458.84375 C 1566.5114,458.84375 1520.8125,482.32514
1520.8125,511.3125 C 1520.8125,511.65225 1520.8313,512.00553 1520.8438,512.34375 L
1517.3438,512.34375 L 1517.3438,555.3125 C 1517.3437,585.28059 1564.6055,609.5625
1622.8438,609.5625 C 1681.082,609.56252 1728.25,585.28059 1728.25,555.3125 L
1728.25,512.34375 L 1724.75,512.34375 C 1724.7625,512.00553 1724.7813,511.65225
1724.7812,511.3125 C 1724.7813,482.32514 1679.1762,458.84375 1622.8438,458.84375 z "
/>
+ <path
+ style="opacity:1;fill:url(#linearGradient3570)"
+ d="M 9,14.568887 L 9,20.015678 C 9,23.815678 15.49,26.895678
23.49,26.895678 C 31.49,26.895678 37.97,23.815678 37.97,20.015678 L 37.97,14.568887 L
9,14.568887 z "
+ id="path7458" />
+ <path
+ clip-path="url(#clipPath17035)"
+
style="opacity:1;fill:url(#linearGradient5372);filter:url(#filter7696)"
+ id="path7460"
+ d="M 23.078104,27.161102 C 31.078104,27.161102 37.535262,24.081102
37.535262,20.281102 L 37.535262,14.834311 C 36.15966,17.910315 29.359518,20.506549
23.683466,22.066208 C 23.731682,23.328921 15.078104,27.161102 23.078104,27.161102 z "
/>
+ <path
+ style="opacity:1;fill:url(#linearGradient3574)"
+ d="M 37.97,14.568887 C 37.97,18.368887 31.49,21.448887
23.49,21.448887 C 15.49,21.448887 9,18.368887 9,14.568887 C 9,10.768887 15.49,7.6888865
23.49,7.6888865 C 31.49,7.6888865 37.97,10.768887 37.97,14.568887 z "
+ id="path7462" />
+ <path
+
style="opacity:0.68983956;fill:none;fill-opacity:1;stroke:url(#radialGradient3576);stroke-width:0.57768553;stroke-miterlimit:4;stroke-opacity:1;filter:url(#filter3968)"
+ d="M 37.728925,14.725637 C 37.728925,18.43144 31.409556,21.43509
23.607865,21.43509 C 15.806175,21.43509 9.4770534,18.43144 9.4770534,14.725637 C
9.4770534,11.019835 15.806175,8.016182 23.607865,8.016182 C 31.409556,8.016182
37.728925,11.019835 37.728925,14.725637 z "
+ id="path7464" />
+ </g>
+ </g>
+ </g>
+ <use
+ id="use5130"
+ width="1000"
+ transform="translate(0,-79.242113)"
+ y="0"
+ xlink:href="#g7452"
+ x="0"
+ height="700" />
+ </g>
+ <rect
+
style="fill:none;stroke:#000000;stroke-width:4.1328311;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect5398"
+ width="244.31485"
+ ry="0"
+ y="-1129.2472"
+ x="550.84259"
+ height="448.21921" />
+ <g
+ transform="translate(234.27619,-667.67601)"
+ id="g5400">
+ <rect
+ style="fill:#ffffff;fill-opacity:1;stroke:none"
+ id="rect5402"
+ width="145"
+ y="-476.63776"
+ x="406"
+ height="33" />
+ <text
+
style="font-size:25px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text5404"
+ sodipodi:linespacing="125%"
+ y="-453.63776"
+ x="411"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+ style="font-weight:bold;font-family:Liberation Sans"
+ id="tspan5406"
+ y="-453.63776"
+ x="411">IPA CLIENT</tspan></text>
+ </g>
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect11007"
+ width="107"
+ height="566"
+ x="442"
+ y="-1139.6377" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 310.2762,-1055.3138 L 572.2762,-1055.3138"
+ sodipodi:nodetypes="cc"
+ id="path5452" />
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:#cc0000;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8771"
+ width="273"
+ transform="translate(0,-1452.7559)"
+ y="841.11816"
+ x="133"
+ height="57" />
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8773"
+ sodipodi:linespacing="89.999998%"
+ y="-576.63776"
+ x="148"
+ xml:space="preserve"><tspan
+
style="font-size:22px;fill:#cc0000;fill-opacity:1;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8775"
+ y="-576.63776"
+ x="148">management interface</tspan></text>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8789"
+ sodipodi:linespacing="89.999998%"
+ y="-1020.6378"
+ x="620"
+ xml:space="preserve"><tspan
+ style="font-size:24px;fill:#ffffff;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8791"
+ y="-1020.6378"
+ x="620">SSSD</tspan></text>
+ <g
+ id="g8793"
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-651.55188)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8795"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8797"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8799"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8801"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8803"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8805"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:middle;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8807"
+ sodipodi:linespacing="89.999998%"
+ y="-868.63782"
+ x="644"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;fill:#ffffff;font-family:AvantGarde"
+ id="tspan8809"
+ y="-868.63782"
+ x="644">nss_ldap</tspan></text>
+ <g
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-529.55188)"
+ id="g8811">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8813"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8815"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8817"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8819"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8821"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8823"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:middle;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8825"
+ sodipodi:linespacing="89.999998%"
+ y="-746.63782"
+ x="650"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;fill:#ffffff;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8827"
+ y="-746.63782"
+ x="650">certmonger</tspan></text>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 392.51781,-867.66656 L 573.51781,-866.66656"
+ sodipodi:nodetypes="cc"
+ id="path12002" />
+ <path
+ id="path12004"
+ sodipodi:nodetypes="ccc"
+ d="M 392.51781,-891.66656 L 509.99656,-891.01751 L
509.51781,-1055.6666"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ inkscape:connector-curvature="0" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 305.01786,-706.75326 L 549.01786,-705.75326"
+ sodipodi:nodetypes="cc"
+ id="path12006" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 411.2366,-589.73088 L 559.9979,-589.1212 L 559.2366,-680.73088"
+ sodipodi:nodetypes="ccc"
+ id="path13200" />
+ <path
+ id="path13202"
+ sodipodi:nodetypes="ccc"
+ d="M 411.77848,-572.84262 L 611.25723,-572.19357 L 610.77848,-736.8427"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ inkscape:connector-curvature="0" />
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect13204"
+ width="98"
+ height="517"
+ x="11"
+ y="-1144.6377" />
+ <rect
+ y="-1123.4711"
+ x="797.33331"
+ height="517"
+ width="106.66666"
+ id="rect14199"
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
/>
+ <text
+ xml:space="preserve"
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ x="169"
+ y="-478.63773"
+ id="text14201"
+ sodipodi:linespacing="89.999998%"><tspan
+ sodipodi:role="line"
+ id="tspan14203"
+ x="169"
+ y="-478.63773"
+ style="font-size:24px;font-family:AvantGarde">web
UI</tspan></text>
+ <text
+ xml:space="preserve"
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ x="281.741"
+ y="-479.92575"
+ id="text14205"
+ sodipodi:linespacing="89.999998%"><tspan
+ sodipodi:role="line"
+ id="tspan14207"
+ x="281.741"
+ y="-479.92575"
+
style="font-size:24px;text-align:start;text-anchor:start;font-family:AvantGarde">command-line</tspan><tspan
+ sodipodi:role="line"
+ x="281.741"
+ y="-458.32575"
+
style="font-size:24px;text-align:start;text-anchor:start;font-family:AvantGarde"
+ id="tspan14209">tools</tspan></text>
+ <path
+
style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 237,-545.16462 C 237,-502.16462 237,-502.16462 237,-502.16462"
+ id="path14219" />
+ <path
+ id="path15214"
+ d="M 289,-545.16462 C 289,-502.16462 289,-502.16462 289,-502.16462"
+
style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
/>
+ </g>
+</svg>
diff --git a/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/index.html
b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/index.html
index 5ff2833..594c0e5 100644
--- a/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/index.html
+++ b/public_html/en-US/Fedora/15/html-single/FreeIPA_Guide/index.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>FreeIPA: Identity/Policy Management</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><meta name="description" content="Identity and policy management —
for both users and machines — is a core function for almost any enterprise environment.
IPA provides a way to create an identity domain that allows machines to enroll to a domain
and immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and cl
ients. This guide is intended for IT and systems administrators." /><script
type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>FreeIPA: Identity/Policy Management</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><meta name="description" content="Identity and policy management —
for both users and machines — is a core function for almost any enterprise environment.
IPA provides a way to create an identity domain that allows machines to enroll to a domain
and immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and cl
ients. This guide is intended for IT and systems administrators." /><script
type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><div xml:lang="en-US" class="book"
id="id4078706" lang="en-US"><div
class="titlepage"><div><div
class="producttitle"><span
class="productname">Fedora</span> <span
class="productnumber">15</span></div><div><h1
id="id4078706" class="title">FreeIPA: Identity/Policy
Management</h1></div><div><h2 class="subtitle">Managing
Identity and Authorization Policies for Linux-Based Enterprise
Networks</h2></div><p class="edition">Edition
0.1</p><div><h3 class="corpauthor">
+ </script></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><div xml:lang="en-US" class="book"
id="id4831632" lang="en-US"><div
class="titlepage"><div><div
class="producttitle"><span
class="productname">Fedora</span> <span
class="productnumber">15</span></div><div><h1
id="id4831632" class="title">FreeIPA: Identity/Policy
Management</h1></div><div><h2 class="subtitle">Managing
Identity and Authorization Policies for Linux-Based Enterprise
Networks</h2></div><p class="edition">Edition
0.1</p><div><h3 class="corpauthor">
<span class="inlinemediaobject"><object
data="Common_Content/images/title_logo.svg" type="image/svg+xml">
</object></span>
- </h3></div><div><div class="authorgroup"><div
class="author"><h3 class="author"><span
class="firstname">Ella Deon</span> <span
class="surname">Lackey</span></h3><code
class="email"><a class="email"
href="mailto:dlackey@redhat.com">dlackey@redhat.com</a></code></div></div></div><hr
/><div><div id="id2970679" class="legalnotice"><h1
class="legalnotice">Legal Notice</h1><div
class="para">
+ </h3></div><div><div class="authorgroup"><div
class="author"><h3 class="author"><span
class="firstname">Ella Deon</span> <span
class="surname">Lackey</span></h3><code
class="email"><a class="email"
href="mailto:dlackey@redhat.com">dlackey@redhat.com</a></code></div></div></div><hr
/><div><div id="id3202736" class="legalnotice"><h1
class="legalnotice">Legal Notice</h1><div
class="para">
Copyright <span class="trademark"></span>© 2011 Red Hat.
</div><div class="para">
The text of and illustrations in this document are licensed by Red Hat under a Creative
Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An
explanation of CC-BY-SA is available at <a
href="http://creativecommons.org/licenses/by-sa/3.0/">http:/...;.
The original authors of this document, and Red Hat, designate the Fedora Project as the
"Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if
you distribute this document or an adaptation of it, you must provide the URL for the
original version.
@@ -26,7 +26,7 @@
All other trademarks are the property of their respective owners.
</div></div></div><div><div
class="abstract"><h6>Abstract</h6><div
class="para">
Identity and policy management — for both users and machines — is a core function for
almost any enterprise environment. IPA provides a way to create an identity domain that
allows machines to enroll to a domain and immediately access identity information reuqired
for single sign-on and authentication services, as well as policy settings that govern
authorization and access. This manual covers all aspects of installing, configuring, and
managing IPA domains, including both servers and clients. This guide is intended for IT
and systems administrators.
- </div></div></div></div><hr /></div><div
class="toc"><dl><dt><span class="preface"><a
href="#Preface">Preface</a></span></dt><dd><dl><dt><span
class="section"><a href="#audience">1. Audience and
Purpose</a></span></dt><dt><span
class="section"><a href="#Document_Conventions">2. Examples
and Formatting</a></span></dt><dd><dl><dt><span
class="section"><a href="#bracketsexamples">2.1.
Brackets</a></span></dt><dt><span
class="section"><a href="#tool-locations">2.2. Client Tool
Information</a></span></dt><dt><span
class="section"><a href="#guide-formatting">2.3. Text
Formatting and
Styles</a></span></dt></dl></dd><dt><span
class="section"><a href="#feedback">3. Giving
Feedback</a></span></dt><dt><span
class="section"><a href="#doc-history">4. Document Change
History</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#installing-ipa">1. Installing a
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Preparing_for_an_IPA_Installation">1.1. Preparin
g to Install the FreeIPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a href="#prerequisites">1.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Installing_the_IPA_Server_Packages">1.2. Installing the FreeIPA Server
Packages</a></span></dt><dt><span
class="section"><a href="#creating-server">1.3. Creating a
FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a href="#install-command">1.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a href="#install-interactive">1.3.2. Setting
up a FreeIPA Server: Basic Interactive Installation</
a></span></dt><dt><span class="section"><a
href="#install-examples">1.3.3. Examples of Creating the FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="#troubleshooting-install">1.3.4.
Troubleshooting Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="#chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">1.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a href="#installing-replica">1.4.1. Prepping
and Installing the Replica Server</a></span></dt><dt><span
class="section"><a href="#creating-the-replica">1.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a
href="#troubleshooting-replica-install">1.4.3. Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="#Uninstalling_IPA_Servers">1.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#setting-up-clients">2. Setting up
Syste
ms as FreeIPA
Clients</a></span></dt><dd><dl><dt><span
class="section"><a href="#fedora-client-setup">2.1. Setting
up a Fedora System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a href="#fedora-pkgs">2.1.1. Installing the
Client Configuration Packages and Setup
Script</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2.
Configuring Kerberos</a></span></dt><dt><span
class="section"><a
href="#fedora-Configuring_NFS_v4_with_Kerberos">2.1.3. Configuring NFS v4
with Kerberos</a></span></dt></dl></dd><dt><span
class="section"><a href="#Using_Microsoft_Windows">2.2.
Configuring a Microsoft Windows System as a FreeIPA
Client</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris">2.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA
_Client_on_Solaris_10">2.3.1. Configuring Solaris
10</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX">2.4. Configuring an HP-UX System
as a FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">2.4.1.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2.
Configuring Kerberos and PAM</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3. Configuring
SSH</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX">2.5. Configuring an AIX System as a
FreeIPA Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2.
Configuring Client Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3.
Configuring Client SSH Access</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Testing_System_Login">2.5.4. Testing
System Login</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X">2.6. Configuring a
Macintosh OS X System as a FreeIPA Client<
/a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH">2.6.5.
Accessing the FreeIPA Server Using SSH</a></span></dt><dt><span
class="section"><a
href="#Macintosh_OS_X-Configuring_System_Login">2.6.6. Configuring System
Login</a></span></dt><
/dl></dd></dl></dd><dt><span
class="chapter"><a href="#basic-usage">3. Basic
Usage</a></span></dt><dd><dl><dt><span
class="section"><a href="#using-the-ui">3.1. Using the IPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="#logging-in">3.2. Logging into the
IPA UI</a></span></dt><dt><span
class="section"><a href="#switching-users">3.3. Switching
Users</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#managing-clients">4. Managing
Clients in the FreeIPA
Domain</a></span></dt><dd><dl><dt><
span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2.
Removing Hosts from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones">4.1.3.
Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="#enrolling-machines">4.2. Enrolling
Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1.
Manual Host Enrollment with Privileged Admi
nistrator</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="#renaming-machines">4.3. Renaming
Machines</a></span></dt><dt><span
class="section"><a href="#config-virt-machines">4.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="#certs">4.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1.
Authentication Usage
Scenarios</a></span></dt></dl></dd><dt><span
class="section"><a href="#
sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems">4.6.
Client Problems</a></span></dt><dt><span
class="section"><a href="#uninstalling-clients">4.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#users">5. Identity: Managing Users
and User Groups</a></span></dt><dd><dl><dt><span
class="section"><a href="#home-directories">5.1. Managing
User Home Directories</a></span></dt><dt><span
class="section"><a href="#adding-users">5.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="#editing-users">5.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">5.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">5.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users">5.5.
Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-groups">5.6. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1.
Creating FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2.
Editing FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3.
Deleting FreeIPA Groups</a></span
</dt></dl></dd><dt><span
class="section"><a href="#user-pwdpolicy">5.7. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4.
Editing the Password Policy</a></span></dt><dt><span
class="section"><a href="#sect-Ente
rprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">5.7.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9.
Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a
href="#searching">5.8. Searching for Users and
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2.
Searching for
Groups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#kerberos">6. Identity: Using
FreeIPA for a Kerberos
Domain</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-kerberos">6.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="#kerb-policies">6.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">6.3.
Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="sectio
n"><a
href="#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">6.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">6.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="#rotating-keys">6.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">6.6.
Kerberos Errors</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#automount">7. Identity: Using
Automount</a></span></dt><dd><dl><dt><s
pan class="section"><a href="#about-automount">7.1. About
Automount and IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-automount">7.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configu
ring_Indirect_Maps">7.2.3. Configuring Indirect
Maps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4.
Links</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#active-directory">8. Identity:
Integrating with Microsoft Active
Directory</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-active-directory">8.1. About
Active Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">8.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a href="#configuring-active-directory">8.3.
Configuring Active Directory
Synchronization</a></span></dt><dt><span cl
ass="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">8.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">8.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">8.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a href="#sect-Enterprise_Identity
_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">8.7.
Winsync Agreement
Failures</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#nis">9. Identity: Integrating with
NIS Domains and
Netgroups</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-nis">9.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="#adding-netgroups">9.1.3. Adding
Netgroups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">9.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="#migrintg-from-nis">9.3. Migrating
from NIS to IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#authz">10. Policy: Configuring
Authorization</a></span></dt>
<dd><dl><dt><span class="section"><a
href="#configuring-host-access">10.1. Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">10.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">10.3.
HBAC Services</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#sudo">11. Policy: Using
sudo</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-sudo">11.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2.
Limitations of the Existing Sudo LDAP S
chema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">11.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">11.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-sudo">11.2. Configuring
sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a h
ref="#server-config">12. Configuring the IPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a href="#managing-access-to-ipa">12.1.
Defining Access Controls within
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1.
Server-side Access
Control</a></span></dt></dl></dd><dt><span
class="section"><a href="#creating-roles">12.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="#self-service">12.3. Defining
Self-Service Settings</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings">12.4.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="#search-limits">12.5. Setting
Default Search Limits</a></span></dt><dt><span
class="section"><a href="#disabling-anon-binds">12.6.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a href="#se
ct-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes">12.7.
Implementing Unique UID and GID
Attributes</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1.
Assigning UIDs and
GIDs</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities">12.8.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2.
Usin
g Your Own Certificate with Firefox</a></span></dt><dt><span
class="section"><a href="#Using_OCSP">12.8.3. Using
OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-apache">12.9. Setting an IPA
Server as an Apache Virtual Host</a></span></dt><dt><span
class="section"><a href="#ipa-cluster">12.10. Using IPA in a
Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_
DNS-Creating_DNS_Entries_for_IPA_Replicas">12.11. Creating DNS Entries for
FreeIPA Replicas</a></span></dt><dt><span
class="section"><a href="#promoting-replica">12.12. Promoting
a Read-Only Replica to an IPA Server</a></span></dt><dt><span
class="section"><a href="#logging">12.13. IPA Server
Logging</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="#chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions">A.
Frequently Asked Questions</a></span></dt><dt><span
class="appendix"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger">B.
Services: Working with
certmonger</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">B.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">B.2.
Using certmonger</a></span></dt><dt><span
class="section"><
a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">B.3.
Using certmonger with NSS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">B.4.
Using certmonger with
IPA</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="#Migrating_from_a_Directory_Server_to_IPA">C. Migrating from a
Directory Server to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">C.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">C.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">C.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a href="#sect-Enterprise_Identity_Management_Gu
ide-Overview-Possible_Scenarios">C.1.3. Possible
Scenarios</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">C.1.4.
Initial and Final States</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">C.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">C.1.6.
Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">C.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">C.2.1.
Phase 1: Migrating Existing Data to IP
A</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">C.2.2.
Phase 2: Updating the Client
Configuration</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">C.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">C.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">C.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_bas
ed_Migration">C.3. Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">C.3.1.
Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">C.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">C.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">C.3.4.
Phase 4: Reconfigure non-SSSD Clients</a></span></dt><dt><span
class="section"><a href="
#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">C.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></dd><dt><span
class="glossary"><a
href="#Glossary">Glossary</a></span></dt><dt><span
class="index"><a
href="#id2984518">Index</a></span></dt></dl></div><div
xml:lang="en-US" class="preface" id="Preface"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Preface</h1></div></div></div><div
class="para">
+ </div></div></div></div><hr /></div><div
class="toc"><dl><dt><span class="preface"><a
href="#Preface">Preface</a></span></dt><dd><dl><dt><span
class="section"><a href="#audience">1. Audience and
Purpose</a></span></dt><dt><span
class="section"><a href="#Document_Conventions">2. Examples
and Formatting</a></span></dt><dd><dl><dt><span
class="section"><a href="#bracketsexamples">2.1.
Brackets</a></span></dt><dt><span
class="section"><a href="#tool-locations">2.2. Client Tool
Information</a></span></dt><dt><span
class="section"><a href="#guide-formatting">2.3. Text
Formatting and
Styles</a></span></dt></dl></dd><dt><span
class="section"><a href="#feedback">3. Giving
Feedback</a></span></dt><dt><span
class="section"><a href="#doc-history">4. Document Change
History</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#introduction">1. Introduction to
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-v-ldap">1.1. FreeIPA v. LDAP: A
More Focused Type
of Service</a></span></dt><dt><span
class="section"><a href="#ipa-domains">1.2. About FreeIPA
Domains</a></span></dt><dd><dl><dt><span
class="section"><a href="#The_IPA_Core">1.2.1. The FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="#IPA_Managed_Hosts">1.2.2. FreeIPA
Managed Hosts</a></span></dt><dt><span
class="section"><a href="#external-work">1.2.3. Integration
with Non-Fedora
Services</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-components">1.3. Identity
Management: Authentication</a></span></dt><dt><span
class="section"><a href="#policy">1.4. Defining Policies:
Authorization</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#installing-ipa">2. Installing a
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Preparing_for_an_IPA_Installation">2.1. Preparing to Install the
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an
_IPA_Installation-Hardware_Requirements">2.1.1. Hardware
Requirements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a href="#prerequisites">2.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Installing_the_IPA_Server_Packages">2.2. Installing the FreeIPA Server
Packages</a></span></dt><dt><span
class="section"><a href="#creating-server">2.3. Creating a
FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a href="#install-command">2.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a href="#install-interactive">2.3.2. Setting
up a FreeIPA Server: Basic Interactive
Installation</a></span></dt><dt><span
class="section"><a href="#install-examples">2.3.3. Examples
of Creating the FreeIPA Server</a></span></dt><dt><span
class="se
ction"><a href="#troubleshooting-install">2.3.4. Troubleshooting
Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="#chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">2.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a href="#installing-replica">2.4.1. Prepping
and Installing the Replica Server</a></span></dt><dt><span
class="section"><a href="#creating-the-replica">2.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a
href="#troubleshooting-replica-install">2.4.3. Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="#Uninstalling_IPA_Servers">2.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#setting-up-clients">3. Setting up
Systems as FreeIPA
Clients</a></span></dt><dd><dl><dt><span
class="section"><a href="#what-happens-clients">3.1. What
Happens in Client Setup</a></span></
dt><dt><span class="section"><a
href="#Configuring_Microsoft_Windows">3.2. Configuring a Microsoft Windows
System as a FreeIPA Client</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris">3.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris_10">3.3.1. Configuring Solaris
10</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX">3.4. Configuring an HP-UX System
as a FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1. Configuring
NTP</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2.
Configuring LDAP Authe
ntication</a></span></dt><dt><span
class="section"><a
href="#Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3. Configuring
Kerberos</a></span></dt><dt><span
class="section"><a
href="#Configuring_Kerberos_and_PAM-Configuring_PAM">3.4.4. Configuring
PAM</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5. Configuring
SSH</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6.
Configuring Access Control</a></span></dt><dt><span
class="section"><a href="#hp-test">3.4.7. Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX">3.5. Configuring an AIX System as a
FreeIPA Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a href="#Configuring_an_IPA_Client_on_AIX-Conf
iguring_Client_Authentication">3.5.2. Configuring the AIX
Client</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X">3.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a href="#testing-config-on-mac">3.6.5. Test
ing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#uninstalling-clients">3.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#basic-usage">4. Basic UI
Usage</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-ui">4.1. Looking at the FreeIPA
UI</a></span></dt><dt><span class="section"><a
href="#using-the-ui">4.2. Using the FreeIPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a href="#config-browser">4.2.1. Configuring
the Browser</a></span></dt><dt><span
class="section"><a href="#logging-in">4.2.2. Logging into the
FreeIPA UI</a></span></dt><dt><span
class="section"><a
href="#Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="#Enabling_UsernamePassword_Authentication_in_Your_Browser">4.2.4.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd
<dt><span class="section"><a
href="#switching-users">4.3. Switching
Users</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#managing-clients">5. Managing
Clients in the FreeIPA
Domain</a></span></dt><dd><dl><dt><span
class="section"><a
href="#IPA_Command_Line_Tools-Working_with_DNS">5.1. Working with
DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1. Adding Hosts to a
FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">5.1.2. Removing Hosts
from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#Working_with_DNS-Managing_DNS_Zones">5.1.3. Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="#enrolling-machines">5.2. Enrolling
Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1.
Manual Host Enrollment with P
rivileged
Administrator</a></span></dt><dt><span
class="section"><a
href="#Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="#Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3. Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="#renaming-machines">5.3. Renaming
Machines</a></span></dt><dt><span
class="section"><a href="#config-virt-machines">5.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="#certs">5.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dt><span
class="section"><a
href="#General_Troubleshooting_Tips-Client_Problems">5.6. Client
Problems</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#users">6. Identity: Managing Users
and User Groups</a></span></dt><dd><dl><dt><span
class="section"><a href="#home-directories">6.1. Managing
User Home Direct
ories</a></span></dt><dt><span
class="section"><a href="#adding-users">6.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="#editing-users">6.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">6.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_IPA_Users-Specifying_Default_User_Settings">6.5.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="#search-limits">6.6. Setting Default
Search Limits</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Users-Deleting_IPA_Users">6.7. Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Deleting_IPA_Users-Using_the_Command_Line">6.7.1. Using the C
ommand Line</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-groups">6.8. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1. Creating FreeIPA
Groups</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2. Editing FreeIPA
Groups</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3. Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-pwdpolicy">6.9. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt>
<span class="section"><a
href="#The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4. Editing
the Password Policy</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6. Password
Policy Attributes</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a href
="#The_IPA_Password_Policy-Using_Local_Logins">6.9.9. Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="#searching">6.10. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Searching_for_Users_and_Groups-Searching_for_Users">6.10.1. Searching
for Users</a></span></dt><dt><span
class="section"><a
href="#Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2. Searching
for
Groups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#kerberos">7. Identity: Using
FreeIPA for a Kerberos
Domain</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-kerberos">7.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="#kerb-policies">7.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">7.3.
Creating and Using Service Principals<
/a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">7.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">7.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="#rotating-keys">7.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">7.6.
Kerberos Errors</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#automount">8. Identity:
Using Automount</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-automount">8.1. About
Automount and IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-automount">8.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a href="#sect-Enterprise_Identity_
Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4.
Links</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#active-directory">9. Identity:
Integrating with Microsoft Active
Directory</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-active-directory">9.1. About
Active Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">9.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a href="#configuring-active-directory">9.3.
Configuring Active Directo
ry Synchronization</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">9.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">9.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">9.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
clas
s="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">9.7.
Winsync Agreement
Failures</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#nis">10. Identity: Integrating with
NIS Domains and
Netgroups</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-nis">10.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="#adding-netgroups">10.1.3. Adding
Netgroups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4.
IPA Netgroup Commands</
a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">10.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="#migrintg-from-nis">10.3. Migrating
from NIS to IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#aut
hz">11. Policy: Configuring
Authorization</a></span></dt><dd><dl><dt><span
class="section"><a href="#configuring-host-access">11.1.
Configuring Host-Based Access Control</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">11.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">11.3.
HBAC Services</a></span></dt></dl></dd><dt><span
class="chapter"><a href="#sudo">12. Policy: Using
sudo</a></span></dt><dd><dl><dt><span
class="section"><a href="#about-sudo">12.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDA
P_Schema">12.1.2. Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">12.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">12.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-sudo">12.2. Configuring
sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2.
Client Configuration for Sudo Rules</a></spa
n></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="#server-config">13. Configuring the
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a href="#managing-access-to-ipa">13.1.
Defining Access Controls within
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a href="#Server_side_Access_Control">13.1.1.
Server-side Access Control</a></span></dt><dt><span
class="section"><a href="#creating-roles">13.1.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="#self-service">13.1.3. Defining
Self-Service
Settings</a></span></dt></dl></dd><dt><span
class="section"><a href="#disabling-anon-binds">13.2.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a
href="#Managing-Unique_UID_and_GID_Attributes">13.3. Managing Unique UID and
GID Number
Assignments</a></span></dt><dd><dl><dt><span
class="section"><a href="#id-ranges-at-install">13.3.1. About
ID Range Assignments During
Installation</a></span></dt><dt><span class="sect
ion"><a href="#Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2.
Adding New
Ranges</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities">13.4.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">13.4.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a href="#Using_OCSP">13.4.3. Using
OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-apache">13.5. Setting a FreeIPA
Server as an Apache Virtual Host</a></span></dt><dt><span
class="section"><a href="#ipa-cluster">13.6. Using FreeIPA in
a Cluster</a></span></dt><dd><dl><dt><span
class="sect
ion"><a
href="#Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="#Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">13.7. Creating
DNS Entries for FreeIPA Replicas</a></span></dt><dt><span
class="section"><a href="#promoting-replica">13.8. Promoting
a Read-Only Replica to a FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="#logging">13.9. FreeIPA Server
Logging</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="#chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions">A.
Frequently Asked Questions</a></span></dt><dt><span
class="appendix"><
a href="#tools-reference">B. FreeIPA Tools
Reference</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa">B.1.
ipa</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-location">B.1.1.
Location</a></span></dt><dt><span
class="section"><a href="#ipa-syntax">B.1.2.
Syntax</a></span></dt><dt><span
class="section"><a href="#ipa-commands">B.1.3.
Commands</a></span></dt><dt><span
class="section"><a href="#ipa-options">B.1.4.
Options</a></span></dt><dt><span
class="section"><a href="#ipa-command-automount">B.1.5. ipa
automountlocation*</a></span></dt><dt><span
class="section"><a href="#ipa-command-automountmap">B.1.6.
ipa automountmap*</a></span></dt><dt><span
class="section"><a href="#ipa-command-automountkey">B.1.7.
ipa
automountkey*</a></span></dt></dl></dd><dt><span
class="section"><a href="#server-tools">B.2. Server
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-compat-manage">B.2.1.
ipa-compat-manage</a></span></dt><dt><span class=
"section"><a href="#ipa-compliance">B.2.2.
ipa-compliance</a></span></dt><dt><span
class="section"><a href="#ipa-dns-install">B.2.3.
ipa-dns-install</a></span></dt><dt><span
class="section"><a href="#ipa-host-net-manage">B.2.4.
ipa-host-net-manage</a></span></dt><dt><span
class="section"><a href="#ipa_kpasswd">B.2.5.
ipa_kpasswd</a></span></dt><dt><span
class="section"><a href="#ipa-ldap-updater">B.2.6.
ipa-ldap-updater</a></span></dt><dt><span
class="section"><a href="#ipa-nis-manage">B.2.7.
ipa-nis-manage</a></span></dt><dt><span
class="section"><a href="#ipa-replica-install">B.2.8.
ipa-replica-install</a></span></dt><dt><span
class="section"><a href="#ipa-replica-manage">B.2.9.
ipa-replica-manage</a></span></dt><dt><span
class="section"><a href="#ipa-replica-prepare">B.2.10.
ipa-replica-prepare</a></span></dt><dt><span
class="section"><a href="#ipa-server-certinstall">B.2.11.
ipa-server-certinstall</a></span></dt><dt><span
class="section"><a href="#ipa-server-install">B.2
.12. ipa-server-install</a></span></dt><dt><span
class="section"><a href="#ipa-ugradeconfig">B.2.13.
ipa-upgradeconfig</a></span></dt><dt><span
class="section"><a href="#ipactl">B.2.14.
ipactl</a></span></dt></dl></dd><dt><span
class="section"><a href="#client-tools">B.3. Client
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-client-install">B.3.1.
ipa-client-install</a></span></dt><dt><span
class="section"><a href="#ipa-getkeytab">B.3.2.
ipa-getkeytab</a></span></dt><dt><span
class="section"><a href="#ipa-join">B.3.3.
ipa-join</a></span></dt><dt><span
class="section"><a href="#ipa-rmkeytab">B.3.4.
ipa-rmkeytab</a></span></dt></dl></dd><dt><span
class="section"><a href="#certmonger-tools">B.4. Certmonger
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#getcert">B.4.1.
getcert</a></span></dt><dt><span
class="section"><a href="#ipa-getcert">B.4.2.
ipa-getcert</a></span></dt></dl></dd></dl></dd><dt><span
class="appendix"><a href="#sect-E
nterprise_Identity_Management_Guide-Working_with_certmonger">C. Services: Working
with certmonger</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">C.2.
Using certmonger</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">C.3.
Using certmonger with NSS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">C.4.
Using certmonger with
IPA</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="#Migrating_from_a_Directory_Server_to_IPA">D. Migrating from a
Directory Server to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a href="#sect-En
terprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">D.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3.
Possible Scenarios</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4.
Initial and Final States</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">D.1.6.
Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">D.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1.
Phase 1: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2.
Phase 2: Updating the Client
Configuration</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a href="#sect-Enterprise_Identity_Mana
gement_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">D.3.
Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">D.3.1.
Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4.
Phase 4: Reconfigure non-SSSD Clients</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></dd><dt><span
class="glossary"><a
href="#Glossary">Glossary</a></span></dt><dt><span
class="index"><a
href="#id3103175">Index</a></span></dt></dl></div><div
xml:lang="en-US" class="preface" id="Preface"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Preface</h1></div></div></div><div
class="para">
FreeIPA is a Fedora-based way to create a security, identity, and authentication
domain. The different security and authentication protocols available to Linux and Unix
systems (like Kerberos, NIS, DNS, PAM, and sudo) are complex, unrelated, and difficult to
manage coherently, especially when combined with different identity stores.
</div><div class="para">
FreeIPA provides a layer that unifies all of these disparate services and simplifies
the administrative tasks for managing users, systems, and security. FreeIPA breaks
management down into two categories: <span
class="emphasis"><em>identity</em></span> and <span
class="emphasis"><em>policy</em></span>. It centralizes the
functions of managing the users and entities within your IT environment (identity) and
then provides a framework to define authentication and authorization for a global security
framework and user-friendly tools like single sign-on (policy).
@@ -102,19 +102,73 @@
</td></tr></table></div>
- </div></div></div><div xml:lang="en-US"
class="chapter" id="installing-ipa" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 1. Installing a FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#Preparing_for_an_IPA_Installation">1.1. Preparing to Install the
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a href="#prerequisites">1.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Installing_the_IPA_Server_Packages">1.2. Installing the FreeIPA Server
Packages</a></span></dt><dt><span
class="section"><a hre
f="#creating-server">1.3. Creating a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a href="#install-command">1.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a href="#install-interactive">1.3.2. Setting
up a FreeIPA Server: Basic Interactive
Installation</a></span></dt><dt><span
class="section"><a href="#install-examples">1.3.3. Examples
of Creating the FreeIPA Server</a></span></dt><dt><span
class="section"><a href="#troubleshooting-install">1.3.4.
Troubleshooting Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="#chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">1.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a href="#installing-replica">1.4.1. Prepping
and Installing the Replica Server</a></span></dt><dt><span
class="section"><a href="#creating-the-replica">1.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a href="#tr
oubleshooting-replica-install">1.4.3. Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="#Uninstalling_IPA_Servers">1.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></div><div
class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="introduction" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 1. Introduction to
FreeIPA</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#ipa-v-ldap">1.1. FreeIPA v. LDAP: A More Focused Type of
Service</a></span></dt><dt><span
class="section"><a href="#ipa-domains">1.2. About FreeIPA
Domains</a></span></dt><dd><dl><dt><span
class="section"><a href="#The_IPA_Core">1.2.1. The FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="#IPA_Managed_Hosts">1.2.2. FreeIPA
Managed Hosts</a></span></dt><dt><span
class="section"><a href="#external-work">1.2.3. Integration
with Non-Fedora
Services</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-components">1.3. Identity
Management: Authentication</a></span></dt><dt><span
class="section"><a href="#policy">1.4. Defining Policies:
Authorization</a></span></dt></dl></div><div
class="para">
+ XXXXX introXXXXXXXX
+ </div><div class="para">
+ FreeIPA is an integrated security information management solution which combines
Fedora, 389 Directory Server, MIT Kerberos, DNS, Certificate System CA, and NTP. Its
numerous administration tools allow an administrator to quickly install, set up, and
administer servers for centralized authentication and identity management. FreeIPA also
supports for host identities, netgroups, automount by location and other features.
+ </div><div class="para">
+ FreeIPA focuses on making centralized identity and policy easy to manage in Linux and
Unix environments and includes interoperability with the Windows environment.
+ </div><div class="section" id="ipa-v-ldap"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-v-ldap">1.1. FreeIPA v. LDAP: A More Focused Type of
Service</h2></div></div></div><div class="para">
+ XXXXXXXXXX fix me XXXXXXXX
+ </div><div class="para">
+ For efficiency, compliance and risk mitigation, organizations need to centrally manage
and correlate vital security information including: * Identity (machine, user, virtual
machines, groups, authentication credentials) * Policy (host based access control, sudo)
Because of its vital importance and the way it is interrelated, we think identity, policy,
and audit information should be open, interoperable, and manageable. Our focus is on
making identity, policy, and audit (some day) easy to centrally manage for the Linux and
Unix world. Of course, we will need to interoperate well with Windows and much more. We
are looking to take concrete and useful steps and so have chosen initially to focus on
Identity solutions for the Unix/Linux world. For policy we focus on the host based access
control management and enforcement. As for other aspects of the policy management related
to systems management and configuration management, after serious evaluation we decided
not to address
these segments for now. There are other projects that are working in this direction. We
will closely monitor those projects and integrate with them as interfaces become
available. We did a lot of research and evaluation in the audit area and realized that
this is a significant effort and might require a project of its own. For now we decided
not to disperse our energy and work more on improving the identity and authentication
aspects of the system. But we will continue to monitor open source projects in the audit
related space. One of such projects that was created as a result of our evaluation is
ELAPI. We will continue investing into that project.
+ </div><div class="para">
+ What are the problems freeIPA is trying to solve? * Focus on solving identity
management across the enterprise providing a reliable open source alternative to existing
solutions * Vendor focus on Web identity management problems has meant less well developed
solutions for central management of the Linux and Unix world's vital security info.
Organizations are forced to maintain a hodgepodge of internal and proprietary solutions at
high TCO. * Proprietary security products don't easily provide access to the vital
security information they collect or manage. This makes it difficult to synchronize and
analyze effectively.
+ </div></div><div class="section"
id="ipa-domains"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-domains">1.2. About FreeIPA
Domains</h2></div></div></div><div class="para">
+ XXXXXXXXXX fix me XXXXXXXX
+ </div><div class="para">
+ FreeIPA is broken down into three main components: the FreeIPA server and the FreeIPA
client.
+ </div><div class="figure"
id="figHigh_level_IPA_Architecture"><div
class="figure-contents"><div class="mediaobject"><img
src="images/IPA_arch.png" width="600" alt="FreeIPA
Interactions" /></div></div><h6>Figure 1.1. FreeIPA
Interactions</h6></div><br class="figure-break" /><div
class="section" id="The_IPA_Core"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Core">1.2.1. The FreeIPA
Server</h3></div></div></div><div class="para">
+ The FreeIPA core consists of the servers, services, and other utilities necessary to
provide the fundamental FreeIPA functionality. This includes the management framework, the
directory server, the KDC, the web server, and the DNS.
+ </div><div class="formalpara"
id="The_IPA_Core-Kerberos_KDC"><h5
class="formalpara">Kerberos KDC</h5>
+ The Kerberos KDC is the Kerberos authentication server, and provides authentication
services for users, hosts, and services. It stores its data in the directory server.
+ </div><div class="para">
+ What is Kerberos? Kerberos is a network authentication protocol created by MIT, and
uses symmetric-key cryptography to authenticate users to network services, which means
that passwords are never actually sent over the network. Consequently, when users
authenticate to network services using Kerberos, unauthorized users attempting to gather
passwords by monitoring network traffic are effectively thwarted. The primary design goal
of Kerberos is to eliminate the transmission of unencrypted passwords across the network.
If used properly, Kerberos effectively eliminates the threat that packet sniffers would
otherwise pose on a network. [edit] How IPA and Kerberos Work Together The IPA
implementation of Kerberos differs from a typical Kerberos implementation mainly in that
it uses Directory Server to store data instead of a flat file. Access control is also
provided by the directory. The IPA Kerberos implementation does not use the native tools
because by default the KDC is no
t aware of Directory Server. IPA provides its own set of tools for working with Kerberos.
Kerberos' native tools, for example, those provided by kadmin.local, should not be
used. For many reasons, kadmin.local does not currently have permission to operate outside
of cn=kerberos. One reason is that it does not understand LDAP, which means that you
cannot create principals where you want. Another reason is that it cannot proxy a password
change to the IPA plugin. Consequently, if a password change is performed via
kadmin.local, then the user entry would be corrupted. Image:Note.png Note: It is highly
recommended that you avoid the use of kadmin and kadmin.local in an IPA deployment. [edit]
IPA, Kerberos, and Service Principals A Service Principal is needed by a server program in
order to perform Kerberos authentication. Kerberos authentication works by obtaining an
encrypted ticket for a service, a ticket that only the service can decrypt (and therefore
verify that the user ob
tained it from the KDC, indirectly proving that the client was able to authenticate to
the KDC and is therefore trustworthy). The Service Principal is therefore needed to make
it possible for the client to tell the KDC which service it needs a ticket for, and for
the KDC to be able to store and provide a secret to the service at the moment the Service
Principal is created. Service Principals are typically released per service, although it
is possible for one Service Principal to be used for more services. For example,
host/fqdn@REALM is used for both the SSH service and also as the generic "host"
principal. [edit] IPA, Kerberos, and DNS As discussed in How IPA and DNS Work Together,
IPA relies heavily on a fully-functional DNS for correct operation. Because of its tight
integration with IPA, Kerberos also requires that the DNS be configured correctly. Using
CNAME and A Records When Kerberos requests a ticket to begin authentication, it will
always resolve a CNAME to its corr
esponding A record; Kerberos libraries will never use a CNAME to ask for a ticket. This
means that when you create service or host principals you need to use the host A record.
For example, consider the following zone file entry: CNAME
www.example.com -> A
name
web-01.example.com If you use the following command to connect to the host via SSH
and want GSSAPI authentication: $ ssh
www.example.com it will actually request a ticket
for host/web-01.example.com(a)EXAMPLE.COM This is the service principal that you must use to
obtain and save tickets in /etc/krb5.keytab for this host.
+ </div><div class="formalpara"
id="Directory_Server"><h5 class="formalpara">Directory
Server</h5>
+ The directory server is the core storage system of the FreeIPA server. The directory
server stores all of the information about user accounts used by the KDC for
authentication, groups, hosts, services, netgroups and policy information. If configured
and used, DNS uses the same instance of the directory server to store DNS information. The
directory server provides a multi-master replication capability so that multiple FreeIPA
replicas can be deployed.
+ </div><div class="para">
+ FDS is an integral part of IPA. In freeIPA, FDS serves as the data store, maintaining
all of an organization's information. The Directory Server also controls access to all
directory information; IPA users are restricted in the level of access they have to FDS
information by the controls in place within FDS itself. FDS access control cannot be
overridden by permissions, delegations, or other controls in IPA.
+ </div><div class="formalpara"><h5
class="formalpara" id="id3133226">DNS</h5>
+ The DNS is the Domain Name Service. This is an optional component that can be
installed and configured at any time. Alternatively, an existing DNS server can be used.
In this case, however, there will be no tight integration between DNS management and the
management of hosts that FreeIPA provides.
+ </div><div class="para">
+ What is DNS? A Domain Name Service (DNS) associates hostnames with their respective
IP addresses, so that when users want to connect to other machines on the network, they
can refer to them by name, without having to remember IP addresses. DNS is normally
implemented using centralized servers that are authoritative for some domains and refer to
other DNS servers for other domains. [edit] How IPA and DNS Work Together IPA clients
find, or discover, IPA servers using a process known as Service Discovery. This can occur
automatically, using DNS, or manually, by entering the IPA server details during the
client configuration phase. [edit] Service Discovery using DNS The recommended method for
ensuring that IPA clients discover IPA servers is via DNS. This requires adding special
records to the DNS configuration. The IPA Server installation generates a sample zone file
which contains sample records for this purpose. In particular, it includes records for the
LDAP servers, Ker
beros realm, and Kerberos servers required in an IPA deployment. These records can be
added to an existing DNS infrastructure - even one hosted on a different OS - or they can
be added to a new DNS server if one does not already exist. The following is an extract
from a zone file where the IPA server, KDC, and DNS server all exist on the same machine
(ipaserver) in the realm
EXAMPLE.COM: ; ldap servers _ldap._tcp IN SRV 0 100 389 ipaserver
;kerberos realm _kerberos IN TXT
EXAMPLE.COM ; kerberos servers _kerberos._tcp IN SRV 0
100 88 ipaserver _kerberos._udp IN SRV 0 100 88 ipaserver _kerberos-master._tcp IN SRV 0
100 88 ipaserver _kerberos-master._udp IN SRV 0 100 88 ipaserver _kpasswd._tcp IN SRV 0
100 464 ipaserver _kpasswd._udp IN SRV 0 100 464 ipaserver If you already have DNS
configured on your network, you can add this to the existing zone file (in this example,
/var/named/example.com.zone.db) so that the IPA clients know where to find the LDAP and
Kerberos servers. Cl
ients will attempt to discover the IPA server first using parameters passed via the
command line, then using the configuration file (/etc/ipa/ipa.conf), and then via DNS.
[edit] Service Discovery without using DNS It is possible, but not recommended, to operate
without these records. If you do not use DNS for service discovery, then your clients will
not automatically find other IPA services in a high-availability setup. During an IPA
client installation, if you do not have DNS correctly configured so that the client can
discover the IPA server, you will need to enter the appropriate information manually.
[edit] Using IPA with Multi-Homed Machines Some of the machines in your IPA deployment may
support multiple Network Interface Cards (NICs). This is often the case for servers or
other machines where high availability or failover is required. These muti-homed machines
will typically have multiple IPs all assigned to the same hostname. Normally this will not
cause any issues
for IPA, as it listens on all available interfaces except localhost. The KDC does not
listen on this interface; it only listens to the machine's public IP addresses. For a
server that has multiple NICs and IP addresses, you need to configure the DNS with the
appropriate A records if the IPA server is to be available via any NIC. For example, the
zone file on the DNS server might have the following A records for an IPA server
(
ipaserver.example.com) with three NICs: ipaserver IN A 192.168.1.100 ipaserver IN A
192.168.1.101 ipaserver IN A 192.168.1.102 This allows IPA clients to discover the IPA
server using any of the available network interfaces.
+ </div><div class="formalpara" id="NTP"><h5
class="formalpara">NTP</h5>
+ NTP is an optional service, but can be enabled on the FreeIPA server, in which case
the FreeIPA server becomes the NTP server for the deployment. You can use other NTP
servers as desired.
+ </div><div class="para">
+ What is NTP? Many computer services (for example, Kerberos) require that the time
differential between different hosts on a network be kept to a minimum for correct or
accurate operation. The Network Time Protocol (NTP) is a protocol used to synchronize
computer clocks over the network. Most operating systems can be configured to synchronize
their clocks with any of a number of time servers. [edit] How IPA and NTP Work Together
IPA combines a number of different technologies, many of which constantly communicate with
each other over the network. In order for these technologies to work together correctly,
the time differential between the clients and servers on the network must be kept to a
minimum. Kerberos, for example, only tolerates a five minute time difference between the
KDC and a client requesting authentication. A time difference greater than five minutes
will result in a failed authentication. System Administrators also rely on accurate time
keeping for correlat
ion of system logs across machines on the network. In the event of problems on the
network or other aspects of a deployment, it may be necessary to inspect the log files of
various machines to determine if specific problems occur at the same time. Without NTP or
another time synchronization system, such troubleshooting would be all but impossible. The
IPA startup process ensures that the NTP service is started and that the time and date is
synchronized before any other IPA-related processes are started. This is to avoid problems
with certificates, LDAP entry creation dates, password expiration dates, account
expiration dates, and any other date-related issues.
+ </div><div class="para">
+ mention the CA and certificates
+ </div><div class="para">
+ mention replicas, replication, and how it works with servers
+ </div></div><div class="section"
id="IPA_Managed_Hosts"><div
class="titlepage"><div><div><h3 class="title"
id="IPA_Managed_Hosts">1.2.2. FreeIPA Managed
Hosts</h3></div></div></div><div class="para">
+ An FreeIPA <em class="firstterm">managed host</em> is a host
that is managed by FreeIPA. The definition of "manage" in this context can be
stated as "being able to retrieve a keytab and certificates on behalf of another host
or service". This management is established by enrolling the host with FreeIPA, a
task performed by the <code
class="command">ipa-client-install</code> command. As a result of this
enrollment, <code class="systemitem">SSSD</code> and <code
class="systemitem">certmonger</code> are configured (they are aware of
the location of the FreeIPA server), the keytab is provisioned and the host certificate is
created. The host certificate is not used by FreeIPA but is created nonetheless, for
possible use by services that might be running on the host. The web server is one example
of this.
+ </div><div class="para">
+ As a result of user authentication against the KDC, the TGT (ticket-granting ticket)
is stored on the client machine. That ticket is used to access different services that are
members of the same Kerberos domain. All services need to be registered in FreeIPA and
have a keytab provisioned for them. To do this, you need to create a service record in
FreeIPA and then execute the <code
class="command">ipa-getkeytab</code> on the host where the service will
be running. Note that this operation is independent of making the host a managed host. The
service can run on either a managed host or an unmanaged host.
+ </div><div class="formalpara" id="SSSD"><h5
class="formalpara">SSSD</h5>
+ When configured to use FreeIPA via its FreeIPA back end, SSSD provides user
authentication, identity look ups and HBAC (Host-based Access Control) enforcement. The
host enrollment and configuration of SSSD are performed automatically by the <code
class="command">ipa-client-install</code> command.
+ </div><div class="formalpara" id="certmonger"><h5
class="formalpara">certmonger</h5>
+ <code class="systemitem">certmonger</code> is an unattended
service that can monitor the certificates on the client system and renew them on a
scheduled basis when they are about to expire. It can also be used to request new
certificates for the services running on the system or for a different system, for example
when a management server or hypervisor requests certificates for a set of virtual
machines.
+ </div></div><div class="section"
id="external-work"><div
class="titlepage"><div><div><h3 class="title"
id="external-work">1.2.3. Integration with Non-Fedora
Services</h3></div></div></div><div class="para">
+ windows and AD samba solaris, hp, mac
+ </div></div></div><div class="section"
id="ipa-components"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-components">1.3. Identity Management:
Authentication</h2></div></div></div><div
class="para">
+ XXXXXXXXXX fix me XXXXXXXX
+ </div><div class="para">
+ What will be freeIPA's first steps around Identity? We are looking to take
concrete and useful steps, and so have chosen to focus our first efforts on centralized
Identity Management and Authentication for Linux and Unix * This solution will initially
consist of an MIT Kerberos 5 server using a Fedora Directory Server backend. The goal is
to make it easy for developers and administrators to set up centralized identity
management for their world using the directory as the central username and password store
and kerberos as the means of authentication and single sign on. * In version 1 we
provided: a fixed schema, simple configuration tools to easily set up an IPA server and
replication, and command line tools and an intuitive GUI for user and group management. *
In version 2 we are working on: integrating Dogtag Certificate Server, DNS server, added
support for hosts, centrally managed netgroups, different automount maps for different
locations, extensible UI/CLI framework
, host based access control and more. * We want to make sure this solution can manage
identity and authentication well for Linux and Unix boxes and we hope our efforts inspire
upstream package owners to kerberize a lot more packages.
+ </div></div><div class="section"
id="policy"><div
class="titlepage"><div><div><h2 class="title"
id="policy">1.4. Defining Policies:
Authorization</h2></div></div></div><div
class="para">
+ XXXXXXXXXX fix me XXXXXXXX
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="installing-ipa" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 2. Installing a FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#Preparing_for_an_IPA_Installation">2.1. Preparing to Install the
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a href="#prerequisites">2.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Installing_the_IPA_Server_Packages">2.2. Installing the FreeIPA Server
Packages</a></span></dt><dt><span
class="section"><a hr
ef="#creating-server">2.3. Creating a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a href="#install-command">2.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a href="#install-interactive">2.3.2. Setting
up a FreeIPA Server: Basic Interactive
Installation</a></span></dt><dt><span
class="section"><a href="#install-examples">2.3.3. Examples
of Creating the FreeIPA Server</a></span></dt><dt><span
class="section"><a href="#troubleshooting-install">2.3.4.
Troubleshooting Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="#chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">2.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a href="#installing-replica">2.4.1. Prepping
and Installing the Replica Server</a></span></dt><dt><span
class="section"><a href="#creating-the-replica">2.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a href="#t
roubleshooting-replica-install">2.4.3. Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="#Uninstalling_IPA_Servers">2.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></div><div
class="para">
The FreeIPA domain is defined and managed by a FreeIPA <span
class="emphasis"><em>server</em></span> which is
essentially a domain controller. There can be multiple domain controllers within a domain
for load-balancing and failover tolerance. These additional servers are called <span
class="emphasis"><em>replicas</em></span> of the master
FreeIPA server.
</div><div class="para">
Both FreeIPA servers and replicas only run on Fedora systems. For both servers and
replicas, the necessary packages must be installed and then the FreeIPA server or replica
itself is configured through setup scripts, which configure all of the requisite
services.
- </div><div class="section"
id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">1.1. Preparing to Install the FreeIPA
Server</h2></div></div></div><div class="para">
+ </div><div class="section"
id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">2.1. Preparing to Install the FreeIPA
Server</h2></div></div></div><div class="para">
Before you install FreeIPA, ensure that the installation environment is suitably
configured. You also need to provide certain information during the installation and
configuration procedures, including realm names and certain usernames and passwords. This
section describes the information that you need to provide.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1. Hardware
Requirements</h3></div></div></div><div
class="para">
- A basic user entry is about 1 KB in size, as is a simple host entry with a
certificate. The structure of the directory tree and the number of indexes in the
Directory Server instance can impact the hardware required for the best performance. <a
class="xref"
href="#tab.Minimum_hardware_requirements_for_IPA">Table 1.1, “Minimum
Hardware Requirements”</a> lists the recommended minimums. For customized systems,
additional indexes, or larger user entries, it is more effective to increase the RAM than
to increase the disk space because the Directory Server stores much of its data in cache.
Add info for disk layout/size recommendations, from
https://www.redhat.com/archives/freeipa-users/2011-May/msg00012.html
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.1.1. Hardware
Requirements</h3></div></div></div><div
class="para">
+ A basic user entry is about 1 KB in size, as is a simple host entry with a
certificate. The structure of the directory tree and the number of indexes in the
Directory Server instance can impact the hardware required for the best performance. <a
class="xref"
href="#tab.Minimum_hardware_requirements_for_IPA">Table 2.1, “Minimum
Hardware Requirements”</a> lists the recommended minimums. For customized systems,
additional indexes, or larger user entries, it is more effective to increase the RAM than
to increase the disk space because the Directory Server stores much of its data in cache.
Add info for disk layout/size recommendations, from
https://www.redhat.com/archives/freeipa-users/2011-May/msg00012.html
</div><div class="note"><div
class="admonition_header"><h2>TIP</h2></div><div
class="admonition"><div class="para">
The Directory Server instance used by the FreeIPA server can be tuned to increase
performance. For tuning information, see the Directory Server documentation at <a
href="http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2...;.
</div></div></div><div class="para">
The system requirements for both 32-bit and 64-bit platforms are the same.
- </div><div class="table"
id="tab.Minimum_hardware_requirements_for_IPA"><h6>Table 1.1. Minimum
Hardware Requirements</h6><div class="table-contents"><table
summary="Minimum Hardware Requirements"
border="1"><colgroup><col width="25%"
align="center" /><col width="25%" align="center"
/><col width="25%" align="center" /><col
width="25%" align="center"
/></colgroup><thead><tr><th align="center">
+ </div><div class="table"
id="tab.Minimum_hardware_requirements_for_IPA"><h6>Table 2.1. Minimum
Hardware Requirements</h6><div class="table-contents"><table
summary="Minimum Hardware Requirements"
border="1"><colgroup><col width="25%"
align="center" /><col width="25%" align="center"
/><col width="25%" align="center" /><col
width="25%" align="center"
/></colgroup><thead><tr><th align="center">
Minimum Hardware Requirements
</th><th align="center">
10,000 - 250,000 Entries
@@ -142,21 +196,21 @@
4 GB
</td><td align="center">
8 GB
- </td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2. Software
Requirements</h3></div></div></div><div
class="para">
+ </td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2. Software
Requirements</h3></div></div></div><div
class="para">
Most of the packages that a FreeIPA server depends on are installed as dependencies
when the FreeIPA packages are installed. There are some packages, however, which are
required before installing the FreeIPA packages:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Kerberos 1.9
</div></li><li class="listitem"><div
class="para">
The <span class="package">named</span> and <span
class="package">bind-dyndb-ldap</span> packages for DNS
- </div></li></ul></div></div><div
class="section" id="prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="prerequisites">1.1.3. System
Prerequisites</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section" id="prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="prerequisites">2.1.3. System
Prerequisites</h3></div></div></div><div
class="para">
The FreeIPA server is set up using a configuration script, and this script makes
certain assumption about the host system. If the system does not meet these prerequisites,
then server configuration may fail.
- </div><div class="section" id="prereq-ds"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ds">1.1.3.1. Directory
Server</h4></div></div></div><div class="para">
+ </div><div class="section" id="prereq-ds"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ds">2.1.3.1. Directory
Server</h4></div></div></div><div class="para">
There must not be any instances of 389 Directory Server installed on the host
machine.
- </div></div><div class="section"
id="prereq-system"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-system">1.1.3.2. System Files
</h4></div></div></div><div class="para">
+ </div></div><div class="section"
id="prereq-system"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-system">2.1.3.2. System Files
</h4></div></div></div><div class="para">
The server script overwrites system files to set up the FreeIPA domain. The system
should be clean, without custom configuration for services like DNS and Kerberos, before
configuring the FreeIPA server.
- </div></div><div class="section"
id="prereq-ports"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ports">1.1.3.3. System
Ports</h4></div></div></div><div class="para">
- FreeIPA uses a number of ports to communicate with its services. These ports, listed
in <a class="xref" href="#tab.ipa-ports">Table 1.2, “FreeIPA
Ports”</a>, must be open and available for FreeIPA to work. They cannot be in use by
another service or blocked by a firewall. To make sure that these ports are available, try
<code class="command">iptables</code> to list the available ports or
<code class="command">nc</code>, <code
class="command">telnet</code>, or <code
class="command">nmap</code> to connect to a port or run a port scan.
- </div><div class="table"
id="tab.ipa-ports"><h6>Table 1.2. FreeIPA Ports</h6><div
class="table-contents"><table summary="FreeIPA Ports"
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ </div></div><div class="section"
id="prereq-ports"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ports">2.1.3.3. System
Ports</h4></div></div></div><div class="para">
+ FreeIPA uses a number of ports to communicate with its services. These ports, listed
in <a class="xref" href="#tab.ipa-ports">Table 2.2, “FreeIPA
Ports”</a>, must be open and available for FreeIPA to work. They cannot be in use by
another service or blocked by a firewall. To make sure that these ports are available, try
<code class="command">iptables</code> to list the available ports or
<code class="command">nc</code>, <code
class="command">telnet</code>, or <code
class="command">nmap</code> to connect to a port or run a port scan.
+ </div><div class="table"
id="tab.ipa-ports"><h6>Table 2.2. FreeIPA Ports</h6><div
class="table-contents"><table summary="FreeIPA Ports"
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
Service
</th><th>
Ports
@@ -184,16 +238,16 @@
</td><td>
53
</td></tr><tr><td>
- NTP<sup>[<a id="id3115092" href="#ftn.id3115092"
class="footnote">b</a>]</sup>
+ NTP<sup>[<a id="id4327073" href="#ftn.id4327073"
class="footnote">b</a>]</sup>
</td><td>
123
</td></tr></tbody><tbody
class="footnotes"><tr><td colspan="2"><div
class="footnote" id="ft.udp-tcp"><p><sup>[<a
id="ftn.ft.udp-tcp" href="#ft.udp-tcp"
class="para">a</a>] </sup>
This service uses both TCP adn UDP ports.
- </p></div><div
class="footnote"><p><sup>[<a id="ftn.id3115092"
href="#id3115092" class="para">b</a>] </sup>
+ </p></div><div
class="footnote"><p><sup>[<a id="ftn.id4327073"
href="#id4327073" class="para">b</a>] </sup>
This service uses UDP ports only.
- </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS">1.1.3.4. DNS</h4></div></div></div><div
class="para">
+ </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS">2.1.3.4. DNS</h4></div></div></div><div
class="para">
FreeIPA uses DNS for the FreeIPA clients to find (<span
class="emphasis"><em>discover</em></span>) the FreeIPA
servers. The DNS service can be managed by FreeIPA itself, or FreeIPA can use an existing
DNS server. Without a properly configured and working DNS, server discovery for clients
and FreeIPA services like, LDAP, Kerberos, and SSL may fail to work.
- </div><div class="section"
id="dns-requirements"><div
class="titlepage"><div><div><h5 class="title"
id="dns-requirements">1.1.3.4.1. DNS
Requirements</h5></div></div></div><div
class="para">
+ </div><div class="section"
id="dns-requirements"><div
class="titlepage"><div><div><h5 class="title"
id="dns-requirements">2.1.3.4.1. DNS
Requirements</h5></div></div></div><div
class="para">
Regardless of whether the DNS is within the FreeIPA server or external, the server
host must have DNS properly configured:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The server's machine name must be set and resolve to its public IP address.
The fully-qualified domain name cannot resolve to the loopback address. It must resolve to
the machine's public IP address, not to <code
class="systemitem">127.0.0.1</code>. The output of the <code
class="command">hostname</code> command cannot be <code
class="systemitem">localhost</code> or <code
class="systemitem">localhost6</code>.
@@ -205,12 +259,12 @@
The DNS must be correctly configured to resolve forward and reverse addresses.
The DNS does not need to be on the same machine as the FreeIPA server, but it does need to
be fully functional.
</div><div class="para">
If you do not have a functional DNS, you can use the <code
class="option">--setup-dns</code> option when you install FreeIPA to
automatically configure a suitable DNS.
- </div></li></ul></div></div><div
class="section" id="dns-file"><div
class="titlepage"><div><div><h5 class="title"
id="dns-file">1.1.3.4.2. FreeIPA-Generated DNS
File</h5></div></div></div><div class="para">
+ </div></li></ul></div></div><div
class="section" id="dns-file"><div
class="titlepage"><div><div><h5 class="title"
id="dns-file">2.1.3.4.2. FreeIPA-Generated DNS
File</h5></div></div></div><div class="para">
To help create and configure a suitable DNS setup, the FreeIPA installation script
creates a sample zone file. During the installation, FreeIPA displays a message similar to
the following:
</div><pre class="screen">Sample zone file for bind has been
created in /tmp/sample.zone.F_uMf4.db
</pre><div class="para">
You should use this file in your DNS zone file.
- </div></div><div class="section"
id="DNS-IPA_DNS_and_NSCD"><div
class="titlepage"><div><div><h5 class="title"
id="DNS-IPA_DNS_and_NSCD">1.1.3.4.3. IPA, DNS, and
NSCD</h5></div></div></div><div class="para">
+ </div></div><div class="section"
id="DNS-IPA_DNS_and_NSCD"><div
class="titlepage"><div><div><h5 class="title"
id="DNS-IPA_DNS_and_NSCD">2.1.3.4.3. IPA, DNS, and
NSCD</h5></div></div></div><div class="para">
<span class="emphasis"><em>It is strongly
recommended</em></span> that you avoid or restrict the use of <code
class="systemitem">nscd</code> (Name Service Caching Daemon) in a
FreeIPA deployment. The <code class="systemitem">nscd</code> service
is extremely useful for reducing the load on the server, and for making clients more
responsive, but drawbacks also exist. This is especially true in deployments that take
advantage of SSSD, which performs its own caching.
</div><div class="para">
<code class="systemitem">nscd</code> performs caching
operations for all services that perform queries via the nsswitch interface, including
<code class="command">getent</code>. Because <code
class="systemitem">nscd</code> performs both positive and negative
caching, if a request determines that a specific FreeIPA user does not exist, it marks
this as a negative cache. Values stored in the cache remain until the cache expires,
regardless of any changes that may occur on the server. The results of such caching is
that new users and memberships may not be visible, and users and memberships that have
been removed may still be visible.
@@ -220,7 +274,7 @@
negative-time-to-live group 60
positive-time-to-live hosts 3600
negative-time-to-live hosts 20
-</pre></div><div class="section"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos"><div
class="titlepage"><div><div><h5 class="title"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos">1.1.3.4.4. DNS
and Kerberos</h5></div></div></div><div
class="para">
+</pre></div><div class="section"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos"><div
class="titlepage"><div><div><h5 class="title"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos">2.1.3.4.4. DNS
and Kerberos</h5></div></div></div><div
class="para">
The Kerberos server requires a valid DNS A record, and reverse DNS needs to work
correctly. It is safe to use CNAMEs if they point to the A name that corresponds to the
principal name used to create SPNs (Service Principal Names) for the host. You should
avoid the use of DDNS names, however, as this can cause major problems later on.
</div><div class="para">
If necessary, add the hostname to the <code
class="filename">/etc/hosts</code> file, as long as the fully qualified
hostname must be listed first. For example:
@@ -236,7 +290,7 @@ negative-time-to-live hosts 20
DNS forwarders must be specified as IP addresses, not as hostnames.
</div></div></div>
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking">1.1.3.5. Configuring
Networking</h4></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services">1.1.3.5.1. Configuring
Networking Services</h5></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking">2.1.3.5. Configuring
Networking</h4></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services">2.1.3.5.1. Configuring
Networking Services</h5></div></div></div><div
class="para">
The default networking service used by Fedora is NetworkManager, and due to the way
this service works, it can cause problems with FreeIPA and the KDC. Consequently, it is
highly recommended that you use the <code
class="systemitem">network</code> service to manage the networking
requirements in a FreeIPA environment and disable the NetworkManager service.
</div><div class="orderedlist"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Networking_Services-To_configure_networking_services_for_IPA"><ol><li
class="listitem"><div class="para">
Boot the machine into single-user mode and run the following commands:
@@ -250,7 +304,7 @@ negative-time-to-live hosts 20
Ensure that static networking is correctly configured.
</div></li><li class="listitem"><div
class="para">
Restart the system.
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File">1.1.3.5.2. Configuring
the /etc/hosts File</h5></div></div></div><div
class="para">
+ </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File">2.1.3.5.2. Configuring
the /etc/hosts File</h5></div></div></div><div
class="para">
You need to ensure that your <code
class="filename">/etc/hosts</code> file is configured correctly. A
misconfigured file can prevent the FreeIPA command-line tools from functioning correctly
and can prevent the FreeIPA web interface from connecting to the FreeIPA server.
</div><div class="para">
Configure the <code class="filename">/etc/hosts</code> file
to list the FQDN for the FreeIPA server <span
class="emphasis"><em>before</em></span> any aliases. Also
ensure that the hostname is not part of the <code
class="literal">localhost</code> entry. The following is an example of
a valid hosts file:
@@ -259,15 +313,15 @@ negative-time-to-live hosts 20
192.168.1.1
ipaserver.example.com ipaserver
</pre><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Do not omit the <code class="systemitem">IPv4</code> entry
in the <code class="filename">/etc/hosts</code> file. This entry is
required by the FreeIPA web service.
- </div></div></div></div></div></div></div><div
class="section" id="Installing_the_IPA_Server_Packages"><div
class="titlepage"><div><div><h2 class="title"
id="Installing_the_IPA_Server_Packages">1.2. Installing the FreeIPA Server
Packages</h2></div></div></div><div class="para">
+ </div></div></div></div></div></div></div><div
class="section" id="Installing_the_IPA_Server_Packages"><div
class="titlepage"><div><div><h2 class="title"
id="Installing_the_IPA_Server_Packages">2.2. Installing the FreeIPA Server
Packages</h2></div></div></div><div class="para">
Installing only the FreeIPA server requires a single package, . If the FreeIPA server
will also manage a DNS server, then it requires two additional packages to set up the
DNS.
</div><div class="para">
All of these packages can be installed using the <code
class="command">yum</code> command:
- </div><div class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># yum install freeipa-server bind
bind-dyndb-ldap</span></pre><div class="para">
Installing the also installs a large number of dependencies, such as <span
class="package">389-ds-base</span> for the LDAP service and <span
class="package">krb5-server</span> for the Kerberos service, along with
FreeIPA tools.
</div><div class="para">
- After the packages are installed, the server instance must be created using the
<code class="command">ipa-server-install</code> command. The options
for configuring the new server instance are described in <a class="xref"
href="#creating-server">Section 1.3, “Creating a FreeIPA Server
Instance”</a>.
- </div></div><div class="section"
id="creating-server"><div
class="titlepage"><div><div><h2 class="title"
id="creating-server">1.3. Creating a FreeIPA Server
Instance</h2></div></div></div><div class="para">
+ After the packages are installed, the server instance must be created using the
<code class="command">ipa-server-install</code> command. The options
for configuring the new server instance are described in <a class="xref"
href="#creating-server">Section 2.3, “Creating a FreeIPA Server
Instance”</a>.
+ </div></div><div class="section"
id="creating-server"><div
class="titlepage"><div><div><h2 class="title"
id="creating-server">2.3. Creating a FreeIPA Server
Instance</h2></div></div></div><div class="para">
The FreeIPA setup script creates a server instance, which includes configuring all of
the required services for the FreeIPA domain:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The network time daemon (ntpd)
@@ -288,21 +342,21 @@ negative-time-to-live hosts 20
</div></li></ul></div><div class="para">
The FreeIPA setup process can be minimal, where the administrator only supplies some
required information, or it can be very specific, with user-defined settings for many
parts of the FreeIPA services. The configuration is passed using arguments with the
<code class="command">ipa-install-server</code> script.
</div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
- The port numbers and directory locations used by FreeIPA are all defined
automatically, as defined in <a class="xref"
href="#prereq-ports">Section 1.1.3.3, “System Ports”</a> and . These
ports and directories <span
class="emphasis"><em>cannot</em></span> be changed or
customized.
- </div></div></div><div class="section"
id="install-command"><div
class="titlepage"><div><div><h3 class="title"
id="install-command">1.3.1. About
ipa-server-install</h3></div></div></div><div
class="para">
+ The port numbers and directory locations used by FreeIPA are all defined
automatically, as defined in <a class="xref"
href="#prereq-ports">Section 2.1.3.3, “System Ports”</a> and . These
ports and directories <span
class="emphasis"><em>cannot</em></span> be changed or
customized.
+ </div></div></div><div class="section"
id="install-command"><div
class="titlepage"><div><div><h3 class="title"
id="install-command">2.3.1. About
ipa-server-install</h3></div></div></div><div
class="para">
A FreeIPA server instance is created by running the <code
class="command">ipa-server-install</code> script. This script can
accept user-defined settings for services, like DNS nad Kerberos, that are used by the
FreeIPA instance, or it can supply predefined values for minimal input from the
administrator.
</div><div class="para">
While <code class="command">ipa-server-install</code> can be
run without any options, so that it prompts for the required information, it has numerous
arguments which allow the configuration process to be easily scripted or to supply
additional information which is not requested during an interactive installation.
</div><div class="para">
- <a class="xref"
href="#tab.ipa-server-install-param">Table 1.3, “ipa-server-install
Options”</a> lists the possible arguments with <code
class="command">ipa-server-install</code>, while <a
class="xref" href="#install-examples">Section 1.3.3, “Examples of
Creating the FreeIPA Server”</a> has examples of some common installation scenarios.
In real life, the <code class="command">ipa-server-install</code>
options are versatile enough to be customized to the specific deployment environment.
- </div><div class="table"
id="tab.ipa-server-install-param"><h6>Table 1.3. ipa-server-install
Options</h6><div class="table-contents"><table
summary="ipa-server-install Options"
border="1"><colgroup><col width="33%" /><col
width="33%" /><col width="33%"
/></colgroup><thead><tr><th>
+ <a class="xref"
href="#tab.ipa-server-install-param">Table 2.3, “ipa-server-install
Options”</a> lists the possible arguments with <code
class="command">ipa-server-install</code>, while <a
class="xref" href="#install-examples">Section 2.3.3, “Examples of
Creating the FreeIPA Server”</a> has examples of some common installation scenarios.
In real life, the <code class="command">ipa-server-install</code>
options are versatile enough to be customized to the specific deployment environment.
+ </div><div class="table"
id="tab.ipa-server-install-param"><h6>Table 2.3. ipa-server-install
Options</h6><div class="table-contents"><table
summary="ipa-server-install Options"
border="1"><colgroup><col width="33%" /><col
width="33%" /><col width="33%"
/></colgroup><thead><tr><th>
Argument
</th><th>
Alternate Argument
</th><th>
Description
</th></tr></thead><tbody><tr><td
colspan="3">
- <span class="bold bold"><strong>Required
Options</strong></span><sup>[<a id="id3152732"
href="#ftn.id3152732" class="footnote">a</a>]</sup>
+ <span class="bold bold"><strong>Required
Options</strong></span><sup>[<a id="id3199507"
href="#ftn.id3199507" class="footnote">a</a>]</sup>
</td></tr><tr><td>
-a <span
class="emphasis"><em>ipa_admin_password</em></span>
</td><td>
@@ -354,12 +408,6 @@ negative-time-to-live hosts 20
</td><td>
Points to the PKCS#10 file which contains the certificate that was generated by
an external CA. If an external CA is used, this is required in a second invocation of
<code class="command">ipa-server-install</code> to complete the
setup process.
</td></tr><tr><td>
- --external_ca_file=<span
class="emphasis"><em>CA_cert_chain_file</em></span>
- </td><td>
-
- </td><td>
- Instructs the installation script to generate a certificate request that can be
submitted to an external or third-party CA.
- </td></tr><tr><td>
--selfsign
</td><td>
@@ -489,9 +537,9 @@ negative-time-to-live hosts 20
</td><td>
Prints the version number of the <code
class="command">ipa-server-install</code> command.
- </td></tr></tbody><tbody
class="footnotes"><tr><td colspan="3"><div
class="footnote"><p><sup>[<a id="ftn.id3152732"
href="#id3152732" class="para">a</a>] </sup>
+ </td></tr></tbody><tbody
class="footnotes"><tr><td colspan="3"><div
class="footnote"><p><sup>[<a id="ftn.id3199507"
href="#id3199507" class="para">a</a>] </sup>
The installation script will prompt for these options if they are not passed
with the script.
- </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="install-interactive"><div
class="titlepage"><div><div><h3 class="title"
id="install-interactive">1.3.2. Setting up a FreeIPA Server: Basic
Interactive Installation</h3></div></div></div><div
class="para">
+ </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="install-interactive"><div
class="titlepage"><div><div><h3 class="title"
id="install-interactive">2.3.2. Setting up a FreeIPA Server: Basic
Interactive Installation</h3></div></div></div><div
class="para">
All that is required to set up a FreeIPA server is to run the <code
class="command">ipa-server-install</code> script. This launchs the
script interactively, which prompts for the required information to set up a server, but
without more advanced configuration like DNS and CA options.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Run the <code class="command">ipa-server-install</code>
script.
@@ -577,10 +625,10 @@ Password <span class="perl_Keyword">for</span>
admin@EXAMPLE.COM:</pre></li><li
Member of <span class="perl_BString">groups</span>: admins
----------------------------
Number of entries returned 1
-
----------------------------</pre></li></ol></div></div><div
class="section" id="install-examples"><div
class="titlepage"><div><div><h3 class="title"
id="install-examples">1.3.3. Examples of Creating the FreeIPA
Server</h3></div></div></div><div class="para">
+
----------------------------</pre></li></ol></div></div><div
class="section" id="install-examples"><div
class="titlepage"><div><div><h3 class="title"
id="install-examples">2.3.3. Examples of Creating the FreeIPA
Server</h3></div></div></div><div class="para">
The way that a FreeIPA server is installed can be different depending on the network
environment, security requirements within the organization, and the desired topology.
These example illustrate some common options when installing the server. These examples
are not mutually exclusive; it is entirely possible to use CA options, DNS options, and
FreeIPA configuration options in the same server invocation. These are called out
separately simply to make it more clear what each configuration area requires.
- </div><div class="section" id="install-normal"><div
class="titlepage"><div><div><h4 class="title"
id="install-normal">1.3.3.1. Non-Interactive Basic
Installation</h4></div></div></div><div
class="para">
- As shown in <a class="xref"
href="#install-interactive">Section 1.3.2, “Setting up a FreeIPA Server:
Basic Interactive Installation”</a>, only a few pieces of information are required
to configured a FreeIPA server. While the setup script can prompt for this information in
interactive mode, this information can also be passed with the setup command to allow
automated and unattended configuration:
+ </div><div class="section" id="install-normal"><div
class="titlepage"><div><div><h4 class="title"
id="install-normal">2.3.3.1. Non-Interactive Basic
Installation</h4></div></div></div><div
class="para">
+ As shown in <a class="xref"
href="#install-interactive">Section 2.3.2, “Setting up a FreeIPA Server:
Basic Interactive Installation”</a>, only a few pieces of information are required
to configured a FreeIPA server. While the setup script can prompt for this information in
interactive mode, this information can also be passed with the setup command to allow
automated and unattended configuration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Passwords for the FreeIPA administrative user and the Directory Server super user
(Directory Manager)
</div></li><li class="listitem"><div
class="para">
@@ -591,7 +639,7 @@ Password <span class="perl_Keyword">for</span>
admin@EXAMPLE.COM:</pre></li><li
The DNS domain name
</div></li></ul></div><div class="para">
This information can be passed with the <code
class="command">ipa-server-install</code>, along with the <code
class="option">-U</code> to force it to run without requiring user
interaction.
- </div><div class="example"
id="ex.basic-opts"><h6>Example 1.1. Basic Installation without
Interaction</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U</span></pre><div class="para">
+ </div><div class="example"
id="ex.basic-opts"><h6>Example 2.1. Basic Installation without
Interaction</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U</span></pre><div class="para">
The script then prints the submitted values:
</div><pre class="programlisting">To accept the default shown
in brackets, press the Enter key.
@@ -599,18 +647,18 @@ The IPA Master Server will be configured with
Hostname:
ipa2.server.example.com
IP address: 1.2.3.4
Domain name: example.com</pre><div class="para">
- Then the script runs through the configuration progress for each FreeIPA service,
as in <a class="xref" href="#install-interactive">Section 1.3.2,
“Setting up a FreeIPA Server: Basic Interactive Installation”</a>.
- </div></div></div><br class="example-break"
/></div><div class="section"
id="install-ca-options"><div
class="titlepage"><div><div><h4 class="title"
id="install-ca-options">1.3.3.2. Using Different
CAs</h4></div></div></div><div class="para">
+ Then the script runs through the configuration progress for each FreeIPA service,
as in <a class="xref" href="#install-interactive">Section 2.3.2,
“Setting up a FreeIPA Server: Basic Interactive Installation”</a>.
+ </div></div></div><br class="example-break"
/></div><div class="section"
id="install-ca-options"><div
class="titlepage"><div><div><h4 class="title"
id="install-ca-options">2.3.3.2. Using Different
CAs</h4></div></div></div><div class="para">
The default installation of FreeIPA uses an integrated Dogtag Certificate System
instance as a certificate authority to issue certificates. However, this configuration is
not required. FreeIPA only requires <span
class="emphasis"><em>a</em></span> certificate authority.
This can be an external CA like Verisign or a corporate CA inconjunction with the internal
Certificate System, or it can even be the FreeIPA server itself, using a self-signed
certificate.
</div><div class="para">
For the FreeIPA server itself to work as a CA, it uses a self-signed certificate,
meaning that it approved and issued its own certificate. This is done by using the
<code class="option">--selfsign</code> option with the <code
class="command">ipa-server-install</code> command. When the FreeIPA
server uses a self-signed certificate, the setup process is exactly the same as a normal
installation, except that no Dogtag Certificate System instance is created. There is still
a <code class="filename">cacert.p12</code> file created that can be
used by replicas and the domain functions exactly the same. The only difference is what CA
issues the certificates.
- </div><div class="example"
id="ex.selfsigned"><h6>Example 1.2. Using a Self-Signed
Certificate</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U
--selfsign</span></pre></div></div><br
class="example-break" /><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ </div><div class="example"
id="ex.selfsigned"><h6>Example 2.2. Using a Self-Signed
Certificate</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U
--selfsign</span></pre></div></div><br
class="example-break" /><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
A self-signed certificate should only be used for a testing or development
environment. A production environment should use the Dogtag Certificate System instance or
an external, public CA.
</div></div></div><div class="para">
Alternatively, the FreeIPA server can use a certificate issued by an external CA.
This can be a corporate CA or a third-party CA like Verisign or Thawte. As with a normal
setup process, using an external CA still uses a Dogtag Certificate System instance for
the FreeIPA server for issuing all of its client and replica certificates; the initial CA
certificate is simply issued by a different CA.
</div><div class="para">
When using an external CA, there are two additional steps that must be performed:
submit the generated certificate request to the external CA and then load the CA
certificate and issued server certificate to complete the setup.
- </div><div class="example"
id="ex.externalca"><h6>Example 1.3. Using an External
CA</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ </div><div class="example"
id="ex.externalca"><h6>Example 2.3. Using an External
CA</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
Run the <code class="command">ipa-server-install</code>
script, using the <code class="option">--external-ca</code> option.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install -a secret12 -r
EXAMPLE.COM -P
password -p secret12 -n
ipa.server.example.com
--external-ca</span></pre></li><li
class="listitem"><div class="para">
The script sets up the NTP and Directory Server services as normal.
@@ -628,12 +676,12 @@ The next step is to get /root/ipa.csr signed by your CA and re-run
ipa-server-in
</div></li><li class="listitem"><div
class="para">
Rerun <code class="command">ipa-server-install</code>,
specifying the locations and names of the certificate and CA chain files. For example:
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install
--external_cert_file=/tmp/servercert20110601.p12
--external_ca_file=/tmp/cacert.p12</span></pre></li><li
class="listitem"><div class="para">
- Complete the setup process and verify that everything is working as expected, as
in <a class="xref" href="#install-interactive">Section 1.3.2,
“Setting up a FreeIPA Server: Basic Interactive Installation”</a>.
- </div></li></ol></div></div></div><br
class="example-break" /></div><div class="section"
id="install-dns"><div
class="titlepage"><div><div><h4 class="title"
id="install-dns">1.3.3.3. Using
DNS</h4></div></div></div><div class="para">
+ Complete the setup process and verify that everything is working as expected, as
in <a class="xref" href="#install-interactive">Section 2.3.2,
“Setting up a FreeIPA Server: Basic Interactive Installation”</a>.
+ </div></li></ol></div></div></div><br
class="example-break" /></div><div class="section"
id="install-dns"><div
class="titlepage"><div><div><h4 class="title"
id="install-dns">2.3.3.3. Using
DNS</h4></div></div></div><div class="para">
FreeIPA can be configured to manage its own DNS, use an existing DNS, or not use DNS
services at all (which is the default). Running the setup script alone does not configure
DNS; this requires the <code class="option">--setup-dns</code>
option.
</div><div class="para">
As with a basic setup, the DNS setup can either prompt for the required information
or the DNS information can be passed with the script to allow an automatic or unattended
setup process.
- </div><div class="example"
id="ex.dns-w-prompts"><h6>Example 1.4. Interactive DNS
Setup</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ </div><div class="example"
id="ex.dns-w-prompts"><h6>Example 2.4. Interactive DNS
Setup</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
Run the <code class="command">ipa-server-install</code>
script, using the <code class="option">--setup-dns</code> option.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install -a secret12 -r
EXAMPLE.COM -P
password -p secret12 -n
ipa.server.example.com
--setup-dns</span></pre></li><li
class="listitem"><div class="para">
The script configures the hostname and domain name as normal.
@@ -658,16 +706,16 @@ Configuring named:
<span class="perl_Keyword">done</span> configuring named.
==============================================================================
Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"><div class="para">
- Verify that everything is working as expected, as in <a class="xref"
href="#install-interactive">Section 1.3.2, “Setting up a FreeIPA Server:
Basic Interactive Installation”</a>.
+ Verify that everything is working as expected, as in <a class="xref"
href="#install-interactive">Section 2.3.2, “Setting up a FreeIPA Server:
Basic Interactive Installation”</a>.
</div></li></ol></div></div></div><br
class="example-break" /><div class="para">
If DNS is used with FreeIPA, then two pieces of information are required: any DNS
forwarders that will be used and using (or not) reverse DNS. To perform a non-interactive
setup, this information can be passed using the <code
class="option">--forwarder | --no-forwarders</code> option and <code
class="option">--no-reverse</code> option.
- </div><div class="example"
id="ex.dns-script"><h6>Example 1.5. Setting up DNS
Non-Interactively</h6><div class="example-contents"><div
class="para">
+ </div><div class="example"
id="ex.dns-script"><h6>Example 2.5. Setting up DNS
Non-Interactively</h6><div class="example-contents"><div
class="para">
To use DNS always requires the <code
class="option">--setup-dns</code>. To user forwarders, use the <code
class="option">--forwarder</code> with a comma-separated list of
forwarders.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--forwarder=1.2.3.0,1.2.255.0</span></pre><div class="para">
Some kind of forwarder information is required. If no external forwarders will be
used with the FreeIPA DNS service, then use the <code
class="option">--no-forwarders</code> option to indicate that only root
servers will be used.
</div><div class="para">
The script always assumes that reverse DNS is configured along with DNS, so it is
not necessary to use any options to <span
class="emphasis"><em>enable</em></span> reverse DNS. To
disable reverse DNS, use the <code
class="option">--no-reverse</code> option.
- </div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--no-reverse</span></pre></div></div><br
class="example-break" /></div></div><div
class="section" id="troubleshooting-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-install">1.3.4. Troubleshooting Installation
Problems</h3></div></div></div><div
class="formalpara"><h5 class="formalpara"
id="id2901843">GSS Failures When Running IPA Commands</h5>
+ </div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--no-reverse</span></pre></div></div><br
class="example-break" /></div></div><div
class="section" id="troubleshooting-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-install">2.3.4. Troubleshooting Installation
Problems</h3></div></div></div><div
class="formalpara"><h5 class="formalpara"
id="id3933131">GSS Failures When Running IPA Commands</h5>
Immediately after installation, there can be Kerberos problems when trying to run an
<code class="command">ipa-*</code> command. For example:
</div><pre class="programlisting">ipa: ERROR: Kerberos error:
('Unspecified GSS failure. Minor code may provide more information',
851968)/('Decrypt integrity check failed', -1765328353)</pre><div
class="para">
There are two potential causes for this:
@@ -675,7 +723,7 @@ Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"
DNS is not properly configured.
</div></li><li class="listitem"><div
class="para">
Active Directory is in the same domain as the FreeIPA server.
- </div></li></ul></div><div
class="formalpara"><h5 class="formalpara"
id="id3056819">named Daemon Fails to Start</h5>
+ </div></li></ul></div><div
class="formalpara"><h5 class="formalpara"
id="id3294372">named Daemon Fails to Start</h5>
If a FreeIPA server is configured to manage DNS and is set up successfully, but the
<code class="systemitem">named</code> service fails to start, this
can indicate that there is a package conflict. Check the <code
class="filename">/var/log/messages</code> file for error messages
related to the <code class="command">named</code> service and the
<code class="filename">ldap.so</code> library:
</div><pre class="screen">ipaserver named[6886]: failed to
dynamically load driver 'ldap.so': libldap-2.4.so.2: cannot open shared object
file: No such file or directory</pre><div class="para">
This usually means that the <span
class="package">bind-chroot</span> package is installed and is
preventing the <code class="systemitem">named</code> service from
starting. To resolve this issue, remove the <span
class="package">bind-chroot</span> package and then restart the FreeIPA
server.
@@ -683,7 +731,7 @@ Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"
<span class="perl_Comment"></span>
<span class="perl_Comment"># ipactl restart</span></pre>
- </div></div></div><div class="section"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">1.4. Setting
up FreeIPA Replicas</h2></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">2.4. Setting
up FreeIPA Replicas</h2></div></div></div><div
class="para">
In the FreeIPA domain, there are three types of machines:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Servers, which manage all of the services used by domain members
@@ -695,17 +743,17 @@ Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"
A replica is a clone of a specific FreeIPA server. The server and replica share the
same internal information about users, machines, certificates, and configured policies.
These data are copied from the server to the replica in a process called <span
class="emphasis"><em>replication</em></span>. The two
Directory Server instances used by an FreeIPA server — the Directory Server instance used
by the FreeIPA server as a data store and the Directory Server instance used by the Dogtag
Certificate System to store certificate information — are replicated over to corresponding
consumer Directory Server instances used by the FreeIPA replica.
</div><div class="note"><div
class="admonition_header"><h2>TIP</h2></div><div
class="admonition"><div class="para">
If you are using the integrated Dogtag Certificate System instance as the CA for the
FreeIPA domain, then it is possible to make a replica of a replica. It is <span
class="emphasis"><em>not</em></span> possible to make a
replica of a replica if you use the <code
class="option">--selfsign</code> option for the original FreeIPA
server.
- </div></div></div><div class="section"
id="installing-replica"><div
class="titlepage"><div><div><h3 class="title"
id="installing-replica">1.4.1. Prepping and Installing the Replica
Server</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="installing-replica"><div
class="titlepage"><div><div><h3 class="title"
id="installing-replica">2.4.1. Prepping and Installing the Replica
Server</h3></div></div></div><div class="para">
Replicas are functionally the same as FreeIPA servers, so they have the same
installation requirements and packages.
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Make sure that the machine meets all of the prerequisites listed in <a
class="xref" href="#Preparing_for_an_IPA_Installation">Section 1.1,
“Preparing to Install the FreeIPA Server”</a>.
+ Make sure that the machine meets all of the prerequisites listed in <a
class="xref" href="#Preparing_for_an_IPA_Installation">Section 2.1,
“Preparing to Install the FreeIPA Server”</a>.
</div></li><li class="listitem"><div
class="para">
- Install the server packages as in <a class="xref"
href="#Installing_the_IPA_Server_Packages">Section 1.2, “Installing the
FreeIPA Server Packages”</a>. However, do <span
class="emphasis"><em>not</em></span> run the <code
class="command">ipa-server-install</code> script.
+ Install the server packages as in <a class="xref"
href="#Installing_the_IPA_Server_Packages">Section 2.2, “Installing the
FreeIPA Server Packages”</a>. However, do <span
class="emphasis"><em>not</em></span> run the <code
class="command">ipa-server-install</code> script.
</div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
The replica and the master server must be running the same version of FreeIPA.
</div></div></div></li><li
class="listitem"><div class="para">
If there is an existing Dogtag Certificate System or Red Hat Certificate System
instance on the replica machine, make sure that port <code
class="systemitem">7389</code> is free. This port is used by the master
FreeIPA server to communicate with the replica.
- </div></li></ul></div></div><div
class="section" id="creating-the-replica"><div
class="titlepage"><div><div><h3 class="title"
id="creating-the-replica">1.4.2. Creating the
Replica</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ </div></li></ul></div></div><div
class="section" id="creating-the-replica"><div
class="titlepage"><div><div><h3 class="title"
id="creating-the-replica">2.4.2. Creating the
Replica</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
Make sure that the replica machine exists in the server's DNS <span
class="emphasis"><em>before</em></span> beginning to
configure the replica. If the server cannot contact the replica machine during the
configuration process, then the replica configuration fails.
</div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
C\On the master server, create a <span
class="emphasis"><em>replica information file</em></span>.
This contains realm and configuration information taken from the master server which will
be used to configure the replica server.
@@ -759,7 +807,7 @@ $ ipa dnsrecord-add
example.com @ --ns-rec
ipareplica.example.com.</pre>
</div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
Use the fully-qualified domain name of the replica, including the final period
(.), otherwise BIND will treat the hostname as relative to the domain.
- </div></div></div></li></ol></div></div><div
class="section" id="troubleshooting-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-replica-install">1.4.3. Troubleshooting Replica
Installation</h3></div></div></div><div
class="para">
+ </div></div></div></li></ol></div></div><div
class="section" id="troubleshooting-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-replica-install">2.4.3. Troubleshooting Replica
Installation</h3></div></div></div><div
class="para">
If the replica installation fails on step 3 (<span class="bold
bold"><strong>[3/11]: configuring certificate server
instance</strong></span>), that usually means that the required port is not
available. This can be verified by checking the debug logs for the CA, <code
class="filename">/var/log/pki-ca/debug</code>, which may show error
messages about being unable to find certain entries. For example:
<pre class="screen">[04/Feb/2011:22:29:03][http-9445-Processor25]:
DatabasePanel
comparetAndWaitEntries ou=people,o=ipaca not found, let's wait</pre>
@@ -770,11 +818,11 @@ comparetAndWaitEntries ou=people,o=ipaca not found, let's
wait</pre>
</div><div class="para">
After uninstalling the replica, ensure that port 7389 on the replica is available,
and retry the replica installation.
- </div></div></div><div class="section"
id="Uninstalling_IPA_Servers"><div
class="titlepage"><div><div><h2 class="title"
id="Uninstalling_IPA_Servers">1.5. Uninstalling FreeIPA Servers and
Replicas</h2></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="Uninstalling_IPA_Servers"><div
class="titlepage"><div><div><h2 class="title"
id="Uninstalling_IPA_Servers">2.5. Uninstalling FreeIPA Servers and
Replicas</h2></div></div></div><div class="para">
To uninstall both a FreeIPA server and a FreeIPA replica, pass the <code
class="option">--uninstall</code> option to the <code
class="command">ipa-server-install</code> command:
<pre class="programlisting"><span class="perl_Comment">#
ipa-server-install --uninstall</span></pre>
- </div></div></div><div xml:lang="en-US"
class="chapter" id="setting-up-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 2. Setting up Systems as FreeIPA
Clients</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#fedora-client-setup">2.1. Setting up a Fedora System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a href="#fedora-pkgs">2.1.1. Installing the
Client Configuration Packages and Setup
Script</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2.
Configuring Kerberos</a></span></dt><dt><span
class="section"><a
href="#fedora-Configuring_NFS_v4_with_Kerberos">2.1.3. Configuring NFS v4
with Kerberos</a></span></dt></dl></dd><dt><span
class="section"><a href="#Using_Microsoft_Windows">2.2.
Configuring a Microsoft Windows System as a FreeIPA
Client</a></span></dt><dt><span
class="section"><a href="#Configuring
_an_IPA_Client_on_Solaris">2.3. Configuring a Solaris System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10">2.3.1.
Configuring Solaris 10</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX">2.4. Configuring an HP-UX System
as a FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">2.4.1.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2.
Configuring Kerberos and PAM</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3. Configuring
S
SH</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX">2.5. Configuring an AIX System as a
FreeIPA Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2.
Configuring Client Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3.
Configuring Client SSH Access</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Testing_System_Login">
2.5.4. Testing System
Login</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X">2.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Us
ing_SSH">2.6.5. Accessing the FreeIPA Server Using
SSH</a></span></dt><dt><span class="section"><a
href="#Macintosh_OS_X-Configuring_System_Login">2.6.6. Configuring System
Login</a></span></dt></dl></dd></dl></div><div
class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="setting-up-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 3. Setting up Systems as FreeIPA
Clients</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#what-happens-clients">3.1. What Happens in Client
Setup</a></span></dt><dt><span
class="section"><a href="#Configuring_Microsoft_Windows">3.2.
Configuring a Microsoft Windows System as a FreeIPA
Client</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris">3.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris_10">3.3.1. Configuring Solaris
10</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a href="#Configuring_an_IPA_C
lient_on_HP_UX">3.4. Configuring an HP-UX System as a
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1. Configuring
NTP</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3. Configuring
Kerberos</a></span></dt><dt><span
class="section"><a
href="#Configuring_Kerberos_and_PAM-Configuring_PAM">3.4.4. Configuring
PAM</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5. Configuring
SSH</a></span></dt><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6.
Configuring Access Control</a></span></dt><dt><span
class="section"><a href="#hp-test">3.4.7. Testing the
Configuration</a></span></dt></d
l></dd><dt><span class="section"><a
href="#Configuring_an_IPA_Client_on_AIX">3.5. Configuring an AIX System as a
FreeIPA Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">3.5.2.
Configuring the AIX
Client</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X">3.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a href="#Configuring_an
_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a href="#testing-config-on-mac">3.6.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#uninstalling-clients">3.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></div><div
class="para">
A <span class="emphasis"><em>client</em></span> is
any system which is a member of the FreeIPA domain. While this is frequently a Fedora
system (and FreeIPA has special tools to make configuring Fedora clients very simple),
machines with other operating systems can also be added to the FreeIPA domain.
</div><div class="para">
One important aspect of a FreeIPA client is that <span
class="emphasis"><em>only</em></span> the system
configuration determines whether the system is part of the domain. (The configuration
includes things like belonging to the Kerberos domain, DNS domain, and having the proper
authentication and certificate setup.) FreeIPA does not require any sort of agent or
daemon running on a client.
@@ -782,65 +830,15 @@ comparetAndWaitEntries ou=people,o=ipaca not found, let's
wait</pre>
This chapter explains how to configure a system to join a FreeIPA domain.
</div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
Clients can only be configured after at least one FreeIPA server has been installed.
- </div></div></div><div class="section"
id="fedora-client-setup"><div
class="titlepage"><div><div><h2 class="title"
id="fedora-client-setup">2.1. Setting up a Fedora System as a FreeIPA
Client</h2></div></div></div><div class="section"
id="fedora-pkgs"><div
class="titlepage"><div><div><h3 class="title"
id="fedora-pkgs">2.1.1. Installing the Client Configuration Packages and
Setup Script</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
- To Fedora systems as FreeIPA clients, you need either an enrollment Kerberos
principal (for example, admin), or the host must be pre-created on the server with a
one-time password to do the enrollment.
- </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Install the client packages. These packages are used only as a simple way to
configure the system; they do <span
class="emphasis"><em>not</em></span> install an agent or
daemon on the client machine.
- </div><div class="para">
- For a regular user system, this requires only <code
class="filename">ipa-client</code>:
- </div><pre class="programlisting"><span
class="perl_Comment"># yum install
freeipa-client</span></pre><div class="para">
- For an administrator workstation, also install the FreeIPA tools package:
- </div><pre class="programlisting"><span
class="perl_Comment"># yum install freeipa-client
freeipa-admintools</span></pre></li><li
class="listitem"><div class="para">
- If the FreeIPA server is also configured as the DNS server, and is in the same
domain as the client, add the server's IP address as the first entry in the
client's <code class="filename">/etc/resolv.conf</code> file.
- </div></li><li class="listitem"><div
class="para">
- After the packages are installed, run the client setup command to configure the
system as a client.
- </div><pre class="programlisting"><span
class="perl_Comment">#
ipa-client-install</span></pre></li></ol></div><div
class="para">
- The <code class="command">ipa-client-install</code> command
runs through a series of configuration changes on the system to set it up as a client in
the FreeIPA domain:
- <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- If DNS discovery is configured correctly, the command sets up the client domain
and realm without prompting for any further information. If DNS Discovery is not
configured, or if the FreeIPA server and client are not in the same domain, the script
will prompt you for the information it requires.
- </div></li><li class="listitem"><div
class="para">
- Retrieves the CA certificate.
- </div></li><li class="listitem"><div
class="para">
- Creates a separate Kerberos configuration in order to test the provided
credentials. This enables the <code
class="command">ipa-client-install</code> command to perform a Kerberos
connection to the FreeIPA XML-RPC server, necessary to join the FreeIPA client to the
FreeIPA domain. Irrespective of whether or not this connection is successful, this
Kerberos configuration is ultimately discarded.
- </div></li><li class="listitem"><div
class="para">
- Calls the <code class="command">ipa-join</code> command to
perform the actual join
- </div></li><li class="listitem"><div
class="para">
- Obtains a service principal for the host service and installs it into <code
class="filename">/etc/krb5.keytab</code>, for example,
(host/ipa.example.com(a)EXAMPLE.COM)
- </div></li><li class="listitem"><div
class="para">
- Enables certmonger and retrieves an SSL server certificate, and installs it into
<code class="filename">/etc/pki/nssdb</code>
- </div></li><li class="listitem"><div
class="para">
- Disables the nscd daemon
- </div></li><li class="listitem"><div
class="para">
- Configures SSSD or LDAP/KRB5, including NSS and PAM configuration files
- </div></li><li class="listitem"><div
class="para">
- Configures NTP
- </div></li></ul></div>
-
- </div><div class="para">
- At the end of this process, the command displays information about the realm, DNS
domain, FreeIPA server, and other related information, similar to the following:
- </div><pre class="screen">
-Discovery was successful!
-Realm:
EXAMPLE.COM
-DNS Domain:
example.com
-IPA Server:
ipaserver.example.com
-BaseDN: dc=example,dc=com
-
-Continue to configure the system with these values? [no]: yes
-Enrollment principal: admin
-Password for admin(a)EXAMPLE.COM:
-Enrolled in IPA realm
EXAMPLE.COM
-Created /etc/ipa/default.conf
-Configured /etc/sssd/sssd.conf
-Configured /etc/krb5.conf for IPA realm
EXAMPLE.COM
-SSSD enabled
-Kerberos 5 enabled
-NTP enabled
-Client configuration complete.
-</pre></div><div class="section"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2. Configuring
Kerberos</h3></div></div></div><div class="para">
- The <code class="command">ipa-client-install</code> command
performs the Kerberos configuration automatically. This includes specifying the realm and
domain details, and default ticket attributes. Forwardable tickets are configured by
default, which facilitates connection to the administration interface from any operating
system, and also provides for auditing of administration operations.
- </div><div class="para">
- The following is an example of a Kerberos configuration file for FreeIPA:
- </div><pre class="programlisting">[libdefaults]
+ </div></div></div><div class="section"
id="what-happens-clients"><div
class="titlepage"><div><div><h2 class="title"
id="what-happens-clients">3.1. What Happens in Client
Setup</h2></div></div></div><div class="para">
+ Whether the client configuration is performed automatically on Fedora systems using
the client setup script or manually on other systems, the general process of configuring a
machine to serve as a FreeIPA client is mostly the same, with slight variation depending
on the platform:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Retrieve the CA certificate for the FreeIPA CA.
+ </div></li><li class="listitem"><div
class="para">
+ Create a separate Kerberos configuration to test the provided credentials. This
enables a Kerberos connection to the FreeIPA XML-RPC server, necessary to join the FreeIPA
client to the FreeIPA domain. This Kerberos configuration is ultimately discarded.
+ </div><div class="para">
+ Setting up the Kerberos configuration includes specifying the realm and domain
details, and default ticket attributes. Forwardable tickets are configured by default,
which facilitates connection to the administration interface from any operating system,
and also provides for auditing of administration operations. For example, this is the
Kerberos configuration for Fedora systems:
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
@@ -856,83 +854,47 @@
EXAMPLE.COM = {
[domain_realm]
.example.com =
EXAMPLE.COM
example.com =
EXAMPLE.COM
-</pre><div class="para">
- Use the following tests to ensure that the configuration is working correctly:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- On the system console, log in as a FreeIPA user. After you have logged in, open a
shell and run the following commands:
- </div><div class="para">
- <code class="command">$ id</code> (ensure that the user IDs
and group IDs are correct)
- </div><div class="para">
- <code class="command">$ getent passwd
<userid></code>
- </div><div class="para">
- <code class="command">$ getent group ipausers</code>
- </div></li></ul></div></div><div
class="section"
id="fedora-Configuring_NFS_v4_with_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="fedora-Configuring_NFS_v4_with_Kerberos">2.1.3. Configuring NFS v4 with
Kerberos</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Obtain a Kerberos ticket for the admin user.
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- Add an NFS service principal on the client.
- </div><div class="para">
- <code class="command"># ipa service-add
nfs/ipaclient.example.com</code>
- </div></li><li class="listitem"><div
class="para">
- Obtain a keytab for the NFS service principal.
- </div><div class="para">
- <code class="command"># ipa-getkeytab -s
ipaserver.example.com -p
nfs/ipaclient.example.com -k /etc/krb5.keytab</code>
- </div><div class="note"><div
class="admonition_header"><h2>NFS Encryption
Support</h2></div><div class="admonition"><div
class="para">
- Some versions of the Linux NFS implementation have limited encryption type
support. If your NFS server is hosted on a version older than Fedora 15, you may need to
use the <code class="option">-e des-cbc-crc</code> option to the
<code class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs you want to set up, both on the server and on all
clients. This instructs the KDC to generate only DES keys.
- </div><div class="para">
- If you use this option to generate DES keys, then all clients and servers that
rely on this encryption type need to have the <code
class="option">allow_weak_crypto</code> option enabled in the
[libdefaults] section of the <code
class="filename">/etc/krb5.conf</code> file. Without these
configuration changes, NFS clients and servers will be unable to authenticate to each
other, and attempts to mount NFS filesystems may fail. The client's rpc.gssd and the
server's rpc.svcgssd daemons may log errors indicating that DES encryption types are
not permitted.
- </div></div></div></li><li
class="listitem"><div class="para">
- Add the following line to the <code
class="filename">/etc/sysconfig/nfs</code> file:
- </div><pre class="programlisting">SECURE_NFS=yes
</pre></li><li class="listitem"><div
class="para">
- Start the rpcgssd daemon.
- </div><div class="para">
- <code class="command"># service rpcgssd start</code>
- </div></li></ol></div><div class="para">
- The FreeIPA client should now be fully configured to mount NFS shares using Kerberos
credentials. Use the following command to test the configuration:
- </div><div class="para">
- <code class="command"># mount -v -t nfs4 -o sec=krb5
ipaserver.example.com:/ /mnt</code>
- </div></div></div><div class="section"
id="Using_Microsoft_Windows"><div
class="titlepage"><div><div><h2 class="title"
id="Using_Microsoft_Windows">2.2. Configuring a Microsoft Windows System as a
FreeIPA Client</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Run the <code class="command">ipa-join</code> command to
perform the actual join
+ </div></li><li class="listitem"><div
class="para">
+ Obtain a service principal for the host service and installs it into <code
class="filename">/etc/krb5.keytab</code>. For example, <code
class="systemitem">host/ipa.example.com(a)EXAMPLE.COM</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Enable certmonger, retrieve an SSL server certificate, and install the certificate
in <code class="filename">/etc/pki/nssdb</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Disable the nscd daemon.
+ </div></li><li class="listitem"><div
class="para">
+ Configures SSSD or LDAP/KRB5, including NSS and PAM configuration files.
+ </div></li><li class="listitem"><div
class="para">
+ Configure NTP.
+ </div></li></ul></div></div><div
class="section" id="Configuring_Microsoft_Windows"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_Microsoft_Windows">3.2. Configuring a Microsoft Windows
System as a FreeIPA Client</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
FreeIPA does <span
class="emphasis"><em>not</em></span> support Microsoft
Windows client authentication.
</div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Download the MIT <span class="productname">Kerberos</span>
- 3.x package for Windows to a known location, and then run the <code
class="filename">kfw-3.x-exe</code> file that you downloaded to start
the <span class="application"><strong>MIT Kerberos Installation
Wizard</strong></span>.
+ Download the MIT Kerberos 3.x package for Windows.
</div></li><li class="listitem"><div
class="para">
- Read the license agreement and then click <span
class="guibutton"><strong>I Agree</strong></span> to accept
the agreement.
+ Run the <code class="filename">kfw-3.x-exe</code> file to
launch the MIT Kerberos Installation Wizard.
</div></li><li class="listitem"><div
class="para">
- Ensure you choose to install KfW Client; the other components are optional.
+ Read and accept the license agreement.
+ </div></li><li class="listitem"><div
class="para">
+ Install the KfW client. All other components are optional.
</div></li><li class="listitem"><div
class="para">
Accept the default destination path.
</div></li><li class="listitem"><div
class="para">
- Select <span class="guilabel"><strong>Download from web
path</strong></span>, and enter the following URL:
- </div><pre class="programlisting">http://<your FreeIPA
server's fully-qualified domain name>/ipa/config/
-</pre></li><li class="listitem"><div
class="para">
+ Select <span class="guilabel"><strong>Download from web
path</strong></span>, and enter the URL to the FreeIPA server. For example:
+ </div><pre
class="programlisting">http://ipaserver.example.com/ipa/conf...
class="listitem"><div class="para">
Select <span class="guilabel"><strong>Autostart the Network
Identity Manager each time you login to Windows</strong></span>.
</div></li><li class="listitem"><div
class="para">
Click <span
class="guibutton"><strong>Install</strong></span> to begin
the installation. When the installation is complete, click <span
class="guibutton"><strong>Finish</strong></span> to exit
the Wizard.
</div></li><li class="listitem"><div
class="para">
Edit the hosts file and add the FreeIPA server. For example:
- </div><pre class="programlisting"><numerical IP
address>
ipaserver.example.com ipaserver
-</pre><div class="para">
- Depending on the version of Windows, the HOSTS file could be located in different
directories. For example:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Windows 2000 Pro: <code
class="filename">C:\WINNT\system32\drivers\etc\</code>
- </div></li><li class="listitem"><div
class="para">
- Windows XP Pro: <code
class="filename">C:\WINDOWS\system32\drivers\etc\</code>
- </div></li></ul></div></li></ol></div></div><div
class="section" id="Configuring_an_IPA_Client_on_Solaris"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Solaris">2.3. Configuring a Solaris System
as a FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10">2.3.1. Configuring
Solaris 10</h3></div></div></div><div
class="para">
- FreeIPA provides an automated method of configuring Solaris 10 to function as a
FreeIPA client. On your Solaris client, run the following command (ensure that you replace
the example domain name with your own):
-<pre class="screen"><code class="command"># ldapclient
init ipa.example.com</code></pre>
-
- </div><div class="para">
- When FreeIPA is installed it creates a configuration profile that will automatically
set up the necessary PAM and <code
class="filename">/etc/ldap.conf</code> configuration for Solaris.
- <div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You can add the <code class="option">-v</code> option to this
command to display more details about the command operation.
- </div></div></div>
-
- </div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Kerberos">2.3.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Configure the <code
class="filename">/etc/krb5/krb5.conf</code> file as follows:
- </div><pre class="programlisting">[libdefaults]
+ </div><pre class="programlisting">1.2.3.4
ipaserver.example.com ipaserver</pre><div class="para">
+ Depending on the version of Windows, the HOSTS file could be located in different
directories.
+ </div></li></ol></div></div><div
class="section" id="Configuring_an_IPA_Client_on_Solaris"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Solaris">3.3. Configuring a Solaris System
as a FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris_10"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10">3.3.1. Configuring Solaris
10</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"
id="st.sol1"><div class="para">
+ As with Fedora systems, FreeIPA provides an automated method of configuring Solaris
10 to function as a FreeIPA client. On the Solaris client, run the <code
class="command">ldapclient</code> with the name of the FreeIPA domain:
+ </div><pre class="programlisting"><span
class="perl_Comment"># ldapclient init
ipa.example.com
-v</span></pre><div class="para">
+ When the command is run, it creates a configuration profile that will automatically
set up the necessary PAM and <code
class="filename">/etc/ldap.conf</code> configuration.
+ </div></li><li class="listitem"><div
class="para">
+ Configure the <code
class="filename">/etc/krb5/krb5.conf</code> file. The Kerberos
configuration includes specifying the realm and domain details and default ticket
attributes. The default file created by <code
class="command">ldapclient</code> configures forwardable tickets by
default, which makes it possible to connect to the UI from any system and provides a way
to audit administration operations.
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
[realms]
@@ -958,107 +920,77 @@ kinit = {
renewable = true
forwardable= true
}
-</pre><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Client_SSH_Access"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Client_SSH_Access">2.3.1.2. Configuring
Client SSH Access</h4></div></div></div><div
class="para">
- Use the following procedure to configure the Solaris FreeIPA client to accept
incoming SSH requests and authenticate with the user's Kerberos credentials. Remember
to replace the example host and domain names with your own host and domain name.
- </div><div class="para">
- The <span class="package">ipa-admintools</span> package is not
available for Solaris. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add a host service principal for the Solaris client.
- </div><div class="para">
-
-<pre class="screen"><code class="command"> # ipa
service-add
host/solarisipaclient.example.com </code></pre>
-
- </div></li><li class="listitem"><div
class="para">
- Create the host keytab file.
- </div><div class="para">
-
-<pre class="screen"><code class="command"># ipa-getkeytab
-s
ipaserver.example.com -p
host/solarisipaclient.example.com -k \</code>
-<code class="command">/tmp/krb5.keytab -e
des-cbc-crc</code></pre>
-
- </div></li><li class="listitem"><div
class="para">
- Copy this keytab to the Solaris machine as <code
class="filename">/etc/krb5/krb5.keytab</code>.
- </div><div class="para">
-
-<pre class="screen"><code class="command"># scp
/tmp/krb5.keytab root@solarisipaclient.example.com:/etc/krb5/krb5.keytab
</code></pre>
-
- </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- After you have performed all of the preceding configuration steps, reboot the
Solaris machine to ensure that all of the changes take effect.
- </div></div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_NFS_v4"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_NFS_v4">2.3.1.3. Configuring
NFS v4</h4></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The NFS v4 configuration is only supported on Solaris 10.
- </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Obtain a Kerberos ticket for the admin user.
-<pre class="screen"><code class="command"># kinit admin
</code></pre>
-
- </div></li><li class="listitem"><div
class="para">
- The <span class="package">ipa-admintools</span> package is
not available for Solaris. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add an NFS service principal for the client.
-<pre class="screen"><code class="command"># ipa
service-add
nfs/solarisipaclient.example.com </code></pre>
+</pre></li><li class="listitem"
id="st.sol3"><div class="para">
+ Configure SSH access so that the Solaris FreeIPA client to accept incoming SSH
requests and authenticate with the user's Kerberos credentials.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ On the FreeIPA server, add a host service principal for the Solaris client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/solarisipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ On the FreeIPA server, create the host keytab file.
+ </div><pre class="programlisting"><span
class="perl_Comment"># ipa-getkeytab -s
ipaserver.example.com -p
host/solarisipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy this keytab to the Solaris machine, and save it as <code
class="filename">/etc/krb5/krb5.keytab</code>.
+ </div><pre class="programlisting"><span
class="perl_Comment"># scp /tmp/krb5.keytab
root@solarisipaclient.example.com:/etc/krb5/krb5.keytab</span></pre></li><li
class="listitem"><div class="para">
+ Reboot the Solaris client machine.
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
+ Configure NFS to work with the Kerberos domain.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Obtain a Kerberos ticket for the admin user.
+<pre class="programlisting"><span class="perl_Comment">#
kinit admin</span></pre>
- </div></li><li class="listitem"><div
class="para">
- Create the NFS keytab file.
-<pre class="screen"><code class="command"># ipa-getkeytab
-s
ipaserver.example.com -p
nfs/solarisipaclient.example.com -k \</code>
-<code class="command">/tmp/krb5.keytab -e
des-cbc-crc</code></pre>
-
- </div><div class="note"><div
class="admonition_header"><h2>NFS Encryption
Support</h2></div><div class="admonition"><div
class="para">
- Some versions of the Linux NFS implementation have limited encryption type
support. If your NFS server is hosted on a version older than Fedora 15, you may need to
use the <code class="option">-e des-cbc-crc</code> option to the
<code class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs you want to set up, both on the server and on all
clients. This instructs the KDC to generate only DES keys.
- </div><div class="para">
- If you use this option to generate DES keys, then all clients and servers that
rely on this encryption type need to have the <code
class="option">allow_weak_crypto</code> option enabled in the
[libdefaults] section of the <code
class="filename">/etc/krb5.conf</code> file. Without these
configuration changes, NFS clients and servers will be unable to authenticate to each
other, and attempts to mount NFS filesystems may fail. The client's rpc.gssd and the
server's rpc.svcgssd daemons may log errors indicating that DES encryption types are
not permitted.
- </div></div></div></li><li
class="listitem"><div class="para">
- Use the <code class="command">klist</code> command to
verify that the ticket was created:
-<pre class="screen"><code class="command"># klist -ket
/tmp/krb5.keytab</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Set up the NFS/Kerberos mapping for the Solaris client <span
class="emphasis"><em>on the FreeIPA server</em></span>.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Add an NFS service principal for the client.
+<pre class="programlisting"><span class="perl_Comment">#
ipa service-add nfs/solarisipaclient.example.com</span></pre>
- </div></li><li class="listitem"><div
class="para">
- Copy the keytab from the server to the client.
-<pre class="screen"><code class="command"># scp
/tmp/krb5.keytab root@solarisipaclient.example.com:/tmp/krb5.keytab
</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Create the NFS keytab file.
+<pre class="programlisting"><span class="perl_Comment">#
ipa-getkeytab -s
ipaserver.example.com -p
nfs/solarisipaclient.example.com -k
/tmp/krb5.keytab -e des-cbc-crc</span></pre>
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
-<pre class="screen"><code class="command">#
ktutil</code>
-<code class="command">ktutil: read_kt /tmp/krb5.keytab</code>
-<code class="command">ktutil: write_kt
/etc/krb5/krb5.keytab</code>
-<code class="command">ktutil: q</code></pre>
+ </div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Some versions of the Linux NFS implementation have limited encryption type
support. If the NFS server is hosted on a version older than Fedora 15, use the <code
class="option">-e des-cbc-crc</code> option to the <code
class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs to set up, both on the server and on all clients.
This instructs the KDC to generate only DES keys.
+ </div><div class="para">
+ When using DES keys, all clients and servers that rely on this encryption type
need to have the <code class="option">allow_weak_crypto</code>
option enabled in the <code class="command">[libdefaults]</code>
section of the <code class="filename">/etc/krb5.conf</code> file.
Without these configuration changes, NFS clients and servers are unable to authenticate to
each other, and attempts to mount NFS filesystems may fail. The client's <code
class="command">rpc.gssd</code> and the server's <code
class="command">rpc.svcgssd</code> daemons may log errors indicating
that DES encryption types are not permitted.
+ </div></div></div></li><li
class="listitem"><div class="para">
+ Use the <code class="command">klist</code> command to
verify that the ticket was created:
+<pre class="programlisting"><span class="perl_Comment">#
klist -ket /tmp/krb5.keytab</span></pre>
- </div></li></ol></div><div class="para">
- The FreeIPA client should now be fully configured to mount NFS shares using Kerberos
credentials.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2. Configuring
Solaris 9</h3></div></div></div><div
class="para">
- The procedures for configuring Solaris 9 as a FreeIPA client are the same as those
for Solaris 10, with the exception of the PAM configuration. This is described below.
- </div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_9-Configuring_PAM_on_Solaris_9"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_9-Configuring_PAM_on_Solaris_9">2.3.2.1. Configuring
PAM on Solaris 9</h4></div></div></div><div
class="para">
- Configure the <code class="filename">/etc/pam.conf</code> file
to use PAM Kerberos. The following example shows how to set up PAM Kerberos authentication
on Solaris 9 for console login:
- </div><pre class="programlisting">login auth requisite
pam_authtok_get.so.1
+ </div></li><li class="listitem"><div
class="para">
+ Copy the keytab from the server to the client.
+<pre class="programlisting"><span class="perl_Comment">#
scp /tmp/krb5.keytab
root@solarisipaclient.example.com:/tmp/krb5.keytab</span></pre>
+
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
+ On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
+<pre class="programlisting"><span class="perl_Comment">#
ktutil</span><span class="perl_Comment"></span>
+<span class="perl_Comment"></span>ktutil: <span
class="perl_Reserved">read</span>_kt /tmp/krb5.keytab
+ktutil: <span class="perl_BString">write</span>_kt
/etc/krb5/krb5.keytab
+ktutil: q</pre>
+
+ </div></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2. Configuring
Solaris 9</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Perform steps <a class="xref" href="#st.sol1">1</a>
through <a class="xref" href="#st.sol3">3</a> in <a
class="xref"
href="#Configuring_an_IPA_Client_on_Solaris_10">Section 3.3.1, “Configuring
Solaris 10”</a> to set up the Solaris 9 client.
+ </div></li><li class="listitem"><div
class="para">
+ Configure the <code class="filename">/etc/pam.conf</code>
file to use PAM Kerberos. For example:
+ </div><pre class="programlisting">login auth requisite
pam_authtok_get.so.1
login auth sufficient pam_krb5.so.1 use_first_pass
login auth sufficient pam_unix.so.1 use_first_pass
login auth required pam_dhkeys.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
-</pre></div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_HP_UX">2.4. Configuring an HP-UX System as a
FreeIPA</h2></div></div></div><div class="para">
- This chapter describes how to configure HP-UX as a FreeIPA client. It also includes
some verification tests to ensure that the configuration is working correctly.
- </div><div class="para">
- Before starting the FreeIPA installation, ensure that you update your system with all
the latest packages.
- </div><div class="para">
- To install an HP-UX client you need administrator privileges in the form of the
Directory Manager password. There is no other way to perform the installation.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+</pre></li></ol></div></div></div><div
class="section" id="Configuring_an_IPA_Client_on_HP_UX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_HP_UX">3.4. Configuring an HP-UX System as a
FreeIPA</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP"><h5
class="formalpara">Configuring NTP</h5>
- Before proceeding with the following configuration steps, ensure that NTP is
correctly configured and enabled, and that time is synchronized between the client and the
FreeIPA server.
- </div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">2.4.1. Configuring
LDAP Authentication</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Install the ldapux client on the HP-UX 11.23 machine.
- </div><div class="para">
- <code class="command"> # swinstall -s
J4269AA_B.04.15.01_HP-UX_B.11.23_IA_PA.depot </code>
- </div></li><li class="listitem"><div
class="para">
- Change to the configuration directory and run the setup script.
- </div><div class="para">
- <code class="command"># cd /opt/ldapux/config/</code>
- </div><div class="para">
- <code class="command"># ./setup</code>
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You only need to perform this configuration on the first HP-UX client. All further
configurations only need to know where the LDAP profile is stored. All clients will then
use the same configuration.
+ </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1. Configuring
NTP</h3></div></div></div><div class="para">
+ Configure and enable NTP and make sure that time is synchronized between the client
and the FreeIPA server.
+ </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2. Configuring
LDAP Authentication</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Install the <code class="filename">ldapux</code> client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># swinstall -s
J4269AA_B.04.15.01_HP-UX_B.11.23_IA_PA.depot</span></pre></li><li
class="listitem"><div class="para">
+ Change to the configuration directory, and run the setup script.
+ </div><pre class="programlisting"><span
class="perl_Comment"># cd /opt/ldapux/config/</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span>
+<span class="perl_Comment"># ./setup</span></pre><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Running the setup script is only necessary for the first HP-UX client. Every
subsequent HP-UX client only needs to know where the LDAP profile is stored. All clients
will then use the same configuration.
</div><div class="para">
- The HP-UX guide for this procedure is located at <a
href="http://docs.hp.com/en/J4269-90075/ch02s07.html">http:/...
+ For more information on this, see the HP-UX documentation at <a
href="http://docs.hp.com/en/J4269-90075/ch02s07.html">http:/...;.
</div></div></div><div class="para">
- The following is a sample output from running the above script:
+ The setup script prompts for information about the FreeIPA LDAP service, such as
its port and host, Directory Manager credentials, and schema and directory suffixes.
</div><pre class="programlisting">Would you like to continue
with the setup? [Yes]
Select which Directory Server you want to connect to ? [RedHat Directory]
Directory server host ? [
ipaserver.example.com]
@@ -1078,54 +1010,36 @@ Bind time limit [5 seconds]
Search time limit [no limit]
Do you want client searches of the directory to follow referrals? [Yes]
Profile TTL [0 = infinite]
-Do you want to remap any of the standard <a
href="http://www.ietf.org/rfc/rfc2307.txt">RFC 2307</a> attribute?
[Yes]
+Do you want to remap any of the standard RFC 2307 attribute? [Yes]
Specify the service you want to map? [ 3=Group]
Specify the attribute you want to map [3 for memberuid ]
Type the name of the attribute memberuid should be mapped to [member]
Specify the service you want to map? [ 0 = exit ]
-Do you want to remap any of the standard <a
href="http://www.ietf.org/rfc/rfc2307.txt">RFC 2307</a> attribute? [ no
this time ]
+Do you want to remap any of the standard RFC 2307 attribute? [ no this time ]
Do you want to create custom search descriptors? [ No ]
</pre></li><li class="listitem"><div
class="para">
Ensure that the LDAP client daemon is running.
- </div><div class="para">
- <code class="command"># ps -ef | grep ldapclientd</code>
- </div><div class="para">
- If necessary, use the following command to start the daemon:
- </div><div class="para">
- <code class="command"># /opt/ldapux/bin/ldapclientd</code>
- </div></li><li class="listitem"><div
class="para">
- Run the following commands to ensure that the LDAP client is working:
- </div><div class="para">
- <code class="command"># nsquery passwd admin</code> (user
should be visible)
- </div><div class="para">
- <code class="command"># nsquery group admins</code> (group
and user should be visible)
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># ps -ef | grep
ldapclientd</span></pre><div class="para">
+ If necessary, start the daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment">#
/opt/ldapux/bin/ldapclientd</span></pre></li><li
class="listitem"><div class="para">
+ Check that the user and group entries in the LDAP client are correct and
available:
+ </div><pre class="programlisting"><span
class="perl_Comment"># nsquery passwd admin</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># nsquery group
admins</span></pre></li><li class="listitem"><div
class="para">
Create a new group on the FreeIPA server.
- </div><div class="para">
- <code class="command"> # ipa group-add testgroup </code>
- </div></li><li class="listitem"><div
class="para">
- Add a test user to the new group created above.
- </div><div class="para">
- <code class="command"> # ipa group-add-member -a testuser testgroup
</code>
- </div></li><li class="listitem"><div
class="para">
- Run the <code class="command">nsquery</code> commands again
to validate the new user and group:
- </div><div class="para">
- <code class="command"># nsquery passwd testuser</code> (user
should be visible)
- </div><div class="para">
- <code class="command"># nsquery group testgroup</code> (group
and user should be visible)
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa group-add
testgroup</span></pre></li><li class="listitem"><div
class="para">
+ Add a test user to the new group.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa group-add-member -a testuser
testgroup</span></pre><div class="para">
+ Validate the new user and group:
+ </div><pre class="programlisting"><span
class="perl_Comment"># nsquery passwd testuser</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># nsquery group
testgroup</span></pre></li><li class="listitem"><div
class="para">
To ensure that the LDAP client daemon starts when the system boots, add the
following lines to the <code
class="filename">/etc/opt/ldapux/ldapclientd.conf</code> file:
<pre class="programlisting">[StartOnBoot]
enable=yes
</pre>
- </div></li></ol></div><div class="para">
- This concludes the LDAP client configuration.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2. Configuring
Kerberos and PAM</h3></div></div></div><div
class="para">
- The Kerberos and PAM configuration process is completely manual. Sample configuration
files are provided for reference, but you need to edit your own system files to reflect
your deployment.
- </div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos">2.4.2.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Edit the <code class="filename">/etc/krb5.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">[libdefaults]
+ </div></li></ol></div></div><div
class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3. Configuring
Kerberos</h3></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/krb5.conf</code> file to
reflect the Kerberos domain used by the FreeIPA server. Setting up the Kerberos
configuration includes specifying the realm and domain details, and default ticket
attributes. Forwardable tickets are configured by default, which facilitates connection to
the administration interface from any operating system, and also provides for auditing of
administration operations. For example:
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
default_tkt_enctypes = DES-CBC-CRC
default_tgs_enctypes = DES-CBC-CRC
@@ -1147,46 +1061,16 @@
example.com =
EXAMPLE.COM
kinit = {
forwardable = true
}
-</pre><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing administration operations.
- </div></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_PAM"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_PAM">2.4.2.2. Configuring
PAM</h4></div></div></div><div class="para">
- The PAM configuration differs slightly between different versions of HP-UX. These
configurations are described below.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_PAM-HP_UX_11i_v2"><h5
class="formalpara">HP-UX 11i v2</h5>
- Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">#
+</pre></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_PAM"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_PAM">3.4.4. Configuring
PAM</h3></div></div></div><div class="para">
+ The PAM configuration differs slightly between different versions of HP-UX.
+ </div><div class="section"
id="Configuring_PAM-HP_UX_11i_v2"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_PAM-HP_UX_11i_v2">3.4.4.1. HP-UX 11i
v2</h4></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/pam.conf</code> file so
that all of the required modules are loaded for authentication. For example:
+ </div><pre class="programlisting">#
# PAM configuration
#
# This pam.conf file is intended as an example only.
# see pam.conf(4) for more details
-#
-#
-################################################################
-# This sample file will authenticate the user who belongs to #
-# either Kerberos or Unix system. Using this configuration file#
-# if the user is authenticated through Kerberos then the Unix #
-# authentication will not be invoked. However,if the Kerberos #
-# authentication fails for the user, then the fallback #
-# authentication mechanism PAM-Unix will be invoked to #
-# authenticate the user.The assumption is the user is either #
-# present in Kerberos or in Unix system. #
-# #
-# In case, the administrator wants the password for all the #
-# users to be synchronous between Kerberos and Unix systems, #
-# then the control flag should to be set to "required" for all #
-# the entries with use_first_pass option set for pam_unix. #
-# If password synchronization is optional then try_first_pass #
-# option need to be set for pam_unix, so that the user can #
-# login using the appropriate passwords. #
-# #
-# The module pam_hpsec(5) is stacked as mandatory module above #
-# all the modules for making security checks before #
-# authentication. #
-
-################################################################
-#
-#
-
# Authentication management
#
login auth required libpam_hpsec.so.1
@@ -1265,36 +1149,15 @@ dtaction password required libpam_hpsec.so.1
dtaction password sufficient libpam_krb5.so.1
dtaction password required libpam_unix.so.1
OTHER password required libpam_unix.so.1
-</pre><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_PAM-HP_UX_11i_v1"><h5
class="formalpara">HP-UX 11i v1</h5>
- Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">#
+</pre></div><div class="section"
id="Configuring_PAM-HP_UX_11i_v1"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_PAM-HP_UX_11i_v1">3.4.4.2. HP-UX 11i
v1</h4></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
+ </div><pre class="programlisting">#
# PAM configuration
#
# This pam.conf file is intended as an example only.
# see pam.conf(4) for more details
#
-################################################################
-# This sample file will authenticate the user who belongs to #
-# either Kerberos or Unix system. Using this configuration file#
-# if the user is authenticated through Kerberos then the Unix #
-# authentication will not be invoked. However,if the Kerberos #
-# authentication fails for the user, then the fallback #
-# authentication mechanism PAM-Unix will be invoked to #
-# authenticate the user.The assumption is the user is either #
-# present in Kerberos or in Unix system. #
-# #
-# In case, the administrator wants the password for all the #
-# users to be synchronous between Kerberos and Unix systems, #
-# then the control flag should to be set to "required" for all #
-# the entries with user_first_pass option set for pam_unix. #
-# If password synchronization is optional then try_first_pass #
-# option need to be set for pam_unix, so that the user can #
-# login using the appropriate passwords. #
-
-################################################################
-#
-
# Authentication management
#
login auth sufficient /usr/lib/security/libpam_krb5.1
@@ -1347,52 +1210,36 @@ dtlogin password required /usr/lib/security/libpam_unix.1
dtaction password sufficient /usr/lib/security/libpam_krb5.1
dtaction password required /usr/lib/security/libpam_unix.1
OTHER password required /usr/lib/security/libpam_unix.1
-</pre></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Access_Control">2.4.2.3. Configuring
Access Control</h4></div></div></div><div
class="para">
- On HP-UX systems a PAM module called pam_authz is available which can be used to
control login access to the system based on a user's group membership.
- </div><div class="para">
- Refer to the HP-UX documentation on pam_authz for details on how to configure access
control for HP-UX systems: <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3. Configuring
SSH</h3></div></div></div><div class="para">
- Before you can use SSH to connect to the FreeIPA server without using a password, you
need to install a suitable version of <code
class="command">ssh</code>, and set up the correct authentication
attributes in the SSH configuration file.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Ensure that you have version A.05.10.007 or later of <code
class="command">ssh</code> installed. Navigate to the following URL to
download a suitable version:
-<pre class="screen"><a
href="http://software.hp.com/portal/swdepot/displayProductInfo.do?pr...
-
+</pre></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5. Configuring
SSH</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Ensure that you have version A.05.10.007 or later of <code
class="command">ssh</code> installed. A current package can be
downloaded from the HO website at <a
href="http://software.hp.com/portal/swdepot/displayProductInfo.do?pr...;.
</div></li><li class="listitem"><div
class="para">
- Make the following changes to the <code
class="filename">/etc/opt/ssh/ssh_config</code> file:
- <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Remove any "PreferredAuthentications" entries.
- </div></li><li class="listitem"><div
class="para">
- Add the following three lines:
+ Edit the <code
class="filename">/etc/opt/ssh/ssh_config</code> file:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Remove any <code
class="command">PreferredAuthentications</code> entries.
+ </div></li><li class="listitem"><div
class="para">
+ Add the following three lines:
<pre class="programlisting">Host *
GSSAPIAuthentication yes
PreferredAuthentications "gssapi-with-mic,publickey,password"
</pre>
- </div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
- Ensure that you include the tab character before the
"GSSAPIAuthentication" and "PreferredAuthentications" entries, and the
double quotes around the "PreferredAuthentications" argument.
- </div></div></div></li></ul></div>
-
- </div></li><li class="listitem"><div
class="para">
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ Include the tab character before the <code
class="command">GSSAPIAuthentication</code> and <code
class="command">PreferredAuthentications</code> lines, and include the
double quotes around the <code
class="command">PreferredAuthentications</code> value.
+ </div></div></div></li></ul></div></li><li
class="listitem"><div class="para">
Remove the <code class="filename">/etc/krb5.keytab</code>
file.
</div></li><li class="listitem"><div
class="para">
- On the FreeIPA server:
+ Set up the NFS/Kerberos mapping for the Solaris client <span
class="emphasis"><em>on the FreeIPA server</em></span>.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Add a host service principal for the HP-UX client.
- </div><div class="para">
- <code class="command"> # ipa service-add
host/hpuxipaclient.example.com </code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/hpuxipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
Create the host keytab file.
- </div><div class="para">
- <code class="command"> # ipa-getkeytab -s
ipaserver.example.com
-p
host/hpuxipaclient.example.com -k /tmp/krb5.keytab -e des-cbc-crc</code>
- </div></li><li class="listitem"><div
class="para">
- Copy this keytab to the HP-UX machine as <code
class="filename">/etc/krb5/krb5.keytab</code>.
- </div><div class="para">
- <code class="command"> # scp /tmp/krb5.keytab
root@hpuxipaclient.example.com:/etc/krb5/krb5.keytab </code>
- </div></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4. Configuring
Access Control</h3></div></div></div><div
class="para">
- HP-UX systems provide a PAM module called pam_authz which can be used to control
login access to the system based on a user's group membership. Refer to the following
HP-UX pam_authz documentation for details on how to configure access control for HP-UX
systems: <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...
- </div><div class="para">
- The following is a sample <code
class="filename">/etc/opt/ldapux/pam_authz.policy</code> file:
-<pre class="programlisting">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa-getkeytab -s
ipaserver.example.com -p
host/hpuxipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy this keytab to the HP-UX machine, and save it as <code
class="filename">/etc/krb5/krb5.keytab</code>.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># scp /tmp/krb5.keytab
root@hpuxipaclient.example.com:/etc/krb5/krb5.keytab</span></pre></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6. Configuring
Access Control</h3></div></div></div><div
class="para">
+ HP-UX systems provide the <code
class="systemitem">pam_authz</code> PAM module, which can be used to
control login access to the system based on a user's group membership. For details on
how to configure access control with this module, see the HP documenttion at <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...;.
+ </div><div class="example"
id="ex.hp-pam-authz-mod"><h6>Example 3.1. pam_authz.policy File: Allow
User Access, Deny Admin Access</h6><div
class="example-contents"><div class="para">
+ This configuration in <code
class="filename">/etc/opt/ldapux/pam_authz.policy</code> prevents the
admin user from logging in while still allowing regular users to log in.
+ </div><pre class="programlisting">
# pam_authz.policy.template:
#
# An example file that could be copied over to /etc/opt/ldapux/pam_authz.policy.
@@ -1426,38 +1273,19 @@ OTHER password required /usr/lib/security/libpam_unix.1
deny:unix_group:admins
allow:unix_local_user
-</pre>
-
- </div><div class="para">
- This configuration will prevent the admin user from logging in, but local UNIX users
can still log in.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5. Testing
the Configuration</h3></div></div></div><div
class="para">
- Use the following tests to validate the PAM and Kerberos configuration:
+</pre></div></div><br class="example-break"
/></div><div class="section" id="hp-test"><div
class="titlepage"><div><div><h3 class="title"
id="hp-test">3.4.7. Testing the
Configuration</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. It may be
necessary to install bash to be able to log in.
+ </div></div></div><div class="para">
+ There are three quick ways to check the Kerberos and PAM configuration for the HP
client:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- On the HP-UX client machine, run <code class="command">kinit
admin</code> and enter the password.
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div><div class="para">
- <code class="command"># klist</code> (to verify that you
received a valid ticket)
- </div></li><li class="listitem"><div
class="para">
- From another Linux client machine, attempt to log in using SSH.
- </div><div class="para">
- <code class="command"> # ssh admin(a)hpuxipaclient.example.com
</code>
- </div><div class="para">
- The admin user should be able to log in using SSH without being asked for a
password.
- </div></li></ul></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
- On the HP-UX client console, at the login prompt, enter the Administrator's
login ID and password. The admin user should be able to log in from the console.
- </div></li></ul></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. You may need
to install bash (or link sh to /bin/bash or modify admin to use /bin/sh or a shell
available in all of your systems) to be able to log in.
- </div></div></div></div></div><div
class="section" id="Configuring_an_IPA_Client_on_AIX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_AIX">2.5. Configuring an AIX System as a
FreeIPA Client</h2></div></div></div><div
class="para">
- This chapter describes how to configure AIX as a FreeIPA client.
- </div><div class="para">
- Before starting the FreeIPA installation, update your system with all the latest
packages.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div><div class="para">
- Many of the following procedures and instructions use example host names, domain
names, and realm names for illustration purposes. You need to replace these example names
with those that apply to your own deployment.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1. Prerequisites</h3></div></div></div><div
class="para">
- Before you begin the configuration, ensure that the following software is installed
and up to date. This can be installed from your AIX media:
+ Attempt to log into the Kerberos realm <span
class="emphasis"><em>from the client machine</em></span> by
using the admin credentials:
+ </div><pre class="programlisting"><span
class="perl_Comment"># kinit admin</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># klist</span></pre></li><li
class="listitem"><div class="para">
+ Attempt to log into the HP machine from another machine in the domain using SSH.
The admin user should be able to log in using SSH without being asked for a password.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ssh
admin(a)hpuxipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ Log into the FreeIPA web UI using the administrator credentials on the HP machine.
+ </div></li></ul></div></div></div><div
class="section" id="Configuring_an_IPA_Client_on_AIX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_AIX">3.5. Configuring an AIX System as a
FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1. Prerequisites</h3></div></div></div><div
class="para">
+ Make sure that all of these packages are installed on the AIX machine before
beginning the client configuration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
v5.3 OS
</div></li><li class="listitem"><div
class="para">
@@ -1478,26 +1306,22 @@ allow:unix_local_user
openssl
</div></li><li class="listitem"><div
class="para">
modcrypt.base (for gssd)
- </div></li></ul></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2. Configuring
Client Authentication</h3></div></div></div><div
class="para">
- Before you begin the following procedures, ensure that NTP is correctly configured
and enabled, and that time is synchronized between the client and the FreeIPA master.
+ </div></li></ul></div><div class="para">
+ Configure and enable NTP and make sure that time is synchronized between the client
and the FreeIPA server.
+ </div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">3.5.2. Configuring
the AIX Client</h3></div></div></div><div
class="para">
+ Setting up an AIX client requires setting up the client to work in the FreeIPA
Kerberos domain and, optionally, to enable SSH authentication to the AIX client using
FreeIPA credentials.
</div><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
+ Kerberos configuration includes specifying the realm and domain details, and default
ticket attributes. Forwardable tickets are configured by default, which facilitates
connection to the administration interface from any operating system, and also provides
for auditing of administration operations. For example:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Configure the krb5 client settings as follows:
- </div><div class="para">
- <code class="command"># mkkrb5clnt -r
EXAMPLE.COM -d
example.com -c
ipaclient.example.com -s ipaserver.example.com</code>
- </div></li><li class="listitem"><div
class="para">
+ Configure the krb5 client settings to use the FreeIPA Kerberos domain:
+ </div><pre class="programlisting"><span
class="perl_Comment"># mkkrb5clnt -r
EXAMPLE.COM -d
example.com -c
ipaclient.example.com -s ipaserver.example.com</span></pre></li><li
class="listitem"><div class="para">
Get a Kerberos ticket:
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- Configure the LDAP client settings as follows:
- </div><div class="para">
- <code class="command"># mksecldap -c -h
ipaserver.example.com -d
cn=accounts,dc=example,dc=com -a uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com -p
secret</code>
- </div></li><li class="listitem"><div
class="para">
- In the <code class="filename">/etc/security/ldap</code>
directory, create the following map files:
+ </div><pre class="programlisting"><span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ Configure the LDAP client settings to use the FreeIPA directory services:
+ </div><pre class="programlisting"><span
class="perl_Comment"># mksecldap -c -h
ipaserver.example.com -d
cn=accounts,dc=example,dc=com -a uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com -p
secret</span></pre></li><li class="listitem"><div
class="para">
+ In the <code class="filename">/etc/security/ldap</code>
directory, create user and group map files:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- FreeIPAuser.map
+ For example, for the <code
class="filename">FreeIPAuser.map</code> file:
</div><pre class="programlisting">#FreeIPAuser.map file
keyobjectclass SEC_CHAR posixaccount s
@@ -1511,13 +1335,13 @@ gecos SEC_CHAR gecos s
spassword SEC_CHAR userpassword s
lastupdate SEC_INT shadowlastchange s
</pre></li><li class="listitem"><div
class="para">
- FreeIPAgroup.map
+ For example, for the <code
class="filename">FreeIPAgroup.map</code> file:
</div><pre class="programlisting">#FreeIPAgroup.map file
groupname SEC_CHAR cn s
id SEC_INT gidNumber s
users SEC_LIST member m
</pre></li></ul></div></li><li
class="listitem"><div class="para">
- Modify the <code
class="filename">/etc/security/ldap/ldap.cfg</code> file as follows.
Remember to specify your own REALM and basedn values.
+ Modify the <code
class="filename">/etc/security/ldap/ldap.cfg</code> file to set the
REALM and base DN values for the FreeIPA domain.
</div><pre
class="programlisting">userbasedn:cn=users,cn=accounts,dc=example,dc=com
groupbasedn:cn=groups,cn=accounts,dc=example,dc=com
@@ -1527,13 +1351,9 @@ groupattrmappath:/etc/security/ldap/FreeIPAgroup.map
userclasses:posixaccount
</pre></li><li class="listitem"><div
class="para">
Start the LDAP client daemon:
- </div><div class="para">
- <code class="command"># start-secldapclntd</code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment">#
start-secldapclntd</span></pre></li><li
class="listitem"><div class="para">
Test the LDAP client connection to the FreeIPA server:
- </div><div class="para">
- <code class="command"># lsldap -a passwd </code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># lsldap -a
passwd</span></pre></li><li class="listitem"><div
class="para">
Add the following sections to the <code
class="filename">/usr/lib/security/methods.cfg</code> file to configure
the system login to use Kerberos and LDAP:
<pre class="programlisting">KRB5A:
program = /usr/lib/security/KRB5A
@@ -1549,120 +1369,96 @@ options = auth=KRB5A,db=LDAP
</pre>
</div></li><li class="listitem"><div
class="para">
- Edit the <code class="filename">/etc/security/user</code>
file, and modify the "default" section as follows:
+ Edit the <code class="filename">/etc/security/user</code>
file, and modify the <code class="command">default</code> section to
use the Kerberos/LDAP system and the LDAP user registry.
<pre class="programlisting">SYSTEM = "KRB5ALDAP"
registry = LDAP
</pre>
- </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3. Configuring
Client SSH Access</h3></div></div></div><div
class="para">
- You can also configure the FreeIPA client to accept incoming SSH requests and
authenticate with the user's Kerberos credentials. After configuring the FreeIPA
client, use the following procedure to configure the FreeIPA client for SSH connections.
Remember to replace the example host and domain names with your own host and domain name.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- SSH syslog configuration:
- </div><pre class="programlisting">auth.info
/var/log/sshd.log
+ </div></li><li class="listitem"><div
class="para">
+ To test the Kerberos configuration, log in as a FreeIPA user and verify that the
user and group information is correct:
+ </div><pre class="programlisting">$ <span
class="perl_BString">id</span></pre></li><li
class="listitem"><div class="para">
+ Optionally, configure the FreeIPA client to accept incoming SSH requests and
authenticate with the user's Kerberos credentials.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Set the SSH syslog configuration:
+ </div><pre class="programlisting">auth.info
/var/log/sshd.log
auth.info /var/log/sshd.log
auth.crit /var/log/sshd.log
auth.warn /var/log/sshd.log
auth.notice /var/log/sshd.log
auth.err /var/log/sshd.log
</pre></li><li class="listitem"><div
class="para">
- SSH logging configuration:
- </div><pre class="programlisting">SyslogFacility AUTH
+ Set the SSH logging configuration:
+ </div><pre class="programlisting">SyslogFacility AUTH
LogLevel INFO
</pre></li><li class="listitem"><div
class="para">
- Configure sshd for GSSAPI (<code
class="filename">/etc/ssh/sshd_config</code>)
- </div><pre class="programlisting"># GSSAPI options
+ Configure <code class="systemitem">sshd</code> to use
GSSAPI:
+ </div><pre class="programlisting">vim /etc/ssh/sshd_config
+
+# GSSAPI options
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
</pre></li><li class="listitem"><div
class="para">
- Restart sshd:
- </div><div class="para">
- <code class="command"># stopsrc -s sshd</code>
- </div><div class="para">
- <code class="command"># startsrc -s sshd</code>
- </div></li><li class="listitem"><div
class="para">
- Restart syslogd:
- </div><div class="para">
- <code class="command"># stopsrc -s syslogd</code>
- </div><div class="para">
- <code class="command"># startsrc -s syslogd</code>
- </div></li><li class="listitem"><div
class="para">
- The <span class="package">ipa-admintools</span> package is
not available for AIX. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add a host service principal for the client.
- </div><div class="para">
- <code class="command"> # ipa service-add
host/ipaclient.example.com </code>
- </div></li><li class="listitem"><div
class="para">
- Retrieve the host keytab.
- </div><div class="para">
- <code class="command"> # ipa-getkeytab -s ipaserver -p
host/ipaclient.example.com -k /tmp/krb5.keytab -e des-cbc-crc </code>
- </div></li><li class="listitem"><div
class="para">
- Copy the keytab from the server to the client.
- </div><div class="para">
- <code class="command"> # scp /tmp/krb5.keytab
root@ipaclient.example.com:/tmp/krb5.keytab </code>
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
- </div><pre class="screen"># ktutil
+ Restart the <code class="filename">sshd</code> daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment"># stopsrc -s sshd</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># startsrc -s
sshd</span></pre></li><li class="listitem"><div
class="para">
+ Restart the <code class="filename">syslogd</code> daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment"># stopsrc -s syslogd</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># startsrc -s
syslogd</span></pre></li><li class="listitem"><div
class="para">
+ Add the client to the FreeIPA server's Kerberos configuration.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Add a host service principal for the client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/ipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ Retrieve the host keytab.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa-getkeytab -s ipaserver -p
host/ipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy the keytab from the server to the client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># scp /tmp/krb5.keytab
root@ipaclient.example.com:/tmp/krb5.keytab</span></pre></li></ol></div></li><li
class="listitem"><div class="para">
+ On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
+ </div><pre class="screen"># ktutil
ktutil: read_kt /tmp/krb5.keytab
ktutil: write_kt /etc/krb5/krb5.keytab
ktutil: q
</pre></li><li class="listitem"><div
class="para">
- Add a user that is only used for authentication. (This can be substituted with krb5
auth if that works from the ldap client). Otherwise go to the FreeIPA server and use
<code class="command">ldapmodify</code>, bind as Directory Manager
and create this user.
- </div><pre class="programlisting">dn:
uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com
+ On the FreeIPA server, add a user that is only used for authentication. (This can
be substituted with krb5 authentication if that works from the LDAP client). Otherwise go
to the FreeIPA server and use <code
class="command">ldapmodify</code>, bind as Directory Manager and create
this user. The user should be assigned a shared password.
+ </div><pre class="programlisting">ldapmodify -D
"cn=directory manager" -w secret -p 389 -h
ipaserver.example.com -x -a
+
+dn: uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com
objectClass: account
objectClass: simplesecurityobject
objectClass: top
uid: nss
-userPassword: Your own shared password here
+userPassword: secretpassword
</pre></li><li class="listitem"><div
class="para">
- On the FreeIPA server, get a ticket for the admin user.
- </div><div class="para">
- <code class="command"> # kinit admin </code>
- </div></li></ol></div><div class="para">
- You should be able to log in as admin using SSH without providing a password.
- </div><div class="para">
- <code class="command"> # ssh admin(a)ipaclient.example.com
</code>
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Testing_System_Login"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Testing_System_Login">2.5.4. Testing
System Login</h3></div></div></div><div
class="para">
- After you have completed the steps in <a class="xref"
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">Section 2.5.2,
“Configuring Client Authentication”</a> and <a class="xref"
href="#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">Section 2.5.3,
“Configuring Client SSH Access”</a>, you should be able to log in as a FreeIPA user
on the AIX machine. Use the following tests to ensure that the configuration is working
correctly:
- </div><div class="para">
- On the system console, log in as a FreeIPA user. After you have logged in, open a
shell and run the following command:
- </div><div class="para">
- <code class="command">$ id</code> (ensure that the user IDs and
group IDs are correct)
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. You may need
to install bash (or link <code class="command">sh</code> to <code
class="command">/bin/bash</code> or modify admin to use <code
class="command">/bin/sh</code> or a shell available in all of your
systems) to be able to log in.
- </div></div></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X">2.6. Configuring a Macintosh
OS X System as a FreeIPA Client</h2></div></div></div><div
class="para">
- This chapter describes how to configure Macintosh OS X as a FreeIPA client. These
instructions are specific to Mac OS X 10.4 (Tiger). This version of the OS includes a
partial install of the Kerberos tools you need by default, especially if you perform an
upgrade from 10.1 or 10.2.
- </div><div class="para">
- Before starting the FreeIPA installation, ensure that you update the system with all
the latest packages.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div><div class="para">
- Many of the following procedures and instructions use example host names, domain
names, and realm names for illustration purposes. You need to replace these example names
with those that apply to your own deployment.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1. Configuring
Kerberos Authentication</h3></div></div></div><div
class="para">
- The current version of FreeIPA does not provide for automatic configuration of
Macintosh clients. Configuring authentication is a manual process, and is described in the
following sections.
- </div><div class="section"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos">2.6.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Configuring the Macintosh to use Kerberos for authentication with FreeIPA is a
two-step process: First, Kerberos needs to be correctly installed and configured, and
second, the Kerberos authentication needs to be enabled.
+ On the FreeIPA server, get a ticket for the admin user.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ To test the SSH configuration, try to log in as the admin user using SSH without
providing a password.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ssh
admin@ipaclient.example.com</span></pre></li></ol></div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. It may be
necessary to install bash to be able to log in.
+ </div></div></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X">3.6. Configuring a Macintosh
OS X System as a FreeIPA Client</h2></div></div></div><div
class="para">
+ These instructions are specific to Mac OS X 10.4 (Tiger) because this version includes
the required Kerberos tools by default.
+ </div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1. Configuring
Kerberos Authentication</h3></div></div></div><div
class="para">
+ Configuring the Macintosh to use Kerberos for authentication with FreeIPA is a
two-step process. First, Kerberos needs to be correctly installed and configured. Then,
Kerberos authentication needs to be enabled.
+ </div><div class="section"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos">3.6.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
+ Setting up the Kerberos configuration includes specifying the realm and domain
details, and default ticket attributes. Forwardable tickets are configured by default,
which facilitates connection to the administration interface from any operating system,
and also provides for auditing of administration operations. For example, this is the
Kerberos configuration for Fedora systems:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Ensure that <code
class="filename">/System/Library/CFMSupport/Kerberos</code> is version
4.2 or higher. If that directory does not exist or is the wrong version, install the
Kerberos Extras support.
+ Make sure that the Kerberos version is 4.2 or higher. The Kerberos directory is
<code class="filename">/System/Library/CFMSupport/Kerberos</code>.
If that directory does not exist or is the wrong version, install the Kerberos Extras
support.
</div></li><li class="listitem"><div
class="para">
- Launch <span
class="application"><strong>/System/Library/Coreservices/Kerberos</strong></span>
+ Launch the Kerberos management application. This is in <code
class="filename">/System/Library/Coreservices/Kerberos</code>.
</div></li><li class="listitem"><div
class="para">
From the <span
class="guimenu"><strong>Edit</strong></span> menu, choose
<span class="guimenuitem"><strong>Edit
Realms</strong></span>.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Settings</strong></span> tab,
enter the FreeIPA server's Kerberos realm (for example,
EXAMPLE.COM).
+ In the <span
class="guilabel"><strong>Settings</strong></span> tab,
enter the FreeIPA server's Kerberos realm, for example,
EXAMPLE.COM.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Servers</strong></span> tab, leave
two lines, whose hostnames you then need to replace with the FreeIPA server's hostname
(for example,
ipaserver.example.com):
+ In the <span
class="guilabel"><strong>Servers</strong></span> tab, enter
the FreeIPA server's hostname for the <span
class="guilabel"><strong>kdc</strong></span> and <span
class="guilabel"><strong>admin</strong></span> values:
</div><pre class="programlisting">kdc
ipaserver.example.com
88
admin
ipaserver.example.com 749
</pre></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Domains</strong></span> tab,
replace the existing domains with the FreeIPA server's actual domain (such as
example.com):
+ In the <span
class="guilabel"><strong>Domains</strong></span> tab,
replace the existing domains with the FreeIPA server's actual domain, such as
example.com:
</div><pre
class="programlisting">.example.com
example.com
</pre></li><li class="listitem"><div
class="para">
Click <span class="guibutton"><strong>Make
default</strong></span> to create the necessary configuration file, and then
close the Kerberos tool.
</div><div class="para">
- This step creates the <code
class="filename">/Library/Preferences/edu.mit.kerberos</code> file, and
it is recommended that you check this file manually to ensure that it is correct.
- </div><div class="para">
- This file should look similar to the following example. Remember to replace the
example.com settings with your own FreeIPA server name, Kerberos realm and domain
details.
+ This creates the <code
class="filename">/Library/Preferences/edu.mit.kerberos</code> file.
Check this file manually to ensure that it is correct. For example:
</div><pre class="programlisting">[domain_realm]
example.com =
EXAMPLE.COM
.example.com = .EXAMPLE.COM
@@ -1680,94 +1476,90 @@
EXAMPLE.COM = {
default_domain =
example.com
kdc = ipaserver.example.com:88
}
-</pre></li></ol></div><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
- </div></div><div class="section"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication">2.6.1.2. Enabling
Kerberos Authentication</h4></div></div></div><div
class="para">
- You now need to modify the <code
class="filename">/private/etc/authorization</code> file to allow
Kerberos authentication.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Log in as the admin user and launch the <span
class="application"><strong>/Applications/Utilities/Terminal</strong></span>
application.
+</pre></li></ol></div></div><div
class="section"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication">3.6.1.2. Enabling
Kerberos Authentication</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Log in as the admin user and launch a terminal.
</div></li><li class="listitem"><div
class="para">
Change to the <code class="filename">/private/etc</code>
directory and make a backup of the existing authorization file.
- </div><div class="para">
- <code class="command"># cd /private/etc</code>
- </div><div class="para">
- <code class="command"># cp -p authorization
authorization_bak</code>
- </div></li><li class="listitem"><div
class="para">
- Open the authorization file, and locate the string
"system.login.console".
- </div></li><li class="listitem"><div
class="para">
- Locate the <em
class="parameter"><code>dict</code></em> entry below this
string, and then locate the <em
class="parameter"><code>mechanisms</code></em> entry.
+ </div><pre class="programlisting"><span
class="perl_Comment"># cd /private/etc</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span>
+<span class="perl_Comment"># cp -p authorization
authorization_bak</span></pre></li><li
class="listitem"><div class="para">
+ Open the authorization file.
+ </div><pre class="programlisting"><span
class="perl_Comment"># vim
/private/etc/authorization</span></pre></li><li
class="listitem"><div class="para">
+ Locate the string <code
class="command">system.login.console</code>, and then edit the <em
class="parameter"><code>dict</code></em> and the <em
class="parameter"><code>mechanisms</code></em> entry just
beneath this line.
</div></li><li class="listitem"><div
class="para">
- Change <em
class="parameter"><code>authinternal</code></em> to <em
class="parameter"><code>builtin:krb5authnoverify,privileged</code></em>
- </div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
- Several instances of <em
class="parameter"><code>authinternal</code></em> may occur
in this file. Ensure that you change the correct instance.
+ Change <em
class="parameter"><code>authinternal</code></em> to <em
class="parameter"><code>builtin:krb5authnoverify,privileged</code></em>.
+ </div><div class="warning"><div
class="admonition_header"><h2>WARNING</h2></div><div
class="admonition"><div class="para">
+ Several instances of <em
class="parameter"><code>authinternal</code></em> may occur
in this file. Change only the instance for <code
class="command">system.login.console</code>.
</div></div></div></li><li
class="listitem"><div class="para">
Save and close the file.
</div></li><li class="listitem"><div
class="para">
Restart the machine to enable Kerberos authentication.
- </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2. Configuring
LDAP Authorization</h3></div></div></div><div
class="para">
- These instructions are specific to Mac OS X 10.4 (Tiger).
- </div><div class="section"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration">2.6.2.1. Creating
the LDAP Configuration</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Launch <span
class="application"><strong>/Applications/Utilities/Directory
Access</strong></span>.
+ </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2. Configuring
LDAP Authorization</h3></div></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration">3.6.2.1. Creating
the LDAP Configuration</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Launch the Directory Access utility.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Services</strong></span> tab,
clear all check boxes except LDAPv3 and Bonjour.
+ In the <span
class="guilabel"><strong>Services</strong></span> tab,
clear all check boxes except LDAPv3 and Bonjour.
</div></li><li class="listitem"><div
class="para">
- Select the <span
class="guilabel"><strong>LDAPv3</strong></span> entry and
click <span
class="guibutton"><strong>Configure</strong></span>.
+ Select the <span
class="guilabel"><strong>LDAPv3</strong></span> entry, and
click <span
class="guibutton"><strong>Configure</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Ensure the <span class="guilabel"><strong>Add DHCP-supplied
LDAP servers</strong></span> check box is not selected.
+ Make sure the <span class="guilabel"><strong>Add
DHCP-supplied LDAP servers</strong></span> checkbox is not selected.
</div></li><li class="listitem"><div
class="para">
Click the arrow next to the <span
class="guilabel"><strong>Show Options</strong></span>
label, and then click <span
class="guibutton"><strong>New</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Enter the Server Name (for example,
ipaserver.example.com).
+ Enter the server hostname in the <span
class="guilabel"><strong>Server Name</strong></span> field,
such as <code class="command">ipaserver.example.com</code>.
</div></li><li class="listitem"><div
class="para">
- Clear the <span class="guilabel"><strong>Encrypt using
SSL</strong></span> check box, and then click <span
class="guibutton"><strong>Manual</strong></span>.
+ Clear the <span class="guilabel"><strong>Encrypt using
SSL</strong></span> checkbox, and then click <span
class="guibutton"><strong>Manual</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Enter the Configuration Name (for example, "FreeIPA LDAP").
+ Enter the configuration name, such as <code
class="command">FreeIPA LDAP</code>.
</div></li><li class="listitem"><div
class="para">
- Ensure that the <span
class="guilabel"><strong>Enable</strong></span> check box
is selected, and that the <span
class="guilabel"><strong>SSL</strong></span> check box is
cleared.
- </div></li></ol></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">2.6.2.2. Setting
up the LDAP Service Configuration
Options</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Select the newly-created LDAP configuration and then click <span
class="guibutton"><strong>Edit</strong></span>.
+ Select the <span
class="guilabel"><strong>Enable</strong></span> checkbox,
and clear the <span
class="guilabel"><strong>SSL</strong></span> checkbox.
+ </div></li></ol></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">3.6.2.2. Setting
up the LDAP Service Configuration
Options</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Select the newly-created LDAP configuration, and click <span
class="guibutton"><strong>Edit</strong></span>.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Connection</strong></span> tab,
specify the following:
+ In the <span
class="guilabel"><strong>Connection</strong></span> tab,
specify the connection settings:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Open/close times out in: 10 seconds
+ Open/close times out in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Query times out in: 10 seconds
+ Query times out in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Re-bind attempted in: 10 seconds
+ Re-bind attempted in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Connection idles out in: 1 minute
- </div></li><li class="listitem"><div
class="para">
- Clear all check boxes
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, specify the following:
+ Connection idles out in 1 minute
+ </div></li></ol></div><div class="para">
+ Clear all checkboxes.
+ </div></li><li class="listitem"><div
class="para">
+ In the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, set the <span
class="guilabel"><strong>Access this LDAP server
using</strong></span> value to <code
class="command">CUSTOM</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Still in the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, configure the naming attributes used by
entries:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Access this LDAP server using: CUSTOM
+ In the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, select <span
class="guilabel"><strong>Default Attribute
Types</strong></span>.
</div></li><li class="listitem"><div
class="para">
- In the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, select <span
class="guilabel"><strong>Default Attribute
Types</strong></span>, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ Click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, select <span
class="guilabel"><strong>RecordName</strong></span> from
the list, and then click <span
class="guibutton"><strong>OK</strong></span>.
+ Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, then select <span
class="guilabel"><strong>RecordName</strong></span> from
the list.
</div></li><li class="listitem"><div
class="para">
- Select the newly-added RecordName attribute, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
+ Select the newly-added <code
class="command">RecordName</code> attribute, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
</div></li><li class="listitem"><div
class="para">
- Type "uid" (without the quotes) in the text box. Click outside of the
text box to set the value.
+ Type <em
class="parameter"><code>uid</code></em> in the text box to
set the LDAP attribute used for naming. Click outside the text box to set the value.
</div></li></ol></div></li><li
class="listitem"><div class="para">
- Add a Users record, as follows:
+ Still in the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, add a users record:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Under the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Record
Types</strong></span> option, select <span
class="guilabel"><strong>Users</strong></span> from the
list, and then click <span
class="guibutton"><strong>OK</strong></span>.
+ Select the <span class="guilabel"><strong>Record
Types</strong></span> option, and select <span
class="guilabel"><strong>Users</strong></span> from the
list.
</div></li><li class="listitem"><div
class="para">
Select the newly-added <span
class="guilabel"><strong>Users</strong></span> record type,
and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
</div></li><li class="listitem"><div
class="para">
- Type "inetOrgPerson" (without the quotes) in the text box. Click
outside of the text box to set the value.
+ Type <em
class="parameter"><code>inetOrgPerson</code></em> in the
text box. Click outside the text box to set the value.
</div></li><li class="listitem"><div
class="para">
- In the <span class="guilabel"><strong>Search
base</strong></span> field, type "dc=example,dc=com" (without the
quotes), and select the <span class="guilabel"><strong>Search in all
subtrees</strong></span> option.
+ In the <span class="guilabel"><strong>Search
base</strong></span> field, type the base DN of the FreeIPA LDAP service, such
as <code class="command">dc=example,dc=com</code>
+ </div></li><li class="listitem"><div
class="para">
+ Select the <span class="guilabel"><strong>Search in all
subtrees</strong></span> option.
</div></li></ol></div></li><li
class="listitem"><div class="para">
- Add attributes to the Users record as appropriate for your deployment. The
following is an example of the required procedure.
+ Add attributes to the users record as appropriate.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Under the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, and then use <span
class="keycap"><strong>Command</strong></span>+<span
class="mousebutton">Click</span> to select the attributes that you want
to add. For example, a typical deployment might include the following attributes:
+ Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, and then use <span
class="keycap"><strong>Ctrl</strong></span> to select
multiple attributes. Common attributes to add include:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
AuthenticationAuthority
</div></li><li class="listitem"><div
class="para">
@@ -1780,44 +1572,38 @@
EXAMPLE.COM = {
UniqueID
</div></li><li class="listitem"><div
class="para">
UserShell
- </div></li></ul></div></li><li
class="listitem"><div class="para">
- Click <span
class="guibutton"><strong>OK</strong></span> to add the
selected attributes to the <span
class="guilabel"><strong>Users</strong></span> record.
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- Specify appropriate mappings for the attributes that you just added. For example:
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Select the <span class="guilabel"><strong>Authentication
Authority</strong></span> record type, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
- </div></li><li class="listitem"><div
class="para">
- Type "#;Kerberosv5;;$uid$;EXAMPLE.COM" (without the quotes) in the
text box. Click outside of the text box to set the value.
+ </div></li></ul></div></li></ol></div></li><li
class="listitem"><div class="para">
+ Specify appropriate mappings for the new attributes. Select the <span
class="guilabel"><strong>Authentication
Authority</strong></span> record type, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel. The attribute mappings have the format <code
class="command">#;</code><span
class="emphasis"><em>Mac-attribute</em></span><code
class="command">;;$</code><span
class="emphasis"><em>LDAP-attribute</em></span><code
class="command">$;</code><span
class="emphasis"><em>value</em></span>. For example, for
the Kerberosv5 principal, the UID, and the realm, the mapping is <code
class="command">#;Kerberosv5;;$uid$;EXAMPLE.COM</code>. These are
common mappings:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Kerberosv5 and UID
</div></li><li class="listitem"><div
class="para">
- Use the same procedure to map PrimaryGroupID to gidNumber.
+ PrimaryGroupID and gidNumber
</div></li><li class="listitem"><div
class="para">
- Use the same procedure to map UniqueID to uidNumber.
- </div></li><li class="listitem"><div
class="para">
- Continue until all required entries have been mapped, and then click <span
class="guibutton"><strong>OK</strong></span>.
- </div></li></ol></div></li><li
class="listitem"><div class="para">
+ UniqueID and uidNumber
+ </div></li></ul></div></li><li
class="listitem"><div class="para">
Click <span
class="guibutton"><strong>OK</strong></span> to finish
setting up the LDAP service configuration options.
- </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3. Configuring
the LDAP Authorization Options</h3></div></div></div><div
class="para">
- You now need to add the LDAP service to the list of locations used to search for user
authentication information.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- On the <span
class="guilabel"><strong>Authentication</strong></span>
tab, change the <span
class="guilabel"><strong>Search</strong></span> value to
<span class="guilabel"><strong>Custom
path</strong></span>, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3. Configuring
the LDAP Authorization Options</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ In the <span
class="guilabel"><strong>Authentication</strong></span>
tab, change the <span
class="guilabel"><strong>Search</strong></span> value to
<span class="guilabel"><strong>Custom
path</strong></span>.
+ </div></li><li class="listitem"><div
class="para">
+ Click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the configuration that you added in the Creating the LDAP Configuration
step, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ Select the configuration created in <a class="xref"
href="#Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">Section 3.6.2.2,
“Setting up the LDAP Service Configuration Options”</a>, and click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Click <span
class="guibutton"><strong>Apply</strong></span> to update
the LDAP configuration, and then exit the <span
class="application"><strong>Directory
Access</strong></span> application.
- </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4. Configuring
NTP</h3></div></div></div><div class="para">
- Open the Date & Time utility and point it to the FreeIPA server URL to set
the date and time automatically.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH">2.6.5. Accessing
the FreeIPA Server Using SSH</h3></div></div></div><div
class="para">
- After configuring client authentication, you should be able to use SSH to connect to
the FreeIPA server without being prompted for a password.
+ Click <span
class="guibutton"><strong>Apply</strong></span> to update
the LDAP configuration.
+ </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4. Configuring
NTP</h3></div></div></div><div class="para">
+ Open the Date and Time utility and point it to the FreeIPA server URL to set the date
and time automatically.
+ </div></div><div class="section"
id="testing-config-on-mac"><div
class="titlepage"><div><div><h3 class="title"
id="testing-config-on-mac">3.6.5. Testing the
Configuration</h3></div></div></div><div
class="para">
+ If client authentication is properly configured, a user can connect to the FreeIPA
server using SSH without being prompted for a password.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Obtain a Kerberos ticket for the admin user.
- </div><div class="para">
- <code class="command"> # kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- If you have a valid Kerberos ticket, SSH should proceed with GSSAPI authentication
without asking for a password:
- </div><pre class="programlisting"><span
class="perl_Comment"># ssh
admin@ipaserver.example.com</span></pre></li></ol></div></div><div
class="section"
id="Macintosh_OS_X-Configuring_System_Login"><div
class="titlepage"><div><div><h3 class="title"
id="Macintosh_OS_X-Configuring_System_Login">2.6.6. Configuring System
Login</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- On the Macintosh login window, log in as a FreeIPA user.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ Log into the server using SSH.
+ </div><pre class="programlisting"><span
class="perl_Comment"># ssh
admin@ipaserver.example.com</span></pre></li></ol></div><div
class="para">
+ Also, check the system login.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Log in as a FreeIPA user.
</div></li><li class="listitem"><div
class="para">
- First, check the user ID to make sure that both the user and group IDs are correct
for the current account.
+ Check the user ID to make sure that both the user and group IDs are correct for the
current account.
</div><pre class="programlisting">$ <span
class="perl_BString">id</span>
<span class="perl_Others">uid=</span>10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span> <span
class="perl_Others">gid=</span>10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span> <span
class="perl_Others">groups=</span>3<span
class="perl_Others">(</span>sys<span
class="perl_Others">)</span>,100<span
class="perl_Others">(</span>users<span
class="perl_Others">)</span>,1070<span
class="perl_Others">(</span>devel2<span
class="perl_Others">)</span>,10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span></pre></li><li
class="listitem"><div class="para">
@@ -1835,68 +1621,162 @@ Valid starting Expires Service principal
Kerberos 4 ticket cache: /tmp/tkt10678
klist: You have no tickets cached</pre>
- </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- To open the Terminal application, navigate to <span
class="application"><strong>Applications/Utilities/Terminal.app</strong></span>
or use the keyboard shortcut <span
class="keycap"><strong>Command-Shift-U</strong></span>. You
can also drag the Terminal icon to the Dock to make it permanently available on your
Desktop.
- </div></div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="basic-usage"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 3. Basic
Usage</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#using-the-ui">3.1. Using the IPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="#logging-in">3.2. Logging into the
IPA UI</a></span></dt><dt><span
class="section"><a href="#switching-users">3.3. Switching
Users</a></span></dt></dl></div><d
iv class="section" id="using-the-ui"><div
class="titlepage"><div><div><h2 class="title"
id="using-the-ui">3.1. Using the IPA
UI</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1. Using
a Browser on Another System</h3></div></div></div><div
class="para">
- If you are unable, or prefer not, to update <code
class="filename">/etc/krb5.conf</code> with the IPA realm information,
you can create another copy and set an appropriate environment variable. You can then run
<code class="command">kinit</code> as before and use your browser to
connect to IPA. This is especially useful if you need to manage multiple realms, and if
you have overlapping domains.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- This procedure is not necessary if you use <code
class="command">ipa-client-install</code> to set up your client.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_a_Browser_on_Another_System-To_set_up_a_browser_on_another_system_that_already_has_Kerberos_set_up_for_a_different_realm"><h6>Procedure 3.1. To
set up a browser on another system that already has Kerberos set up for a different
realm:</h6><ol class="1"><li class="step"><div
class="para">
- Copy the <code class="filename">/etc/krb5.conf</code> file
from the IPA server to the client system. Do not overwrite the existing <code
class="filename">krb5.conf</code> file. Run the following command on
the IPA server:
+ </div></li></ol></div></div></div><div
class="section" id="uninstalling-clients"><div
class="titlepage"><div><div><h2 class="title"
id="uninstalling-clients">3.7. Uninstalling a FreeIPA
Client</h2></div></div></div><div class="para">
+ For Fedora clients, the <code
class="command">ipa-client-install</code> utility can be used to
uninstall the client and remove it from the FreeIPA domaine. To remove the client, use the
<code class="option">--uninstall</code> option.
+ </div><pre class="programlisting"><span
class="perl_Comment"># ipa-client-install
--uninstall</span></pre><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ There is an uninstall option with the <code
class="command">ipa-join</code> command. This is called by <code
class="command">ipa-client-install --uninstall</code> as part of the
uninstallation process. However, while the <code
class="command">ipa-join</code> option removes the client from the
domain, it does not actually uninstall the client or properly remove all of the
FreeIPA-related configuration. Do not run <code class="command">ipa-join
-u</code> to attempt to uninstall the FreeIPA client. The only way to uninstall a
client completely is to use <code class="command">ipa-client-install
--uninstall</code>.
+ </div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="basic-usage"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 4. Basic UI
Usage</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#ipa-ui">4.1. Looking at the FreeIPA
UI</a></span></dt><dt><span class="section"><a
href="#using-the-ui">4.2. Using the FreeIPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a href="#config-browser">4.2.1. Configuring
the Browser</a></span></dt><dt><span
class="section"><a href="#logging-in">4.2.2. Logging into the
FreeIPA UI</a></span></dt><dt><span
class="section"><a
href="#Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="#Enabling_UsernamePassword_Authentication_in_Your_Browser">4.2.4.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a hr
ef="#switching-users">4.3. Switching
Users</a></span></dt></dl></div><div
class="para">
+ XXXXX introXXXXXXXX
+ </div><div class="section" id="ipa-ui"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-ui">4.1. Looking at the FreeIPA
UI</h2></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div></div><div class="section"
id="using-the-ui"><div
class="titlepage"><div><div><h2 class="title"
id="using-the-ui">4.2. Using the FreeIPA
UI</h2></div></div></div><div class="section"
id="config-browser"><div
class="titlepage"><div><div><h3 class="title"
id="config-browser">4.2.1. Configuring the
Browser</h3></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div><div class="para">
+ Firefox can use your Kerberos credentials for authentication, but you need to specify
which domains to communicate with, and using which attributes.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Open Firefox, and type "about:config" in the <span
class="guilabel"><strong>Address Bar</strong></span>.
+ </div></li><li class="listitem"><div
class="para">
+ In the <span
class="guilabel"><strong>Search</strong></span> field, type
"negotiate".
+ </div></li><li class="listitem"><div
class="para">
+ Enter the domain names, including the preceding period (.):
+<pre class="programlisting">network.negotiate-auth.trusted-uris
.example.com
+network.negotiate-auth.delegation-uris .example.com
+network.negotiate-auth.using-native-gsslib true
+</pre>
+
</div><div class="para">
-
-<pre class="screen"><code class="command"> # scp
/etc/krb5.conf root@ipaclient:/etc/krb5_ipa.conf </code></pre>
+ If you are configuring Firefox on Microsoft Windows, make the following changes
instead:
+<pre class="programlisting">network.negotiate-auth.trusted-uris
.example.com
+network.auth.use-sspi false
+network.negotiate-auth.delegation-uris .example.com
+</pre>
- </div></li><li class="step"><div
class="para">
- On the IPA client, open a shell and run the following commands:
-<pre class="screen"><code class="command">$ export
KRB5_CONFIG=/etc/krb5_ipa.conf</code>
-<code class="command">$ kinit user(a)EXAMPLE.COM</code>
-<code class="command">$ /usr/bin/firefox</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ In Firefox, navigate to the FreeIPA server (use the fully-qualified domain name,
for example, <code
class="systemitem">http://ipaserver.example.com</code>). Ensure that
there are no Kerberos authentication errors, and that you can see and interact with the
Web interface.
+ </div></li></ol></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Navigate to <code
class="uri">http://ipa.example.com/ipa/config/ca.crt</cod...
+ </div></li><li class="listitem"><div
class="para">
+ Select at least the first (<span
class="guilabel"><strong>Trust this CA to identify web
sites</strong></span>) and third (<span
class="guilabel"><strong>Trust this CA to identify software
developers</strong></span>) check boxes.
+ </div></li><li class="listitem"><div
class="para">
+ Click <span
class="guibutton"><strong>OK</strong></span>.
+ </div><div class="informalfigure"><div
class="mediaobject"><img src="images/Accept_CA_No_Exception.png"
width="600"
/></div></div></li></ol></div><div
class="para">
+ Rather than permanently adding an exception, you can leave all boxes unchecked and
click <span class="guibutton"><strong>OK</strong></span>
to proceed. At this point the Kerberos authentication will fail, so you need to click the
associated link and then click <span
class="guibutton"><strong>Import the FreeIPA Certificate
Authority</strong></span>.
+ </div><div class="formalpara"
id="Using_the_Browser_Interface-Configuring_Kerberos_Authentication"><h5
class="formalpara">Configuring Kerberos Authentication</h5>
+ Use the following procedure to configure your browser for Kerberos authentication
against your newly-installed domain.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Type "about:config" in the address bar. Accept that you will be careful.
+ </div></li><li class="listitem"><div
class="para">
+ In the Search field, type "negotiate".
+ </div></li><li class="listitem"><div
class="para">
+ Ensure the following lines reflect your setup. Replace "example.com" with
your own FreeIPA server's domain, including the preceding period (.):
+ <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ network.negotiate-auth.trusted-uris .example.com
+ </div></li><li class="listitem"><div
class="para">
+ network.negotiate-auth.delegation-uris .example.com
+ </div></li><li class="listitem"><div
class="para">
+ network.negotiate-auth.using-native-gsslib true
+ </div></li></ul></div>
- </div></li><li class="step"><div
class="para">
- Configure and test <span
class="application"><strong>Firefox</strong></span>.
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2. Enabling
Username/Password Authentication in Your
Browser</h3></div></div></div><div class="para">
- If Kerberos authentication fails, the browser login will also fail, preventing access
to the IPA web interface. You can configure IPA to display a username/password
authentication dialog box if this situation occurs.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Enabling_UsernamePassword_Authentication_in_Your_Browser-To_enable_failover_to_usernamepassword_authentication"><h6>Procedure 3.2. To
enable failover to username/password authentication:</h6><ol
class="1"><li class="step"><div
class="para">
- Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file, and change the
<em
class="parameter"><code>KrbMethodK5Passwd</code></em>
attribute from <code class="literal">off</code> to <code
class="literal">on</code>.
- </div></li><li class="step"><div
class="para">
- Restart the <code class="systemitem">httpd</code> service:
-<pre class="screen"><code class="command"># service httpd
restart</code></pre>
+ </div></li></ol></div><div class="formalpara"
id="Using_the_Browser_Interface-Displaying_the_IPA_Homepage"><h5
class="formalpara">Displaying the FreeIPA Homepage</h5>
+ Your browser should now be fully configured and ready to connect to the FreeIPA
server. In the address bar, type “localhost” or the name of the host. The FreeIPA homepage
should now display. Explore this page and the links it provides, familiarize yourself with
the available options, and file a bug whenever you find something is not working.
+ </div><div class="section"
id="Configuring_Your_Local_Browser-Troubleshooting"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Your_Local_Browser-Troubleshooting">4.2.1.1. Troubleshooting</h4></div></div></div><div
class="para">
+ If you have followed the configuration steps and Negotiate authentication is not
working, you can turn on verbose logging of the authentication process, and potentially
find the cause of the problem.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Exit the browser.
+ </div></li><li class="listitem"><div
class="para">
+ Open a shell, and run the following commands:
+<pre class="screen">export NSPR_LOG_MODULES=negotiateauth:5
+export NSPR_LOG_FILE=/tmp/moz.log
+</pre>
+
+ </div><div class="para">
+ This will enable verbose logging, and all information will be logged to <code
class="filename">/tmp/moz.log</code>, which may give a clue to the
problem. Restart your browser from that shell, and visit the website you were unable to
authenticate to earlier.
+ </div></li></ol></div><div class="formalpara"
id="Troubleshooting-Analyzing_the_Symptoms"><h5
class="formalpara">Analyzing the Symptoms</h5>
+ Refer to the following symptoms and possible solutions to help resolve issues with
Negotiate authentication.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ If you receive output similar to the following:
+<pre class="screen">-1208550944[90039d0]: entering
nsNegotiateAuth::GetNextToken()
+-1208550944[90039d0]: gss_init_sec_context() failed: Miscellaneous failure
+No credentials cache found
+</pre>
+ it means that you do not have any Kerberos tickets, and need to run <code
class="command">kinit</code>.
+ </div></li><li class="listitem"><div
class="para">
+ If you can run <code class="command">kinit</code>
successfully but you are unable to authenticate, and the log file contains output similar
to the following:
+<pre class="screen">-1208994096[8d683d8]: entering
nsAuthGSSAPI::GetNextToken()
+-1208994096[8d683d8]: gss_init_sec_context() failed: Miscellaneous failure
+Server not found in Kerberos database
+</pre>
+ it generally indicates a Kerberos configuration problem. Ensure you have the
following in the [domain_realm] section of the <code
class="filename">/etc/krb5.conf</code> file:
+<pre
class="screen">.example.com =
EXAMPLE.COM
+example.com =
EXAMPLE.COM
+</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ If nothing appears in the log file it is possible that you are behind a proxy, and
that proxy is removing the HTTP headers required for Negotiate authentication. Try to
connect to the server using HTTPS instead, which allows the request to pass through
unmodified. Then proceed to debug using the log file, as described above.
+ </div></li></ol></div></div></div><div
class="section" id="logging-in"><div
class="titlepage"><div><div><h3 class="title"
id="logging-in">4.2.2. Logging into the FreeIPA
UI</h3></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div><div class="para">
+ To be able to perform any administrative task you need to authenticate to the server.
During the configuration step you were prompted to create two users. The first of these,
Directory Manager, is the superuser, used to perform rare, low-level tasks. The second
user, admin, is used to perform normal administrative activities.
+ </div><div class="para">
+ To authenticate as the admin user:
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Open a new terminal window. This is to ensure that all default aspects of the
environment (especially paths) are set correctly.
+ </div></li><li class="listitem"><div
class="para">
+ In this window, type <code class="command">kinit
admin</code>.
+ </div></li><li class="listitem"><div
class="para">
+ When you are prompted to enter a password, use the password that you specified
during the configuration step for the admin user.
+ </div></li></ol></div><div class="para">
+ As a result of this operation you will acquire what is known as a Kerberos <span
class="emphasis"><em>ticket</em></span>. You can use the
<code class="command">klist</code> command to inspect the details of
the ticket that you have acquired.
+ </div><div class="para">
+ You can now authenticate using the newly-created user and temporary password. Type
<code class="command">kinit</code> <em
class="replaceable"><code>userLogin</code></em> to log in
to FreeIPA. This will prompt you for a password and then immediately request a password
change.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ The Kerberos client libraries used by the <code
class="command">kinit</code> utility have some limitations. One of
these limitations is the fact that the on-disc ticket storage is overwritten with any new
invocation of <code class="command">kinit</code>. This means that if
you authenticated as admin, then added aa new user, set the password and then tried to
authenticate as that user, the administrator's ticket would be lost. To prevent this
from happening, a special environment variable, <code
class="varname">KRB5CCNAME</code>, can be used. This allows you to keep
credential caches separate in different shells. Refer to the <code
class="command">kinit</code> man page for more information.
+ </div></div></div><div class="para">
+ You can browse the FreeIPA man pages and help system to explore other FreeIPA
commands. Please take some time to become familiar with the ways other FreeIPA objects can
be created and modified.
+ </div></div><div class="section"
id="Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3. Using
a Browser on Another System</h3></div></div></div><div
class="para">
+ If you are unable, or prefer not, to update <code
class="filename">/etc/krb5.conf</code> with the FreeIPA realm
information, you can create another copy and set an appropriate environment variable. You
can then run <code class="command">kinit</code> as before and use
your browser to connect to FreeIPA. This is especially useful if you need to manage
multiple realms, and if you have overlapping domains.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ This procedure is not necessary if you use <code
class="command">ipa-client-install</code> to set up your client.
+ </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Copy the <code class="filename">/etc/krb5.conf</code> file
from the FreeIPA server to the client system. Do not overwrite the existing <code
class="filename">krb5.conf</code> file. Run the following command on
the FreeIPA server:
+ </div><div class="para">
+
+<pre class="screen"> # scp /etc/krb5.conf
root@ipaclient:/etc/krb5_ipa.conf</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ On the FreeIPA client, open a shell and run the following commands:
+<pre class="screen">$ export KRB5_CONFIG=/etc/krb5_ipa.conf
+$ kinit user(a)EXAMPLE.COM
+$ /usr/bin/firefox</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Configure and test Firefox.
+ </div></li></ol></div></div><div
class="section"
id="Enabling_UsernamePassword_Authentication_in_Your_Browser"><div
class="titlepage"><div><div><h3 class="title"
id="Enabling_UsernamePassword_Authentication_in_Your_Browser">4.2.4. Enabling
Username/Password Authentication in Your
Browser</h3></div></div></div><div class="para">
+ If Kerberos authentication fails, the browser login will also fail, preventing access
to the FreeIPA web interface. You can configure FreeIPA to display a username/password
authentication dialog box if this situation occurs.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file, and change the
<em
class="parameter"><code>KrbMethodK5Passwd</code></em>
attribute from off to on.
+ </div></li><li class="listitem"><div
class="para">
+ Restart the <code class="systemitem">httpd</code> service:
+<pre class="screen"># service httpd restart</pre>
</div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- You need to perform this procedure on all of the IPA servers in your deployment.
+ You need to perform this procedure on all of the FreeIPA servers in your
deployment.
</div></li><li class="listitem"><div
class="para">
- This change may not be preserved between IPA updates.
- </div></li></ul></div></div></div></div></div><div
class="section" id="logging-in"><div
class="titlepage"><div><div><h2 class="title"
id="logging-in">3.2. Logging into the IPA
UI</h2></div></div></div><div class="para">
- To be able to perform any administrative task you need to authenticate to the server.
During the configuration step you were prompted to create two users. The first of these,
<code class="literal">Directory Manager</code>, is the superuser,
used to perform rare, low-level tasks. The second user, <code
class="literal">admin</code>, is used to perform normal administrative
activities.
+ This change may not be preserved between FreeIPA updates.
+ </div></li></ul></div></div></div></div></div><div
class="section" id="switching-users"><div
class="titlepage"><div><div><h2 class="title"
id="switching-users">4.3. Switching
Users</h2></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
</div><div class="para">
- To authenticate as the <code class="literal">admin</code> user:
- </div><div class="procedure"><ol class="1"><li
class="step"><div class="para">
- Open a new terminal window. This is to ensure that all default aspects of the
environment (especially paths) are set correctly.
- </div></li><li class="step"><div
class="para">
- In this window, type <code class="command">kinit
admin</code>.
- </div></li><li class="step"><div
class="para">
- When you are prompted to enter a password, use the password that you specified
during the configuration step for the <code
class="literal">admin</code> user.
- </div></li></ol></div><div class="para">
- As a result of this operation you will acquire what is known as a Kerberos <em
class="firstterm">ticket</em>. You can use the <code
class="command">klist</code> command to inspect the details of the
ticket that you have acquired.
+ One of the main advantages of FreeIPA is that it uses Kerberos for authentication.
This means that if the machine is configured to use FreeIPA as an authentication server
and you have an FreeIPA account, then once you have logged in to the machine and
authenticated, you can reuse your Kerberos credentials to access other services in the
FreeIPA domain. This avoids the need to constantly re-enter your password to access
different services.
</div><div class="para">
- You can now authenticate using the newly-created user and temporary password. Type
<code class="command">kinit <user login></code> to log
in to IPA. This will prompt you for a password and then immediately request a password
change.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The <span
class="application"><strong>Kerberos</strong></span> client
libraries used by the <code class="command">kinit</code> utility
have some limitations. One of these limitations is the fact that the on-disc ticket
storage is overwritten with any new invocation of <code
class="command">kinit</code>. This means that if you authenticated as
<code class="systemitem">admin</code>, then added user <code
class="systemitem">foo</code>, set their password and then tried to
authenticate as that user, the administrator's ticket would be lost. To prevent this
from happening, a special environment variable, <code
class="varname">KRB5CCNAME</code>, can be used. This allows you to keep
credential caches separate in different shells. Refer to the <code
class="command">kinit</code> man page for more information.
- </div></div></div><div class="para">
- You can browse the IPA man pages and help system to explore other IPA commands. Please
take some time to become familiar with the ways other IPA objects can be created and
modified.
- </div></div><div class="section"
id="switching-users"><div
class="titlepage"><div><div><h2 class="title"
id="switching-users">3.3. Switching
Users</h2></div></div></div><div class="para">
- One of the main advantages of IPA is that it uses <code
class="systemitem">Kerberos</code> for authentication. This means that
if the machine is configured to use IPA as an authentication server and you have an IPA
account, then once you have logged in to the machine and authenticated, you can reuse your
<code class="systemitem">Kerberos</code> credentials to access other
services in the IPA domain. This avoids the need to constantly re-enter your password to
access different services.
+ For example, to connect to the FreeIPA web interface, you can enter the server's
address in your browser and it will use your Kerberos ticket to authenticate against
FreeIPA. Similar functionality is available if you try to access a file share, a wiki or
any other application that is configured to be a Kerberos service in the FreeIPA domain.
</div><div class="para">
- For example, to connect to the IPA web interface, you can enter the server's
address in your browser and it will use your <code
class="systemitem">Kerberos</code> ticket to authenticate against IPA.
Similar functionality is available if you try to access a file share, a wiki or any other
application that is configured to be a <code
class="systemitem">Kerberos</code> service in the IPA domain.
+ If you log in to a machine using an account different from your FreeIPA account, use
the <code class="command">kinit</code> command to establish your
Kerberos credentials. Similarly, if you need to log in to FreeIPA as a different user,
perhaps in another user role or as the administrator, you need to replace your existing
credentials with those of the new user. Currently you can only store one set of tickets
per logged-in user, and they are the credentials that will be used when you log in to
FreeIPA.
</div><div class="para">
- If you log in to a machine using an account different from your IPA account, use the
<code class="command">kinit</code> command to establish your
<code class="systemitem">Kerberos</code> credentials. Similarly, if
you need to log in to IPA as a different user, perhaps in another user role or as the
administrator, you need to replace your existing credentials with those of the new user.
Currently you can only store one set of tickets per logged-in user, and they are the
credentials that will be used when you log in to IPA.
- </div><div class="para">
- For example, if your local account name is <code
class="systemitem">localUser</code> but your IPA account name is
<code class="systemitem">ipaUser</code>, run the following command,
and enter your password when prompted:
+ For example, if your local account name is localUser but your FreeIPA account name is
ipaUser, run the following command, and enter your password when prompted:
</div><pre class="screen">$ kinit ipaUser
Password for ipaUser(a)EXAMPLE.COM:
</pre><div class="para">
- This establishes your <code class="systemitem">Kerberos</code>
credentials on the local machine. You can use the <code
class="command">klist</code> command to verify that you received a
<em class="firstterm">ticket granting ticket (TGT)</em> from the
server. This should return output similar to the following:
+ This establishes your Kerberos credentials on the local machine. You can use the
<code class="command">klist</code> command to verify that you
received a <span class="emphasis"><em>ticket granting ticket
(TGT)</em></span> from the server. This should return output similar to the
following:
</div><pre class="screen">$ klist
Ticket cache: FILE:/tmp/krb5cc_500
Default principal: ipaUser(a)EXAMPLE.COM
@@ -1907,30 +1787,30 @@ Valid starting Expires Service principal
Kerberos 4 ticket cache: /tmp/tkt500
klist: You have no tickets cached
</pre><div class="para">
- You should now be able to connect to the IPA web interface. If you were already
connected to the web interface as another user, refresh the browser to display the updated
details for the new user.
+ You should now be able to connect to the FreeIPA web interface. If you were already
connected to the web interface as another user, refresh the browser to display the updated
details for the new user.
</div><div class="para">
- If you configured <code class="systemitem">SSSD</code> or
<code class="systemitem">pam_krb5</code> on the machine with IPA,
then the ticket is created for you when you log in to the machine requires authentication
(for example, <code class="command">sudo</code>).
- </div></div></div><div xml:lang="en-US"
class="chapter" id="managing-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 4. Managing Clients in the FreeIPA
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2.
Removing Hosts from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones">4.1.3.
Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="#enrolling-machines">4.2. E
nrolling Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1.
Manual Host Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="#renaming-machines">4.3. Renaming
Machines</a></span></dt><dt><span
class="section"><a href="#config-virt-machines">4.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="#certs">4.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dd><dl>
<dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1.
Authentication Usage
Scenarios</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems">4.6.
Client Problems</a></span></dt><dt><span
class="section"><a href="#uninstalling-clients">4.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1. Working
with DNS</h2></div></div></div><div class="para">
+ If you configured SSSD or <code
class="systemitem">pam_krb5</code> on the machine with FreeIPA, then
the ticket is created for you when you log in to the machine requires authentication (for
example, <code class="command">sudo</code>).
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="managing-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 5. Managing Clients in the FreeIPA
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#IPA_Command_Line_Tools-Working_with_DNS">5.1. Working with
DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1. Adding Hosts to a
FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">5.1.2. Removing Hosts
from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="#Working_with_DNS-Managing_DNS_Zones">5.1.3. Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="#enrolling-machines">5.2. Enrolling
Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1.
Manual Ho
st Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="#Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="#Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3. Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="#renaming-machines">5.3. Renaming
Machines</a></span></dt><dt><span
class="section"><a href="#config-virt-machines">5.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="#certs">5.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dt><span
class="section"><a
href="#General_Troubleshooting_Tips-Client_Problems">5.6. Client
Problems</a></span></dt></dl></div><div
class="section"
id="IPA_Command_Line_Tools-Working_with_DNS"><div
class="titlepage"><div><div><h2 class="title"
id="IPA_Command_Line_Tools-Working_with_DNS">5.1. Worki
ng with DNS</h2></div></div></div><div
class="para">
A number of benefits exist if you take advantage of FreeIPA's ability to
automatically install and configure a DNS, in particular the ability to ease the
modification of DNS records when adding hosts to FreeIPA. For example, options exist to
add and remove IP addresses, A entries, PTR entries, etc. These options are not available
if you are not using a FreeIPA-based DNS.
</div><div class="para">
IPA stores all DNS information as discrete records in LDAP, and communicates with LDAP
using the <span class="package">bind-dyndb-ldap</span> plug-in and
the <code class="filename">install/share/60basev2.ldif</code>
schema. You can install and configure the DNS as part of the FreeIPA server installation,
using the <code class="option">--setup-dns</code> option, or you can
add it later using the <code class="command">ipa-dns-install</code>
command.
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
The following options are currently only available with IPv4 addresses.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1. Adding
Hosts to a FreeIPA DNS</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Working_with_DNS-Adding_Hosts_to_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1. Adding Hosts to a
FreeIPA DNS</h3></div></div></div><div
class="para">
If you are using a FreeIPA-based DNS system, you can use the <code
class="option">--ip-address</code> and <code
class="option">--force</code> options to the <code
class="command">ipa host-add</code> command to provide the IP address
and hostname of the FreeIPA machine to the DNS. For example,
<pre class="screen"><code class="command">$ ipa host-add
--force --ip-address=192.168.166.31
puma.example.com </code></pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2. Removing
Hosts from a FreeIPA DNS</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Working_with_DNS-Removing_Hosts_from_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">5.1.2. Removing Hosts
from a FreeIPA DNS</h3></div></div></div><div
class="para">
IPA provides the <code class="command">ipa host-del</code>
command to delete FreeIPA hosts. You can pass the <code
class="option">--updatedns</code> option to this command to remove the
associated records from the DNS. It will attempt to remove any record, A, AAAA, PTR, NS,
SRV, and other entries that reference this host. For example,
<pre class="screen"><code class="command">$ ipa host-del
--updatedns puma</code></pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones">4.1.3. Managing
DNS Zones</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Working_with_DNS-Managing_DNS_Zones"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Managing_DNS_Zones">5.1.3. Managing DNS
Zones</h3></div></div></div><div class="para">
IPA provides all the necessary commands to create and manage zones in a
FreeIPA-managed DNS server. You can create and delete zones and add entries to any of
these zones using the appropriate FreeIPA commands.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_DNS_Zones">4.1.3.1. Adding
DNS Zones</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Managing_DNS_Zones-Adding_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Adding_DNS_Zones">5.1.3.1. Adding DNS
Zones</h4></div></div></div><div class="para">
Use the <code class="command">ipa dnszone-add</code> command
to add a new zone to your DNS server. You can pass optional attributes on the command
line, and you will be prompted for any required information. The following example
demonstrates adding a new zone to your top-level domain.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You need to restart the <code class="systemitem">named</code>
service whenever you create a new zone, otherwise the DNS server will not reply
successfully to queries asking for records in the new zone. This is a one-time operation;
any subsequent changes to the zone do not require any further action to be effective.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_add_the_sub_domain_translation_to_the_ipadocs.org_domain"><h6>Procedure 4.1. To
add the sub-domain "translation" to the
ipadocs.org domain</h6><ol
class="1"><li class="step"><div
class="para">
+ </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_add_the_sub_domain_translation_to_the_ipadocs.org_domain"><h6>Procedure 5.1. To
add the sub-domain "translation" to the
ipadocs.org domain</h6><ol
class="1"><li class="step"><div
class="para">
Ensure you have a valid Kerberos ticket:
<pre class="screen"><code class="command">$ kinit
admin</code>
Password for admin@IPADOCS.ORG:</pre>
@@ -1958,12 +1838,12 @@ Password for admin@IPADOCS.ORG:</pre>
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-Using_Dynamic_DNS_Updates"><h5
class="formalpara">Using Dynamic DNS Updates</h5>
Dynamic DNS updates are not enabled by default for new DNS zones served by FreeIPA;
that is, zones added by the <code class="command">ipa
dnszone-add</code> command. This may lead to errors in the <code
class="command">ipa-client-install</code> script when it joins this
domain and tries to add a DNS record pointing to this new client.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_enable_dynamic_DNS_updates"><h6>Procedure 4.2. To
enable dynamic DNS updates</h6><ul><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_enable_dynamic_DNS_updates"><h6>Procedure 5.2. To
enable dynamic DNS updates</h6><ul><li class="step"><div
class="para">
Use the following command to enable dynamic updates:
</div><pre class="screen"><code
class="command">$ ipa dnszone-mod
clients.example.com --allow-dynupdate \
</code>
<code class="command">--update-policy="grant
TESTRELM krb5-self * A; grant TESTRELM krb5-self *
AAAA;"</code></pre><div class="para">
In this example, <code
class="systemitem">clients.example.com</code> is the custom DNS domain
managed by the FreeIPA server and TESTRELM is the Kerberos realm.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_Records_to_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_Records_to_DNS_Zones">4.1.3.2. Adding
Records to DNS Zones</h4></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="Managing_DNS_Zones-Adding_Records_to_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Adding_Records_to_DNS_Zones">5.1.3.2. Adding Records
to DNS Zones</h4></div></div></div><div
class="para">
Use the <code class="command">ipa dnsrecord-add</code> command
to add various types of records to DNS zones. The following examples demonstrate adding
some of these types of records.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Adding_Records_to_DNS_Zones-Adding_IPv4_Type_A_Resource_Records"><h5
class="formalpara">Adding IPv4 (Type A) Resource Records</h5>
Type A resource records map hostnames to IPv4 addresses. To add a type A resource
record, run the following command:
@@ -1989,7 +1869,7 @@ Password for admin@IPADOCS.ORG:</pre>
<pre class="programlisting">A, AAAA, A6, AFSDB, APL, CERT, CNAME, DHCID,
DLV, DNAME, DNSKEY, DS, HIP, IPSECKEY, KX, LOC,
MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF, SRV, SSHFP, TA,
TXT</pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Deleting_Records_from_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Deleting_Records_from_DNS_Zones">4.1.3.3. Deleting
Records from DNS Zones</h4></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Managing_DNS_Zones-Deleting_Records_from_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Deleting_Records_from_DNS_Zones">5.1.3.3. Deleting
Records from DNS Zones</h4></div></div></div><div
class="para">
Use the <code class="command">ipa dnsrecord-del</code> command
to remove records from DNS zones. The following examples demonstrate how to remove the
records added in the preceding examples.
</div><div class="para">
To remove the A type record from the "www" record, run the following
command:
@@ -2005,7 +1885,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
You can also delegate zones if you want to allow other areas of your company
intranet to reach your DNS server, or if you want to allow access from outside your
firewalls. Refer to the <a
href="http://www.isc.org/software/bind/documentation">ISC BIND
documentation</a> for further information.
</div><div class="para">
Refer to the <code class="command">ipa help dns</code> help
page for more information about working with DNS and FreeIPA.
- </div></div></div></div><div class="section"
id="enrolling-machines"><div
class="titlepage"><div><div><h2 class="title"
id="enrolling-machines">4.2. Enrolling
Machines</h2></div></div></div><div class="para">
+ </div></div></div></div><div class="section"
id="enrolling-machines"><div
class="titlepage"><div><div><h2 class="title"
id="enrolling-machines">5.2. Enrolling
Machines</h2></div></div></div><div class="para">
Enrollment is the process whereby a host entry is created and saved in the directory
server, and a keytab for that host entry is generated on the server and provisioned to the
client. This keytab is saved with specific ownership and permission properties in a
specific directory on the client.
</div><div class="para">
With the host entry successfully created and the keytab in place, enrollment is
complete and the client machine can now automatically connect to and communicate with the
FreeIPA server.
@@ -2023,7 +1903,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
</div><div class="para">
These are examined in more detail below.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1. Manual
Host Enrollment with Privileged
Administrator</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1. Manual
Host Enrollment with Privileged
Administrator</h3></div></div></div><div
class="para">
This scenario implements the following sequence of operations:
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
The Administrator logs into the machine that they want to enroll with FreeIPA.
@@ -2046,8 +1926,8 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
</div><div class="para">
At this stage the enrollment is complete and the machine can now automatically
connect to and communicate with the FreeIPA server.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2. Manual
Host Enrollment with Separation of
Duties</h3></div></div></div><div class="para">
- This scenario assumes that there are different administrators with different levels
of privileges regarding host-related operations. One administrator (A) can add and edit
host entries, and thus enroll the hosts as described in <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">Section 4.2.1,
“Manual Host Enrollment with Privileged Administrator”</a>. The second administrator
(B) has insufficient permissions to create host entries, but is allowed to enroll
machines. The following sequence of operations is engaged:
+ </div></div><div class="section"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2. Manual
Host Enrollment with Separation of
Duties</h3></div></div></div><div class="para">
+ This scenario assumes that there are different administrators with different levels
of privileges regarding host-related operations. One administrator (A) can add and edit
host entries, and thus enroll the hosts as described in <a class="xref"
href="#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">Section 5.2.1,
“Manual Host Enrollment with Privileged Administrator”</a>. The second administrator
(B) has insufficient permissions to create host entries, but is allowed to enroll
machines. The following sequence of operations is engaged:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Administrator A authorizes enrollment of a host by creating the host entry in the
back end using the webUI or command-line script.
</div></li><li class="listitem"><div
class="para">
@@ -2065,7 +1945,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
The keytab is saved with <code
class="systemitem">root:root</code> ownership and 0600 permissions, and
in a specific directory on the client machine.
</div></li></ol></div><div class="para">
At this stage the enrollment is complete and the machine can now automatically
connect to and communicate with the FreeIPA server.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3. Bulk
Host Deployment</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Enrollment_Scenarios-Bulk_Host_Deployment"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3. Bulk Host
Deployment</h3></div></div></div><div
class="para">
This scenario is very useful for automatic provisioning of multiple hosts (or virtual
machines). In this scenario you can pre-create a number of hosts on the FreeIPA server and
set passwords on them. You can use your kickstart operation to perform the enrollment. For
example, the <span
class="application"><strong>cobbler</strong></span> utility
makes this relatively easy because you can store variables in the <span
class="application"><strong>cobbler</strong></span> system
configuration.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
There are two ways to set the password. You can either supply your own or have
FreeIPA generate a random one.
@@ -2097,7 +1977,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
</div></li><li class="listitem"><div
class="para">
Because the password is set to expire, the Kerberos keytab will be generated and
the password attribute cleared.
- </div></li></ol></div></div></div><div
class="section" id="renaming-machines"><div
class="titlepage"><div><div><h2 class="title"
id="renaming-machines">4.3. Renaming
Machines</h2></div></div></div><div class="para">
+ </div></li></ol></div></div></div><div
class="section" id="renaming-machines"><div
class="titlepage"><div><div><h2 class="title"
id="renaming-machines">5.3. Renaming
Machines</h2></div></div></div><div class="para">
The hostname of a system is critical for the correct operation of Kerberos and SSL.
Both of these security mechanisms rely on the hostname to ensure that communication is
occurring between the specified hosts, and that no "man-in-the-middle" or other
attacks are affecting the system.
</div><div class="para">
In an environment where virtual machines are commonplace, or perhaps in a clustered
environment, copying, moving, and renaming hosts could be quite common, resulting in
frequent demands for renames of machines.
@@ -2107,7 +1987,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
Due to the nature of service principals, renaming hosts also requires the regeneration
of service principals. Each service has a Kerberos principal in the form of <code
class="systemitem"><service
name>/<hostname>@<REALM></code>, for example,
<code class="systemitem">ldap/server.example.com(a)EXAMPLE.COM</code>.
This principal can be referred to as a "service principal". In some cases the
<code class="systemitem">@<REALM></code> is omitted,
leaving only <code class="systemitem"><service
name>/<hostname></code>. (The "/" is a
"slash" separator, not an "or" operator.)
</div><div class="para">
The following procedure renames the host <code
class="systemitem">server.example.com</code> in the Kerberos realm
<code class="systemitem">EXAMPLE.COM</code>, to the new hostname
<code class="systemitem">master.example.com</code>. This procedure
uses example file names, hostnames and domain names throughout; you need to update these
examples to suit your own environment.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine"><h6>Procedure 4.3. To
rename a FreeIPA machine:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine"><h6>Procedure 5.3. To
rename a FreeIPA machine:</h6><ol class="1"><li
class="step"><div class="para">
Identify which services are running on the machine. These need to be re-created when
the machine is re-enrolled:
<pre class="screen"><code class="command"># ipa
service-find server.example.com</code></pre>
@@ -2151,7 +2031,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
If you need certificates for services, use either <code
class="command">certmonger</code> or the FreeIPA administration tools.
</div></li><li class="step"><div
class="para">
Re-add the host to any applicable host groups.
- </div></li></ol></div></div><div
class="section" id="config-virt-machines"><div
class="titlepage"><div><div><h2 class="title"
id="config-virt-machines">4.4. Reconfiguring Virtual
Machines</h2></div></div></div><div class="para">
+ </div></li></ol></div></div><div
class="section" id="config-virt-machines"><div
class="titlepage"><div><div><h2 class="title"
id="config-virt-machines">5.4. Reconfiguring Virtual
Machines</h2></div></div></div><div class="para">
There are two cases where it might be necessary to reconfigure a VM enrolled in a
FreeIPA domain:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The VM is copied.
@@ -2162,7 +2042,7 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
</div></li></ul></div>
</div><div class="para">
- In each case, the procedure is identical to that described for renaming a FreeIPA
machine: <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine">Procedure 4.3,
“To rename a FreeIPA machine:”</a>. Although it is possible to <span
class="emphasis"><em>not</em></span> completely unconfigure
the client, there is no real downside to doing this (that is, running the <code
class="command">ipa-client-install --uninstall</code> command).
+ In each case, the procedure is identical to that described for renaming a FreeIPA
machine: <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine">Procedure 5.3,
“To rename a FreeIPA machine:”</a>. Although it is possible to <span
class="emphasis"><em>not</em></span> completely unconfigure
the client, there is no real downside to doing this (that is, running the <code
class="command">ipa-client-install --uninstall</code> command).
</div><div class="para">
If you cannot use the <code class="command">ipa-client-install
--uninstall</code> command, or it is failing for some reason, use the following
manual procedure to remove the FreeIPA configuration from the client. Bear in mind,
however, that this procedure cannot be undone:
</div><div class="procedure"><ol class="1"><li
class="step"><div class="para">
@@ -2187,31 +2067,33 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
Add the new host to FreeIPA, or re-join using administrator privileges:
<pre class="programlisting"><code class="command">$
ipa-join</code></pre>
- </div></li></ol></div></div><div
class="section" id="certs"><div
class="titlepage"><div><div><h2 class="title"
id="certs">4.5. Configuring Certificate-Based Machine
Authentication</h2></div></div></div><div
class="para">
- IPA v2 extends the scope of authentication to include machines on the network. Machine
authentication is required for the FreeIPA server to trust the machine and to accept
FreeIPA connections from the client software installed on that machine. After
authenticating the client, the FreeIPA server can respond to its requests.
+ </div></li></ol></div></div><div
class="section" id="certs"><div
class="titlepage"><div><div><h2 class="title"
id="certs">5.5. Configuring Certificate-Based Machine
Authentication</h2></div></div></div><div
class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX bz646240
</div><div class="para">
- IPA supports two different approaches to machine authentication: Key Tables (or <em
class="firstterm">keytabs</em>, a symmetric key resembling to some
extent a user password); and Machine Certificates. FreeIPA clients use XML-RPC calls to
request keytabs and certificates. Keys and certificate requests are generated on machines
applying for certificates. Certificates are generated by the CA, in response to
certificate requests submitted to FreeIPA and stored in FreeIPA's DS, and at the same
time delivered to the machine for use in PKI machine authentication.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1. Authentication
Usage Scenarios</h3></div></div></div><div
class="para">
- Usage scenarios are split into the following categories:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Deployment of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Authentication using machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Revocation of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Renewal of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Recovery from destruction of FreeIPA server
- </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems">4.6. Client
Problems</h2></div></div></div><div class="para">
+ Authentication includes machines on the network. Machine authentication is required
for the FreeIPA server to trust the machine and to accept FreeIPA connections from the
client software installed on that machine. After authenticating the client, the FreeIPA
server can respond to its requests.
+ </div><div class="para">
+ FreeIPA supports two different approaches to machine authentication: Key Tables (or
<em class="firstterm">keytabs</em>, a symmetric key resembling to
some extent a user password); and Machine Certificates. FreeIPA clients use XML-RPC calls
to request keytabs and certificates. Keys and certificate requests are generated on
machines applying for certificates. Certificates are generated by the CA, in response to
certificate requests submitted to FreeIPA and stored in FreeIPA's DS, and at the same
time delivered to the machine for use in PKI machine authentication.
+ </div><div class="para">
+ Usage scenarios are split into the following categories:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Deployment of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Authentication using machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Revocation of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Renewal of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Recovery from destruction of FreeIPA server
+ </div></li></ul></div><div class="para">
+ Machine authentication * Machines coming on the network and requesting services within
the IPA realm shall be authenticated against that realm * Machine authentication
credentials shall be used to provide mutual authentication/trust, encryption, and SSO
capabilities for the services and applications requesting resources and accessing other
services within the same IPA realm
+ </div><div class="para">
+ Note: Term "Machine" below means is either a physical host or a guest image
in virtual machine. * [1.1] Integrate DNS server into the IPA server (Planned) o [1.1.1]
Store DNS information in the DS (Planned) o [1.1.2] Allow IPA clients to automatically
discover IPA servers (using DNS configuration) (Planned) o [1.1.3] Allow management of the
DNS entries through the central IPA management console (Planned) o [1.1.4] Continue to
allow IPA to function with an external DNS server (Planned) * [1.2] Policy on an IPA
server shall determine the rules of the enrollment for the new machines. Options include:
o [1.2.1] The machine shall automatically be registered in IPA and configured with
settings that were pre-initialized (Planned) o [1.2.2] An Administrator is required to
manually authenticate to the IPA server and initialize the configuration settings
(Planned) * [1.3] When machine joins IPA realm the following operations shall be
performed: (Planned) o [1.3.1] A unique and perm
anent identifier (machine GUID) shall be set for each machine. (Planned) o [1.3.2] Assign
a kerberos principal to the machine. (Planned) o [1.3.3] Kerberos machine principal name
will be administrator assigned or automatically set (Planned) o [1.3.4] Kerberos machine
principal will default to the hostname (Planned) o [1.3.5] Capture attributes about the
machine (Planned to some extent) + [1.3.5.1] Hostname + [1.3.5.2] Identify operating
system on the machine + [1.3.5.3] In the case of administrator enrollment, the ID of the
administrator o [1.3.6] Generate and provision keytab for machine authentication (Planned)
o [1.3.7] Generate and provision machine certificate for the machine/VM to be used by
applications and services that require PKI authentication (Planned) * [1.6] Renewal o
[1.6.1] Automatically renew kerberos credential according to the centrally managed renewal
policies (Planned - do it yourself instructions) o [1.6.2] Automatically renew and
provision certificates
before their expiration according to the centrally managed policy (Planned) * [1.7]
Allow a machine to leave the realm, de-activating the identity from IPA and
destroying/revoking any certificates/keytabs. (Planned) o [1.7.1] The task of
de-activating a machine from a realm should not require access (physical or network) to
that client machine (Planned) o [1.7.2] Allow machine to be de-activated from IPA realm
through the IPA client software (Planned) o [1.7.3] Allow machine to be re-enrolled into
the IPA realm. (Planned) * [1.8] Update LDAP schema to support machine identity and
related policies (Planned - but only for identity part) * [1.9] Maintain the identity of
the machine or virtual machine after an upgrade of the OS including a major upgrade for
example from 4 to 5. (Planned)
+ </div></div><div class="section"
id="General_Troubleshooting_Tips-Client_Problems"><div
class="titlepage"><div><div><h2 class="title"
id="General_Troubleshooting_Tips-Client_Problems">5.6. Client
Problems</h2></div></div></div><div class="para">
If you are unable to log into a machine or the standard NSS tools fail to return user
and group information (for example, <code class="command">getent passwd
admin</code> fails), inspect the SSSD logs in <code
class="filename">/var/log/sssd/</code>. You should start with the log
file for your domain (<code
class="filename">sssd_example.com.log</code>).
</div><div class="para">
To increase the log level, set <code
class="varname">debug_level</code> = 9 in the <code
class="literal">[domain/<em
class="replaceable"><code>example.com</code></em>]</code>
section of the <code class="filename">/etc/sssd/sssd.conf</code>
file, and restart the <code class="systemitem">sssd</code> daemon
for this change to take effect. Monitor the <code
class="filename">/var/log/sssd/sssd_example.com.log</code> file for any
relevant information.
- </div></div><div class="section"
id="uninstalling-clients"><div
class="titlepage"><div><div><h2 class="title"
id="uninstalling-clients">4.7. Uninstalling a FreeIPA
Client</h2></div></div></div><div class="para">
- For Fedora clients, the <code
class="command">ipa-client-install</code> utility can be used to
uninstall the client and remove it from the FreeIPA domaine. To remove the client, use the
<code class="option">--uninstall</code> option.
- </div><pre class="programlisting"><span
class="perl_Comment"># ipa-client-install
--uninstall</span></pre><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
- There is an uninstall option with the <code
class="command">ipa-join</code> command. This is called by <code
class="command">ipa-client-install --uninstall</code> as part of the
uninstallation process. However, while the <code
class="command">ipa-join</code> option removes the client from the
domain, it does not actually uninstall the client or properly remove all of the
FreeIPA-related configuration. Do not run <code class="command">ipa-join
-u</code> to attempt to uninstall the FreeIPA client. The only way to uninstall a
client completely is to use <code class="command">ipa-client-install
--uninstall</code>.
- </div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="users"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 5. Identity: Managing Users and User
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#home-directories">5.1. Managing User Home
Directories</a></span></dt><dt><span
class="section"><a href="#adding-users">5.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="#editing-users">5.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">5.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">5.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="#sect-Enterprise_Identity_
Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users">5.5. Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-groups">5.6. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1.
Creating FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2.
Editing FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3.
Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-pwdpolicy">5.7. Setting an
Individual Password Polic
y</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4.
Editing the Password Policy</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_Us
er_Groups">5.7.5. Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9.
Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="#searching">5.8. Searching for Users
and Groups</a></span></dt><dd><dl><dt><span
class="section"><a hre
f="#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2.
Searching for
Groups</a></span></dt></dl></dd></dl></div><div
class="section" id="home-directories"><div
class="titlepage"><div><div><h2 class="title"
id="home-directories">5.1. Managing User Home
Directories</h2></div></div></div><div
class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="users" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 6. Identity: Managing Users and User
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#home-directories">6.1. Managing User Home
Directories</a></span></dt><dt><span
class="section"><a href="#adding-users">6.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="#editing-users">6.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">6.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_IPA_Users-Specifying_Default_User_Settings">6.5.
Specifying Default User Settings</a></span></dt><dt><span cla
ss="section"><a href="#search-limits">6.6. Setting Default
Search Limits</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Users-Deleting_IPA_Users">6.7. Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Deleting_IPA_Users-Using_the_Command_Line">6.7.1. Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-groups">6.8. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1. Creating FreeIPA
Groups</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2. Editing FreeIPA
Groups</a></span></dt><dt><span
class="section"><a
href="#Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3. Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="#user-pwdpolicy">6.9. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a href="#
The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4. Editing
the Password Policy</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6. Password
Policy Attributes</a></span></dt><dt><span
class="section"><a href="#The
_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7. Notifying
Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="#The_IPA_Password_Policy-Using_Local_Logins">6.9.9. Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="#searching">6.10. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Searching_for_Users_and_Groups-Searching_for_Users">6.10.1. Searching
for Users</a></span></dt><dt><span
class="section"><a
href="#Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2. Searching
for
Groups</a></span></dt></dl></dd></dl></div><div
class="section" id="home-directories"><div
class="titlepage"><div><div><h2 class="title"
id="home-directories">6.1. Managing User Home
Directories</h2></div></div></div><div class
="para">
FreeIPA, as part of managing users, can manage user home directories. However, the
FreeIPA server has expectations about
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The default prefix for users' home directories is <code
class="filename">/home</code>.
@@ -2227,19 +2109,19 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF,
SRV, SSHFP, TA
If a suitable directory and mechanism are not available for the creation of home
directories, users may not be able to log in.
</div></li></ul></div>
- </div></div><div class="section"
id="adding-users"><div
class="titlepage"><div><div><h2 class="title"
id="adding-users">5.2. Adding
Users</h2></div></div></div><div class="para">
+ </div></div><div class="section"
id="adding-users"><div
class="titlepage"><div><div><h2 class="title"
id="adding-users">6.2. Adding
Users</h2></div></div></div><div class="para">
FreeIPA supports a wide range of <span
class="property">username</span> formats, but you need to be aware of
any restrictions that may apply to your particular environment. For example, a <span
class="property">username</span> that starts with a digit may cause
problems for some UNIX systems.
</div><div class="para">
The range of <span class="property">username</span> formats
supported by FreeIPA can be described by the following regular expression:
- </div><pre class="screen"><code
class="command">[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]</code></pre><div
class="para">
+ </div><pre
class="screen">[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]</pre><div
class="para">
The trailing $ symbol is permitted for Samba 3.x machine support.
</div><div class="para">
Use the <code class="command">ipa user-add</code> command to add
users to FreeIPA. You can pass attributes directly on the command line, or run the command
with no parameters to enter interactive mode. Interactive mode prompts you to enter the
basic attributes required to add a new user. You can add further attributes using the
<code class="command">ipa user-mod</code> command. Use the <code
class="command">ipa user-mod --list</code> command to view a list of
the attributes that you can modify using this command.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_the_Command_Line-To_create_the_user_jlamb_using_the_command_line"><h6>Procedure 5.1. To
create the user <code class="systemitem">jlamb</code> using the
command line:</h6><ul><li class="step"><div
class="para">
+ </div><div class="procedure"
id="Using_the_Command_Line-To_create_the_user_jlamb_using_the_command_line"><h6>Procedure 6.1. To
create the user <code class="systemitem">jlamb</code> using the
command line:</h6><ul><li class="step"><div
class="para">
Open a shell and run the following command:
</div><div class="para">
-<pre class="screen"><code class="command">$ ipa user-add
jlamb --first=John --last=Lamb --password</code></pre>
+<pre class="screen">$ ipa user-add jlamb --first=John --last=Lamb
--password</pre>
</div><div class="para">
This will prompt for a password and then complete the new entry with default
values.
@@ -2264,53 +2146,133 @@ UID: 387115841
Press <span
class="keycap"><strong>Enter</strong></span> at each prompt
to accept the default values (enclosed in square brackets), or type an alternative.
</div><div class="para">
Refer to the <code class="command">ipa user-add</code> help page
for more information.
- </div></div><div class="section"
id="editing-users"><div
class="titlepage"><div><div><h2 class="title"
id="editing-users">5.3. Editing
Users</h2></div></div></div><div class="para">
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a user is created without specifying a UID or GID number, then the user account
is automatically assigned an ID number that is next available in the server or replica
range. (Number ranges are described more in <a class="xref"
href="#Managing-Unique_UID_and_GID_Attributes">Section 13.3, “Managing Unique
UID and GID Number Assignments”</a>.) This means that a user always has a unique
number for its UID number and, if configured, for its private group.
+ </div><div class="para">
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
user entry, the server does not validate that the <em
class="parameter"><code>uidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in a
search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa user-find
--all</code>.
+ </div></div></div></div><div class="section"
id="editing-users"><div
class="titlepage"><div><div><h2 class="title"
id="editing-users">6.3. Editing
Users</h2></div></div></div><div class="para">
Use the <code class="command">ipa user-mod</code> command to
modify user account details, such as adding, removing or changing attributes. Refer to the
following examples:
</div><div class="para">
To update attributes for the user <code
class="systemitem">jsmith</code>:
- </div><div class="para">
- <code class="command">$ ipa user-mod jsmith <code
class="option">--email=johnsmith(a)mydomain.com</code> <code
class="option">--title=Editor</code></code>
- </div><div class="para">
+ </div><pre class="screen">$ ipa user-mod jsmith
--email=johnsmith(a)mydomain.com --title=Editor</pre><div
class="para">
To retrieve a list of attributes for a user:
- </div><div class="para">
- <code class="command">$ ipa user-show --raw <user
name></code>
- </div><div class="para">
+ </div><pre class="screen">$ ipa user-show --raw <em
class="replaceable"><code>userName</code></em></pre><div
class="para">
The list of attributes corresponds to those available in the web interface, not
including any custom attributes that may have been defined.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">5.4. Activating
and Deactivating User Accounts</h2></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">6.4. Activating
and Deactivating User Accounts</h2></div></div></div><div
class="para">
FreeIPA user accounts can be set to a status of <code
class="literal">Active</code> or <code
class="literal">Inactive</code>. If you deactivate a user account, that
user can no longer log in to FreeIPA, change their password, or perform any other tasks.
Any existing connections will remain valid until their <code
class="systemitem">Kerberos</code> TGT and other tickets expire, but
they will not be able to renew them. The account and all associated information still
exists, but is inaccessible by the user.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">5.4.1. Using
the Command Line</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="Activating_and_Deactivating_User_Accounts-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1. Using
the Command Line</h3></div></div></div><div
class="para">
Use the <code class="command">ipa user-enable</code> and
<code class="command">ipa user-disable</code> commands to enable and
disable user accounts, respectively. Refer to the following examples:
</div><div class="para">
To disable the <code class="systemitem">jsmith</code> user
account:
</div><div class="para">
- <code class="command">$ ipa user-disable jsmith</code>
+ $ ipa user-disable jsmith
</div><div class="para">
To enable the <code class="systemitem">jsmith</code> user
account:
</div><div class="para">
- <code class="command"> $ ipa user-enable jsmith</code>
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users">5.5. Deleting
FreeIPA Users</h2></div></div></div><div
class="para">
+ $ ipa user-enable jsmith
+ </div></div></div><div class="section"
id="Configuring_IPA_Users-Specifying_Default_User_Settings"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Specifying_Default_User_Settings">6.5. Specifying
Default User Settings</h2></div></div></div><div
class="para">
+ You can configure the default settings for FreeIPA users to suit your deployment. For
example, you can specify the maximum username length, the default path to the <code
class="filename">/home</code> directory, the default shell, and other
attributes.
+ </div><div class="para">
+ FreeIPA supports the following User Settings:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ <span class="guilabel"><strong>Maximum Username
Length</strong></span> (<span
class="property">ipaMaxUsernameLength</span>): The maximum length of
any username. The default value is eight.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Root for Home
Directories</strong></span> (<span
class="property">ipaHomesRootDir</span>): The root directory for all
home directories. The default value is <code
class="filename">/home</code>.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default
Shell</strong></span> (<span
class="property">ipaDefaultLoginShell</span>): The default shell for
all user accounts. The default value is <code
class="filename">/bin/sh</code>.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default User
Group</strong></span> (<span
class="property">ipaDefaultPrimaryGroup</span>): The default group to
which all newly created accounts are added. The default value is <code
class="systemitem">ipausers</code>, which is automatically created
during the FreeIPA server installation process.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default E-mail
Domain</strong></span> (<span
class="property">ipaDefaultEmailDomain</span>): The default domain used
to create email addresses for all newly created accounts. The default is the domain to
which the FreeIPA server belongs.
+ </div></li></ul></div><div class="para">
+ Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. The following is an example of how to set the
maximum username length to 64 characters, and the default home directory to <code
class="filename">/users/home</code>:
+ </div><pre class="screen"># ipa config-mod --maxusername=64
--homedirectory=/users/home
+Max username length: 64
+Home directory base: /users/home
+Default shell: /bin/sh
+Default users group: ipausers
+Default e-mail domain:
mydomain.net
+Search time limit: 2
+Search size limit: 100
+User search fields: uid,givenname,sn,telephonenumber,ou,title
+Group search fields: cn,description
+Migration mode: FALSE
+Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
+ Refer to the <code class="command">ipa help config</code> page
for more information.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ The default root directory for all home directories is <code
class="filename">/home</code>, but it is the responsibility of the
system administrator to ensure that whatever value is specified for this attribute is
actually available.
+ </div><div class="para">
+ Fedora includes a <code class="systemitem">PAM</code> module
called <code class="systemitem module">pam_mkhomedir</code> that can
automatically create a home directory if one does not exist for the user authenticating
against the system. FreeIPA does not force the use of this module because it may try to
create home directories even when the shared storage is not available. It is the
responsibility of the system administrator to activate this module on the clients if
needed.
+ </div></div></div></div><div class="section"
id="search-limits"><div
class="titlepage"><div><div><h2 class="title"
id="search-limits">6.6. Setting Default Search
Limits</h2></div></div></div><div class="para">
+ You can set limits on the number of records returned when performing various queries,
for example when you run the <code
class="command">ipa user-find</code> command. These limits are
specified by the <em class="parameter"><code>Search size
limit</code></em> attribute in the default FreeIPA configuration. The default
value for this attribute is 100.
+ </div><div class="para">
+ To view the current configuration, run the <code
class="command"># ipa config-show</code> command. Refer to the <code
class="command">ipa help config</code> help page for more information.
+ </div><div class="para">
+ The following is a sample FreeIPA configuration:
+ </div><pre class="screen">[ming@myserver ~]$ ipa config-show
+Max username length: 32
+Home directory base: /home
+Default users group: ipausers
+Default e-mail domain:
mydomain.net
+Search time limit: 2
+Search size limit: 20
+User search fields: uid,givenname,sn,telephonenumber,ou,title
+Group search fields: cn,description
+Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
+ You can use the <code class="command">ipa config-mod</code>
command to specify a suitable value for the <em
class="parameter"><code>Search size limit</code></em>
attribute. For example, if you set this value to 10, the <code
class="command">ipa user-find</code> command will only return 10
entries, even if many more entries exist. If you set this value to 0 (zero) or −1, it
means that there are no restrictions on the number of entries that can be returned.
+ </div><div class="orderedlist"><h6>Setting search size
limits</h6><ol><li class="listitem"><div
class="para">
+ To set the <em class="parameter"><code>Search size
limit</code></em> attribute to 50, run the following command:
+<pre class="programlisting"># ipa config-mod
--searchrecordslimit=50</pre>
+
+ </div></li></ol></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
+ You need to be aware of the potential performance impact of setting the search size
limit too high. You need to determine a suitable balance between the benefits of always
returning all entries matched by a search, and the performance gained by implementing a
search filter.
+ </div><div class="para">
+ Note also that if the size limit is set too high or removed completely it might
affect the behavior of UI screens.
+ </div></div></div><div class="para">
+ You can configure various aspects of the FreeIPA search functionality to suit your
deployment. For example, you can restrict the number of fields upon which a user can base
a search, or limit the number of records returned for any particular search.
+ </div><div class="para">
+ FreeIPA supports the following search configuration attributes:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ <em class="parameter"><code>Search Time
Limit</code></em>: The maximum time, in seconds, that a search will run before
failing.
+ </div></li><li class="listitem"><div
class="para">
+ <em class="parameter"><code>Search Records
Limit</code></em>: The maximum number of records that a search can return. Set
this value to zero (0) to specify no limit. The directory server limit (the default value
is 2000) still applies.
+ </div></li><li class="listitem"><div
class="para">
+ <em class="parameter"><code>User Search
Fields</code></em>: For a user search, specifies the fields to search for the
values entered by a user.
+ </div></li><li class="listitem"><div
class="para">
+ <em class="parameter"><code>Group Search
Fields</code></em>: For a group search, specifies the fields to search for the
values entered by a user.
+ </div></li></ul></div><div class="para">
+ Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. For example, to specify a search time limit
of 60 seconds, use the following command:
+<pre class="screen"># ipa config-mod --searchtimelimit=60</pre>
+ Refer to the <code class="command">ipa help config</code> page
for more information.
+ </div><div class="para">
+ If you add attributes to the user or group search fields, you should also create a new
<code class="systemitem">LDAP</code> index for those attributes to
avoid performance degradation. Conversely, the existence of too many indexes can impact
write performance, so you need to balance one against the other.
+ </div><div class="para">
+ Refer to <a
href="http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_...
Indexes</a> in the <em class="citetitle">389 Directory Server
Administration Guide</em> for information on creating indexes.
+ </div></div><div class="section"
id="Configuring_IPA_Users-Deleting_IPA_Users"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Deleting_IPA_Users">6.7. Deleting FreeIPA
Users</h2></div></div></div><div class="para">
If you delete a FreeIPA user account, all of the information stored in the entry for
that identity is lost. This includes the user's full name, group membership, phone
numbers, and passwords. The actual user account and home directory still exist, be they on
a server, local machine, or other provider, but they are no longer accessible by FreeIPA.
</div><div class="para">
Unlike deactivation, if you delete a user account, it cannot be retrieved. If you need
this user account again, you need to recreate it and add all of the account details
manually.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Unlike in earlier versions of FreeIPA, it is now possible to delete the <code
class="systemitem">admin</code> user. If, however, you delete all of
the <code class="systemitem">admin</code> users then you will need
to use the Directory Manager account to create a new administrative user. Alternatively,
if you have a user in the group management role, they can add a new <code
class="systemitem">admin</code> user.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1. Using
the Command Line</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Deleting_IPA_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="Deleting_IPA_Users-Using_the_Command_Line">6.7.1. Using the Command
Line</h3></div></div></div><div class="para">
Use the <code class="command">ipa user-del</code> command to
delete user accounts. For example:
</div><div class="para">
To delete the <code class="systemitem">jsmith</code> user
account:
</div><div class="para">
- <code class="command">$ ipa user-del jsmith</code>
+ $ ipa user-del jsmith
</div><div class="para">
If you intend to delete multiple users, you can use the <code
class="option">--continue</code> option to prevent the command from
stopping should it encounter any errors. For example:
</div><div class="para">
- <code class="command">$ ipa user-del <code
class="option">--continue</code> <em
class="parameter"><code>user_01</code></em> <em
class="parameter"><code>user_02</code></em> <em
class="parameter"><code>user_03</code></em></code>
+ $ ipa user-del <code class="option">--continue</code> <em
class="parameter"><code>user_01</code></em> <em
class="parameter"><code>user_02</code></em> <em
class="parameter"><code>user_03</code></em>
</div><div class="para">
If you run this command without using the <code
class="option">--continue</code> option, FreeIPA will delete the listed
user accounts unless it encounters any errors, at which point it stops. For example, if
<em class="parameter"><code>user_02</code></em> did not
exist, the previous command would only delete <em
class="parameter"><code>user_01</code></em>; <em
class="parameter"><code>user_03</code></em> would not be
affected.
</div><div class="para">
The <code class="option">--continue</code> option returns a
summary of successes and failures to <code
class="systemitem">stdout</code>.
- </div></div></div><div class="section"
id="user-groups"><div
class="titlepage"><div><div><h2 class="title"
id="user-groups">5.6. Creating User
Groups</h2></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="user-groups"><div
class="titlepage"><div><div><h2 class="title"
id="user-groups">6.8. Creating User
Groups</h2></div></div></div><div class="para">
FreeIPA uses groups to facilitate the management and administration of all types of
objects, such as users, hosts, tasks, roles, and others. This section introduces <code
class="systemitem">User Groups</code> and how they are used within
FreeIPA. Other object groups behave and are used in similar ways; these are discussed
elsewhere.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-User_Groups"><h5
class="formalpara">User Groups</h5>
+ </div><div class="formalpara"
id="Configuring_IPA_Groups-User_Groups"><h5
class="formalpara">User Groups</h5>
Three groups are created during the installation process: <code
class="systemitem">ipausers</code>, <code
class="systemitem">admins</code>, and <code
class="systemitem">editors</code>. All of these groups are required for
FreeIPA operation.
</div><div class="para">
The FreeIPA Administrator is a member of the <code
class="systemitem">admins</code> group. All other users belong to the
global group <code class="systemitem">ipausers</code>, and you can
create as many additional groups as you require.
@@ -2320,11 +2282,11 @@ UID: 387115841
The <code class="systemitem">editors</code> group is a special
group used by the web interface. Members of this group have at least one delegation, which
means they can edit records apart from their own.
</div><div class="para">
You can create groups based on the departments within your organization, for example,
Development, Finance, and HR. You can also create groups based on the permissions, or
roles, required to manage your departmental or other groups.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Nested_Groups"><h5
class="formalpara">Nested Groups</h5>
+ </div><div class="formalpara"
id="Configuring_IPA_Groups-Nested_Groups"><h5
class="formalpara">Nested Groups</h5>
You can also create nested groups. For example, you can create a group called
"Documentation", and then create sub-groups such as "Writers",
"Translators", and "Editors". You can add users to each of the
sub-groups to suit the needs of your organization. Any users that you add to a sub-group
automatically become members of the parent group.
</div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
Avoid the creation of cyclic groups; that is, groups that contain groups that in turn
contain their own ancestors, and avoid creating group names that contain spaces. Either of
these conditions can lead to unexpected behavior.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1. Creating
FreeIPA Groups</h3></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_IPA_Groups-Using_the_Command_Line">5.6.1.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Configuring_IPA_Groups-Creating_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1. Creating FreeIPA
Groups</h3></div></div></div><div class="section"
id="Creating_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Creating_IPA_Groups-Using_the_Command_Line">6.8.1.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-add</code> command to
add groups. You can include attributes on the command line or use the command
interactively. For example:
</div><div class="para">
To create a group called "Engineering" using the command line:
@@ -2347,7 +2309,13 @@ Added group "documentation"
Description: All authors, editors, and translators
GID: 387115845</pre><div class="para">
The group name and description are mandatory fields. If either of these are not
included on the command line, you will be prompted to include them.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Using_the_Command_Line-Adding_members_to_a_new_group"><h5
class="formalpara">Adding members to a new group</h5>
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a group is created without specifying a GID number, then the group entry is
assigned the ID number that is next available in the server or replica range. (Number
ranges are described more in <a class="xref"
href="#Managing-Unique_UID_and_GID_Attributes">Section 13.3, “Managing Unique
UID and GID Number Assignments”</a>.) This means that a group always has a unique
number for its GID number.
+ </div><div class="para">
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
group entry, the server does not validate that the <em
class="parameter"><code>gidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in
a search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa group-find
--all</code>.
+ </div></div></div><div class="formalpara"
id="Using_the_Command_Line-Adding_members_to_a_new_group"><h5
class="formalpara">Adding members to a new group</h5>
You cannot add members to a newly-created group using the <code
class="command">ipa group-add</code> command. First you need to create
the group, and then use the <code
class="command">ipa group-add-member</code> command to add members. For
example:
</div><pre class="screen">$ ipa group-add-member
--users=user01,user02,user03 engineering
Group name: engineering
@@ -2367,23 +2335,23 @@ Number of members added 3
-------------------------
Number of members added 2
-------------------------
-</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2. Editing
FreeIPA Groups</h3></div></div></div><div
class="para">
+</pre></div></div><div class="section"
id="Configuring_IPA_Groups-Editing_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2. Editing FreeIPA
Groups</h3></div></div></div><div class="para">
You can edit many of the attributes that define a group, as well as add or remove
members. Some attributes are read-only by default, however you can edit these attributes
if required.
</div><div class="para">
You cannot edit the group name. The group name is the primary key, so changing it is
the equivalent of deleting the group and creating a new one.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Editing_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Editing_IPA_Groups-Using_the_Command_Line">5.6.2.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Editing_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Editing_IPA_Groups-Using_the_Command_Line">6.8.2.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-mod</code> command to
modify specific attributes of FreeIPA groups. FreeIPA provides numerous commands for
working with groups, such as <code
class="command">ipa group-add-member</code> and <code
class="command">ipa group-detach</code>; run the <code
class="command">ipa help group</code> command to access the FreeIPA
group help page for more information.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3. Deleting
FreeIPA Groups</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Configuring_IPA_Groups-Deleting_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3. Deleting FreeIPA
Groups</h3></div></div></div><div class="para">
When you delete a FreeIPA group, only the immediate group is removed; members of the
group are not affected.
</div><div class="para">
When you delete a FreeIPA group, any delegations that apply to that group are also
removed. For example, suppose you added an "EngineeringManager" group
specifically to set up delegations for the Engineering Manager. If you delete the
EngineeringManager group, then those delegations are also lost. These delegations cannot
be retrieved. If you need this group and delegation again, you need to recreate them.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Groups-Using_the_Command_Line">5.6.3.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Deleting_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Deleting_IPA_Groups-Using_the_Command_Line">6.8.3.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-del</code> command to
delete groups. For example:
</div><div class="para">
To delete the Engineering group:
</div><div class="para">
- <code class="command">$ ipa group-del Engineering</code>
- </div></div></div></div><div class="section"
id="user-pwdpolicy"><div
class="titlepage"><div><div><h2 class="title"
id="user-pwdpolicy">5.7. Setting an Individual Password
Policy</h2></div></div></div><div class="para">
+ $ ipa group-del Engineering
+ </div></div></div></div><div class="section"
id="user-pwdpolicy"><div
class="titlepage"><div><div><h2 class="title"
id="user-pwdpolicy">6.9. Setting an Individual Password
Policy</h2></div></div></div><div class="para">
FreeIPA has a default policy of never exposing passwords, even hashed passwords, to
clients, in the interests of system security. This policy applies even if you still rely
on NIS server functionality to some degree, for example, as a result of a full or partial
migration from NIS to FreeIPA. FreeIPA normally expects a switch to Kerberos for
authentication, but this may not always be possible.
</div><div class="para">
The FreeIPA password policy supports the specification of various password attributes
that help to ensure the security of your system, and also that of individual user
accounts. You can specify the password lifetime, length, and the types of characters
required, all as part of the FreeIPA password policy.
@@ -2393,67 +2361,67 @@ Number of members added 3
Because the password policy is enforced by the <abbr
class="abbrev">KDC</abbr>, any further policy specifications that you
implement as part of the Directory Server password policy will not be visible in FreeIPA,
and neither will they be enforced.
</div></li><li class="listitem"><div
class="para">
Different rules apply to changing passwords, depending on your login credentials.
- </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1. Changing
Passwords as the Directory Manager</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div></div><div
class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1. Changing
Passwords as the Directory Manager</h3></div></div></div><div
class="para">
If you reset a password using <em class="parameter
entry"><code>cn=Directory Manager</code></em> credentials (only
possible if you manually perform an <code
class="systemitem">LDAP</code> password change operation) then you
override any checks and the password is set to whatever you specify. The FreeIPA password
policy is ignored.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2. Changing
Passwords as the FreeIPA
Administrator</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2. Changing
Passwords as the FreeIPA
Administrator</h3></div></div></div><div
class="para">
If you reset a password using <code
class="systemitem">admin</code> credentials (that is, as part of the
<code class="systemitem">admins</code> group), the FreeIPA password
policy is ignored, but the expiration date is set to "now". This means that the
user is forced to change the password at login time, and the password policy is then
enforced. This is also true for users who have had password changing rights delegated to
them.
</div><div class="para">
Consequently, the FreeIPA Administrator can easily create users with
"default" passwords and reset user's passwords, but will not know the
actual, final password entered by the user. Further, any password that is transmitted from
the FreeIPA Administrator to the user, even over insecure channels, is a temporary
password. Consequently, it is not critical if it is accidentally disclosed, provided that
the user promptly resets it.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3. Changing
Passwords as a Regular User</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3. Changing
Passwords as a Regular User</h3></div></div></div><div
class="para">
If you are logged in as a regular user (that is, you are not part of the <code
class="systemitem">admins</code> group, or possessed of any elevated
privileges), then you can only change your own password, and these changes are always
subject to the FreeIPA password policy.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4. Editing
the Password Policy</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Editing_the_Password_Policy"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4. Editing the
Password Policy</h3></div></div></div><div
class="para">
You can use either the web interface or the command line to edit the FreeIPA password
policy. However, you can only edit those attributes supported by FreeIPA.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Editing_the_Password_Policy-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Editing_the_Password_Policy-Using_the_Command_Line">5.7.4.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Editing_the_Password_Policy-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Editing_the_Password_Policy-Using_the_Command_Line">6.9.4.1. Using the
Command Line</h4></div></div></div><div
class="para">
Use the <code class="command">ipa pwpolicy-*</code> commands
to create and modify FreeIPA password policies. These commands are provided as part of the
<code class="command">ipa pwpolicy</code> plug-in functionality. The
<code class="command">ipa help pwpolicy</code> command displays the
help page and some examples of using this plug-in.
</div><div class="para">
For example, use the following command to update the minimum global password length
to 10 characters, and to specify that no history of passwords be kept:
</div><div class="para">
- <code class="command"># ipa pwpolicy-mod --minlength=10
--history=0</code>
+ # ipa pwpolicy-mod --minlength=10 --history=0
</div><div class="para">
To display the global password policy:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show</code>
+ # ipa pwpolicy-show
</div><div class="para">
- Refer to <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">Section 5.7.6,
“Password Policy Attributes”</a> for information on password policy attributes.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">5.7.5. Setting
Different Password Policies for Different User
Groups</h3></div></div></div><div class="para">
+ Refer to <a class="xref"
href="#The_IPA_Password_Policy-Password_Policy_Attributes">Section 6.9.6,
“Password Policy Attributes”</a> for information on password policy attributes.
+ </div></div></div><div class="section"
id="The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5. Setting
Different Password Policies for Different User
Groups</h3></div></div></div><div class="para">
The FreeIPA password policy plug-in (<code class="command">ipa
pwpolicy</code>) manages both global and per-group password policies. You can use
this plug-in to display or modify existing password policies to suit the needs of your
environment.
</div><div class="para">
The following examples demonstrate how to display and modify existing password
policies.
</div><div class="para">
To display the password policy for a specific group:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show --group=<em
class="replaceable"><code>example</code></em></code>
+ # ipa pwpolicy-show --group=<em
class="replaceable"><code>example</code></em>
</div><div class="para">
To add a new policy for a specific group:
</div><div class="para">
- <code class="command"># ipa pwpolicy-add --minlife=10 --priority=10
--group=<em
class="replaceable"><code>example</code></em></code>
+ # ipa pwpolicy-add --minlife=10 --priority=10 --group=<em
class="replaceable"><code>example</code></em>
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
When adding or modifying the password policy for a group, that group needs to
already exist but does not need to contain any members.
</div></div></div><div class="para">
To remove an attribute from a password policy, use the <code
class="command">ipa pwpolicy-mod</code> command to set an empty value
for the required attribute to delete it.
</div><div class="para">
The following example illustrates adding a password policy with three specific
attributes to an existing group:
- </div><pre class="screen"><code
class="command"># ipa pwpolicy-add --minlife=1 --maxlife=5 --priority=1
g1</code>
+ </div><pre class="screen"># ipa pwpolicy-add --minlife=1
--maxlife=5 --priority=1 g1
Group: g1
Max lifetime (days): 5
Min lifetime (hours): 1
Priority: 1
</pre><div class="para">
The following command uses the <code class="command">ipa
pwdpolicy-mod</code> command to set an empty value to the <em
class="parameter"><code>minlife</code></em> attribute:
- </div><pre class="screen"><code
class="command"># ipa pwpolicy-mod --minlife= g1</code>
+ </div><pre class="screen"># ipa pwpolicy-mod --minlife= g1
Group: g1
Max lifetime (days): 5</pre><div class="para">
To display the policy for a given user:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show --user=tuser1</code>
+ # ipa pwpolicy-show --user=tuser1
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Password policies are not cumulative. That is, you cannot override a single setting
in a policy and let it fall back to the global policy on all the others; it is all or
nothing.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies">5.7.5.1. Setting
the Priority of Password Policies</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies"><div
class="titlepage"><div><div><h4 class="title"
id="Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies">6.9.5.1. Setting
the Priority of Password Policies</h4></div></div></div><div
class="para">
The following example demonstrates the use of password priority, where a user and
two groups are created, with a separate password policy for each group. Each policy has a
different priority, and the user is added to both groups.
- </div><div class="procedure"><ol
class="1"><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_a_user"><h5
class="formalpara">Adding a user</h5>
+ </div><div class="procedure"><ol
class="1"><li class="step"><div
class="formalpara"
id="Setting_the_Priority_of_Password_Policies-Adding_a_user"><h5
class="formalpara">Adding a user</h5>
Use the <code class="command">ipa user-add</code> command
to add a new user:
</div><pre class="screen">
-<code class="command"># ipa user-add --first=Tim --last=User
tuser1</code>
+# ipa user-add --first=Tim --last=User tuser1
---------
Added user "tuser1"
---------
@@ -2464,10 +2432,10 @@ Added user "tuser1"
GECOS field: tuser1
Login shell: /bin/sh
Kerberos principal: tuser1(a)IPANETWORK.ORG
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_the_user_groups"><h5
class="formalpara">Adding the user groups</h5>
- Use the <code class="command">ipa group-add</code> command
to add two new groups:
- </div><pre class="screen">
-<code class="command"># ipa group-add --desc=Group1 g1</code>
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa group-add</code> command
to add two new groups:
+ </div><pre class="screen">
+# ipa group-add --desc=Group1 g1
----------
Added group "g1"
----------
@@ -2480,10 +2448,10 @@ Added group "g2"
----------
Group name: g2
Description: Group2
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Specifying_the_password_policies"><h5
class="formalpara">Specifying the password policies</h5>
- Use the <code class="command">ipa pwpolicy-add</code>
command to specify different policies for each group:
- </div><pre class="screen">
-<code class="command"># ipa pwpolicy-add --minlife=10 --priority=10
--group=g1</code>
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa pwpolicy-add</code>
command to specify different policies for each group:
+ </div><pre class="screen">
+# ipa pwpolicy-add --minlife=10 --priority=10 --group=g1
---------------------------
Added policy for group "g1"
---------------------------
@@ -2496,12 +2464,12 @@ Added policy for group "g2"
---------------------------
Group: g2
Minimum lifetime (in hours): 20
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_the_user_to_the_groups"><h5
class="formalpara">Adding the user to the groups</h5>
- Use the <code class="command">ipa group-add-member</code>
command to add the user that you previously created to each group. You can then use the
<code class="command">ipa pwpolicy-show</code> command to display
the policy that is in effect for the user.
- </div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa group-add-member</code>
command to add the user that you previously created to each group. You can then use the
<code class="command">ipa pwpolicy-show</code> command to display
the policy that is in effect for the user.
+ </div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
Add the user to the <code class="systemitem">g1</code>
group and then check the policy:
</div><pre class="screen">
-<code class="command">$ ipa group-add-member --users=tuser1
g1</code>
+$ ipa group-add-member --users=tuser1 g1
Group name: g1
Description: Group1
Member Users: tuser1
@@ -2517,7 +2485,7 @@ $ ipa pwpolicy-show --user=tuser1
</pre></li><li class="step"><div
class="para">
Add the user to the <code class="systemitem">g2</code>
group and recheck the policy:
</div><pre class="screen">
-<code class="command">$ ipa group-add-member --users=tuser1
g2</code>
+$ ipa group-add-member --users=tuser1 g2
Group name: g2
Description: Group2
Member Users: tuser1
@@ -2527,28 +2495,26 @@ $ ipa pwpolicy-show --user=tuser1
Number of members added 1
-------------------------
-<code class="command">$ ipa pwpolicy-show --user=tuser1</code>
+$ ipa pwpolicy-show --user=tuser1
Group: g1
Minimum lifetime (in hours): 10
</pre><div class="para">
Notice that the password policy that is in effect for the user <code
class="systemitem">tuser1</code> is taken from the <code
class="systemitem">g1</code> group, because it has a higher priority.
- </div></li></ol></div></li><li
class="step"><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Removing_the_user_from_a_single_group"><h5
class="formalpara">Removing the user from a single group</h5>
- Finally, use the <code class="command">ipa
group-remove-member</code> command to remove the user from the <code
class="systemitem">g1</code> group to demonstrate that they still have
a custom policy.
- </div><pre class="screen">
-<code class="command">$ ipa group-remove-member --users=tuser1
g1</code>
+ </div></li></ol></div></li><li
class="step"><div class="para">
+ Finally, use the <code class="command">ipa
group-remove-member</code> command to remove the user from the <code
class="systemitem">g1</code> group to demonstrate that they still have
a custom policy.
+ </div><pre class="screen">
+$ ipa group-remove-member --users=tuser1 g1
---------------------------
Number of members removed 1
---------------------------
Users:
Groups:
-<code class="command">$ ipa pwpolicy-show --user=tuser1</code>
+$ ipa pwpolicy-show --user=tuser1
Group: g2
Minimum lifetime (in hours): 20
-</pre></li></ol></div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You can use the <code class="command">ipa help
<topic></code> command to display a list of the commands available for
working with various topics.
- </div></div></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6. Password
Policy Attributes</h3></div></div></div><div
class="para">
- The password policy is enforced by the <code class="systemitem
module">pwd_extop</code> SLAPI plug-in. FreeIPA 2.0 supports the following
password policy attributes:
+</pre></li></ol></div></div></div><div
class="section"
id="The_IPA_Password_Policy-Password_Policy_Attributes"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6. Password
Policy Attributes</h3></div></div></div><div
class="para">
+ The password policy is enforced by the <code class="systemitem
module">pwd_extop</code> SLAPI plug-in. FreeIPA supports the following
password policy attributes:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<span class="guilabel"><strong>Minimum Password
Lifetime</strong></span> (<span
class="property">krbMinPwdLife</span>): The minimum period of time, in
hours, that a user's password must be in effect before the user can change it. The
default value is one hour.
</div><div class="para">
@@ -2558,9 +2524,7 @@ Number of members removed 1
</div></li><li class="listitem"><div
class="para">
<span class="guilabel"><strong>Minimum Number of Character
Classes</strong></span> (<span
class="property">krbPwdMinDiffChars</span>): The minimum number of
different classes, or types, of character that must exist in a password before it is
considered valid. The default value is 0 (zero).
</div><div class="para">
- For example, setting <span
class="property">krbPwdMinDiffChars</span> = 3 requires that passwords
contain at least one character from three of the supported classes.
- </div><div class="para">
- The following character classes are supported:
+ For example, setting <span class="property">krbPwdMinDiffChars =
3</span> requires that passwords contain at least one character from three of the
supported classes. There are six supported character classes:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Upper-case characters
</div></li><li class="listitem"><div
class="para">
@@ -2570,10 +2534,8 @@ Number of members removed 1
</div></li><li class="listitem"><div
class="para">
Special characters (for example, punctuation)
</div></li><li class="listitem"><div
class="para">
- 8-bit characters (characters whose decimal code starts at 128 or below, for
example, Â, Ã, and Ä)
- </div></li></ul></div><div class="para">
- The following special classes also exist:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ 8-bit characters (characters whose decimal code starts at 128 or below)
+ </div></li><li class="listitem"><div
class="para">
Number of repeated characters
</div><div class="para">
This weights in the opposite direction, so that if you have too many repeated
characters you will not meet the quorum to satisfy the "level" expressed by
<span class="property">krbPwdMinDiffChars</span>.
@@ -2598,26 +2560,26 @@ Number of members removed 1
<span class="guilabel"><strong>Lockout
Time</strong></span> (<span
class="property">lockouttime</span>): Specifies the period (in seconds)
for which a lockout is enforced.
</div></li></ul></div><div class="para">
Refer to the <code class="command">ipa help pwpolicy-add</code>
help page for more information on configuring the FreeIPA password policy.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7. Notifying
Users of Password Expiration</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7. Notifying
Users of Password Expiration</h3></div></div></div><div
class="para">
If it is installed and configured, SSSD can use the PAM module to send messages to
users, warning them about imminent password expiration. Fedora has a <code
class="option">pam_pwd_expiration_warning</code> option to fine tune
this feature. You can also manually search for passwords that are due to expire by a
specified date. For example, to retrieve all user entries whose passwords are due to
expire before March 1st, 2011, run the following command:
</div><div class="para">
-<pre class="screen"><code class="command">$ ldapsearch -Y
GSSAPI -b "cn=users,cn=accounts,dc=example,dc=com"</code> <code
class="command">'(krbPasswordExpiration<=20110301000000Z)'</code></pre>
+<pre class="screen">$ ldapsearch -Y GSSAPI -b
"cn=users,cn=accounts,dc=example,dc=com"
'(krbPasswordExpiration<=20110301000000Z)'</pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8. Using
SSH for Password Authentication</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Using_SSH_for_Password_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8. Using
SSH for Password Authentication</h3></div></div></div><div
class="para">
If you use password authentication (no GSSAPI authentication, and no ticket on the
client) with a new user, or with a user whose password has expired, you need to enable
Challenge-Response authentication. Otherwise, the password changing dialog box will not
display.
</div><div class="para">
This is not enabled by default because some older <code
class="systemitem">SSL</code> clients may not support
Challenge-Response authentication, and it is needed only if the password has expired.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Using_SSH_for_Password_Authentication-To_enable_Challenge_Response_authentication"><h5
class="formalpara">To enable Challenge-Response authentication:</h5>
+ </div><div class="formalpara"
id="Using_SSH_for_Password_Authentication-To_enable_Challenge_Response_authentication"><h5
class="formalpara">To enable Challenge-Response authentication:</h5>
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Set <em
class="parameter"><code>ChallengeResponseAuthentication</code></em>
to <code class="literal">yes</code> in the <code
class="filename">/etc/ssh/sshd_config</code> file.
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9. Using
Local Logins</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Using_Local_Logins"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Using_Local_Logins">6.9.9. Using Local
Logins</h3></div></div></div><div class="para">
User identity and authentication is managed by SSSD in recent versions of Fedora. The
default settings specified by the FreeIPA installation script include timeout settings
that still allow local logins to succeed if the client cannot access the FreeIPA server.
These settings are specified in the <code
class="filename">/etc/sssd/sssd.conf</code> file, and can be tuned to
suit your particular deployment. Further, if SSSD's password caching feature is
enabled, a user can log in even if the FreeIPA server is down. A typical deployment would
normally include two or more servers for redundancy, and so this would not normally be a
problem.
</div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
These timeout settings are only set on operating systems that support the FreeIPA
installation script, meaning Fedora 15 and later. On other versions, specify these values
manually or it may be impossible to log into the host if no FreeIPA servers are
available.
- </div></div></div></div></div><div
class="section" id="searching"><div
class="titlepage"><div><div><h2 class="title"
id="searching">5.8. Searching for Users and
Groups</h2></div></div></div><div class="para">
+ </div></div></div></div></div><div
class="section" id="searching"><div
class="titlepage"><div><div><h2 class="title"
id="searching">6.10. Searching for Users and
Groups</h2></div></div></div><div class="para">
FreeIPA provides extensive search capabilities, which enable you to perform simple and
partial-match searches on a range of attributes, including:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
First Name (givenname)
@@ -2651,7 +2613,7 @@ Number of members removed 1
Home Page
</div></li></ul></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot use wildcards to search for users or groups. The search string must
include at least one character that appears in one of the indexed search fields.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1. Searching
for Users</h3></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users-Using_the_Command_Line">5.8.1.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Searching_for_Users_and_Groups-Searching_for_Users"><div
class="titlepage"><div><div><h3 class="title"
id="Searching_for_Users_and_Groups-Searching_for_Users">6.10.1. Searching for
Users</h3></div></div></div><div class="section"
id="Searching_for_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Searching_for_Users-Using_the_Command_Line">6.10.1.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa user-find</code> command to
search for users from the command line. The basic syntax of this command is as follows:
<div class="cmdsynopsis"><p><code
class="command">ipa user-find</code> [
options
@@ -2688,7 +2650,7 @@ Member of groups: ipausers
Number of entries returned 2
----------------------------</pre><div class="para">
If you do not see the entry that you are looking for, you may need to adjust the
<code class="option">--searchrecordslimit</code> option in the
default FreeIPA configuration.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2. Searching
for Groups</h3></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Groups-Using_the_Command_Line">5.8.2.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Searching_for_Users_and_Groups-Searching_for_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2. Searching
for Groups</h3></div></div></div><div class="section"
id="Searching_for_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Searching_for_Groups-Using_the_Command_Line">6.10.2.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-find</code> command to
search for groups from the command line. The basic syntax of this command is as follows:
<div class="cmdsynopsis"><p><code
class="command">ipa group-find</code> {
string
@@ -2712,7 +2674,7 @@ Member users: dkim, mkang, lming, klim
Number of entries returned 1
----------------------------</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The <code class="command">ipa group-find</code> command
searches both group names and group descriptions. If your search results are too
extensive, use a more specific search string.
- </div></div></div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="kerberos"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 6. Identity: Using FreeIPA for a Kerberos
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-kerberos">6.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="#kerb-policies">6.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">6.3.
Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">6.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Princip
als-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2. Configuring an
NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">6.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="#rotating-keys">6.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">6.6.
Kerberos Errors</a></span></dt></dl></div><div
class="section" id="about-kerberos"><div
class="titlepage"><div><div><h2 class="title"
id="about-kerberos">6.1. About
Kerberos</h2></div></div></div><div class="para">
+ </div></div></div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="kerberos"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Using FreeIPA for a Kerberos
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-kerberos">7.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="#kerb-policies">7.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">7.3.
Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">7.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Princip
als-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2. Configuring an
NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">7.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="#rotating-keys">7.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">7.6.
Kerberos Errors</a></span></dt></dl></div><div
class="section" id="about-kerberos"><div
class="titlepage"><div><div><h2 class="title"
id="about-kerberos">7.1. About
Kerberos</h2></div></div></div><div class="para">
The Kerberos server is a part of FreeIPA. When you run the <code
class="command">kinit</code> command you invoke a client that connects
to the Kerberos server. As a result of the authentication the client receives a <em
class="firstterm">ticket</em>. This ticket is a temporary pass; or a
better description might be a pass-book. The best example from real life might be a pass
to a movie festival. A single pass to such a festival would allow someone to attend
different movies at their discretion. Kerberos is very similar. When a user tries to
access any resource that is protected by Kerberos, that resource requires the user to
present a valid ticket, the same as in the movies.
</div><div class="para">
To obtain such a ticket the user needs to prove their identity; that they are who they
claim to be. Asking the user to constantly authenticate with their password would soon
prove to be too annoying and hard to manage. This is why a multi-tier process exists,
where the user first authenticates and obtains a so-called <em
class="firstterm">ticket-granting ticket</em> (TGT). This ticket can
then be presented to the Kerberos server at any time and a new ticket specific to the
resource that the user wants to access can be acquired. All of these tickets have a
configurable expiration time, so the user occasionally needs to re-authenticate, but it is
much less of a burden.
@@ -2756,7 +2718,7 @@ Number of entries returned 1
Failure to export an updated keytab can cause problems that are difficult to isolate.
For example, existing service connections may continue to function, but no new connections
may be possible.
</div><div class="para">
Due to the critical role that keytabs play in authenticating users and services, and
the issues that can arise if they are compromised, ensure that all keytab files are
appropriately secured, and have suitable file ownership and permissions established.
- </div></div></div></div><div class="section"
id="kerb-policies"><div
class="titlepage"><div><div><h2 class="title"
id="kerb-policies">6.2. Setting Kerberos Ticket
Policies</h2></div></div></div><div class="para">
+ </div></div></div></div><div class="section"
id="kerb-policies"><div
class="titlepage"><div><div><h2 class="title"
id="kerb-policies">7.2. Setting Kerberos Ticket
Policies</h2></div></div></div><div class="para">
Kerberos tickets are issued subject to the restraints of the <em
class="firstterm">Kerberos ticket policy</em>. This policy defines the
maximum ticket lifetime and also the maximum renewal age, the period during which the
ticket is renewable. You can use the <code
class="command">ipa krbtpolicy-mod</code> command to modify the policy
to suit your environment. You can also use the <code
class="command">ipa krbtpolicy-reset</code> command to reset the policy
to the default values.
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Any change to the global Kerberos ticket policy requires a restart of the KDC for the
changes to take effect. Use the following command to restart the KDC:
@@ -2772,7 +2734,7 @@ Number of entries returned 1
</div><div class="para">
Changes to per-user policies take effect immediately for newly-requested tickets, for
example, when the user next runs <code
class="command">kinit</code>.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">6.3. Creating
and Using Service Principals</h2></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">7.3. Creating
and Using Service Principals</h2></div></div></div><div
class="para">
You can use the web interface to create service principals and also to search for
existing service principals. For security and other reasons, however, it is not possible
to retrieve a keytab using the web interface. This has to be done either on the command
line on the system where the service is accessed, or on the FreeIPA server itself, and the
keytab then exported to the client host.
</div><div class="para">
The following example demonstrates creating a service principal and keytab on a client
host for the <code class="systemitem">HTTP</code> service. In this
example, the client host is <code
class="systemitem">ipaclient.example.com</code> and the FreeIPA server
is <code class="systemitem">ipaserver.example.com</code>:
@@ -2798,7 +2760,7 @@ Number of entries returned 1
The <code class="command">ipa-getkeytab</code> command resets
the secret for the specified principal. This means that all other keytabs for that
principal are rendered invalid.
</div></div></div><div class="para">
FreeIPA provides a range of tools and commands to facilitate the creation and
administration of services and the service principals and certificates required to use
them. Some of this can be automated, but there will always be a certain amount of manual
intervention required to create services and certificates after the initial joining of a
host to a realm. These requirements and procedures are discussed in the following
sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">6.3.1. Creating
a FreeIPA Service</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Prerequisites"><h5
class="formalpara">Prerequisites</h5>
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">7.3.1. Creating
a FreeIPA Service</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Prerequisites"><h5
class="formalpara">Prerequisites</h5>
Before you can create a service for a FreeIPA host, you need to ensure that the host
exists. This should be true if it has already joined the realm. Use the following command
to determine if the host exists:
<pre class="screen"><code class="command"># ipa host-show
myserver.mydomain.net</code></pre>
@@ -2817,7 +2779,7 @@ Number of entries returned 1
Added service "test/myserver.mydomain.net(a)MYDOMAIN.NET"
-------------------------------------------------------
Principal: test/myserver.mydomain.net(a)MYDOMAIN.NET
- Managed by: myserver.mydomain.net</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service">6.3.1.1. Requesting
a Certificate for a Service</h4></div></div></div><div
class="para">
+ Managed by: myserver.mydomain.net</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service">7.3.1.1. Requesting
a Certificate for a Service</h4></div></div></div><div
class="para">
Use the following command to request a certificate for the new service. The
certificate request is contained in the <code
class="filename">example.csr</code> file.
<pre class="screen"><code class="command"># ipa
cert-request --principal=test/myserver.mydomain.net example.csr </code></pre>
@@ -2849,7 +2811,7 @@ Email Address []:authors@mydomain.net
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
-An optional company name []:</pre></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests">6.3.1.2. Using
certmonger to Manage Certificate
Requests</h4></div></div></div><div class="para">
+An optional company name []:</pre></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests">7.3.1.2. Using
certmonger to Manage Certificate
Requests</h4></div></div></div><div class="para">
You can also use <span
class="application"><strong>certmonger</strong></span> to
manage the certificate request process for you. Use the following command to request a
certificate:
<pre class="screen"><code class="command"># ipa-getcert
request -d /etc/pki/nssdb -n Server-Cert</code></pre>
@@ -2865,8 +2827,8 @@ An optional company name []:</pre></div><div
class="section" id="sect-Enterprise
<pre class="screen"><code class="command">$ ipa
config-show | grep -i subject</code></pre>
FreeIPA will reject requests with invalid subject base values.
</div><div class="para">
- Refer to the <code class="systemitem">certmonger</code> man
page and also to <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">Section B.1,
“What is certmonger?”</a> for more information.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS">6.3.1.3. Using
NSS</h4></div></div></div><div class="para">
+ Refer to the <code class="systemitem">certmonger</code> man
page and also to <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">Section C.1,
“What is certmonger?”</a> for more information.
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS">7.3.1.3. Using
NSS</h4></div></div></div><div class="para">
If you need to create an NSS database in which to store your key, use the <code
class="command">certutil</code> command as follows:
<pre class="screen"><code class="command">$ certutil -N
-d /path/to/database/dir</code>
<code class="command">$ certutil -R -s "CN=myserver.mydomain.net,
O=MYDOMAIN.NET" \</code>
@@ -2882,9 +2844,9 @@ An optional company name []:</pre></div><div
class="section" id="sect-Enterprise
Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
This means you need to use
MYDOMAIN.NET for the organization. FreeIPA will reject
requests whose subject base differs from this value.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2. Configuring
an NFS Service Principal on the FreeIPA
Server</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2. Configuring
an NFS Service Principal on the FreeIPA
Server</h3></div></div></div><div class="para">
The following procedure describes how to configure <code
class="systemitem">NFS</code> on the FreeIPA server and to set up an
<code class="systemitem">NFS</code> service principal.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_an_NFS_Service_Principal_on_the_IPA_Server-Configuring_NFS_on_the_IPA_Server"><h6>Procedure 6.1. Configuring
<code class="systemitem">NFS</code> on the FreeIPA
Server</h6><ol class="1"><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_an_NFS_Service_Principal_on_the_IPA_Server-Configuring_NFS_on_the_IPA_Server"><h6>Procedure 7.1. Configuring
<code class="systemitem">NFS</code> on the FreeIPA
Server</h6><ol class="1"><li class="step"><div
class="para">
Configure the export directory.
<pre class="screen"><code class="command"># mkdir
/export</code>
<code class="command"># chmod 777 /export</code></pre>
@@ -2925,11 +2887,11 @@ Certificate Subject base: O=MYDOMAIN.NET</pre><div
class="para">
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Note the use of the <code class="option">-k</code> option
when restarting <code class="systemitem">rpcgssd</code>. This is
necessary to update the NFS configuration with the path to the NFS keytab.
- </div></div></div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">6.4. Refreshing
Kerberos Tickets</h2></div></div></div><div
class="para">
+ </div></div></div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">7.4. Refreshing
Kerberos Tickets</h2></div></div></div><div
class="para">
Some compliance or company security policies may require that system administrators
manually refresh Kerberos tickets, perhaps annually or more frequently. The current
version of FreeIPA does not provide automatic renewal of Kerberos tickets.
</div><div class="para">
Manually refreshing Kerberos tickets is a two step process: you first need to find all
of the keytabs that are older than a certain date, and then obtain a new keytab for the
host or service in question. This process is described in detail below.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Refreshing_Kerberos_Tickets-How_to_manually_refresh_Kerberos_keytabs"><h6>Procedure 6.2. How
to manually refresh Kerberos keytabs</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Refreshing_Kerberos_Tickets-How_to_manually_refresh_Kerberos_keytabs"><h6>Procedure 7.2. How
to manually refresh Kerberos keytabs</h6><ol class="1"><li
class="step"><div class="para">
Find all keytabs, both for host services and for any other services, issued before
today. Use the following queries (update the dates as necessary):
<pre class="screen"><code class="command"># ldapsearch -x
-b "cn=computers,cn=accounts,dc=example,dc=com"</code> <code
class="command">"(&(krblastpwdchange<=20110110000000)(krblastpwdchange>=19710101000000))"
dn krbprincipalname</code></pre>
@@ -2956,7 +2918,7 @@ Certificate Subject base: O=MYDOMAIN.NET</pre><div
class="para">
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Some services, such as NFSv4, only support a limited set of encryption types. Ensure
that you pass the appropriate arguments to the <code
class="command">ipa-getkeytab</code> command.
- </div></div></div></div><div class="section"
id="rotating-keys"><div
class="titlepage"><div><div><h2 class="title"
id="rotating-keys">6.5. Rotating
Keys</h2></div></div></div><div class="para">
+ </div></div></div></div><div class="section"
id="rotating-keys"><div
class="titlepage"><div><div><h2 class="title"
id="rotating-keys">7.5. Rotating
Keys</h2></div></div></div><div class="para">
Kerberos keys are similar to passwords, and in the interests of security they should
occasionally be changed. The frequency of these changes may be determined by company or
other policies. Each key has an associated version number, which are stored in the <em
class="parameter"><code>KVNO</code></em> parameter.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Rotating_Kerberos_Keys-Obtaining_a_new_service_principal_Kerberos_key"><h5
class="formalpara">Obtaining a new service principal Kerberos key</h5>
Use the <code class="command">ipa-getkeytab</code> command to
create a new Kerberos key. For example, use the following command to refresh your FreeIPA
keytab:
@@ -2991,7 +2953,7 @@ Valid starting Expires Service principal
</div><div class="para">
This will display service and host keytab information. It is not possible to determine
if it has a key directly, but you can infer that a keytab was issued by looking at the
last change date.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">6.6. Kerberos
Errors</h2></div></div></div><div class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">7.6. Kerberos
Errors</h2></div></div></div><div class="para">
If <code class="command">kinit</code> fails or you see an
unusual Kerberos error back in the framework, inspect the following files for possible
causes:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
On the server: <code
class="filename">/var/log/krb5kdc.log</code>
@@ -2999,11 +2961,11 @@ Valid starting Expires Service principal
If you were using the framework also look in <code
class="filename">/var/log/httpd/error_log</code>
</div></li></ul></div>
- </div></div></div><div xml:lang="en-US"
class="chapter" id="automount" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Using
Automount</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-automount">7.1. About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-automount">7.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a href="#sect-
Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">7.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4.
Links</a></span></dt></dl></dd></dl></div><div
class="section" id="about-automount"><div
class="titlepage"><div><div><h2 class="title"
id="about-automount">7.1. About Automount and
IPA</h2></div></div></div><div class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="automount" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 8. Identity: Using
Automount</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-automount">8.1. About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-automount">8.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a href="#sect-
Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4.
Links</a></span></dt></dl></dd></dl></div><div
class="section" id="about-automount"><div
class="titlepage"><div><div><h2 class="title"
id="about-automount">8.1. About Automount and
IPA</h2></div></div></div><div class="para">
This chapter describes how to configure <code
class="command">automount</code> on <code
class="systemitem">Linux</code> and <code
class="systemitem">Solaris</code> for use with IPA. It details the
procedures and configuration changes necessary to set up <code
class="command">automount</code>, the <code
class="filename">auto.master</code> file and other map files used by
<code class="command">autofs</code>.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1. Known
Issues with Automount</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Known_Issues_with_Automount-Additional_Schema_Required_for_Some_Systems"><h5
class="formalpara">Additional Schema Required for Some Systems</h5>
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1. Known
Issues with Automount</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Known_Issues_with_Automount-Additional_Schema_Required_for_Some_Systems"><h5
class="formalpara">Additional Schema Required for Some Systems</h5>
If you are supporting <code class="systemitem">Solaris</code>
clients, you need to use the 2307bis-style <code
class="command">automount</code> schema, although Sun's version is
NOT identical to the one at <a
href="http://people.redhat.com/nalin/schema/autofs.schema">h...;.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2. Assumptions</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2. Assumptions</h3></div></div></div><div
class="para">
In order to illustrate the <code
class="command">automount</code> configuration procedures, this chapter
assumes that:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The IPA server is correctly installed and operational.
@@ -3028,13 +2990,13 @@ Valid starting Expires Service principal
</div><pre class="programlisting">/home 192.168.1.0/16
(rw,fsid=0,insecure,no_subtree_check,sync,anonuid=65534,anongid=65534)
</pre><div class="para">
You should test that you can mount the <code
class="filename">/home</code> directory from the command line before
proceeding with the <code class="command">automount</code>
configuration. This makes troubleshooting easier if the configuration does not work.
- </div></div></div><div class="section"
id="configuring-automount"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-automount">7.2. Configuring
Automount</h2></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="configuring-automount"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-automount">8.2. Configuring
Automount</h2></div></div></div><div
class="para">
IPA natively supports automount and so only minimal configuration is required. IPA 2.0
also introduces the concept of a <em
class="firstterm">location</em>, which allows for different sets of
maps for different purposes, or locations.
<div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You can direct different clients to use different map sets. These map sets use a
tree structure, which means that you cannot share maps between locations.
</div></div></div>
Any extra steps required for configuring automount on Linux or Solaris are described
below. Refer to the <code class="command">ipa help automount</code>
help page for more information and a list of available commands.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1. Configuring
autofs on Linux</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-To_configure_autofs_on_Linux"><h6>Procedure 7.1. To
configure autofs on Linux:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1. Configuring
autofs on Linux</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-To_configure_autofs_on_Linux"><h6>Procedure 8.1. To
configure autofs on Linux:</h6><ol class="1"><li
class="step"><div class="para">
Edit the <code class="filename">/etc/sysconfig/autofs</code>
file as follows. This specifies the attributes that <code
class="command">autofs</code> searches for:
</div><pre class="programlisting">#
# Other common LDAP naming
@@ -3056,7 +3018,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
<pre class="screen"><code class="command"># service
autofs restart</code></pre>
- </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration">7.2.1.1. Testing
the Configuration</h4></div></div></div><div
class="para">
+ </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration">8.2.1.1. Testing
the Configuration</h4></div></div></div><div
class="para">
Test the configuration by attempting to list a user's <code
class="filename">/home</code> directory:
</div><div class="para">
@@ -3064,7 +3026,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
</div><div class="para">
If this does not mount the remote file system, check the <code
class="filename">/var/log/messages</code> file for errors or other
indications of what the problem might be. You can also increase the debug level in the
<code class="filename">/etc/sysconfig/autofs</code> file by setting
the <em class="parameter"><code>LOGGING</code></em>
parameter to <code class="literal">debug</code>.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2. Solaris
automount</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2. Solaris
automount</h3></div></div></div><div
class="para">
The following procedure describes the steps required to configure <code
class="command">automount</code> for <code
class="systemitem">Solaris</code>.
</div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
If the <code class="systemitem">NFS</code> server is running
on <code class="systemitem">Linux</code>, you need to specify on the
<code class="systemitem">Solaris</code> machine that NFSv3 is the
maximum supported version. Edit the <code
class="filename">/etc/default/nfs</code> file and set the following
parameter:
@@ -3089,7 +3051,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
<pre class="screen"><code class="command"># svcadm enable
svc:/system/filesystem/autofs</code></pre>
- </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration">7.2.2.1. Testing
the Configuration</h4></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Testing_the_Configuration-_To_test_the_automount_configuration_run_the_following_commands_"><h6>Procedure 7.2.
To test the <code class="command">automount</code> configuration,
run the following commands: </h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration">8.2.2.1. Testing
the Configuration</h4></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Testing_the_Configuration-_To_test_the_automount_configuration_run_the_following_commands_"><h6>Procedure 8.2.
To test the <code class="command">automount</code> configuration,
run the following commands: </h6><ol class="1"><li
class="step"><div class="para">
<pre class="screen"><code class="command"># ldapclient -l
auto_master</code>
dn:
automountkey=/home,automountmapname=auto.master,cn=<location>,cn=automount,dc=example,dc=com
@@ -3105,7 +3067,7 @@ automountInformation: auto.home
<pre class="screen"><code class="command"># ls
/home/<username></code></pre>
- </div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">7.2.3. Configuring
Indirect Maps</h3></div></div></div><div
class="para">
+ </div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3. Configuring
Indirect Maps</h3></div></div></div><div
class="para">
An indirect map defines a container for mount points. For example, if you create an
indirect map <code class="filename">/share</code>, then all
automount keys are relative to that map. If you define an automount key <code
class="systemitem">ipauser</code>, the map would appear as <code
class="filename">/share/ipauser</code>. In other words, indirect maps
specify relative paths. Compare this to the absolute paths specified by direct maps.
</div><div class="para">
The following example creates an indirect map for <code
class="filename">/usr/man</code> using the built-in IPA commands. This
creates a single indirect map, <code
class="filename">/usr/man/man1</code>, which:
@@ -3115,7 +3077,7 @@ automountInformation: auto.home
Adds <code class="filename">auto.man</code> to <code
class="filename">auto.master</code> on the mount point <code
class="filename">/usr/man</code>
</div></li><li class="listitem"><div
class="para">
Adds an indirect mount of <code class="filename">man1</code>
to <code class="filename">auto.man</code>
- </div></li></ul></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-How_to_create_an_indirect_map"><h6>Procedure 7.3. How
to create an indirect map:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ul></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-How_to_create_an_indirect_map"><h6>Procedure 8.3. How
to create an indirect map:</h6><ol class="1"><li
class="step"><div class="para">
Create a new location:
</div><pre class="screen"><code
class="command">$ ipa automountlocation-add baltimore</code>
Location: baltimore</pre></li><li class="step"><div
class="para">
@@ -3138,7 +3100,7 @@ automountInformation: auto.home
On <code class="systemitem">Solaris</code>, use the following
arguments with the <code class="command">ldapclient</code> command:
</div><pre class="programlisting">-a
serviceSearchDescriptor=auto_man:automountMapName=auto.man, \
cn=<location>,cn=automount,dc=example,dc=com?one \
-</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps">7.2.3.1. Configuring
Direct Maps</h4></div></div></div><div
class="para">
+</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps">8.2.3.1. Configuring
Direct Maps</h4></div></div></div><div
class="para">
Direct maps list exact locations to mount specified maps, for example <code
class="filename">/usr/local/bin</code> or <code
class="filename">/mnt</code>. That is, they specify absolute paths as
mount points. Compare this to the relative paths specified by indirect maps.
</div><div class="para">
To add a direct map configuration, IPA requires a number of modifications to the
<code class="filename">auto.direct</code> file. The following two
entries are created during the installation process:
@@ -3151,7 +3113,7 @@ automountInformation: auto.home
automountMapName: auto.direct
</pre><div class="para">
Use the following procedure to add a mount to this direct map for the <code
class="filename">/share</code> directory:
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Direct_Maps-How_to_create_a_direct_map"><h6>Procedure 7.4. How
to create a direct map:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Direct_Maps-How_to_create_a_direct_map"><h6>Procedure 8.4. How
to create a direct map:</h6><ol class="1"><li
class="step"><div class="para">
Create a new location:
</div><pre class="screen"><code
class="command">$ ipa automountlocation-add brisbane</code>
Location: brisbane</pre></li><li class="step"><div
class="para">
@@ -3163,7 +3125,7 @@ automountInformation: auto.home
On <code class="systemitem">Solaris</code>, use the following
arguments with the <code class="command">ldapclient</code> command:
</div><pre class="programlisting">-a
serviceSearchDescriptor=auto_direct:automountMapName=auto.direct, \
cn=<location>,cn=automount,dc=example,dc=com?one \
-</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4. Links</h3></div></div></div><div
class="para">
+</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4. Links</h3></div></div></div><div
class="para">
The following pages were used as references for this work:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<a
href="http://efod.se/blog/archive/2006/06/27/autofs-and-ldap">http://efod.se/blog/archive/2006/06/27/autofs-and-ldap</a>
@@ -3175,13 +3137,13 @@ automountInformation: auto.home
<a
href="http://forums.fedoraforum.org/forum/showthread.php?t=135635&am...
</div></li><li class="listitem"><div
class="para">
<a
href="http://blogs.sun.com/rohanpinto/entry/nis_to_ldap_migration_gu...
- </div></li></ul></div></div></div></div><div
xml:lang="en-US" class="chapter" id="active-directory"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 8. Identity: Integrating with Microsoft Active
Directory</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-active-directory">8.1. About Active Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">8.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a href="#configuring-active-directory">8.3.
Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_S
ynchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">8.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">8.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">8.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">8.7.
Winsync Agreement
Failures</a></span></dt></dl></div><div
class="para">
+ </div></li></ul></div></div></div></div><div
xml:lang="en-US" class="chapter" id="active-directory"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 9. Identity: Integrating with Microsoft Active
Directory</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-active-directory">9.1. About Active Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">9.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a href="#configuring-active-directory">9.3.
Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_S
ynchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">9.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">9.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">9.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">9.7.
Winsync Agreement
Failures</a></span></dt></dl></div><div
class="para">
To synchronize user identity information between 389 Directory Server and Windows
Active Directory, IPA employs a plug-in that extends the functionality of the 389
Directory Server Windows Sync utility. This plug-in allows IPA to perform the data
manipulation necessary to achieve synchronization between 389 Directory Server and Windows
Active Directory. The IPA Windows Sync plug-in uses the <em
class="parameter"><code>ipaWinSyncUserAttr</code></em>
parameter to specify which attributes and values to add to new users that are synchronized
from Active Directory.
- </div><div class="section"
id="about-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="about-active-directory">8.1. About Active Directory, IPA, and Identity
Management</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1. Domain
Name Considerations</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="about-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="about-active-directory">9.1. About Active Directory, IPA, and Identity
Management</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1. Domain
Name Considerations</h3></div></div></div><div
class="para">
IPA clients find, or discover, IPA servers using a process known as <em
class="firstterm">Service Discovery</em>. This can occur automatically,
using DNS, or manually, by entering the IPA server details during the client configuration
phase. If your Active Directory installation is in the same domain as the IPA server, it
is possible that when you install IPA clients they will not discover the IPA server, but
rather the Active Directory DNS. This means that IPA commands run on the client will fail
because the client cannot contact the IPA server.
</div><div class="para">
To avoid this situation, use a separate domain for your IPA and Active Directory
servers. If this is not possible, use the <em
class="parameter"><code>--force</code></em> parameter when
you run the <code class="command">ipa-client-install</code> script.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">8.2. Setting
up Active Directory</h2></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">9.2. Setting
up Active Directory</h2></div></div></div><div
class="para">
The Windows Sync utility requires TLS/SSL to synchronize password changes. Therefore,
you need to set up Active Directory as an SSL server. The easiest way to achieve this is
to install Microsoft Certificate System in Enterprise Root Mode; Active Directory will
then automatically enroll to retrieve its SSL server certificate.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You need to install both the <code
class="command">winsync</code> and <code
class="command">passsync</code> utilities to synchronize User IDs and
attributes as well as passwords.
@@ -3191,7 +3153,7 @@ automountInformation: auto.home
Refer to the <a
href="http://directory.fedoraproject.org/wiki/Howto:WindowsSync"...
Project Windows Sync Howto</a> for information on setting up Active Directory as an
SSL server.
</div><div class="para">
After you have installed Microsoft Certificate System, you need to save the CA
certificate in ASCII (PEM) format. This CA Certificate is required to create the
synchronization agreement.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-To_save_the_CA_certificate_in_ASCII_format"><h6>Procedure 8.1. To
save the CA certificate in ASCII format:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-To_save_the_CA_certificate_in_ASCII_format"><h6>Procedure 9.1. To
save the CA certificate in ASCII format:</h6><ol class="1"><li
class="step"><div class="para">
Navigate to My Network Places and drill down to the CA distribution point. On
Windows 2003 Server this is typically <code
class="filename">C:\WINDOWS\system32\certsrv\CertEnroll\</code>
</div></li><li class="step"><div
class="para">
Double-click the security certificate file (<code
class="filename">.crt</code> file) to display the <span
class="guilabel"><strong>Certificate</strong></span> dialog
box.
@@ -3204,12 +3166,12 @@ automountInformation: auto.home
</div></li><li class="step"><div
class="para">
Click <span
class="guibutton"><strong>OK</strong></span> to exit the
wizard.
</div></li></ol></div><div class="para">
- Refer to <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">Section 8.4,
“Creating Synchronization Agreements”</a> for information on how to use the CA
Certificate to create the synchronization agreement.
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-Select_Base_64_encoded_X.509_to_export_the_security_certificate_as_ASCII"><div
class="figure-contents"><div class="mediaobject"
align="center"><img src="images/ASCII_Cert_Export.png"
align="middle" alt="Select Base-64 encoded X.509 to export the security
certificate as ASCII" /></div></div><h6>Figure 8.1. Select
Base-64 encoded X.509 to export the security certificate as
ASCII</h6></div><br class="figure-break" /></div><div
class="section" id="configuring-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-active-directory">8.3. Configuring Active Directory
Synchronization</h2></div></div></div><div
class="para">
+ Refer to <a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">Section 9.4,
“Creating Synchronization Agreements”</a> for information on how to use the CA
Certificate to create the synchronization agreement.
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-Select_Base_64_encoded_X.509_to_export_the_security_certificate_as_ASCII"><div
class="figure-contents"><div class="mediaobject"
align="center"><img src="images/ASCII_Cert_Export.png"
align="middle" alt="Select Base-64 encoded X.509 to export the security
certificate as ASCII" /></div></div><h6>Figure 9.1. Select
Base-64 encoded X.509 to export the security certificate as
ASCII</h6></div><br class="figure-break" /></div><div
class="section" id="configuring-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-active-directory">9.3. Configuring Active Directory
Synchronization</h2></div></div></div><div
class="para">
The Windows Sync plug-in is installed on the IPA server, and enables one-way
replication of users and groups from Windows to IPA. The <code
class="command">ipa-server-install</code> script automatically installs
the plug-in configuration entry and enables it by default. The Windows Sync plug-in is
only ever called if Windows Sync is used.
</div><div class="para">
The passsync plug-in for Windows uses a standard <code
class="command">ldapmodify</code> operation to change users'
passwords. These operations take effect immediately, and are still normally subject to
password policy settings. When the special user used by passsync sets the password, these
password policies should be bypassed and the password should not be set to immediately
expire, as is the case when a normal administrator resets a user password. To achieve
this, you need to add a list of passSync Manager DNs to the password plug-in
configuration. These users will be exempt from password policy enforcement in the same way
that the Directory Manager is exempt. This currently requires a manual configuration, as
follows:
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Windows_Sync_on_the_IPA_Server-To_add_a_list_of_passSync_Manager_DNs_to_the_password_plug_in_configuration"><h6>Procedure 8.2. To
add a list of passSync Manager DNs to the password plug-in configuration:</h6><ol
class="1"><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Windows_Sync_on_the_IPA_Server-To_add_a_list_of_passSync_Manager_DNs_to_the_password_plug_in_configuration"><h6>Procedure 9.2. To
add a list of passSync Manager DNs to the password plug-in configuration:</h6><ol
class="1"><li class="step"><div
class="para">
As Directory Manager, modify the entry <em
class="parameter"><code>cn=ipa_pwd_extop,cn=plugins,cn=config</code></em>
</div></li><li class="step"><div
class="para">
Add or update the <em
class="parameter"><code>passSyncManagersDNs</code></em>
attribute. This is a multi-valued list of DNs that bypass password policy.
@@ -3223,7 +3185,7 @@ add: passSyncManagersDNs
passSyncManagersDNs: uid=admin,cn=users,cn=accounts,dc=example,dc=com
</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The entry <em class="parameter"><code>cn=Directory
Manager</code></em> always bypasses policy and does not need to be explicitly
listed.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">8.4. Creating
Synchronization Agreements</h2></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">9.4. Creating
Synchronization Agreements</h2></div></div></div><div
class="para">
Use the <code class="command">ipa-replica-manage connect</code>
command to create synchronization agreements. The following command-line arguments apply
to creating synchronization agreements:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<code class="option">--winsync</code> — specifies that this is
a Windows Sync agreement. Winsync replication occurs every five minutes.
@@ -3239,12 +3201,12 @@ passSyncManagersDNs:
uid=admin,cn=users,cn=accounts,dc=example,dc=com
<code class="option">--win-subtree</code> — the DN of the
Windows subtree containing the users you want to synchronize. The default value is <em
class="parameter"><code>cn=Users,$SUFFIX</code></em> — this
is what Windows AD typically uses as the default value.
</div></li></ul></div><div class="para">
The following example illustrates adding a new WinSync agreement:
- </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Creating_Synchronization_Agreements-Adding_a_WinSync_agreement_between_an_IPA_server_and_an_AD_server."><h6>Example 8.1. Adding
a WinSync agreement between an IPA server and an AD server.</h6><div
class="example-contents"><pre class="screen"><code
class="command">ipa-replica-manage connect --winsync --binddn
cn=administrator,cn=users,dc=example,dc=com \</code>
-<code class="command">--bindpw password --passsync password --cacert
/path/to/certfile.cer
adserver.example.com
-v</code></pre></div></div><br class="example-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">8.5. Modifying
Synchronization Agreements</h2></div></div></div><div
class="para">
+ </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Creating_Synchronization_Agreements-Adding_a_WinSync_agreement_between_an_IPA_server_and_an_AD_server."><h6>Example 9.1. Adding
a WinSync agreement between an IPA server and an AD server.</h6><div
class="example-contents"><pre class="screen"><code
class="command">ipa-replica-manage connect --winsync --binddn
cn=administrator,cn=users,dc=example,dc=com \</code>
+<code class="command">--bindpw password --passsync password --cacert
/path/to/certfile.cer
adserver.example.com
-v</code></pre></div></div><br class="example-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">9.5. Modifying
Synchronization Agreements</h2></div></div></div><div
class="para">
You can change the behavior of the synchronization agreement to suit the changing
needs of your organization. You can modify a number of attributes related to the
synchronization agreement using default tools provided with IPA.
</div><div class="para">
The following example illustrates changing the synchronization behavior of account
lock status. By default, account lock status is synchronized between IPA and AD. This
means that accounts that are locked in IPA are also locked (disabled) in AD, and vice
versa. You can change this synchronization behavior as follows:
- </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Configuring_the_IPA_WinSync_agreement_to_not_synchronize_account_lock_status_information."><h6>Example 8.2. Configuring
the IPA WinSync agreement to not synchronize account lock status
information.</h6><div class="example-contents"><pre
class="screen"><code class="command">$ ldapmodify -x -D
"cn=directory manager" -w password</code>
+ </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Configuring_the_IPA_WinSync_agreement_to_not_synchronize_account_lock_status_information."><h6>Example 9.2. Configuring
the IPA WinSync agreement to not synchronize account lock status
information.</h6><div class="example-contents"><pre
class="screen"><code class="command">$ ldapmodify -x -D
"cn=directory manager" -w password</code>
dn: cn=ipa-winsync,cn=plugins,cn=config
changetype: modify
replace: ipaWinSyncAcctDisable
@@ -3253,13 +3215,13 @@ ipaWinSyncAcctDisable: none
modifying entry "cn=ipa-winsync,cn=plugins,cn=config"
</pre></div></div><br class="example-break" /><div
class="para">
The default value of the <em
class="parameter"><code>ipaWinSyncAcctDisable</code></em>
attribute is <code class="literal">both</code>. If you change this
value to <code class="literal">none</code>, as described in the
example, account lock status synchronization is completely disabled. Valid values for
<em
class="parameter"><code>ipaWinSyncAcctDisable</code></em>
are <code class="literal">both</code>, <code
class="literal">to_ad</code>, <code
class="literal">to_ds</code>, and <code
class="literal">none</code>.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1. Changing
the Default Synchronization Subtree</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1. Changing
the Default Synchronization Subtree</h3></div></div></div><div
class="para">
When you create synchronization agreements, two default containers are used as the
source of the user accounts to synchronize between IPA and Windows Active Directory. IPA
uses the <em
class="parameter"><code>cn=users,cn=accounts,$SUFFIX</code></em>
subtree as the default container, and Windows uses the <em
class="parameter"><code>CN=Users,$SUFFIX</code></em>
subtree. You can use the <em
class="parameter"><code>--win-subtree</code></em> argument
to the <code class="command">ipa-replica-manage connect</code>
command to override the default Windows subtree.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
If you pass such arguments to the bash or other shell, ensure that you quote spaces
and other shell metacharacters. For example, the argument <em
class="parameter"><code>--win-subtree=cn=users, dc=example,
dc=com</code></em> will fail. The argument <em
class="parameter"><code>--win-subtree="cn=users, dc=example,
dc=com"</code></em> will succeed.
</div></div></div><div class="para">
IPA does not currently support modifying the default synchronization container while
you are creating the synchronization agreement. You can, however, change the container
after the agreement has been established. To do so, you can either modify the <code
class="filename">dse.ldif</code> file directly (ensure that you stop
the directory server before editing this file), or use <code
class="command">ldapmodify</code> to change <em
class="parameter"><code>nsds7WindowsReplicaSubtree</code></em>.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">8.6. Deleting
Synchronization Agreements</h2></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">9.6. Deleting
Synchronization Agreements</h2></div></div></div><div
class="para">
You can use the IPA administration tools to delete existing synchronization
agreements. For example, to delete an agreement with the AD server <code
class="systemitem">adserver.example.com</code>, run the following
command:
</div><div class="para">
<code class="command"># ipa-replica-manage disconnect
adserver.example.com</code>
@@ -3267,7 +3229,7 @@ modifying entry "cn=ipa-winsync,cn=plugins,cn=config"
This removes the replication agreement between the IPA and AD servers. To complete the
operation, you need to remove the AD certificate from the IPA server. Run the following
command to remove the AD certificate:
</div><div class="para">
<code class="command"># certutil -D -d /etc/dirsrv/slapd-$REALM/ -n
"Imported CA"</code>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">8.7. Winsync
Agreement Failures</h2></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Winsync_Agreement_Failures-Symptom"><h5
class="formalpara">Symptom</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">9.7. Winsync
Agreement Failures</h2></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Winsync_Agreement_Failures-Symptom"><h5
class="formalpara">Symptom</h5>
If the creation of a winsync agreement fails, you may see an error message similar to
the following:
<pre class="screen">"Update failed! Status: [81 - LDAP error:
Can't contact LDAP server]
</pre>
@@ -3295,7 +3257,7 @@ Imported CA
CT,,C</pre>
</div><pre class="screen">"Windows PassSync entry exists,
not resetting password"
</pre><div class="para">
This is not an error, but rather a notification that IPA is not re-adding the <code
class="systemitem">passync</code> user, and neither is it changing the
original password. The <code class="systemitem">passync</code> user
is a special user entry that can change passwords in IPA.
- </div></div></div><div xml:lang="en-US"
class="chapter" id="nis" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 9. Identity: Integrating with NIS Domains and
Netgroups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-nis">9.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="#adding-netgroups">9.1.3. Adding
Netgroups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a href="#sec
t-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">9.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="#migrintg-from-nis">9.3. Migrating
from NIS to IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></div><div
class="section" id="about-nis"><div
class="titlepage"><div><div><h2 class="title"
id="about-nis">9.1.
About NIS and IPA</h2></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1. What
are Netgroups?</h3></div></div></div><div
class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="nis" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 10. Identity: Integrating with NIS Domains and
Netgroups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-nis">10.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="#adding-netgroups">10.1.3. Adding
Netgroups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a href
="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">10.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="#migrintg-from-nis">10.3. Migrating
from NIS to IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></div><div
class="section" id="about-nis"><div
class="titlepage"><div><div><h2 class="title"
id="abou
t-nis">10.1. About NIS and
IPA</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1. What
are Netgroups?</h3></div></div></div><div
class="para">
Netgroups are a concept introduced in the directory service NIS. They were designed
to contain users, hosts (machines) and other netgroups. A netgroup is a user-host-domain
triplet. Refer to the following for more details about netgroups and their uses:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<a
href="http://compute.cnr.berkeley.edu/cgi-bin/man-cgi?netgroup+4&quo...
@@ -3307,11 +3269,11 @@ Imported CA
CT,,C</pre>
Despite this difference, it is important to underline that there are two plug-ins in
IPA that make the data in the new format available via NIS or the old standard RFC2307 and
RFC2307bis LDAP schema. For details, refer to the documentation and examples at: <a
href="https://fedorahosted.org/slapi-nis/">https://fedorahos...;.
The entries stored using the new schema are converted into the standard NIS netgroup map
and served via the NIS protocol by the first plug-in described on the slapi-nis project
page and the compatibility plug-in can be used to create a virtual LDAP view that matches
the standard 2307 or 2307bis schema for netgroups using the IPA-specific schema.
</div><div class="para">
Historically, netgroups have been used to define groups of hosts or users. The
advantage of netgroups for user aggregation has been that netgroups allow nesting while
normal UNIX user groups do not. Netgroups also provide the only way to aggregate hosts.
There is no notion of host groups in NIS, although for effective centralized system
management they are definitely needed. It is important to understand that netgroups are
collections of entities, be they users, hosts, or both, but there is no relation between
particular user-host pairs defined in the netgroup triplet.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2. The
IPA Approach to Netgroups</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2. The
IPA Approach to Netgroups</h3></div></div></div><div
class="para">
IPA defines both user groups and host groups, each of which allow nesting. This is a
much cleaner way of aggregation and allows better separation of duties and access control.
In an IPA deployment, netgroups are a much less attractive approach to grouping than with
other LDAP-based systems compliant with RFC 2307 (this defines the LDAP schema for users,
groups, netgroups and other maps).
</div><div class="para">
Client-side applications, for example, SUDO, need netgroups because there is no
alternative to host grouping on the client side. Consequently, netgroups are far from
obsolete on the client side. A lot of effort is still required within SSSD and IPA to
provide clean interfaces to reliably (both online and offline) relay centrally-managed
information to applications running on a client machine. IPA therefore provides a way to
define and store netgroups, but they are viewed as secondary to user groups and host
groups.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups">9.1.2.1. How
IPA Stores Netgroups</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups">10.1.2.1. How
IPA Stores Netgroups</h4></div></div></div><div
class="para">
IPA stores netgroups in a different format from that specified in RFC2307 and
RFC2307bis. The netgroup entries defined by the IPA schema allow relating different
objects (users, groups, hosts, host groups) to each other. IPA also provides what is known
as a <em class="firstterm">compat (compatibility)</em> plug-in. This
plug-in creates a virtual view of the data stored in native IPA entries in the format
expected by the RFC-compliant clients. This means that even though the internal data
representation of netgroups is different from the RFC, this deviation does not affect
clients due to the presence of the <code
class="systemitem">compat</code> plug-in.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-How_IPA_Stores_Netgroups-Comparison_of_Schema"><h5
class="formalpara">Comparison of Schema</h5>
To realize the differences, we can compare the standard RFC schema for netgroups
and the schema used by IPA. IPA defines the following object class:
@@ -3345,7 +3307,7 @@ Imported CA
CT,,C</pre>
<a
href="http://www.freeipa.org/page/DS_Design_Summary#Netgroups"&...
</div></li></ul></div>
- </div></div></div><div class="section"
id="adding-netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="adding-netgroups">9.1.3. Adding
Netgroups</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="adding-netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="adding-netgroups">10.1.3. Adding
Netgroups</h3></div></div></div><div
class="para">
NIS groups traditionally contain a so-called netgroup triple of the format: (machine,
user, domain)
</div><pre class="screen">machine - machine name, a host name
user - user name
@@ -3361,7 +3323,7 @@ NIS domain name: panda
Member User: admin
Member Host: icefloat.panda</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
There is no necessary relationship between the machine and the user. Only one of
those fields is usually used at a time to avoid confusion.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4. IPA
Netgroup Commands</h3></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4. IPA
Netgroup Commands</h3></div></div></div><div
class="para">
The IPA netgroup management plug-in conforms to the Create, Read, Update, Delete
(CRUD) command-naming conventions used in all other plug-ins that ship with the default
IPA installation. You can use the following command to display a list of the IPA commands
available for working with netgroups:
</div><div class="para">
@@ -3409,7 +3371,7 @@ Member Host: icefloat.panda</pre><div
class="note"><div class="admonition_header
--netgroups=NETGROUPS
]</p></div></pre><div class="para">
USERS, GROUPS, HOSTS, HOSTGROUPS, and NETGROUPS are comma-separated lists of names of
the appropriate objects.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples">9.1.4.1. Examples</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples">10.1.4.1. Examples</h4></div></div></div><div
class="para">
The following examples provide an introduction to using the <code
class="command">ipa netgroup-*</code> commands:
</div><pre class="screen">
<code class="command"># ipa netgroup-add net0 --desc="test
netgroup"</code>
@@ -3446,11 +3408,11 @@ Number of members removed 1
<code class="command"># ipa netgroup-show net0</code>
ipa: ERROR: no such entry
-</pre></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">9.2. Configuring
the Network Information Service
(NIS)</h2></div></div></div><div class="para">
+</pre></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">10.2. Configuring
the Network Information Service
(NIS)</h2></div></div></div><div class="para">
The Network Information Service (NIS) is an RPC service, used in conjunction with
<code class="systemitem">portmap</code> and other related services
to distribute maps of usernames, passwords, and other sensitive information to any
computer claiming to be within its domain.
</div><div class="para">
IPA provides a NIS server plug-in to facilitate the integration of NIS clients with an
IPA domain, including exposing any automount maps that have been configured.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1. Exposing
Automount Maps to NIS Clients</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1. Exposing
Automount Maps to NIS Clients</h3></div></div></div><div
class="para">
Currently, when the NIS service is enabled, the server is automatically configured to
serve the NIS domain with the IPA domain's name, and to serve IPA users, groups, and
netgroups (passwd, group, and netgroup maps) to the NIS domain.
</div><div class="para">
If you have defined automount maps, these maps need to be manually added to the NIS
server plug-in's configuration in the directory server in order to expose them to NIS
clients.
@@ -3458,7 +3420,7 @@ ipa: ERROR: no such entry
The NIS plug-in needs to know the name of the NIS domain, the name of the NIS map,
how to find the directory entries to use as the NIS map's contents, and which
attributes to use as the NIS map's key and value. Most of these settings will be the
same for every map.
</div><div class="para">
The IPA server stores the automount maps, grouped by automount location, in the
<em class="parameter"><code>cn=automount</code></em>
branch of the IPA domain's tree.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration">9.2.1.1. Example
Automount Map Configuration</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration">10.2.1.1. Example
Automount Map Configuration</h4></div></div></div><div
class="para">
If you have created an automount map named <code
class="filename">auto.example</code> in a location named
"default", you first need to add an entry to the configuration for the NIS
server running on a host named <code
class="systemitem">dirsrv</code>, as follows:
<pre class="screen">LOCATION=default
NISDOMAIN=example.com
@@ -3485,11 +3447,11 @@ EOF
This entry instructs the plug-in to create a map named <code
class="filename">auto.master</code> in the domain named <code
class="systemitem">${NISDOMAIN}</code>, and that the data for that map
should be read from the entries at and below <em
class="parameter"><code>automountmapname=${NISMAP}</code></em>,
which exists inside a container named <code
class="systemitem">cn=${LOCATION}</code>. This container is in the
automount section of the IPA data store. The keys for the entries in the automount map in
NIS are the values of the <em
class="parameter"><code>automountKey</code></em> attribute
for the directory server entries, and the corresponding values in the NIS map are the
values of the <em
class="parameter"><code>automountInformation</code></em>
attribute in those same entries.
</div><div class="para">
You then need to repeat the process for the <code
class="filename">auto.direct</code> map, and then any other maps that
you have defined.
- </div></div></div></div><div class="section"
id="migrintg-from-nis"><div
class="titlepage"><div><div><h2 class="title"
id="migrintg-from-nis">9.3. Migrating from NIS to
IPA</h2></div></div></div><div class="para">
+ </div></div></div></div><div class="section"
id="migrintg-from-nis"><div
class="titlepage"><div><div><h2 class="title"
id="migrintg-from-nis">10.3. Migrating from NIS to
IPA</h2></div></div></div><div class="para">
The IPA development team researched the topic of how netgroups are typically used in
order to better determine an optimal migration design solution. This research shows that
the main use cases for netgroups are the aggregation of users and the aggregation of
hosts, but not both at the same time. IPA does not provide a special script or command to
facilitate the migration of customers' existing netgroups to IPA. This operation must
be performed by the system administrator himself or with the help of professional
services. This chapter provides some guidelines to ease the process of migrating netgroups
to IPA.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1. Preparing
Your Environment</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1. Preparing
Your Environment</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
These procedures are guidelines only, and are provided to help clean your
environment and make it more manageable. It is not a definitive set of instructions, and
administrators need to be creative and factor in the real constraints present in their
environment. If any steps described below are not possible due to independent conditions,
we recommend migrating netgroups on a one-to-one basis. This is described later in this
chapter.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment"><h6>Procedure 9.1. To
prepare your environment</h6><ol class="1"><li
class="step"><div class="para">
+ </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment"><h6>Procedure 10.1. To
prepare your environment</h6><ol class="1"><li
class="step"><div class="para">
Inspect your client applications and determine which kind of grouping information
they need from the central server. For example, if netgroups exist that contain only
users, and any applications that rely on these netgroups can be converted to use UNIX
groups instead of netgroups, then we recommend doing so. If this is not possible, we still
recommend creating UNIX groups out of the netgroups. If no applications use them, we
recommend deleting these netgroups altogether. Refer to the following example:
</div><ol class="a"><li class="step"><div
class="para">
Given the following netgroup: <code class="systemitem">(host1,
user1, )(host2, user2,)(host3, user3, )...</code>, create a group consisting of the
users <code class="systemitem">user1</code>, <code
class="systemitem">user2</code>, and <code
class="systemitem">user3</code> (assuming it does not already exist).
@@ -3519,12 +3481,12 @@ EOF
Add users and hosts as direct members of the netgroup, or, alternatively, put
them into groups and then add those groups as members to the netgroup.
</div><div class="para">
For IPA clients, both methods result in the same thing — having the users and
hosts managed in the netgroup — but from an administrative perspective, it may be simpler
in some environments to use one option instead of the other.
- </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2. Migrating
Netgroups</h3></div></div></div><div
class="para">
+ </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2. Migrating
Netgroups</h3></div></div></div><div
class="para">
There are three main approaches that can be taken to the actual migration procedure:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Dump the netgroups from the source into an LDIF file.
</div></li><li class="listitem"><div
class="para">
- Create a script that follows the instructions in <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment">Procedure 9.1,
“To prepare your environment”</a> to convert the LDIF format into an LDIF file that
contains IPA native objects.
+ Create a script that follows the instructions in <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment">Procedure 10.1,
“To prepare your environment”</a> to convert the LDIF format into an LDIF file that
contains IPA native objects.
</div></li><li class="listitem"><div
class="para">
Run the conversion script and load the resulting LDIF file into IPA using the
<code class="command">ldapmodify</code> command.
</div><div class="para">
@@ -3537,13 +3499,13 @@ EOF
Refer to the IPA CLI help system for more details. Use the <code
class="command">ipa help</code> command to display a list of available
topics.
</div></li></ol></div></li><li
class="listitem"><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Use the UI to manually create a new structure of netgroups.
- </div></li></ol></div></li></ol></div></div></div></div><div
xml:lang="en-US" class="chapter" id="authz"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 10. Policy: Configuring
Authorization</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#configuring-host-access">10.1. Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">10.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">10.3.
HBAC Services</a></span></dt></dl></div><div
class="section" id="configuring-host-access"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-host-access">10.1. Configuring Host-Based Access
Control</h2></div></div></div><div class="para">
+ </div></li></ol></div></li></ol></div></div></div></div><div
xml:lang="en-US" class="chapter" id="authz"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 11. Policy: Configuring
Authorization</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#configuring-host-access">11.1. Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">11.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">11.3.
HBAC Services</a></span></dt></dl></div><div
class="section" id="configuring-host-access"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-host-access">11.1. Configuring Host-Based Access
Control</h2></div></div></div><div class="para">
Host-based access control (HBAC) uses <em
class="firstterm">rules</em> to determine who can access what services
on what hosts and from where. You can use HBAC to control which users or groups on a
source host can access a service, or group of services, on a target host. Target hosts and
source hosts in HBAC rules must be hosts managed by IPA.
</div><div class="para">
You can also specify a category of users, target hosts, and source hosts. This is
currently limited to "all", but might be expanded in the future.
</div><div class="para">
The available services and groups of services are controlled by the <code
class="systemitem">hbacsvc</code> and <code
class="systemitem">hbacsvcgroup</code> plug-ins, respectively.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">10.2. HBAC
Service Groups</h2></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">11.2. HBAC
Service Groups</h2></div></div></div><div
class="para">
HBAC service groups can contain any number of individual services (<em
class="firstterm">members</em>), and are typically used to group
similar services to make it easier to create HBAC rules. All HBAC service groups require a
name and description. IPA provides a single default group, SUDO, used for SUDO-related
services.
</div><div class="para">
Use the <code class="command">ipa hbacsvcgroup-find</code>
command to display the existing HBAC groups:
@@ -3559,7 +3521,7 @@ Number of entries returned 1
</div><div class="para">
IPA provides commands for adding, removing and modifying HBAC service groups, adding
and removing members to and from those groups, and displaying group information. Refer to
the <code class="command">ipa help hbacsvcgroup</code> help page for
more information.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">10.3. HBAC
Services</h2></div></div></div><div class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">11.3. HBAC
Services</h2></div></div></div><div class="para">
HBAC services refer to the PAM services that the IPA HBAC system can control access
to. HBAC service names must exactly match the service name that PAM is evaluating. For
example, use the following command to add the <code
class="systemitem">tftp</code> service as an HBAC service:
<pre class="screen"><code class="command"># ipa
hbacsvc-add tftp</code>
-------------------------
@@ -3583,27 +3545,27 @@ Number of entries returned 2
</div><div class="para">
Refer to the <code class="command">ipa help hbacsvc</code> help
page for more information.
- </div></div></div><div xml:lang="en-US"
class="chapter" id="sudo" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 11. Policy: Using
sudo</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-sudo">11.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">11.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configurati
on">11.1.4. Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-sudo">11.2. Configuring
sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></div><div
class="section" id="about-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="about-sudo">11.1. About sudo and
IPA</h2></div></div></div><div class="para">
+ </div></div></div><div xml:lang="en-US"
class="chapter" id="sudo" lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 12. Policy: Using
sudo</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#about-sudo">12.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">12.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">12.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configurati
on">12.1.4. Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="#configuring-sudo">12.2. Configuring
sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></div><div
class="section" id="about-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="about-sudo">12.1. About sudo and
IPA</h2></div></div></div><div class="para">
The <code class="command">sudo</code> command allows a system
administrator to delegate authority, allowing certain users (or groups of users) the
ability to run one or more commands as root or as another user, and at the same time
providing an audit trail of the commands and their arguments. For more information,
including coverage of the options available for use with <code
class="command">sudo</code>, refer to the <code
class="command">sudo</code> and <code
class="command">sudoers</code> man pages.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1. Sudo
with LDAP</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1. Sudo
with LDAP</h3></div></div></div><div
class="para">
In the past, <code class="command">sudo</code> used a single,
local, configuration file, <code
class="filename">/etc/sudoers</code>. It is possible to share the same
<code class="filename">sudoers</code> file among machines, but there
is no built-in mechanism to distribute it. Some have attempted to work around this by
synchronizing changes using CVS, RSYNC, RDIST, RCP, SCP, and even NFS. By using LDAP for
<code class="filename">sudoers</code>, IPA provides a
centrally-administered, globally-available configuration source for <code
class="command">sudo</code>.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2. Limitations
of the Existing Sudo LDAP Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">12.1.2. Limitations
of the Existing Sudo LDAP Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
The current schema relies on LDAP-stored POSIX groups for its groups of users. The
limitation here is that you cannot use a group of users for <code
class="command">sudo</code> without the users inheriting potential
POSIX rights.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Hosts"><h5
class="formalpara">Groups of Hosts</h5>
The current schema does not have a concept of host groups. Instead, it relies on the
legacy LDAP nisNetgroupTriple to manage groups of hosts.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Commands"><h5
class="formalpara">Groups of Commands</h5>
The current schema does not have a concept of command groups. This requires that
individual commands be present in each Sudo rule. It also limits the ability to reuse a
group of commands for multiple Sudo rules.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">11.1.3. Benefits
of the IPA Alternative Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">12.1.3. Benefits
of the IPA Alternative Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
Groups of users can be either POSIX or non-POSIX groups within IPA. This provides
the flexibility to group users without assigning POSIX rights or GID information to the
group.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Computers"><h5
class="formalpara">Groups of Computers</h5>
The IPA alternative schema also addresses the issue of host groups and netgroups for
the purpose of sudo. The <code class="command">sudo</code> utility
itself does not support host groups—a better and cleaner host grouping mechanism—but
instead expects netgroups. To resolve this issue, IPA automatically creates a "shadow
netgroup" with the same name as every host group that you create. This means that you
can create host groups but still use netgroups with <code
class="command">sudo</code> without encountering any problems.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Commands"><h5
class="formalpara">Groups of Commands</h5>
Command groups are a new concept introduced by IPA. These objects allow
administrators the ability to create groups of <code
class="command">sudo</code> commands that can be reused for multiple
rules without the need of assigning individual commands throughout.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">11.1.4. Compatibility
and Managed Entry Plug-in
Configuration</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Compatibility_Translation_for_Native_Sudo"><h5
class="formalpara">Compatibility Translation for Native Sudo</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">12.1.4. Compatibility
and Managed Entry Plug-in
Configuration</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Compatibility_Translation_for_Native_Sudo"><h5
class="formalpara">Compatibility Translation for Native Sudo</h5>
The native <code class="command">sudo</code> binary does not
yet support SSSD or the IPA Sudo Schema. As an interim solution, IPA has implemented a
compatibility plug-in which transparently translates IPA Sudo rules into those supported
by the current <code class="command">sudo</code> binary.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Managed_Entries_for_NIS_Netgroups"><h5
class="formalpara">Managed Entries for NIS Netgroups</h5>
In order to seamlessly support the current implementation of sudo, IPA provides a
managed entry plug-in for NIS netgroups. Whenever an IPA host group is created, a
translated nisNetgroupTriple is also created.
- </div></div></div><div class="section"
id="configuring-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-sudo">11.2. Configuring
sudo</h2></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="configuring-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-sudo">12.2. Configuring
sudo</h2></div></div></div><div class="para">
To fully implement Sudo rules, you need to perform various configuration steps on both
the IPA server and client. You should first create a <em
class="firstterm">Sudo command object</em>, and optionally create any
<em class="firstterm">Sudo command groups</em>. Finally, create a
<em class="firstterm">Sudo rule</em>, which should contain at least
the following components:
<div class="itemizedlist"><div class="para">
One or more:
@@ -3617,7 +3579,7 @@ Number of entries returned 2
</div><div class="para">
These steps are described in detail in the following sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1. Server
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules"><h6>Procedure 11.1. How
to configure your server to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1. Server
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules"><h6>Procedure 12.1. How
to configure your server to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
Set up a host group, and add the client to the host group:
</div><ol class="a"><li class="step"><pre
class="screen"><code class="command">$ ipa hostgroup-add
bne_doc</code>
Description: BNE Documentation hosts
@@ -3734,7 +3696,7 @@ Number of members added 1
-------------------------
</pre>
- </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2. Client
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-How_to_configure_your_client_to_use_Sudo_rules"><h6>Procedure 11.2. How
to configure your client to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2. Client
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-How_to_configure_your_client_to_use_Sudo_rules"><h6>Procedure 12.2. How
to configure your client to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
Configure <code class="command">sudo</code> to look to LDAP
for the <code class="filename">sudoers</code> file. Add the
following line to <code class="filename">/etc/nsswitch.conf</code>:
<pre class="programlisting">sudoers: ldap</pre>
@@ -3767,7 +3729,7 @@ timelimit 15
uri
ldap://ipaserver.ipadocs.org
</pre>
<div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The sudo user's password in this configuration is the same password you set
up in <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules">Procedure 11.1,
“How to configure your server to use Sudo rules:”</a>.
+ The sudo user's password in this configuration is the same password you set
up in <a class="xref"
href="#proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules">Procedure 12.1,
“How to configure your server to use Sudo rules:”</a>.
</div></div></div>
</div><div class="para">
@@ -3782,7 +3744,7 @@ uri
ldap://ipaserver.ipadocs.org
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
A bug has been filed in Fedora to have this configuration requirement addressed
during the boot process.
- </div></div></div></li></ol></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes">11.2.2.1. NIS
Configuration Notes</h4></div></div></div><div
class="para">
+ </div></div></div></li></ol></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes">12.2.2.1. NIS
Configuration Notes</h4></div></div></div><div
class="para">
Originally called <em class="firstterm">Yellow Pages
(YP)</em>, NIS was created by Sun Microsystems and stands for Network Information
Service. It was primarily used by UNIX to centrally manage authentication and enumeration
information such as user/password, host/IP address, POSIX groups, and netgroups. NIS (the
service) does not actually need to be configured on either the client or the server. Not
only is it unnecessary, but might be considered a security risk if it were running. NIS is
an RPC service and is insecure by today's standards, partly because:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
It provides no host authentication mechanisms
@@ -3796,28 +3758,28 @@ uri
ldap://ipaserver.ipadocs.org
The IPA LDAP implementation provides the schema to support NIS as defined in <a
href="http://tools.ietf.org/html/rfc2307">RFC 2307</a>. NIS objects are
automatically created inside of LDAP and NSS_LDAP, or SSSD fetches them using an encrypted
LDAP connection.
</div><div class="para">
Utilizing SSSD or NSS_LDAP, a client system can enumerate the necessary NIS
information using authenticated and encrypted queries to the back end LDAP service
provided by the IPA Server. This eliminates the need for NIS client configuration for
systems that can support NIS using LDAP when utilizing IPA.
- </div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="server-config"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 12. Configuring the IPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#managing-access-to-ipa">12.1. Defining Access Controls within
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1.
Server-side Access
Control</a></span></dt></dl></dd><dt><span
class="section"><a href="#creating-roles">12.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="#self-service">12.3. Defining
Self-Service Settings</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings">12.4.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="#search-limits">12.5. Setting
Default Search L
imits</a></span></dt><dt><span
class="section"><a href="#disabling-anon-binds">12.6.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes">12.7.
Implementing Unique UID and GID
Attributes</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1.
Assigning UIDs and
GIDs</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities">12.8.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="sec
tion"><a
href="#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a href="#Using_OCSP">12.8.3. Using
OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-apache">12.9. Setting an IPA
Server as an Apache Virtual Host</a></span></dt><dt><span
class="section"><a href="#ipa-cluster">12.10. Using IPA in a
Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2.
Using t
he Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">12.11.
Creating DNS Entries for FreeIPA
Replicas</a></span></dt><dt><span
class="section"><a href="#promoting-replica">12.12. Promoting
a Read-Only Replica to an IPA Server</a></span></dt><dt><span
class="section"><a href="#logging">12.13. IPA Server
Logging</a></span></dt></dl></div><div
class="section" id="managing-access-to-ipa"><div
class="titlepage"><div><div><h2 class="title"
id="managing-access-to-ipa">12.1. Defining Access Controls within
IPA</h2></div></div></div><div class="para">
- Access control is a mechanism which defines user access. That is, it defines the
rights that users and other objects have been granted in order to perform operations on
other users or objects. When the IPA directory server receives a request, it uses the
authentication information provided by the user in the bind operation together with <em
class="firstterm">access control instructions (ACIs)</em> defined in
the server to allow or deny access to directory information. The server can allow or deny
permissions for actions, such as read, write, search, and compare, on directory server
entries. The permission level granted to a user may depend on the authentication
information provided.
+ </div></div></div></div></div><div
xml:lang="en-US" class="chapter" id="server-config"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 13. Configuring the FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#managing-access-to-ipa">13.1. Defining Access Controls within
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a href="#Server_side_Access_Control">13.1.1.
Server-side Access Control</a></span></dt><dt><span
class="section"><a href="#creating-roles">13.1.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="#self-service">13.1.3. Defining
Self-Service
Settings</a></span></dt></dl></dd><dt><span
class="section"><a href="#disabling-anon-binds">13.2.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a
href="#Managing-Unique_UID_and_GID_Attributes">13.3. Managing Unique UID and
GID Number
Assignments</a></span></dt><dd><dl><dt><span
class="section"><a href="#id-ran
ges-at-install">13.3.1. About ID Range Assignments During
Installation</a></span></dt><dt><span
class="section"><a
href="#Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2. Adding New
Ranges</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities">13.4.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="#Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">13.4.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a href="#Using_OCSP">13.4.3. Using
OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="#ipa-apache">13.5. Setting a FreeIPA
Server as an Apache Virtual Host</a></span></dt><dt><span
class="se
ction"><a href="#ipa-cluster">13.6. Using FreeIPA in a
Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="#Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="#Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="#Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">13.7. Creating
DNS Entries for FreeIPA Replicas</a></span></dt><dt><span
class="section"><a href="#promoting-replica">13.8. Promoting
a Read-Only Replica to a FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="#logging">13.9. FreeIPA Server
Logging</a></span></dt></dl></div><div
class="section" id="managing-access-to-ipa"><div
class="titlepage">
<div><div><h2 class="title"
id="managing-access-to-ipa">13.1. Defining Access Controls within
FreeIPA</h2></div></div></div><div class="para">
+ Access control is a mechanism which defines user access. That is, it defines the
rights that users and other objects have been granted in order to perform operations on
other users or objects. When the FreeIPA directory server receives a request, it uses the
authentication information provided by the user in the bind operation together with <em
class="firstterm">access control instructions (ACIs)</em> defined in
the server to allow or deny access to directory information. The server can allow or deny
permissions for actions, such as read, write, search, and compare, on directory server
entries. The permission level granted to a user may depend on the authentication
information provided.
</div><div class="para">
- IPA implements a number of different methods for controlling access to the various
objects, commands and processes that exist within an IPA domain. This includes a Kerberos
Ticket Policy, a Password Policy, Host-based Access Control and SUDO Command Policies for
controlling client access to services and commands; that is, outside of the IPA server,
and a separate Access Control Model for controlling server-side objects; that is, LDAP
entries within the IPA server.
+ FreeIPA implements a number of different methods for controlling access to the various
objects, commands and processes that exist within a FreeIPA domain. This includes a
Kerberos Ticket Policy, a Password Policy, Host-based Access Control and SUDO Command
Policies for controlling client access to services and commands; that is, outside of the
FreeIPA server, and a separate Access Control Model for controlling server-side objects;
that is, LDAP entries within the FreeIPA server.
</div><div class="para">
- IPA relies on three separate types of access control rules:
+ FreeIPA relies on three separate types of access control rules:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Role-based rules: specify what operations an entity can perform based on its IPA
Role.
+ Role-based rules: specify what operations an entity can perform based on its FreeIPA
Role.
</div></li><li class="listitem"><div
class="para">
Self-service rules: specify what an entity can change within its own entry.
</div></li><li class="listitem"><div
class="para">
Delegation rules: specify which groups can modify members of another group.
</div></li></ul></div><div class="para">
- These three types of access control complement each other, and allow IPA
administrators to create a very flexible set of access control permissions and
restrictions.
+ These three types of access control complement each other, and allow FreeIPA
administrators to create a very flexible set of access control permissions and
restrictions.
</div><div class="para">
- Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by IPA. Users, groups, hosts, and host groups can be added to different IPA
Roles. These roles provide the necessary permissions for access. You can create as many
roles as you need to suit the requirements of your deployment.
+ Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by FreeIPA. Users, groups, hosts, and host groups can be added to different
FreeIPA Roles. These roles provide the necessary permissions for access. You can create as
many roles as you need to suit the requirements of your deployment.
</div><div class="para">
There are several aspects to working with roles. Because it is a hierarchical system,
to create a fully operational role you need to create the role itself, add privileges to
this role to establish what tasks it can and cannot perform, and finally add members to
the role, such as users, groups, etc. The reverse is also true; if you remove a role, then
any users or groups who relied on this role to perform certain tasks will no longer be
able to do so.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot create nested roles. That is, a role cannot contain another role.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1. Server-side
Access Control</h3></div></div></div><div
class="para">
- The IPA Access Control Model is based on the underlying 389 Directory Server access
control model, which uses access control instructions (ACIs) to define user access within
the system. An ACI is a construct that can express a complex set of access control
information.
+ </div></div></div><div class="section"
id="Server_side_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Server_side_Access_Control">13.1.1. Server-side Access
Control</h3></div></div></div><div class="para">
+ The FreeIPA Access Control Model is based on the underlying 389 Directory Server
access control model, which uses access control instructions (ACIs) to define user access
within the system. An ACI is a construct that can express a complex set of access control
information.
</div><div class="para">
As explained in the directory server documentation, the three main parts of an ACI
statement are:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
@@ -3829,9 +3791,9 @@ uri
ldap://ipaserver.ipadocs.org
</div></li></ul></div>
</div><div class="para">
- The ACI structure itself is very flexible, but can also be confusing. IPA attempts to
structure these ACIs in order to provide a formalized input and output that can be
expressed on the command line and in the WebUI, while at the same time maintaining
sufficient flexibility to create complex access control rules. In order to achieve this,
IPA implements three types of access control. These are discussed in the following
sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control-Types_of_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control-Types_of_Access_Control">12.1.1.1. Types
of Access Control</h4></div></div></div><div
class="para">
- IPA relies on three separate types of access control rules:
+ The ACI structure itself is very flexible, but can also be confusing. FreeIPA
attempts to structure these ACIs in order to provide a formalized input and output that
can be expressed on the command line and in the WebUI, while at the same time maintaining
sufficient flexibility to create complex access control rules. In order to achieve this,
FreeIPA implements three types of access control. These are discussed in the following
sections.
+ </div><div class="section"
id="Server_side_Access_Control-Types_of_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="Server_side_Access_Control-Types_of_Access_Control">13.1.1.1. Types of
Access Control</h4></div></div></div><div
class="para">
+ FreeIPA relies on three separate types of access control rules:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Role-based
</div></li><li class="listitem"><div
class="para">
@@ -3839,35 +3801,35 @@ uri
ldap://ipaserver.ipadocs.org
</div></li><li class="listitem"><div
class="para">
Delegation
</div></li></ul></div>
- These three types of access control complement each other, allowing IPA
administrators to create a very flexible set of access control permissions and
restrictions.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Role_based_Access_Control"><h5
class="formalpara">Role-based Access Control</h5>
- Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by IPA. Different users who perform the same tasks within an organization are
typically combined into a group, and this group is made a member of an IPA <em
class="firstterm">Role</em>. This Role provides the member groups and
users the necessary permissions to perform their assigned tasks.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Self_service_Access_Control"><h5
class="formalpara">Self-service Access Control</h5>
+ These three types of access control complement each other, allowing FreeIPA
administrators to create a very flexible set of access control permissions and
restrictions.
+ </div><div class="formalpara"
id="Types_of_Access_Control-Role_based_Access_Control"><h5
class="formalpara">Role-based Access Control</h5>
+ Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by FreeIPA. Different users who perform the same tasks within an organization
are typically combined into a group, and this group is made a member of a FreeIPA <em
class="firstterm">Role</em>. This Role provides the member groups and
users the necessary permissions to perform their assigned tasks.
+ </div><div class="formalpara"
id="Types_of_Access_Control-Self_service_Access_Control"><h5
class="formalpara">Self-service Access Control</h5>
Self-service access control defines what operations an entity can perform on
itself. This method of control is attribute based; that is, it defines what attributes can
be modified for any particular entity. The ability of a user to update their own password
is an example of self-service access control. Self-service access control applies to any
authenticated entity performing an operation, not only to users. This method of access
control should also be used with caution, to avoid the possibility that it lead to the
elevation of an entity's privileges.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Delegation_Access_Control"><h5
class="formalpara">Delegation Access Control</h5>
+ </div><div class="formalpara"
id="Types_of_Access_Control-Delegation_Access_Control"><h5
class="formalpara">Delegation Access Control</h5>
Delegation access control defines what operations one group of users or entries can
perform on another group of users or entries. In each case, the group of users or entries
may be identified by a provided filter. The core difference between delegation access
control rules and other rules is that the target—the object of the access control rule—is
not a class of entries but rather a set of specific entries that are members of a group or
retrieved by a specific filter. The delegation rules allow targeted management of specific
user entries.
</div><div class="para">
- In each case, the access control rule resolves the constituents of the IPA access
control expression: "<em class="firstterm">Who</em> can do
<em class="firstterm">What</em> to <em
class="firstterm">Whom</em>". The following section explains these
constituents in more detail.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-The_IPA_Access_Control_Expression"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-The_IPA_Access_Control_Expression">12.1.1.1.1. The
IPA Access Control Expression</h5></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_Who_of_Access_Control"><h5
class="formalpara">The "Who" of Access Control</h5>
- In simple grammatical terms, the "who" of an IPA <em
class="firstterm">access control instruction (ACI)</em>, or expression,
is the subject. It specifies the entity that interacts with the system and tries to
perform an administrative task. This task could be an administrator adding a user, a user
changing his home address, or a host requesting a certificate for a service running on the
host.
+ In each case, the access control rule resolves the constituents of the FreeIPA
access control expression: "<em class="firstterm">Who</em> can
do <em class="firstterm">What</em> to <em
class="firstterm">Whom</em>". The following section explains these
constituents in more detail.
+ </div><div class="section"
id="Types_of_Access_Control-The_IPA_Access_Control_Expression"><div
class="titlepage"><div><div><h5 class="title"
id="Types_of_Access_Control-The_IPA_Access_Control_Expression">13.1.1.1.1. The
FreeIPA Access Control Expression</h5></div></div></div><div
class="formalpara"
id="The_IPA_Access_Control_Expression-The_Who_of_Access_Control"><h5
class="formalpara">The "Who" of Access Control</h5>
+ In simple grammatical terms, the "who" of a FreeIPA <em
class="firstterm">access control instruction (ACI)</em>, or expression,
is the subject. It specifies the entity that interacts with the system and tries to
perform an administrative task. This task could be an administrator adding a user, a user
changing his home address, or a host requesting a certificate for a service running on the
host.
</div><div class="para">
- It is important to understand that the "who" is not necessarily a person;
it can be any entity that has successfully authenticated against IPA. In order to
authenticate against the IPA server, this entity, the "who", needs to have a
Kerberos principal. After the entity has authenticated, it can connect to the IPA server
and try to issue administrative commands. The system will either allow or deny the
requested operation based on this entity's permissions.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_What_of_Access_Control"><h5
class="formalpara">The "What" of Access Control</h5>
- To continue the analogy with grammatical terms, the "what" of an IPA ACI
is the verb. This specifies the actual administrative operation that the subject, the
"who", is trying to perform. Such operations can target actual entries, such as
adding or deleting users, or they can target specific attributes of entries, such as
changing phone numbers for a user entry, or changing the member attributes of a group
entry.
+ It is important to understand that the "who" is not necessarily a person;
it can be any entity that has successfully authenticated against FreeIPA. In order to
authenticate against the FreeIPA server, this entity, the "who", needs to have a
Kerberos principal. After the entity has authenticated, it can connect to the FreeIPA
server and try to issue administrative commands. The system will either allow or deny the
requested operation based on this entity's permissions.
+ </div><div class="formalpara"
id="The_IPA_Access_Control_Expression-The_What_of_Access_Control"><h5
class="formalpara">The "What" of Access Control</h5>
+ To continue the analogy with grammatical terms, the "what" of a FreeIPA
ACI is the verb. This specifies the actual administrative operation that the subject, the
"who", is trying to perform. Such operations can target actual entries, such as
adding or deleting users, or they can target specific attributes of entries, such as
changing phone numbers for a user entry, or changing the member attributes of a group
entry.
</div><div class="para">
Most entry attributes are optional, and the operations against attributes can be
any of the following:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- <code class="command">Add</code> — allows the creation of
a new attribute, or new values for multi-valued attributes.
+ Add — allows the creation of a new attribute, or new values for multi-valued
attributes.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Delete</code> — allows the removal
of an attribute.
+ Delete — allows the removal of an attribute.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Read</code> — makes attributes
accessible.
+ Read — makes attributes accessible.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Write</code> — allows modification
of existing attributes.
+ Write — allows modification of existing attributes.
</div></li></ul></div>
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_Whom_of_Access_Control"><h5
class="formalpara">The "Whom" of Access Control</h5>
- The "whom" of an IPA ACI is the object, or <em
class="firstterm">target</em>, upon which the ACI acts. Targets can be
expressed in different ways:
+ </div><div class="formalpara"
id="The_IPA_Access_Control_Expression-The_Whom_of_Access_Control"><h5
class="formalpara">The "Whom" of Access Control</h5>
+ The "whom" of a FreeIPA ACI is the object, or <em
class="firstterm">target</em>, upon which the ACI acts. Targets can be
expressed in different ways:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
As a class of entries, for example: <code
class="classname">user</code>; <code
class="classname">group</code>; <code
class="classname">host</code>.
</div></li><li class="listitem"><div
class="para">
@@ -3880,9 +3842,9 @@ uri
ldap://ipaserver.ipadocs.org
As a set of entries selected by filter, for example: <em
class="parameter"><code>cn="filter"</code></em>.
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types">12.1.1.1.2. Directory
Server ACIs and IPA Access Control
Types</h5></div></div></div><div class="para">
- The following table summarizes the relationship between the different Directory
Server ACI components and the IPA access control types.
- </div><div class="table"
id="tabl-Enterprise_Identity_Management_Guide-Directory_Server_ACIs_and_IPA_Access_Control_Types-Summary_mapping_table_of_Directory_Server_ACI_component_types_to_IPA_access_control_types."><h6>Table 12.1. Summary
mapping table of Directory Server ACI component types to IPA access control
types.</h6><div class="table-contents"><table
summary="Summary mapping table of Directory Server ACI component types to IPA access
control types." border="1"><colgroup><col
align="left" width="25%" /><col align="left"
width="25%" /><col align="left" width="25%"
/><col align="left" width="25%"
/></colgroup><thead><tr><th align="left">
+ </div></div><div class="section"
id="Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types"><div
class="titlepage"><div><div><h5 class="title"
id="Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types">13.1.1.1.2. 389
Directory Server ACIs and FreeIPA Access Control
Types</h5></div></div></div><div class="para">
+ The following table summarizes the relationship between the different 389 Directory
Server ACI components and the FreeIPA access control types.
+ </div><div class="table"
id="tab.aci-mapping"><h6>Table 13.1. Mapping 389 Directory Server and
FreeIPA Access Control Types</h6><div
class="table-contents"><table summary="Mapping 389 Directory Server
and FreeIPA Access Control Types" border="1"><colgroup><col
align="left" width="25%" /><col align="left"
width="25%" /><col align="left" width="25%"
/><col align="left" width="25%"
/></colgroup><thead><tr><th align="left">
Type of Access Control
</th><th align="left">
Target
@@ -3901,7 +3863,7 @@ uri
ldap://ipaserver.ipadocs.org
Taskgroup.
</div>
<div class="para">
- (A taskgroup is a special internal entry developed as part of IPA to construct
the access control hierarchy. A taskgroup is a "container" that is granted
permission to perform specific tasks.)
+ (A taskgroup is a special internal entry developed as part of FreeIPA to
construct the access control hierarchy. A taskgroup is a "container" that is
granted permission to perform specific tasks.)
</div>
</td></tr><tr><td align="left">
@@ -3920,25 +3882,25 @@ uri
ldap://ipaserver.ipadocs.org
Write, Add, or Delete. Read is implied.
</td><td align="left">
A group of users, usually a group of administrative users.
- </td></tr></tbody></table></div></div><br
class="table-break" /></div></div></div></div><div
class="section" id="creating-roles"><div
class="titlepage"><div><div><h2 class="title"
id="creating-roles">12.2. Creating
Roles</h2></div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_an_IPA_Role-To_set_up_a_new_role"><h6>Procedure 12.1. To
set up a new role:</h6><ol class="1"><li
class="step"><div class="para">
- Add the new role:
- </div><pre class="screen"><code
class="command"># ipa role-add --desc="User Administrator"
useradmin</code>
+ </td></tr></tbody></table></div></div><br
class="table-break" /></div></div></div><div
class="section" id="creating-roles"><div
class="titlepage"><div><div><h3 class="title"
id="creating-roles">13.1.2. Creating
Roles</h3></div></div></div><div
class="orderedlist"><h6>To set up a new
role:</h6><ol><li class="listitem"><div
class="para">
+ Add the new role:
+ </div><pre class="screen"># ipa role-add --desc="User
Administrator" useradmin
------------------------
Added role "useradmin"
------------------------
Role name: useradmin
- Description: User Administrator</pre></li><li
class="step"><div class="para">
- Add the required privileges to the role:
- </div><pre class="screen"><code
class="command"># ipa role-add-privilege --privileges="User
Administrators" useradmin</code>
+ Description: User Administrator</pre></li><li
class="listitem"><div class="para">
+ Add the required privileges to the role:
+ </div><pre class="screen"># ipa role-add-privilege
--privileges="User Administrators" useradmin
Role name: useradmin
Description: User Administrator
Privileges: user administrators
----------------------------
Number of privileges added 1
----------------------------
-</pre></li><li class="step"><div
class="para">
- Add the required groups to the role. In this case, we are adding only a single
group, <code class="systemitem">useradmin</code>, which already
exists.
- </div><pre class="screen"><code
class="command"># ipa role-add-member --groups=useradmins
useradmin</code>
+</pre></li><li class="listitem"><div
class="para">
+ Add the required groups to the role. In this case, we are adding only a single
group, <code class="systemitem">useradmin</code>, which already
exists.
+ </div><pre class="screen"># ipa role-add-member
--groups=useradmins useradmin
Role name: useradmin
Description: User Administrator
Member groups: useradmins
@@ -3947,26 +3909,25 @@ uri
ldap://ipaserver.ipadocs.org
Number of members added 1
-------------------------
</pre></li></ol></div><div class="para">
- The result of this procedure is that any user in the <code
class="systemitem">useradmins</code> group can add, modify, and remove
users, change user passwords, add users to the default group, and unlock user accounts.
You can use the <code class="command">ipa privilege-show</code>
command to determine exactly which command set the user or group can access:
-<pre class="screen"><code class="command"># ipa
privilege-show 'user administrators'</code>
+ The result of this procedure is that any user in the <code
class="systemitem">useradmins</code> group can add, modify, and remove
users, change user passwords, add users to the default group, and unlock user accounts.
You can use the <code class="command">ipa privilege-show</code>
command to determine exactly which command set the user or group can access:
+<pre class="screen"># ipa privilege-show 'user administrators'
Privilege name: User Administrators
Description: User Administrators
Permissions: add users, change a user password, add user to default group, unlock user
accounts,
remove users, modify users
Granting privilege to roles: useradmin</pre>
- </div><div class="para">
- As the needs of your enterprise change, you may need to modify the roles that you have
established. For example, you may need to change the members of the role, or change the
privileges associated with the role. You can use the <code
class="command">ipa role-*</code> commands to perform these functions.
For example, to remove an existing privilege from a role, use the <code
class="command">ipa role-remove-privilege</code> command. To remove
members from a role, use the <code class="command">ipa
role-remove-member</code> command. Refer to the <code
class="command">ipa role help</code> pages for more information.
- </div><div class="para">
- You can use the <code class="command">ipa role-del</code>
command to delete IPA roles from your configuration. Bear in mind, however, that any
entities that rely on this role for access to IPA objects or to perform certain tasks will
no longer have that ability.
- </div></div><div class="section"
id="self-service"><div
class="titlepage"><div><div><h2 class="title"
id="self-service">12.3. Defining Self-Service
Settings</h2></div></div></div><div class="para">
- Self-service access control rules define the operations that an entity can perform on
itself. These rules are attribute based; that is, they define what attributes can be
modified for any particular entity. You can create self-service rules so that users can
manage their own addresses, keep their contact details current, change their passwords,
etc.
- </div><div class="para">
- Self-service rules are defined and managed by a number of sub-commands. Use the
<code class="command">ipa help selfservice</code> command to display
the list of available commands.
- </div><div class="para">
- The following example demonstrates how to add a new self-service rule that allows
users to maintain their own name details. Note that access control rules whose names
contain spaces or other special characters need to be quoted.
-<pre class="screen"><code class="command">$ ipa
selfservice-add "Users can manage their own name details" --permissions=write
\</code>
- <code
class="command">--attrs=givenname,displayname,title,initials</code>
+ </div><div class="para">
+ As the needs of your enterprise change, you may need to modify the roles that you
have established. For example, you may need to change the members of the role, or change
the privileges associated with the role. You can use the <code
class="command">ipa role-*</code> commands to perform these functions.
For example, to remove an existing privilege from a role, use the <code
class="command">ipa role-remove-privilege</code> command. To remove
members from a role, use the <code class="command">ipa
role-remove-member</code> command. Refer to the <code
class="command">ipa role help</code> pages for more information.
+ </div><div class="para">
+ You can use the <code class="command">ipa role-del</code>
command to delete FreeIPA roles from your configuration. Bear in mind, however, that any
entities that rely on this role for access to FreeIPA objects or to perform certain tasks
will no longer have that ability.
+ </div></div><div class="section"
id="self-service"><div
class="titlepage"><div><div><h3 class="title"
id="self-service">13.1.3. Defining Self-Service
Settings</h3></div></div></div><div class="para">
+ Self-service access control rules define the operations that an entity can perform on
itself. These rules are attribute based; that is, they define what attributes can be
modified for any particular entity. You can create self-service rules so that users can
manage their own addresses, keep their contact details current, change their passwords,
etc.
+ </div><div class="para">
+ Self-service rules are defined and managed by a number of sub-commands. Use the
<code class="command">ipa help selfservice</code> command to display
the list of available commands.
+ </div><div class="para">
+ The following example demonstrates how to add a new self-service rule that allows
users to maintain their own name details. Note that access control rules whose names
contain spaces or other special characters need to be quoted.
+<pre class="screen">$ ipa selfservice-add "Users can manage their
own name details" --permissions=write --attrs=givenname,displayname,title,initials
-----------------------------------------------------------
Added selfservice "Users can manage their own name details"
-----------------------------------------------------------
@@ -3974,191 +3935,113 @@ Added selfservice "Users can manage their own name
details"
Permissions: write
Attributes: givenname, displayname, title, initials</pre>
- </div><div class="para">
- You can use the <code class="command">ipa
selfservice-show</code> command to display the newly-created rule.
- </div><div class="para">
- You can use the <code class="command">ipa selfservice-mod</code>
command to manage your self-service rules. For example, you can add or remove various
attributes from any of the defined rules, or change the permissions. For example, you can
add telephone contact details to the rule we created in the previous example:
-<pre class="screen"><code class="command">$ ipa
selfservice-mod "Users can manage their own name details" \</code>
- <code
class="command">--attrs=givenname,displayname,title,initials,homephone,mobile,telephonenumber</code>
+ </div><div class="para">
+ You can use the <code class="command">ipa
selfservice-show</code> command to display the newly-created rule.
+ </div><div class="para">
+ You can use the <code class="command">ipa
selfservice-mod</code> command to manage your self-service rules. For example, you
can add or remove various attributes from any of the defined rules, or change the
permissions. For example, you can add telephone contact details to the rule we created in
the previous example:
+<pre class="screen">$ ipa selfservice-mod "Users can manage their
own name details"
--attrs=givenname,displayname,title,initials,homephone,mobile,telephonenumber
--------------------------------------------------------------
Modified selfservice "Users can manage their own name details"
--------------------------------------------------------------
- Self-service name: Users can manage their own name details
- Permissions: write
- Attributes: givenname, displayname, title, initials, homephone, mobile,
telephonenumber</pre>
-
- </div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
- You need to include all of the required attributes when you modify a self-service
rule, including existing ones.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings">12.4. Specifying
Default User Settings</h2></div></div></div><div
class="para">
- You can configure the default settings for IPA users to suit your deployment. For
example, you can specify the maximum username length, the default path to the <code
class="filename">/home</code> directory, the default shell, and other
attributes.
- </div><div class="para">
- IPA supports the following User Settings:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- <span class="guilabel"><strong>Maximum Username
Length</strong></span> (<span
class="property">ipaMaxUsernameLength</span>): The maximum length of
any username. The default value is eight.
- </div></li><li class="listitem"><div
class="para">
- <span class="guilabel"><strong>Root for Home
Directories</strong></span> (<span
class="property">ipaHomesRootDir</span>): The root directory for all
home directories. The default value is <code
class="filename">/home</code>
- </div></li><li class="listitem"><div
class="para">
- <span class="guilabel"><strong>Default
Shell</strong></span> (<span
class="property">ipaDefaultLoginShell</span>): The default shell for
all user accounts. The default value is <code
class="command">/bin/sh</code>
- </div></li><li class="listitem"><div
class="para">
- <span class="guilabel"><strong>Default User
Group</strong></span> (<span
class="property">ipaDefaultPrimaryGroup</span>): The default group to
which all newly created accounts are added. The default value is <code
class="systemitem">ipausers</code>, which is automatically created
during the IPA server installation process.
- </div></li><li class="listitem"><div
class="para">
- <span class="guilabel"><strong>Default E-mail
Domain</strong></span> (<span
class="property">ipaDefaultEmailDomain</span>): The default domain used
to create email addresses for all newly created accounts. The default is the domain to
which the IPA server belongs.
- </div></li></ul></div><div class="para">
- Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. The following is an example of how to set the
maximum username length to 64 characters, and the default home directory to <code
class="filename">/users/home</code>:
- </div><pre class="screen"><code class="command">#
ipa config-mod --maxusername=64 --homedirectory=/users/home</code>
-Max username length: 64
-Home directory base: /users/home
-Default shell: /bin/sh
-Default users group: ipausers
-Default e-mail domain:
mydomain.net
-Search time limit: 2
-Search size limit: 100
-User search fields: uid,givenname,sn,telephonenumber,ou,title
-Group search fields: cn,description
-Migration mode: FALSE
-Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
- Refer to the <code class="command">ipa help config</code> page
for more information.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The default root directory for all home directories is <code
class="filename">/home</code>, but it is the responsibility of the
system administrator to ensure that whatever value is specified for this attribute is
actually available.
- </div><div class="para">
- Fedora includes a <code class="systemitem">PAM</code> module
called <code class="systemitem module">pam_mkhomedir</code> that can
automatically create a home directory if one does not exist for the user authenticating
against the system. IPA does not force the use of this module because it may try to create
home directories even when the shared storage is not available. It is the responsibility
of the system administrator to activate this module on the clients if needed.
- </div></div></div></div><div class="section"
id="search-limits"><div
class="titlepage"><div><div><h2 class="title"
id="search-limits">12.5. Setting Default Search
Limits</h2></div></div></div><div class="para">
- You can set limits on the number of records returned when performing various queries,
for example when you run the <code
class="command">ipa user-find</code> command. These limits are
specified by the <em class="parameter"><code>Search size
limit</code></em> attribute in the default IPA configuration. The default
value for this attribute is 100.
- </div><div class="para">
- To view the current configuration, run the <code
class="command"># ipa config-show</code> command. Refer to the <code
class="command">ipa help config</code> help page for more information.
- </div><div class="para">
- The following is a sample IPA configuration:
- </div><pre class="screen">[ming@myserver ~]$ ipa config-show
-Max username length: 32
-Home directory base: /home
-Default users group: ipausers
-Default e-mail domain:
mydomain.net
-Search time limit: 2
-Search size limit: 20
-User search fields: uid,givenname,sn,telephonenumber,ou,title
-Group search fields: cn,description
-Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
- You can use the <code class="command">ipa config-mod</code>
command to specify a suitable value for the <em
class="parameter"><code>Search size limit</code></em>
attribute. For example, if you set this value to 10, the <code
class="command">ipa user-find</code> command will only return 10
entries, even if many more entries exist. If you set this value to 0 (zero) or −1, it
means that there are no restrictions on the number of entries that can be returned.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_Limits_for_Search_Results-Setting_search_size_limits"><h6>Procedure 12.2. Setting
search size limits</h6><ul><li class="step"><div
class="para">
- To set the <em class="parameter"><code>Search size
limit</code></em> attribute to 50, run the following command:
-<pre class="programlisting"><code class="command">#
ipa config-mod --searchrecordslimit=50</code></pre>
-
- </div></li></ul></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
- You need to be aware of the potential performance impact of setting the search size
limit too high. You need to determine a suitable balance between the benefits of always
returning all entries matched by a search, and the performance gained by implementing a
search filter.
- </div><div class="para">
- Note also that if the size limit is set too high or removed completely it might
affect the behavior of UI screens.
- </div></div></div><div class="para">
- You can configure various aspects of the IPA search functionality to suit your
deployment. For example, you can restrict the number of fields upon which a user can base
a search, or limit the number of records returned for any particular search.
- </div><div class="para">
- IPA supports the following search configuration attributes:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- <em class="parameter"><code>Search Time
Limit</code></em>: The maximum time, in seconds, that a search will run before
failing.
- </div></li><li class="listitem"><div
class="para">
- <em class="parameter"><code>Search Records
Limit</code></em>: The maximum number of records that a search can return. Set
this value to zero (0) to specify no limit. The directory server limit (the default value
is 2000) still applies.
- </div></li><li class="listitem"><div
class="para">
- <em class="parameter"><code>User Search
Fields</code></em>: For a user search, specifies the fields to search for the
values entered by a user.
- </div></li><li class="listitem"><div
class="para">
- <em class="parameter"><code>Group Search
Fields</code></em>: For a group search, specifies the fields to search for the
values entered by a user.
- </div></li></ul></div><div class="para">
- Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. For example, to specify a search time limit
of 60 seconds, use the following command:
-<pre class="screen"><code class="command"># ipa
config-mod --searchtimelimit=60</code></pre>
- Refer to the <code class="command">ipa help config</code> page
for more information.
- </div><div class="para">
- If you add attributes to the user or group search fields, you should also create a new
<code class="systemitem">LDAP</code> index for those attributes to
avoid performance degradation. Conversely, the existence of too many indexes can impact
write performance, so you need to balance one against the other.
- </div><div class="para">
- Refer to <a
href="http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_...
Indexes</a> in the <em class="citetitle">Directory Server
Administration Guide</em> for information on creating indexes.
- </div></div><div class="section"
id="disabling-anon-binds"><div
class="titlepage"><div><div><h2 class="title"
id="disabling-anon-binds">12.6. Disabling Anonymous
Binds</h2></div></div></div><div class="para">
- Even though the XML-RPC and WebUI always require authentication, the default IPA
configuration allows anonymous binds to the LDAP port by anyone in the same domain as the
IPA server, and consequent retrieval of a range of data, including user, group, netgroup,
host, host group, and service records. This is generally considered insecure, and some RFC
standards require that it be disabled to achieve compliance. With anonymous binds
disabled, all connections to the directory server need to provide a valid identity.
+Self-service name: Users can manage their own name details
+Permissions: write
+Attributes: givenname, displayname, title, initials, homephone, mobile,
telephonenumber</pre>
+
+ </div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
+ You need to include all of the required attributes when you modify a self-service
rule, including existing ones.
+ </div></div></div></div></div><div
class="section" id="disabling-anon-binds"><div
class="titlepage"><div><div><h2 class="title"
id="disabling-anon-binds">13.2. Disabling Anonymous
Binds</h2></div></div></div><div class="para">
+ Even though the XML-RPC and WebUI always require authentication, the default FreeIPA
configuration allows anonymous binds to the LDAP port by anyone in the same domain as the
FreeIPA server, and consequent retrieval of a range of data, including user, group,
netgroup, host, host group, and service records. This is generally considered insecure,
and some RFC standards require that it be disabled to achieve compliance. With anonymous
binds disabled, all connections to the directory server need to provide a valid identity.
</div><div class="para">
To disable anonymous binds, perform this LDAP modification:
-<pre class="screen"><code class="command"># ldapmodify -x
-D "cn=Directory Manager" -W</code>
+<pre class="screen"># ldapmodify -x -D "cn=Directory Manager"
-W
Enter LDAP Password:
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: off
-<code class="command"># service dirsrv restart</code></pre>
+# service dirsrv restart</pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes">12.7. Implementing
Unique UID and GID Attributes</h2></div></div></div><div
class="para">
- An IPA deployment needs to handle the dual constraints of generating random UID and
GID values, while ensuring that replicas never generate the same UID or GID value. It is
also important to minimize the chance that any two deployments of IPA have overlapping
ranges.
+ </div></div><div class="section"
id="Managing-Unique_UID_and_GID_Attributes"><div
class="titlepage"><div><div><h2 class="title"
id="Managing-Unique_UID_and_GID_Attributes">13.3. Managing Unique UID and GID
Number Assignments</h2></div></div></div><div
class="para">
+ A FreeIPA server must generate random UID and GID values and simultaneously ensure
that replicas never generate the same UID or GID value. The need for unique UID and GID
numbers might even cross FreeIPA domains, if a single organization has multiple disparate
domains.
</div><div class="para">
- The system administrator—or whoever is performing the IPA installation—can impact the
logic that deals with these constraints only once, when the system is being installed.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1. Assigning
UIDs and GIDs</h3></div></div></div><div
class="para">
- To assign UIDs and GIDs, IPA uses the directory server DNA plug-in. This plug-in is
configured with a range of IDs and will assign a new ID whenever an entry requiring the
uidNumber or gidNumber attributes is added to the system.
+ The UID and GID numbers are divided into <span
class="emphasis"><em>ranges</em></span>. By keeping
separate numeric ranges for individual servers and replicas, the chances are minimal that
any numbers issued by one server or replica will duplicate those from another. Ranges are
updated and shared intelligently between servers and replicas through the Dynamic Numeric
Assignment (DNA) Plug-in, as part of the backend 389 Directory Server instance for the
domain. The same range is used for user IDs (<em
class="parameter"><code>uidNumber</code></em>) and group
IDs (<em class="parameter"><code>gidNumber</code></em>).
A user and a group may have the same ID, but since the ID is set in different attributes,
there is no conflict. Using the same ID number for both a user and a group also allows an
administrator to configure user private groups, where a unique system group is created for
each user and the ID number is the same for both the user and the group.
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a user is created interactively or without specifying a UID or GID number, then
the user account is created with an ID number that is next available in the server or
replica range. This means that a user always has a unique number for its UID number and,
if configured, for its private group.
</div><div class="para">
- For simplicity, and to allow configuring User Private Groups (UPGs) at any time, IPA
uses a single range of UIDs and GIDs, instead of using two separate ranges. When UPGs are
active, the private group gidNumber is numerically identical to the uidNumber of its
user.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges">12.7.1.1. Selecting
ID Ranges</h4></div></div></div><div
class="para">
- When the first IPA server is installed, a range of 200,000 IDs is randomly selected
between the values 1MiB and 2GiB, approximately. There are 10,000 possible ranges. The
selection of a random range provides a high probability of non-conflicting IDs if, at a
later stage, a trust relationship or merge between two separate installations needs to
occur.
- </div><div class="para">
- IDs are assigned in order by a single master, but ID ranges can be split and
distributed between replicas. When a replica is installed it is configured with an invalid
depleted range, and a place in the shared tree where it can expose information about the
ranges it manages. The first time an allocation is needed, the replica will notice it has
no more IDs available and will contact one of the other available masters (typically the
one with the greatest available range). A special extended operation is performed to split
the range in two, so that the original master and the replica will each receive half of
the previously available range for their use. When a range comes close to depletion (by
default when less than 100 IDs are available), a new range is requested.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges">12.7.1.2. Adding
New Ranges</h4></div></div></div><div
class="para">
- If the domain-wide range is close to depletion, the system administrator needs to
manually select and add a new range to one of the masters. All other replicas will manage
sharing the range among them as necessary.
- </div><div class="para">
- To add a new range, the Directory Manager must connect to the LDAP server and add
the new range as a dash-separated minimum/maximum value pair in the <em
class="parameter"><code>dnaNextRange</code></em> attribute
in the DNA configuration entry for the ranges in question. For example, the following
command adds a new range of 100k values:
- </div><pre class="screen"><code
class="command">% ldapmodify -x -D "cn=Directory Manager"
-W</code>
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
user entry, the server does not validate that the <em
class="parameter"><code>uidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries. The same is true for group entries: a duplicate <em
class="parameter"><code>gidNumber</code></em> can be
manually assigned to the entry.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in a
search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa user-find
--all</code>.
+ </div></div></div><div class="section"
id="id-ranges-at-install"><div
class="titlepage"><div><div><h3 class="title"
id="id-ranges-at-install">13.3.1. About ID Range Assignments During
Installation</h3></div></div></div><div
class="para">
+ The FreeIPA administrator can initially define a range during server installation,
using the <code class="option">--idstart</code> and <code
class="option">--idmax</code> options with <code
class="command">ipa-server-install</code>. These options are not
required, so the setup script can assign random ranges during installation.
+ </div><div class="para">
+ If no range is set manually when the first FreeIPA server is installed, a range of
200,000 IDs is randomly selected. There are 10,000 possible ranges. Selecting a random
range from that number provides a high probability of non-conflicting IDs if two separate
FreeIPA domains are ever merged in the future.
+ </div><div class="para">
+ With a single FreeIPA server, IDs are assigned to entries in order through the range.
With replicas, the initial server ID range is split and distributed.
+ </div><div class="para">
+ When a replica is installed, it is configured with an invalid range. It also has a
directory entry (that is shared among replicas) that instructs the replica where it can
request a valid range. When the replica starts, or as its current range is depleted so
that less than 100 IDs are available, it can contact one of the available servers for a
new range allotment. A special extended operation splits the range in two, so that the
original server and the replica each have half of the available range.
+ </div></div><div class="section"
id="Assigning_UIDs_and_GIDs-Adding_New_Ranges"><div
class="titlepage"><div><div><h3 class="title"
id="Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2. Adding New
Ranges</h3></div></div></div><div class="para">
+ If the range for the entire domain is close to depletion, a new range can be manually
selected and assigned to one of the master servers. All replicas then request ID ranges
from the master as necessary.
+ </div><div class="para">
+ The changes to the range are done by editing the 389 Directory Server configuration
to change the DNA Plug-in instance. The range is defined in the <em
class="parameter"><code>dnaNextRange</code></em> parameter.
For example:
+ </div><pre class="screen">ldapmodify -x -D "cn=Directory
Manager" -W -h
server.example.com -p 389
Enter LDAP Password: *******
dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config
changetype: modify
add: dnaNextRange
-dnaNextRange: 123400000-123500000</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- This command only adds the specified range of values; it does not check that the
values in that range are actually available. This check will be performed when an attempt
is made to allocate those values. If, for example, you added a range that contained mostly
values that were already allocated, time would be lost as the system cycled through
searching for unallocated values, and then finally failing if none were available.
- </div></div></div></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities">12.8. Configuring
Certificates and Certificate
Authorities</h2></div></div></div><div
class="para">
- IPA creates a self-signed Certificate Authority (<abbr
class="abbrev">CA</abbr>) during the installation process. If you have
your own or a preferred <abbr class="abbrev">CA</abbr>, however, and
want to use your own certificates, IPA provides the necessary tools to import certificates
for use by Directory Server and the <code
class="systemitem">HTTP</code> server. While not a prerequisite for the
correct operation of IPA, it is recommended that you save an <acronym
class="acronym">ASCII</acronym> copy of your <abbr
class="abbrev">CA</abbr> certificate as <code
class="filename">/usr/share/ipa/html/ca.crt</code> to ensure that users
download the correct certificate.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1. Installing
Your Own Certificate</h3></div></div></div><div
class="para">
- Use the <code class="command">ipa-server-certinstall</code>
command to install your own certificate. You can install the certificate for use by
Directory Server, <code class="systemitem">HTTP</code> Server, or
both.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Installing_Your_Own_Certificate-To_install_the_certificate_for_use_by_Directory_Server"><h5
class="formalpara">To install the certificate for use by Directory
Server:</h5>
- <code class="command"> # /usr/sbin/ipa-server-certinstall -d
/path/to/pkcs12.p12 </code>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2. Using
Your Own Certificate with Firefox</h3></div></div></div><div
class="para">
- To continue using the <span
class="application"><strong>Firefox</strong></span>
auto-configuration feature, you need an object-signing certificate, and you need to
regenerate the <code
class="filename">/usr/share/ipa/html/configure.jar</code> file.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The following procedure assumes that the signing certificate is provided as a
PKCS#12 file.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_Your_Own_Certificate_with_Firefox-To_use_your_own_certificate_with_Firefox"><h6>Procedure 12.3. To
use your own certificate with Firefox:</h6><ol class="1"><li
class="step"><div class="para">
+dnaNextRange: 123400000-123500000</pre><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ This command only adds the specified range of values; it does not check that the
values in that range are actually available. This check is performed when an attempt is
made to allocate those values. If a range is added that contains mostly values that were
already allocated, the system will cycle through the entire range searching for
unallocated values, and then the operation ultimately fails if none are available.
+ </div></div></div></div></div><div
class="section"
id="Configuring_Certificates_and_Certificate_Authorities"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_Certificates_and_Certificate_Authorities">13.4. Configuring
Certificates and Certificate
Authorities</h2></div></div></div><div
class="para">
+ FreeIPA creates a self-signed Certificate Authority (<abbr
class="abbrev">CA</abbr>) during the installation process. If you have
your own or a preferred <abbr class="abbrev">CA</abbr>, however, and
want to use your own certificates, FreeIPA provides the necessary tools to import
certificates for use by 389 Directory Server and the <code
class="systemitem">HTTP</code> server. While not a prerequisite for the
correct operation of FreeIPA, it is recommended that you save an <acronym
class="acronym">ASCII</acronym> copy of your <abbr
class="abbrev">CA</abbr> certificate as <code
class="filename">/usr/share/ipa/html/ca.crt</code> to ensure that users
download the correct certificate.
+ </div><div class="section"
id="Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1. Installing
Your Own Certificate</h3></div></div></div><div
class="para">
+ Use the <code class="command">ipa-server-certinstall</code>
command to install your own certificate. You can install the certificate for use by 389
Directory Server, <code class="systemitem">HTTP</code> Server, or
both.
+ </div><pre class="screen"># /usr/sbin/ipa-server-certinstall -d
/path/to/pkcs12.p12</pre></div><div class="section"
id="Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">13.4.2. Using
Your Own Certificate with Firefox</h3></div></div></div><div
class="para">
+ To continue using the Firefox auto-configuration feature, you need an object-signing
certificate, and you need to regenerate the <code
class="filename">/usr/share/ipa/html/configure.jar</code> file.
+ </div><div class="orderedlist"><h6>To use your own
certificate with Firefox:</h6><ol><li class="listitem"><div
class="para">
Create a suitable directory and then create the new certificate database in that
directory.
-<pre class="screen"><code class="command"># mkdir
/tmp/signdb</code>
-<code class="command"># certutil -N -d
/tmp/signdb</code></pre>
+<pre class="screen"># mkdir /tmp/signdb
+# certutil -N -d /tmp/signdb</pre>
- </div></li><li class="step"><div
class="para">
- Import the signing certificate into that same directory.
-<pre class="screen"><code class="command"># pk12util -i
/path/to/pkcs12.p12 -d /tmp/signdb</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Import the PKCS #12 file for the signing certificate into that same directory.
+<pre class="screen"># pk12util -i /path/to/pkcs12.p12 -d
/tmp/signdb</pre>
- </div></li><li class="step"><div
class="para">
- Make a temporary signing directory, and copy the IPA javascript file to that
directory.
-<pre class="screen"><code class="command"># mkdir
/tmp/sign</code>
-<code class="command"># cp /usr/share/ipa/html/preferences.html
/tmp/sign</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Make a temporary signing directory, and copy the FreeIPA javascript file to that
directory.
+<pre class="screen"># mkdir /tmp/sign
+# cp /usr/share/ipa/html/preferences.html /tmp/sign</pre>
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Use the certificate you created earlier to sign the javascript file and to
regenerate the <code class="filename">configure.jar</code> file.
-<pre class="screen"><code class="command"># signtool -d
/tmp/signdb -k Signing_cert_nickname \</code>
-<code class="command">-Z /usr/share/ipa/html/configure.jar -e
.html</code></pre>
+<pre class="screen"># signtool -d /tmp/signdb -k Signing_cert_nickname -Z
/usr/share/ipa/html/configure.jar -e .html</pre>
- </div></li></ol></div></div><div
class="section" id="Using_OCSP"><div
class="titlepage"><div><div><h3 class="title"
id="Using_OCSP">12.8.3. Using
OCSP</h3></div></div></div><div class="para">
- <code class="systemitem">The Online Certificate Status Protocol
(OCSP)</code> is natively provided by the CA embedded into FreeIPA. This is so that
any client that supports it can use OCSP for certificate validity checks.
+ </div></li></ol></div></div><div
class="section" id="Using_OCSP"><div
class="titlepage"><div><div><h3 class="title"
id="Using_OCSP">13.4.3. Using
OCSP</h3></div></div></div><div class="para">
+ The Online Certificate Status Protocol (OCSP) is natively provided by the CA embedded
into FreeIPA. This is so that any client that supports it can use OCSP for certificate
validity checks.
</div><div class="para">
The OCSP responder URL is encoded into the certificates issued by FreeIPA. In order
for that responder to be available, port 9180 needs to be open in the firewall. The OCSP
URL uses the following format:
<pre class="screen">http://ipa.example.com:9180/ca/ocsp</pre>
</div><div class="para">
- For more information on OCSP, refer to the RFC at <a
href="http://www.ietf.org/rfc/rfc2560.txt">http://www.ietf.o...
- </div></div></div><div class="section"
id="ipa-apache"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-apache">12.9. Setting an IPA Server as an Apache Virtual
Host</h2></div></div></div><div class="para">
- If you have a standard Apache instance running on port 80, you can configure IPA to
run on a secondary port, for example, on port 8089. You should be aware, however, that in
this configuration, IPA does not use <code
class="systemitem">SSL</code>; all requests will use standard <code
class="systemitem">HTTP</code>.
+ For more information on OCSP, refer to the RFC at <a
href="http://www.ietf.org/rfc/rfc2560.txt">http://www.ietf.o...;.
+ </div></div></div><div class="section"
id="ipa-apache"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-apache">13.5. Setting a FreeIPA Server as an Apache Virtual
Host</h2></div></div></div><div class="para">
+ If you have a standard Apache instance running on port 80, you can configure FreeIPA
to run on a secondary port, for example, on port 8089. You should be aware, however, that
in this configuration, FreeIPA does not use <code
class="systemitem">SSL</code>; all requests will use standard <code
class="systemitem">HTTP</code>.
</div><div class="para">
- The following procedure assumes that IPA is configured to run on port 80, and that you
want to move it to port 8089.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_IPA_to_run_as_an_Apache_Virtual_Host-To_configure_IPA_to_run_on_port_8089"><h6>Procedure 12.4. To
configure IPA to run on port 8089:</h6><ol class="1"><li
class="step"><div class="para">
+ The following procedure assumes that FreeIPA is configured to run on port 80, and that
you want to move it to port 8089.
+ </div><div class="orderedlist"><h6>To configure FreeIPA to
run on port 8089:</h6><ol><li class="listitem"><div
class="para">
Log in as the <code class="systemitem">root</code> user.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file. Add the
following three lines to the beginning of the file:
</div><pre class="programlisting">Listen 8089
NameVirtualHost *:8089
<VirtualHost *:8089>
-</pre></li><li class="step"><div
class="para">
+</pre></li><li class="listitem"><div
class="para">
Add the following line to the end of the file:
</div><pre class="programlisting"></VirtualHost>
</pre><div class="para">
- This wraps the entire IPA configuration in a virtual host, and ensures that Apache
is listening to that port.
+ This wraps the entire FreeIPA configuration in a virtual host, and ensures that
Apache is listening to that port.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot use port 8080. This port is used by the <code
class="systemitem">ipa_webgui</code> service.
- </div></div></div></li><li
class="step"><div class="para">
+ </div></div></div></li><li
class="listitem"><div class="para">
Comment out the following rewrite rules from the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file:
</div><pre
class="programlisting">----------------------------------------------------------------------
# Redirect to the fully-qualified hostname. Not redirecting to secure
@@ -4172,31 +4055,31 @@ RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{REQUEST_URI} !^/(errors|config|favicon.ico)
RewriteRule ^/(.*)
https://host.foo.com/$1 [L,R=301,NC]
---------------------------------------------------------------------
-</pre></li><li class="step"><div
class="para">
+</pre></li><li class="listitem"><div
class="para">
Reload the <code class="systemitem">httpd</code> service.
</div><div class="para">
-<pre class="screen"><code class="command"># service httpd
reload</code></pre>
+<pre class="screen"># service httpd reload</pre>
</div></li></ol></div><div class="para">
- This configures IPA to run on port 8089, leaving port 80 free for your normal web
site.
- </div></div><div class="section"
id="ipa-cluster"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-cluster">12.10. Using IPA in a
Cluster</h2></div></div></div><div class="para">
- The IPA server currently does not specifically handle the case of a service running in
a cluster. That is, the IPA server is not <em class="firstterm">cluster
aware</em>. It is possible to configure a clustered service to be part of IPA,
although a certain amount of manual configuration is required. This involves sharing and
synchronizing Kerberos keys across all of the participating hosts, and also configuring
services running on the hosts to respond to whatever names the clients want to use.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1. Configuring
Kerberos Credentials for a Clustered
Environment</h3></div></div></div><div
class="para">
+ This configures FreeIPA to run on port 8089, leaving port 80 free for your normal web
site.
+ </div></div><div class="section"
id="ipa-cluster"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-cluster">13.6. Using FreeIPA in a
Cluster</h2></div></div></div><div class="para">
+ The FreeIPA server currently does not specifically handle the case of a service
running in a cluster. That is, the FreeIPA server is not <em
class="firstterm">cluster aware</em>. It is possible to configure a
clustered service to be part of FreeIPA, although a certain amount of manual configuration
is required. This involves sharing and synchronizing Kerberos keys across all of the
participating hosts, and also configuring services running on the hosts to respond to
whatever names the clients want to use.
+ </div><div class="section"
id="Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1. Configuring
Kerberos Credentials for a Clustered
Environment</h3></div></div></div><div
class="para">
Use the following procedure to set up the Kerberos credentials for an environment
where your managed host is a cluster of nodes.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><h6>Procedure 12.5. Configuring
Kerberos Credentials for a Clustered Environment</h6><ol
class="1"><li class="step"><div
class="para">
- Enroll all of the hosts in the IPA domain, and collect any keytabs that have been
set up. At a minimum, this is <code
class="filename">/etc/krb5.keytab</code>, although additional services
may have their keys in other files.
- </div></li><li class="step"><div
class="para">
+ </div><div class="orderedlist"><h6>Configuring Kerberos
Credentials for a Clustered Environment</h6><ol><li
class="listitem"><div class="para">
+ Enroll all of the hosts in the FreeIPA domain, and collect any keytabs that have
been set up. At a minimum, this is <code
class="filename">/etc/krb5.keytab</code>, although additional services
may have their keys in other files.
+ </div></li><li class="listitem"><div
class="para">
Use the <code class="command">ktutil</code> command to
produce a single keytab file that contains the contents of all of the keytab files.
- </div><ol class="a"><li class="step"><div
class="para">
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
For each file, use the <code class="command">rkt</code>
command to read the keys from that file.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Use the <code class="command">wkt</code> command to write
all of the keys which have been read to a new keytab file.
- </div></li></ol></li><li
class="step"><div class="para">
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
Replace the keytab files on each host with the newly-created keytab file.
</div></li></ol></div><div class="para">
Each host in this cluster should now be able to impersonate any other host.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration">12.10.1.1. Service-specific
Configuration</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration">13.6.1.1. Service-specific
Configuration</h4></div></div></div><div
class="para">
Additional service-specific configuration may be required if cluster members do not
reset their hostnames when they take over for a failed service.
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
For <code class="systemitem">sshd</code>, set <em
class="parameter"><code>GSSAPIStrictAcceptorCheck
no</code></em> in <code
class="filename">/etc/ssh/sshd_config</code>
@@ -4204,103 +4087,813 @@ RewriteRule ^/(.*)
https://host.foo.com/$1
[L,R=301,NC]
For <code class="systemitem">mod_auth_kerb</code>, set
<em class="parameter"><code>KrbServiceName
Any</code></em> in <code
class="filename">/etc/httpd/conf.d/auth_kerb.conf</code>
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration">12.10.1.2. SSL
Server Configuration</h4></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration">13.6.1.2. SSL
Server Configuration</h4></div></div></div><div
class="para">
For SSL servers, it is important that the subject name or a <em
class="parameter"><code>subjectAlternativeName</code></em>
value for the server's certificate look correct when a client connects to the
clustered item. The simplest way to do this is to keep the private key and certificate
synchronized across all of the hosts, but it is better to share the private key if
possible. Ensuring that certificates issued to each cluster member contain <em
class="parameter"><code>subjectAlternativeName</code></em>
values naming all of the cluster members should satisfy any client connection
requirements.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2. Using
the Same Service Principal for Multiple
Services</h3></div></div></div><div class="para">
- One aspect of applying IPA in a cluster use case is using the same service principal
for multiple services, spread across different machines. This is a simple procedure and
could be implemented as follows:
+ </div></div></div><div class="section"
id="Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services"><div
class="titlepage"><div><div><h3 class="title"
id="Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2. Using
the Same Service Principal for Multiple
Services</h3></div></div></div><div class="para">
+ One aspect of applying FreeIPA in a cluster use case is using the same service
principal for multiple services, spread across different machines. This is a simple
procedure and could be implemented as follows:
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
Retrieve a service principal in the normal way, using the <code
class="command">ipa-getkeytab</code> command, or use the keytab that is
set up when the host joins the realm. That is, by using <code
class="command">ipa-join</code>, which creates or updates the <code
class="filename">/etc/krb5.keytab</code> file with a host/principal.
</div></li><li class="listitem"><div
class="para">
When you have the principal in a keytab on the system, you can direct multiple
servers or services to use the same file, or you can copy the file to discrete locations
as required.
</div></li></ol></div>
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">12.11. Creating
DNS Entries for FreeIPA Replicas</h2></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">13.7. Creating
DNS Entries for FreeIPA Replicas</h2></div></div></div><div
class="para">
You can use the <code class="option">--ip-address</code> option
with the <code class="command">ipa-replica-prepare</code> command to
pre-create DNS entries for a replica. If you include this option, FreeIPA will add the A
and PTR records for the replica to the DNS. For example:
-<pre class="screen"><code class="command">$
ipa-replica-prepare
master2.example.com --ip-address 192.168.1.2</code></pre>
+<pre class="screen">$ ipa-replica-prepare
master2.example.com
--ip-address 192.168.1.2</pre>
- </div></div><div class="section"
id="promoting-replica"><div
class="titlepage"><div><div><h2 class="title"
id="promoting-replica">12.12. Promoting a Read-Only Replica to an IPA
Server</h2></div></div></div><div class="para">
+ </div></div><div class="section"
id="promoting-replica"><div
class="titlepage"><div><div><h2 class="title"
id="promoting-replica">13.8. Promoting a Read-Only Replica to a FreeIPA
Server</h2></div></div></div><div class="para">
The only difference between a replica and the master server is that the master owns
the self-signed CA. If you copy the appropriate files from the master to the replica,
import the CA into the replica directory server, and delete the existing replication
agreements, that replica will then appear as a master server.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
If you install with the <code class="option">--selfsign</code>
option, follow this procedure if you want to promote a replica to a master. This is
because the private key for the self-signed CA is stored in the Apache database (<code
class="filename">/etc/httpd/alias</code>). The private key for a Dogtag
Certificate System CA is stored in its own security database.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Promoting_Replicas_to_Function_as_Master_Servers-To_promote_a_replica_to_a_master_server"><h6>Procedure 12.6. To
promote a replica to a master server:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></div></div><div
class="orderedlist"><h6>To promote a replica to a master
server:</h6><ol><li class="listitem"><div
class="para">
Copy the <code
class="filename">/var/lib/ipa/ca_serialno</code> file from the master
to the replica.
- </div></li><li class="step"><div
class="para">
- Import the CA into the replica DS NSS database, as follows:
+ </div></li><li class="listitem"><div
class="para">
+ Import the CA into the replica 389 Directory Server NSS database, as follows:
<pre class="screen"># cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .
</pre>
</div><div class="para">
The password on the <code class="filename">PKCS#12</code> file
is stored as <code
class="filename">/etc/dirsrv/slapd-REALM/pwdfile.txt</code> on the
original server.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Delete the existing replication agreements, as follows:
<pre class="screen"># ipa-replica-manage del
master.example.com
</pre>
</div></li></ol></div><div class="para">
- You now have two identical IPA servers, neither of which know about the other. You can
shut down the old master and bring up the new machine (if you are introducing a new
replica into your network). Create a replica file on the new master and install it on the
new machine.
- </div></div><div class="section"
id="logging"><div
class="titlepage"><div><div><h2 class="title"
id="logging">12.13. IPA Server
Logging</h2></div></div></div><div class="para">
- If you are using the IPA command-line tools or the WebUI to manage IPA data then you
should refer to the following sections to help troubleshoot any problems.
+ You now have two identical FreeIPA servers, neither of which know about the other. You
can shut down the old master and bring up the new machine (if you are introducing a new
replica into your network). Create a replica file on the new master and install it on the
new machine.
+ </div></div><div class="section"
id="logging"><div
class="titlepage"><div><div><h2 class="title"
id="logging">13.9. FreeIPA Server
Logging</h2></div></div></div><div class="para">
+ If you are using the FreeIPA command-line tools or the WebUI to manage FreeIPA data
then you should refer to the following sections to help troubleshoot any problems.
</div><div class="para">
You should first check the <code
class="filename">/var/log/httpd/error_log</code> file. This may contain
more information on the error and/or a python stacktrace.
</div><div class="para">
To see the LDAP queries that are being made by the framework you can inspect the
<code class="filename">/var/log/dirsrv/slapd-INSTANCE/access</code>
file. Note that this file is buffered and so it only writes to disk about every 30
seconds.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Server-Increasing_Server_Debugging_Output"><h5
class="formalpara">Increasing Server Debugging Output</h5>
+ </div><div class="formalpara"
id="Server-Increasing_Server_Debugging_Output"><h5
class="formalpara">Increasing Server Debugging Output</h5>
To increase the server debugging output you can create the <code
class="filename">/etc/ipa/server.conf</code> file and include the
following entry:
<pre class="programlisting">[global]
debug=True</pre>
You need to restart the <code class="systemitem">httpd</code>
daemon for this change to take effect.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Server-Increasing_Client_Debugging_Output"><h5
class="formalpara">Increasing Client Debugging Output</h5>
+ </div><div class="formalpara"
id="Server-Increasing_Client_Debugging_Output"><h5
class="formalpara">Increasing Client Debugging Output</h5>
You can increase debugging output on the client with the <code
class="option">-v</code> global option:
-<pre class="screen"><code class="command">$ ipa -v
user-show admin</code></pre>
+<pre class="screen">$ ipa -v user-show admin</pre>
You can use the <code class="option">-v</code> option twice to
display the XML-RPC exchange:
-<pre class="screen"><code class="command">$ ipa -vv
user-show admin</code></pre>
+<pre class="screen">$ ipa -vv user-show admin</pre>
- </div></div></div><div xml:lang="en-US"
class="appendix"
id="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Frequently Asked
Questions</h1></div></div></div><div
class="qandaset"><dl><dt>Q: <a
href="#id3126288">
+ </div></div></div><div xml:lang="en-US"
class="appendix"
id="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Frequently Asked
Questions</h1></div></div></div><div
class="qandaset"><dl><dt>Q: <a
href="#id3389352">
Is it possible to change the IP address of the master server?
- </a></dt><dt>Q: <a href="#id3273320">
+ </a></dt><dt>Q: <a href="#id3293041">
Why are there restrictions on the length of user and group names? How can I change
this?
- </a></dt><dt>Q: <a href="#id2895429">
+ </a></dt><dt>Q: <a href="#id3091138">
What is the difference between a replica and a master server?
- </a></dt><dt>Q: <a href="#id2913912">
+ </a></dt><dt>Q: <a href="#id3388580">
Can I promote a replica to function as the master? How?
- </a></dt><dt>Q: <a href="#id3216114">
+ </a></dt><dt>Q: <a href="#id3389616">
Why does the ipa-client-install script fail to find the IPA server on a network that
uses Active Directory DNS?
- </a></dt><dt>Q: <a href="#id2871497">
+ </a></dt><dt>Q: <a href="#id3151157">
Can an administrator who is connected to "Server B" revoke a certificate
issued by "Server A"?
- </a></dt></dl><div class="qandaset"><div
id="id3126288" class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </a></dt></dl><div class="qandaset"><div
id="id3389352" class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Is it possible to change the IP address of the master server?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Yes. If you are only changing the IP address then it is sufficient to update the
<code class="filename">/etc/hosts</code> file, the system
configuration and the DNS entry.
- </div></div></div></div><div id="id3273320"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3293041"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Why are there restrictions on the length of user and group names? How can I change
this?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
User and group name lengths are specified in the policy. The default maximum
username length is 32 characters. The maximum configurable length for user or group names
is 255 characters. This restriction was introduced because some non-Linux operating
systems have limitations on the length of username that they can support.
</div><div class="para">
You can modify these settings either in the user interface or on the command line.
For example, to specify the maximum username length, run the following command: <code
class="command">ipa config-mod --maxusername=INT</code>
- </div></div></div></div><div id="id2895429"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3091138"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
What is the difference between a replica and a master server?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The only difference between a replica and the initial IPA install (the
"master") is that the first server owns the self-signed CA.
- </div></div></div></div><div id="id2913912"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3388580"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Can I promote a replica to function as the master? How?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
- Yes. Refer to <a class="xref"
href="#promoting-replica">Section 12.12, “Promoting a Read-Only Replica to an
IPA Server”</a>.
- </div></div></div></div><div id="id3216114"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ Yes. Refer to <a class="xref"
href="#promoting-replica">Section 13.8, “Promoting a Read-Only Replica to a
FreeIPA Server”</a>.
+ </div></div></div></div><div id="id3389616"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Why does the <code class="command">ipa-client-install</code>
script fail to find the IPA server on a network that uses Active Directory DNS?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
This is probably due to the fact that Active Directory has its own SRV records for
Kerberos and LDAP, and so the <code
class="command">ipa-client-install</code> script retrieves those
records instead of any that you may have added for IPA.
- </div></div></div></div><div id="id2871497"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3151157"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Can an administrator who is connected to "Server B" revoke a certificate
issued by "Server A"?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Yes, assuming that Servers A and B contain non-cloned CAs whose portion of internal
storage has been replicated to share revocation information only.
- </div></div></div></div></div></div></div><div
xml:lang="en-US" class="appendix"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Services: Working with
certmonger</h1></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">B.1. What
is certmonger?</h2></div></div></div><div
class="para">
+ </div></div></div></div></div></div></div><div
xml:lang="en-US" class="appendix" id="tools-reference"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">FreeIPA Tools
Reference</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#ipa">B.1.
ipa</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-location">B.1.1.
Location</a></span></dt><dt><span
class="section"><a href="#ipa-syntax">B.1.2.
Syntax</a></span></dt><dt><span
class="section"><a href="#ipa-commands">B.1.3.
Commands</a></span></dt><dt><span
class="section"><a href="#ipa-options">B.1.4.
Options</a></span></dt><dt><span
class="section"><a href="#ipa-command-automount">B.1.5. ipa
automountlocation*</a></span></dt><dt><span
class="section"><a href="#ipa-command-automountmap">B.1.6.
ipa automountmap*</a></span></dt><dt><span
class="section"><a href="#ipa-command-automountkey">B.1.7.
ipa
automountkey*</a></span></dt></dl></dd><dt><span
class="section"><a href="#server-
tools">B.2. Server
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-compat-manage">B.2.1.
ipa-compat-manage</a></span></dt><dt><span
class="section"><a href="#ipa-compliance">B.2.2.
ipa-compliance</a></span></dt><dt><span
class="section"><a href="#ipa-dns-install">B.2.3.
ipa-dns-install</a></span></dt><dt><span
class="section"><a href="#ipa-host-net-manage">B.2.4.
ipa-host-net-manage</a></span></dt><dt><span
class="section"><a href="#ipa_kpasswd">B.2.5.
ipa_kpasswd</a></span></dt><dt><span
class="section"><a href="#ipa-ldap-updater">B.2.6.
ipa-ldap-updater</a></span></dt><dt><span
class="section"><a href="#ipa-nis-manage">B.2.7.
ipa-nis-manage</a></span></dt><dt><span
class="section"><a href="#ipa-replica-install">B.2.8.
ipa-replica-install</a></span></dt><dt><span
class="section"><a href="#ipa-replica-manage">B.2.9.
ipa-replica-manage</a></span></dt><dt><span
class="section"><a href="#ipa-replica-prepare">B.2.10.
ipa-replica-prepare</a></span></dt><dt>
<span class="section"><a
href="#ipa-server-certinstall">B.2.11.
ipa-server-certinstall</a></span></dt><dt><span
class="section"><a href="#ipa-server-install">B.2.12.
ipa-server-install</a></span></dt><dt><span
class="section"><a href="#ipa-ugradeconfig">B.2.13.
ipa-upgradeconfig</a></span></dt><dt><span
class="section"><a href="#ipactl">B.2.14.
ipactl</a></span></dt></dl></dd><dt><span
class="section"><a href="#client-tools">B.3. Client
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#ipa-client-install">B.3.1.
ipa-client-install</a></span></dt><dt><span
class="section"><a href="#ipa-getkeytab">B.3.2.
ipa-getkeytab</a></span></dt><dt><span
class="section"><a href="#ipa-join">B.3.3.
ipa-join</a></span></dt><dt><span
class="section"><a href="#ipa-rmkeytab">B.3.4.
ipa-rmkeytab</a></span></dt></dl></dd><dt><span
class="section"><a href="#certmonger-tools">B.4. Certmonger
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a href="#getcert">B.4.1. getcert<
/a></span></dt><dt><span class="section"><a
href="#ipa-getcert">B.4.2.
ipa-getcert</a></span></dt></dl></dd></dl></div><div
class="para">
+ XXXXX introXXXXXXXX
+ </div><div class="section" id="ipa"><div
class="titlepage"><div><div><h2 class="title"
id="ipa">B.1. ipa</h2></div></div></div><div
class="para">
+ IPA uses a plugin system where the same plugin is used both for the XML-RPC
server-side interface and for the command-line interface. This results in a consistent,
unified interface that is easy to maintain. From the user's perspective, plugins are
more or less interchangeable with commands. Most plugins implement commands used to manage
IPA and its data. With the exception of two build-ins (`help` and `console`) all commands
are introduced by plugins. Commands are invoked like this: ipa [global-options] COMMAND
[command-parameters-that-is-options-and-arguments] A list of global options can be
displayed using: ipa --help The plugins are organized by type of objects they manage. This
type can also be used to get an overview of the available commands. To display all
commands in a specific module, use the `help` command as follows: ipa help TOPIC
Parameters available for a specific command are displayed with: ipa COMMAND --help If a
list of parameter isn't enough, more infor
mation about specific commands is available through the `help` command: ipa help COMMAND
Description
+ </div><div class="section" id="ipa-location"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-location">B.1.1. Location</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-admintools
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-syntax"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-syntax">B.1.2. Syntax</h3></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-commands"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-commands">B.1.3. Commands</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an automount
key. automountkey-find Search for an automount key. automountkey-mod Modify an automount
key. automountkey-show Display an automount key. automountlocation-add Create a new
automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map. cert-remove-hold Take a revoked certificate off hold. cert-request
Submit a certificate signing request. cert-rev
oke Revoke a certificate. cert-show Retrieve an existing certificate. cert-status Check
the status of a certificate signing request. config-mod Modify configuration options.
config-show Show the current configuration. console Start the IPA interactive Python
console. delegation-add Add a new delegation. delegation-del Delete a delegation.
delegation-find Search for delegations. delegation-mod Modify a delegation.
delegation-show Display information about a delegation. dns-resolve Resolve a host name in
DNS dnsrecord-add Add new DNS resource record. dnsrecord-del Delete DNS resource record.
dnsrecord-find Search for DNS resources. dnsrecord-show Display DNS resource. dnszone-add
Create new DNS zone (SOA record). dnszone-del Delete DNS zone (SOA record).
dnszone-disable Disable DNS Zone. dnszone-enable Enable DNS Zone. dnszone-find Search for
DNS zones (SOA records). dnszone-mod Modify DNS zone (SOA record). dnszone-show Display
information about a DNS zone (SOA record). entit
le-consume Consume an entitlement entitle-find Search for entitlement accounts.
entitle-get Retrieve the entitlement certs entitle-import Import an entitlement
certificate. entitle-register Register to the entitlement system entitle-status Display
current entitlements entitle-sync Re-sync the local entitlement cache with the entitlement
server env Show environment variables group-add Create a new group. group-add-member Add
members to a group. group-del Delete group. group-detach Detach a managed group from a
user group-find Search for groups. group-mod Modify a group. group-remove-member Remove
members from a group. group-show Display information about a named group. hbacrule-add
Create a new HBAC rule. hbacrule-add-host Add target hosts and hostgroups to an HBAC rule
hbacrule-add-service Add services to an HBAC rule. hbacrule-add-sourcehost Add source
hosts and hostgroups from a HBAC rule. hbacrule-add-user Add users and groups to an HBAC
rule. hbacrule-del Delete an HBAC
rule. hbacrule-disable Disable an HBAC rule. hbacrule-enable Enable an HBAC rule.
hbacrule-find Search for HBAC rules. hbacrule-mod Modify an HBAC rule.
hbacrule-remove-host Remove target hosts and hostgroups from an HBAC rule.
hbacrule-remove-service Remove service and service groups from an HBAC rule.
hbacrule-remove-sourcehost Remove source hosts and hostgroups from an HBAC rule.
hbacrule-remove-user Remove users and groups from an HBAC rule. hbacrule-show Display the
properties of an HBAC rule. hbacsvc-add Add a new HBAC service. hbacsvc-del Delete an
existing HBAC service. hbacsvc-find Search for HBAC services. hbacsvc-mod Modify an HBAC
service. hbacsvc-show Display information about an HBAC service. hbacsvcgroup-add Add a
new HBAC service group. hbacsvcgroup-add-member Add members to an HBAC service group.
hbacsvcgroup-del Delete an HBAC service group. hbacsvcgroup-find Search for an HBAC
service group. hbacsvcgroup-mod Modify an HBAC service group. hbacsvcgroup-remov
e-member Remove members from an HBAC service group. hbacsvcgroup-show Display information
about an HBAC service group. help Display help for a command or topic. host-add Add a new
host. host-add-managedby Add hosts that can manage this host. host-del Delete a host.
host-disable Disable the Kerberos key, SSL certificate and all services of a host.
host-find Search for hosts. host-mod Modify information about a host.
host-remove-managedby Remove hosts that can manage this host. host-show Display
information about a host. hostgroup-add Add a new hostgroup. hostgroup-add-member Add
members to a hostgroup. hostgroup-del Delete a hostgroup. hostgroup-find Search for
hostgroups. hostgroup-mod Modify a hostgroup. hostgroup-remove-member Remove members from
a hostgroup. hostgroup-show Display information about a hostgroup. krbtpolicy-mod Modify
Kerberos ticket policy. krbtpolicy-reset Reset Kerberos ticket policy to the default
values. krbtpolicy-show Display the current Kerberos tic
ket policy. migrate-ds Migrate users and groups from DS to IPA. netgroup-add Add a new
netgroup. netgroup-add-member Add members to a netgroup. netgroup-del Delete a netgroup.
netgroup-find Search for a netgroup. netgroup-mod Modify a netgroup.
netgroup-remove-member Remove members from a netgroup. netgroup-show Display information
about a netgroup. passwd Set a user's password permission-add Add a new permission.
permission-del Delete a permission. permission-find Search for permissions. permission-mod
Modify a permission. permission-show Display information about a permission. ping ping a
remote server plugins Show all loaded plugins privilege-add Add a new privilege.
privilege-add-permission Add permissions to a privilege. privilege-del Delete a privilege.
privilege-find Search for privileges. privilege-mod Modify a privilege.
privilege-remove-permission Remove permissions from a privilege. privilege-show Display
information about a privilege. pwpolicy-add Add a new group
password policy. pwpolicy-del Delete a group password policy. pwpolicy-find Search for
group password policies. pwpolicy-mod Modify a group password policy. pwpolicy-show
Display information about password policy. role-add Add a new role. role-add-member Add
members to a role. role-add-privilege Add privileges to a role. role-del Delete a role.
role-find Search for roles. role-mod Modify a role. role-remove-member Remove members from
a role. role-remove-privilege Remove privileges from a role. role-show Display information
about a role. selfservice-add Add a new self-service permission. selfservice-del Delete a
self-service permission. selfservice-find Search for a self-service permission.
selfservice-mod Modify a self-service permission. selfservice-show Display information
about a self-service permission. service-add Add a new IPA new service. service-add-host
Add hosts that can manage this service. service-del Delete an IPA service. service-disable
Disable the Kerberos k
ey and SSL certificate of a service. service-find Search for IPA services. service-mod
Modify an existing IPA service. service-remove-host Remove hosts that can manage this
service. service-show Display information about an IPA service. show-mappings
ipalib.cli.show_mappings sudocmd-add Create new sudo command. sudocmd-del Delete sudo
command. sudocmd-find Search for commands. sudocmd-mod Modify command. sudocmd-show
Display sudo command. sudocmdgroup-add Create new sudo command group.
sudocmdgroup-add-member Add members to sudo command group. sudocmdgroup-del Delete sudo
command group. sudocmdgroup-find Search for sudo command groups. sudocmdgroup-mod Modify
group. sudocmdgroup-remove-member Remove members from sudo command group.
sudocmdgroup-show Display sudo command group. sudorule-add Create new Sudo Rule.
sudorule-add-allow-command Add commands and sudo command groups affected by Sudo Rule.
sudorule-add-deny-command Add commands and sudo command groups affected by Sudo
Rule. sudorule-add-host Add hosts and hostgroups affected by Sudo Rule.
sudorule-add-option Add an option to the Sudo rule. sudorule-add-runasgroup Add group for
Sudo to execute as. sudorule-add-runasuser Add user for Sudo to execute as.
sudorule-add-user Add users and groups affected by Sudo Rule. sudorule-del Delete Sudo
Rule. sudorule-disable Disable a Sudo rule. sudorule-enable Enable a Sudo rule.
sudorule-find Search for Sudo Rule. sudorule-mod Modify Sudo Rule.
sudorule-remove-allow-command Remove commands and sudo command groups affected by Sudo
Rule. sudorule-remove-deny-command Remove commands and sudo command groups affected by
Sudo Rule. sudorule-remove-host Remove hosts and hostgroups affected by Sudo Rule.
sudorule-remove-option Remove an option from Sudo rule. sudorule-remove-runasgroup Remove
group for Sudo to execute as. sudorule-remove-runasuser Remove user for Sudo to execute
as. sudorule-remove-user Remove users and groups affected by Sudo Rule. sudorule-
show Dispaly Sudo Rule. user-add Add a new user. user-del Delete a user. user-disable
Disable a user account. user-enable Enable a user account. user-find Search for users.
user-mod Modify a user. user-show Display information about a user. user-unlock Unlock a
user account
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-options"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-options">B.1.4. Options</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div><div
class="para">
+ help topics: automount Automount cert IPA certificate operations config Manage the
IPA configuration delegation Group to Group Delegation dns Domain Name System (DNS)
entitle Entitlements group Groups of users hbac Host-based access control commands host
Hosts/Machines hostgroup Groups of hosts. krbtpolicy Kerberos ticket policy migration
Migration to IPA misc Misc plug-ins netgroup Netgroups passwd Set a user's password
permission Permissions ping Ping the remote IPA server privilege Privileges pwpolicy
Password policy role Roles selfservice Self-service Permissions service Services sudo
commands for controlling sudo configuration user Users
+ </div></div><div class="section"
id="ipa-command-automount"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automount">B.1.5. ipa
automountlocation*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automount-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-syntax">B.1.5.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automount-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-commands">B.1.5.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automount-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-options">B.1.5.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-command-automountmap"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automountmap">B.1.6. ipa
automountmap*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automountmap-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-syntax">B.1.6.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automountmap-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-commands">B.1.6.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automountmap-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-options">B.1.6.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-command-automountkey"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automountkey">B.1.7. ipa
automountkey*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automountkey-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-syntax">B.1.7.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automountkey-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-commands">B.1.7.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automountkey-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-options">B.1.7.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><div
class="section" id="server-tools"><div
class="titlepage"><div><div><h2 class="title"
id="server-tools">B.2. Server
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section"
id="ipa-compat-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-compat-manage">B.2.1. ipa-compat-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-compat-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-location">B.2.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-compat-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-syntax">B.2.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-compat-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-options">B.2.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-compliance"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-compliance">B.2.2. ipa-compliance</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-compliance-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-location">B.2.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-compliance-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-syntax">B.2.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-compliance-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-options">B.2.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-dns-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-dns-install">B.2.3. ipa-dns-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-dns-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-location">B.2.3.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-dns-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-syntax">B.2.3.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-dns-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-options">B.2.3.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-host-net-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-host-net-manage">B.2.4. ipa-host-net-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-host-net-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-location">B.2.4.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-host-net-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-syntax">B.2.4.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-host-net-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-options">B.2.4.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa_kpasswd"><div
class="titlepage"><div><div><h3 class="title"
id="ipa_kpasswd">B.2.5. ipa_kpasswd</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa_kpasswd-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-location">B.2.5.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa_kpasswd-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-syntax">B.2.5.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa_kpasswd-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-options">B.2.5.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-ldap-updater"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-ldap-updater">B.2.6. ipa-ldap-updater</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-ldap-updater-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-location">B.2.6.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-ldap-updater-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-syntax">B.2.6.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-ldap-updater-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-options">B.2.6.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-nis-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-nis-manage">B.2.7. ipa-nis-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-nis-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-location">B.2.7.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-nis-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-syntax">B.2.7.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-nis-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-options">B.2.7.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-install">B.2.8. ipa-replica-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-location">B.2.8.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-syntax">B.2.8.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-options">B.2.8.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-manage">B.2.9. ipa-replica-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-location">B.2.9.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-syntax">B.2.9.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-options">B.2.9.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-prepare"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-prepare">B.2.10. ipa-replica-prepare</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-prepare-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-location">B.2.10.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-prepare-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-syntax">B.2.10.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-prepare-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-options">B.2.10.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-server-certinstall"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-server-certinstall">B.2.11. ipa-server-certinstall</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-server-certinstall-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-location">B.2.11.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-server-certinstall-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-syntax">B.2.11.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-server-certinstall-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-options">B.2.11.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-server-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-server-install">B.2.12. ipa-server-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-server-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-location">B.2.12.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-server-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-syntax">B.2.12.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-server-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-options">B.2.12.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-ugradeconfig"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-ugradeconfig">B.2.13. ipa-upgradeconfig</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-upgradeconfig-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-location">B.2.13.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-upgradeconfig-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-syntax">B.2.13.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-upgradeconfig-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-options">B.2.13.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipactl"><div
class="titlepage"><div><div><h3 class="title"
id="ipactl">B.2.14. ipactl</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipactl-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-location">B.2.14.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipactl-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-syntax">B.2.14.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipactl-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-options">B.2.14.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><div
class="section" id="client-tools"><div
class="titlepage"><div><div><h2 class="title"
id="client-tools">B.3. Client
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section"
id="ipa-client-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-client-install">B.3.1. ipa-client-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-client-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-location">B.3.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-client-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-syntax">B.3.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-client-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-options">B.3.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-getkeytab"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-getkeytab">B.3.2. ipa-getkeytab</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-getkeytab-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-location">B.3.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-getkeytab-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-syntax">B.3.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-getkeytab-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-options">B.3.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-join"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-join">B.3.3. ipa-join</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-join-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-location">B.3.3.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-join-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-syntax">B.3.3.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-join-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-options">B.3.3.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-rmkeytab"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-rmkeytab">B.3.4. ipa-rmkeytab</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-rmkeytab-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-location">B.3.4.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-rmkeytab-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-syntax">B.3.4.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-rmkeytab-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-options">B.3.4.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><div
class="section" id="certmonger-tools"><div
class="titlepage"><div><div><h2 class="title"
id="certmonger-tools">B.4. Certmonger
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section" id="getcert"><div
class="titlepage"><div><div><h3 class="title"
id="getcert">B.4.1. getcert</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="getcert-location"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-location">B.4.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="getcert-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-syntax">B.4.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="getcert-options"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-options">B.4.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ certmonger
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-getcert"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-getcert">B.4.2. ipa-getcert</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-getcert-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-location">B.4.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ certmonger
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-getcert-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-syntax">B.4.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-getcert-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-options">B.4.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div></div><div
xml:lang="en-US" class="appendix"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Services: Working with
certmonger</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">C.2.
Using certmonger</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">C.3.
Using certmonger with NSS</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">C.4.
Using certmonger with IPA</a></span></dt></dl>
</div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1. What
is certmonger?</h2></div></div></div><div
class="para">
The <code class="systemitem">certmonger</code> daemon, together
with its command line clients, attempts to simplify the process of generating
public/private key pairs and Certificate Signing Requests (CSRs), and submitting CSRs to
Certificate Authorities (CAs) for signing.
</div><div class="para">
The <code class="systemitem">certmonger</code> daemon also
monitors certificates for imminent expiration and, with the help of a CA, can optionally
refresh certificates that are about to expire. It can also drive the entire IPA enrollment
process, from key generation through to enrollment itself and refreshing certificates.
</div><div class="para">
The set of certificates that <code
class="systemitem">certmonger</code> monitors is tracked in files
stored in a user-configurable directory. The default location is <code
class="filename">/var/lib/certmonger/requests</code>.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">B.2. Using
certmonger</h2></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">C.2. Using
certmonger</h2></div></div></div><div
class="para">
Probably the simplest use case is to generate a certificate which is signed by the
subject itself. These are not typically used in production, but are suitable for
demonstration and testing purposes. Consider the following command:
</div><pre class="screen"><code class="command">#
selfsign-getcert request -f /tmp/server.crt -k
/tmp/server.key</code></pre><div class="para">
This informs <code class="systemitem">certmonger</code> that we
want a key to be stored in the file <code
class="filename">/tmp/server.key</code>, to generate a corresponding
certificate, and to store that certificate in the file <code
class="filename">/tmp/server.crt</code>. Using <code
class="command">selfsign-getcert</code> also implicitly tells <code
class="systemitem">certmonger</code> to <span
class="emphasis"><em>self-sign</em></span> the CSR, which
it generates and uses internally, with the subject's own key. During this process,
certmonger:
@@ -4312,7 +4905,7 @@ debug=True</pre>
created the CSR
</div></li><li class="listitem"><div
class="para">
used the same key to produce a signed certificate.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">B.3. Using
certmonger with NSS</h2></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">C.3. Using
certmonger with NSS</h2></div></div></div><div
class="para">
The previous example used plain files for holding the key and the certificate, but
certmonger can also take advantage of NSS database storage. In this scenario, you need to
pass the database's location and a nickname for the certificate to certmonger.
Consider the following example:
<pre class="screen"><code class="command">#
selfsign-getcert request -d /tmp -n Test-Certificate</code></pre>
@@ -4323,7 +4916,7 @@ debug=True</pre>
</div><div class="para">
Refer to the <code class="command">getcert</code> man page for
more information about the available command options.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">B.4. Using
certmonger with IPA</h2></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">C.4. Using
certmonger with IPA</h2></div></div></div><div
class="para">
The only difference between using <code
class="systemitem">certmonger</code> with the IPA CA and producing a
self-signed certificate is changing the command prefix. Instead of using <code
class="command">selfsign-getcert</code>, use the <code
class="command">ipa-getcert</code> command. For example:
<pre class="screen"><code class="command">ipa-getcert
request -r \</code>
<code class="command">-f /etc/httpd/conf/ssl.crt/server.crt
\</code>
@@ -4332,9 +4925,9 @@ debug=True</pre>
<code class="command">-D `hostname --fqdn` \</code>
<code class="command">-U id-kp-serverAuth</code></pre>
- </div></div></div><div xml:lang="en-US"
class="appendix" id="Migrating_from_a_Directory_Server_to_IPA"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Migrating from a Directory Server to
IPA</h1></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">C.1. Overview</h2></div></div></div><div
class="para">
+ </div></div></div><div xml:lang="en-US"
class="appendix" id="Migrating_from_a_Directory_Server_to_IPA"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Migrating from a Directory Server to
IPA</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">D.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3.
Possible Scenarios</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4.
Initial and Final States</a></sp
an></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">D.1.6.
Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">D.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1.
Phase 1: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2.
Phase 2: Updating the Client Configuration</a
</span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">D.3.
Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring
_SSSD">D.3.1. Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4.
Phase 4: Reconfigure non-SSSD Clients</a></span></dt><dt><span
class="section"><a
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></div><div
class="sectio
n"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1. Overview</h2></div></div></div><div
class="para">
This appendix addresses the situation where a customer has previously deployed an
internal Directory Server (DS) and is planning to use IPA instead. The customer needs to
transfer all user data from the DS to IPA so that IPA can function fully and correctly.
The goal is to perform this migration without requiring that users change their passwords
or perform some other specific action.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">C.1.1. Assumptions</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">D.1.1. Assumptions</h3></div></div></div><div
class="para">
It is not practical to identify and address each of the scenarios in which a DS and
IPA might be deployed, and where migration might be required. Consequently, the following
assumptions are made:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
This is a one-to-one transition from one DS realm to one IPA realm. No
consolidation is involved.
@@ -4346,7 +4939,7 @@ debug=True</pre>
Some machines might be present that are managed by <code
class="systemitem">NIS</code> or are not part of the DS deployment, but
are planned to be part of the IPA domain
</div><div class="para">
Machines that cannot be moved from the <code
class="systemitem">NIS</code> domain to LDAP or IPA because they are
old and do not support <code class="systemitem">nss_ldap</code> are
assumed to remain in and be served by the <code
class="systemitem">NIS</code> domain. The migration of such machines to
the IPA domain, while possible, is a challenging task and is out of the scope of the
current use case.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">C.1.2. Known
Issues</h3></div></div></div><div class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2. Known
Issues</h3></div></div></div><div class="para">
A number of issues exist that need to be considered when planning the migration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
A generic DS uses a different schema and <em
class="firstterm">Directory Information Tree (DIT)</em> when compared
to IPA. No known DS uses the same flat DIT structure that IPA uses. IPA is optimized for
performance, and attempts to avoid any architectural design flaws that have occurred in
the past.
@@ -4354,7 +4947,7 @@ debug=True</pre>
IPA uses Kerberos for authentication, and so each user requires that Kerberos keys
be stored in the IPA DS, in addition to the standard LDAP hashes used by the DS
</div><div class="para">
In order to generate these keys, the password needs to be available in clear text
to IPA's DS password plug-in. It is available when the user is created in IPA using
IPA tools or LDAP, but this is not the case when the user is migrated from other external
storage such as another DS. Consequently, the existing password hashes can be reloaded,
but the Kerberos hashes cannot be generated. IPA provides a number of solutions to
overcome this issue; these are described later in this appendix.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">C.1.3. Possible
Scenarios</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3. Possible
Scenarios</h3></div></div></div><div
class="para">
The following have been identified as typical migration scenarios:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Migrate an existing environment to IPA but do not use its Kerberos features for
now
@@ -4362,13 +4955,13 @@ debug=True</pre>
Migrate an existing environment to IPA and use its Kerberos features using only
IPA v1 functionality. That is, do not use SSSD.
</div></li><li class="listitem"><div
class="para">
Migrate an existing environment to IPA and use its Kerberos features on some
machines, while some machines will use SSSD and some will not; this is the primary use
case.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">C.1.4. Initial
and Final States</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4. Initial
and Final States</h3></div></div></div><div
class="para">
The following sections describe the initial, pre‐migration state, and the final,
post‐migration state of a DS deployment when migrating to a single IPA domain.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State">C.1.4.1. Initial
State</h4></div></div></div><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State">D.1.4.1. Initial
State</h4></div></div></div><div class="para">
In the initial state, there is a single data source (the Directory Server) and a
single client machine configuration. This client configuration uses <code
class="systemitem">LDAP</code> to connect to the Directory Server and
retrieve information about users and groups. This configuration uses <code
class="systemitem">PAM_LDAP</code> and <code
class="systemitem">NSS_LDAP</code> for authentication and identity
lookups. These modules enable the client systems to use data retrieved from the DS just as
if it were stored in <code class="filename">/etc/passwd</code> or
<code class="filename">/etc/shadow</code>. The following diagram
illustrates this type of implementation, where <code
class="systemitem">LDAP</code> is used to connect to the DS for both
authentication and authorization. The case where <code
class="systemitem">Kerberos</code> is used for authentication and
<code class="systemitem">LDAP</code> for identity, and where these
two data stores are synchronized, is not
described here. Consequently, the initial state may not be as simple or as
straightforward as displayed here, however the approach and the final state will be
similar.
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Initial_State-Initial_state_of_deployment_before_migrating_to_IPA."><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Initial_State.png" alt="Initial state of
deployment before migrating to IPA."
/></div></div><h6>Figure C.1. Initial state of deployment before
migrating to IPA.</h6></div><br class="figure-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State">C.1.4.2. Final
State</h4></div></div></div><div class="para">
- In the final state, even though only a single data source exists, multiple possible
machine configurations are now possible. This is illustrated in <a
class="xref"
href="#figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA">Figure C.2,
“Final state of deployment after migrating to IPA”</a>
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA"><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Final_State.png" alt="Final state of deployment
after migrating to IPA" /></div></div><h6>Figure C.2. Final
state of deployment after migrating to IPA</h6></div><br
class="figure-break" /><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options">C.1.4.2.1. Configuration
Options</h5></div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuration_Options-Connected_to_IPA_via_SSSD_Using_SSSDs_LDAP_Back_End"><h5
class="formalpara">Connected to IPA via SSSD Using SSSD's LDAP Back
End</h5>
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Initial_State-Initial_state_of_deployment_before_migrating_to_IPA."><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Initial_State.png" alt="Initial state of
deployment before migrating to IPA."
/></div></div><h6>Figure D.1. Initial state of deployment before
migrating to IPA.</h6></div><br class="figure-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State">D.1.4.2. Final
State</h4></div></div></div><div class="para">
+ In the final state, even though only a single data source exists, multiple possible
machine configurations are now possible. This is illustrated in <a
class="xref"
href="#figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA">Figure D.2,
“Final state of deployment after migrating to IPA”</a>
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA"><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Final_State.png" alt="Final state of deployment
after migrating to IPA" /></div></div><h6>Figure D.2. Final
state of deployment after migrating to IPA</h6></div><br
class="figure-break" /><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options">D.1.4.2.1. Configuration
Options</h5></div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuration_Options-Connected_to_IPA_via_SSSD_Using_SSSDs_LDAP_Back_End"><h5
class="formalpara">Connected to IPA via SSSD Using SSSD's LDAP Back
End</h5>
Clients connect to IPA via SSSD. SSSD is integrated into the PAM and NSS stacks by
means of PAM_SSS and NSS_SSS, respectively. SSSD's LDAP back end is configured for
both authentication and for identity lookups. In this use case, IPA functions like a
normal DS.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Kerberos authentication can be configured instead of LDAP authentication. In this
case, IPA acts as a normal DS for identity lookups and a normal KDC for Kerberos
authentication.
@@ -4380,7 +4973,7 @@ debug=True</pre>
Clients connect directly to IPA and use PAM_KRB5 and NSS_LDAP. This is the same
configuration as that provided for IPA v1.x
</div><div class="para">
In the initial state, clients use LDAP to communicate with the Directory Server to
retrieve information about users and groups. <code
class="systemitem">PAM_LDAP</code> and <code
class="systemitem">NSS_LDAP</code> are modules that enable the client
systems to use data retrieved from the Directory Server as if it were stored in <code
class="filename">/etc/passwd</code> or <code
class="filename">/etc/shadow</code>. In the final state, IPA provides
all of the same functionality and many more features besides.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">C.1.5. Recommended
Sequence of Steps</h3></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5. Recommended
Sequence of Steps</h3></div></div></div><div
class="para">
The migration from DS to IPA requires:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Installing IPA on a suitable machine
@@ -4404,13 +4997,13 @@ debug=True</pre>
Deploy SSSD first
</div></li></ul></div><div class="para">
Each approach is valid and accomplishes the same goal, but using a different sequence
of operations.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies">C.1.5.1. Comparison
of Migration Strategies</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies">D.1.5.1. Comparison
of Migration Strategies</h4></div></div></div><div
class="para">
Each approach has a different impact on the IT team and the users. You need to
select the approach that best suits your deployment. These scenarios can be modified to
meet the needs of your enterprise. Provided you understand the implications and reasoning
behind each step, there is no requirement to follow the steps in the given order. It is
important to understand that until the Kerberos keys are generated in IPA, users will not
be able to authenticate with Kerberos credentials using <code
class="systemitem">PAM_KRB5</code> or <code
class="command">kinit</code>.
</div><div class="para">
You should also consider an alternative migration scenario, where passwords are not
migrated. In this scenario, users are not migrated into IPA but rather added as new users
with new passwords. Users would then change their password the first time they
authenticate. The initial password would be defined by IT and sent to users by email or
communicated in some other way.
</div><div class="para">
Migrating users from an existing system provides a smoother transition but also
requires parallel management of DS and IPA during the migration. If you do not preserve
passwords, the migration can be performed more quickly and you can avoid the period of
double management of IPA and DS.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">C.1.6. Implementation
Details</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">D.1.6. Implementation
Details</h3></div></div></div><div class="para">
The following sequence of operations occurs when users are migrated using SSSD:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
A user tries to log in to the machine.
@@ -4436,15 +5029,15 @@ debug=True</pre>
If the bind operation fails for any reason, the IPA identity provider back end will
fail authentication, otherwise it will continue.
</div></li><li class="listitem"><div
class="para">
The IPA identity provider back end will unbind and try Kerberos authentication
again. This time it is expected to succeed because the keys already exist in the entry.
- </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">C.2. Performing
a Server-based Migration</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">D.2. Performing
a Server-based Migration</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Each phase of the migration should be performed as a single step.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">C.2.1. Phase
1: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1. Phase
1: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
The first phase of the migration consists of setting up IPA and migrating data from
the existing DS to that used by IPA. This involves the use of the <code
class="command">ipa migrate-ds</code> command, which dumps the user
data from the original DS, converts it into a format suitable for use by IPA, and then
loads the converted data into IPA.
</div><div class="para">
The <code class="command">ipa migrate-ds</code> command
connects to the DS and binds as the <code class="systemitem">Directory
Manager</code>, and then extracts all objectClass=person objects from ou=People.
This can be changed using the <code
class="option">--user-container</code> option. It also extracts all
objects from ou=Groups. This can be changed using the <code
class="option">--group-container</code> option. It adds all object
classes and attributes required by IPA (if they are missing) and coverts DNs in attributes
to match the IPA Directory Information Tree (DIT). The command returns an error if
migration is not enabled.
</div><div class="para">
Refer to the <code class="command">ipa migrate-ds</code> help
page for more details about this command (<code class="command">ipa help
migrate-ds</code>).
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_1_Migrating_Existing_Data_to_IPA-To_migrate_existing_data_to_IPA"><h6>Procedure C.1. To
migrate existing data to IPA:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_1_Migrating_Existing_Data_to_IPA-To_migrate_existing_data_to_IPA"><h6>Procedure D.1. To
migrate existing data to IPA:</h6><ol class="1"><li
class="step"><div class="para">
Install IPA, including any custom DS schema, on a different machine from the
existing DS. Refer to
</div></li><li class="step"><div
class="para">
Use the following command to enable IPA migration mode:
@@ -4468,7 +5061,7 @@ debug=True</pre>
The migration log file is currently not implemented. Instead, any error messages
are printed to standard output.
</div></div></div>
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">C.2.2. Phase
2: Updating the Client Configuration</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_2_Updating_the_Client_Configuration-To_update_the_client_configuration"><h6>Procedure C.2. To
update the client configuration:</h6><ul><li
class="step"><div class="para">
+ </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2. Phase
2: Updating the Client Configuration</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_2_Updating_the_Client_Configuration-To_update_the_client_configuration"><h6>Procedure D.2. To
update the client configuration:</h6><ul><li
class="step"><div class="para">
Update the client configuration to use PAM_LDAP and NSS_LDAP to connect to IPA
instead of connecting to DS, NIS, or using local files.
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
If the intention is to automatically generate the Kerberos keys when a user
authenticates, the configuration should use startTLS and simple bind authentication. For
this to occur, the IT department needs to ensure the IPA server certificate is copied to
the client.
@@ -4478,7 +5071,7 @@ debug=True</pre>
</div></li></ul></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
You should not update your client configuration to use PAM_KRB5 and NSS_LDAP (that
is, the equivalent of IPA v1) at this stage unless absolutely necessary. This is because
the Kerberos keys will not yet exist in the IPA user entries, and consequently users will
not be able to log in. If such a configuration is required, users can be directed to a
specific web page on the IPA server after the data has been loaded into the IPA server.
This page will prompt the user for their password and perform an LDAP bind. The DS
password plug-in will capture these passwords and generate the Kerberos keys.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">C.2.3. Phase
3: Installing and Configuring SSSD</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_3_Installing_and_Configuring_SSSD-To_install_and_configure_SSSD"><h5
class="formalpara">To install and configure SSSD:</h5>
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3. Phase
3: Installing and Configuring SSSD</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_3_Installing_and_Configuring_SSSD-To_install_and_configure_SSSD"><h5
class="formalpara">To install and configure SSSD:</h5>
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
Install SSSD on the machines that can support it:
</div><div class="para">
@@ -4487,24 +5080,24 @@ debug=True</pre>
Configure SSSD to use IPA as a back end (Kerberos and LDAP). Installing SSSD and
enrolling the client with IPA will ensure delivery of the machine Kerberos key and server
certificate to the client. Refer to
</div></li></ol></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">C.2.4. Phase
4: Migrating Users</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_4_Migrating_Users-To_migrate_the_users_from_DS_to_IPA"><h5
class="formalpara">To migrate the users from DS to IPA:</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4. Phase
4: Migrating Users</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_4_Migrating_Users-To_migrate_the_users_from_DS_to_IPA"><h5
class="formalpara">To migrate the users from DS to IPA:</h5>
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Instruct users to log in to IPA using either an SSSD client or a client that
supports PAM_LDAP with startTLS and simple bind. An SSSD client configured as described in
<a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">Section C.2.3,
“Phase 3: Installing and Configuring SSSD”</a> will perform a silent migration.
Clients configured with startTLS and simple bind will also trigger key generation. A
Kerberos key is created the first time a user logs in, and this key is stored in the IPA
back end.
+ Instruct users to log in to IPA using either an SSSD client or a client that
supports PAM_LDAP with startTLS and simple bind. An SSSD client configured as described in
<a class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">Section D.2.3,
“Phase 3: Installing and Configuring SSSD”</a> will perform a silent migration.
Clients configured with startTLS and simple bind will also trigger key generation. A
Kerberos key is created the first time a user logs in, and this key is stored in the IPA
back end.
</div></li><li class="listitem"><div
class="para">
As the migration of the user population progresses (that is, as the Kerberos keys
are generated on the IPA server), you can begin to configure other, non-SSSD clients to
suit your requirements.
</div></li></ol></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">C.2.5. Phase
5: Decommission the DS</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5. Phase
5: Decommission the DS</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
When the migration of all clients and users is complete, decommission the DS.
- </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">C.3. Performing
a Client-based Migration</h2></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">C.3.1. Phase
1: Installing and Configuring SSSD</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">D.3. Performing
a Client-based Migration</h2></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">D.3.1. Phase
1: Installing and Configuring SSSD</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
Install SSSD first on the machines that can support it:
</div><div class="para">
<code class="command"># yum install sssd</code>
</div></li><li class="listitem"><div
class="para">
Configure SSSD with the LDAP back end and point it to the existing DS deployment.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">C.3.2. Phase
2: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
- Install IPA and migrate the existing DS data as described in <a
class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">Section C.2.1,
“Phase 1: Migrating Existing Data to IPA”</a>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">C.3.3. Phase
3: Migrate SSSD Clients from LDAP to
IPA</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2. Phase
2: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
+ Install IPA and migrate the existing DS data as described in <a
class="xref"
href="#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">Section D.2.1,
“Phase 1: Migrating Existing Data to IPA”</a>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3. Phase
3: Migrate SSSD Clients from LDAP to
IPA</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
Start moving clients that have SSSD installed from the LDAP back end to the IPA
back end, and enroll them with IPA. This will download the required keys and
certificates.
</div></li><li class="listitem"><div
class="para">
Instruct users to use (that is, to log in at least once) the machines with SSSD and
IPA back end, or go to the web page and authenticate.
@@ -4517,9 +5110,9 @@ debug=True</pre>
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
It is important to include the quotes around the filter so that it is not
interpreted by the shell.
- </div></div></div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">C.3.4. Phase
4: Reconfigure non-SSSD Clients</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></div></div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4. Phase
4: Reconfigure non-SSSD Clients</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
As the user population is migrated (the Kerberos keys are generated), you can start
reconfiguring other (non‐SSSD) clients as required. The clients can be set up in any state
shown on the diagram above.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">C.3.5. Phase
5: Decommission the Directory Server</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5. Phase
5: Decommission the Directory Server</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
When the migration of the clients is complete, decommission the DS.
</div></li></ul></div></div></div></div><div
xml:lang="en-US" class="glossary" id="Glossary"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Glossary</h2></div></div></div><div
class="glossdiv"><h3
class="title">A</h3><dl><dt>access control
instruction</dt><dd><p>See <a class="glosssee"
href="#aci">ACI</a>.</p></dd><dt>access control
list</dt><dd><p>See <a class="glosssee"
href="#ACL">ACL</a>.</p></dd><dt>access
rights</dt><dd><div class="para">
In the context of access control, specify the level of access granted or denied. Access
rights are related to the type of operation that can be performed on the directory. The
following rights can be granted or denied: read, write, add, delete, search, compare,
selfwrite, proxy and all.
@@ -4855,4 +5448,4 @@ debug=True</pre>
Speeds up the display of entries in the Directory Server Console. Virtual list view
indexes can be created on any branch point in the directory tree to improve display
performance.
</div><p>See Also <a class="glossseealso"
href="#browsing-index">browsing
index</a>.</p></dd></dl></div><div
class="glossdiv"><h3
class="title">X</h3><dl><dt>X.500
standard</dt><dd><div class="para">
The set of ISO/ITU-T documents outlining the recommended information model, object
classes and attributes used by directory server implementation.
-</div></dd></dl></div></div><div class="index"
id="id2984518"><div
class="titlepage"><div><div><h2
class="title">Index</h2></div></div></div><div
class="index"></div></div></div></body></html>
+</div></dd></dl></div></div><div class="index"
id="id3103175"><div
class="titlepage"><div><div><h2
class="title">Index</h2></div></div></div><div
class="index"></div></div></div></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Certificates_and_Certificate_Authorities.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Certificates_and_Certificate_Authorities.html
new file mode 100644
index 0000000..b6b4e1d
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Certificates_and_Certificate_Authorities.html
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.4. Configuring Certificates and Certificate
Authorities</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev"
href="Managing-Unique_UID_and_GID_Attributes.html" title="13.3. Managing
Unique UID and GID Number Assignments" /><link rel="next"
href="ipa-apache.html" title="13.5. Setting a FreeIPA Server as an Apache
Virtual Host" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Managing-Unique_UID_and_GID_Attributes.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_Certificates_and_Certificate_Authorities"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_Certificates_and_Certificate_Authorities">13.4. Configuring
Certificates and Certificate
Authorities</h2></div></div></div><div
class="para">
+ FreeIPA creates a self-signed Certificate Authority (<abbr
class="abbrev">CA</abbr>) during the installation process. If you have
your own or a preferred <abbr class="abbrev">CA</abbr>, however, and
want to use your own certificates, FreeIPA provides the necessary tools to import
certificates for use by 389 Directory Server and the <code
class="systemitem">HTTP</code> server. While not a prerequisite for the
correct operation of FreeIPA, it is recommended that you save an <acronym
class="acronym">ASCII</acronym> copy of your <abbr
class="abbrev">CA</abbr> certificate as <code
class="filename">/usr/share/ipa/html/ca.crt</code> to ensure that users
download the correct certificate.
+ </div><div class="section"
id="Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1. Installing
Your Own Certificate</h3></div></div></div><div
class="para">
+ Use the <code class="command">ipa-server-certinstall</code>
command to install your own certificate. You can install the certificate for use by 389
Directory Server, <code class="systemitem">HTTP</code> Server, or
both.
+ </div><pre class="screen"># /usr/sbin/ipa-server-certinstall -d
/path/to/pkcs12.p12</pre></div><div class="section"
id="Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">13.4.2. Using
Your Own Certificate with Firefox</h3></div></div></div><div
class="para">
+ To continue using the Firefox auto-configuration feature, you need an object-signing
certificate, and you need to regenerate the <code
class="filename">/usr/share/ipa/html/configure.jar</code> file.
+ </div><div class="orderedlist"><h6>To use your own
certificate with Firefox:</h6><ol><li class="listitem"><div
class="para">
+ Create a suitable directory and then create the new certificate database in that
directory.
+<pre class="screen"># mkdir /tmp/signdb
+# certutil -N -d /tmp/signdb</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Import the PKCS #12 file for the signing certificate into that same directory.
+<pre class="screen"># pk12util -i /path/to/pkcs12.p12 -d
/tmp/signdb</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Make a temporary signing directory, and copy the FreeIPA javascript file to that
directory.
+<pre class="screen"># mkdir /tmp/sign
+# cp /usr/share/ipa/html/preferences.html /tmp/sign</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Use the certificate you created earlier to sign the javascript file and to
regenerate the <code class="filename">configure.jar</code> file.
+<pre class="screen"># signtool -d /tmp/signdb -k Signing_cert_nickname -Z
/usr/share/ipa/html/configure.jar -e .html</pre>
+
+ </div></li></ol></div></div><div
class="section" id="Using_OCSP"><div
class="titlepage"><div><div><h3 class="title"
id="Using_OCSP">13.4.3. Using
OCSP</h3></div></div></div><div class="para">
+ The Online Certificate Status Protocol (OCSP) is natively provided by the CA embedded
into FreeIPA. This is so that any client that supports it can use OCSP for certificate
validity checks.
+ </div><div class="para">
+ The OCSP responder URL is encoded into the certificates issued by FreeIPA. In order
for that responder to be available, port 9180 needs to be open in the firewall. The OCSP
URL uses the following format:
+<pre class="screen">http://ipa.example.com:9180/ca/ocsp</pre>
+
+ </div><div class="para">
+ For more information on OCSP, refer to the RFC at <a
href="http://www.ietf.org/rfc/rfc2560.txt">http://www.ietf.o...;.
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Managing-Unique_UID_and_GID_Attributes.html"><strong>Prev</strong>13.3. Managing
Unique UID and GID Number Assignme...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong>13.5. Setting a
FreeIPA Server as an Apache
Virtu...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
new file mode 100644
index 0000000..1880d5a
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.4. Activating and Deactivating User Accounts</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="editing-users.html"
title="6.3. Editing Users" /><link rel="next"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"
title="6.5. Specifying Default User Settings" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="editing-users.html"><strong
Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">6.4. Activating
and Deactivating User Accounts</h2></div></div></div><div
class="para">
+ FreeIPA user accounts can be set to a status of
<code class="literal">Active</code> or <code
class="literal">Inactive</code>. If you deactivate a user account, that
user can no longer log in to FreeIPA, change their password, or perform any other tasks.
Any existing connections will remain valid until their <code
class="systemitem">Kerberos</code> TGT and other tickets expire, but
they will not be able to renew them. The account and all associated information still
exists, but is inaccessible by the user.
+ </div><div class="section"
id="Activating_and_Deactivating_User_Accounts-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1. Using
the Command Line</h3></div></div></div><div
class="para">
+ Use the <code class="command">ipa user-enable</code> and
<code class="command">ipa user-disable</code> commands to enable and
disable user accounts, respectively. Refer to the following examples:
+ </div><div class="para">
+ To disable the <code class="systemitem">jsmith</code> user
account:
+ </div><div class="para">
+ $ ipa user-disable jsmith
+ </div><div class="para">
+ To enable the <code class="systemitem">jsmith</code> user
account:
+ </div><div class="para">
+ $ ipa user-enable jsmith
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="editing-users.html"><strong>Prev</strong>6.3. Editing
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong>6.5. Specifying
Default User Settings</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Deleting_IPA_Users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Deleting_IPA_Users.html
new file mode 100644
index 0000000..c6f5add
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Deleting_IPA_Users.html
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.7. Deleting FreeIPA Users</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="search-limits.html"
title="6.6. Setting Default Search Limits" /><link rel="next"
href="user-groups.html" title="6.8. Creating User Groups"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="search-limits.html"><strong>Prev</strong></a></li><li
class="next"
<a accesskey="n"
href="user-groups.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_IPA_Users-Deleting_IPA_Users"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Deleting_IPA_Users">6.7. Deleting FreeIPA
Users</h2></div></div></div><div class="para">
+ If you delete a FreeIPA user account, all of the information stored in the entry
for that identity is lost. This includes the user's full name, group membership, phone
numbers, and passwords. The actual user account and home directory still exist, be they on
a server, local machine, or other provider, but they are no longer accessible by FreeIPA.
+ </div><div class="para">
+ Unlike deactivation, if you delete a user account, it cannot be retrieved. If you need
this user account again, you need to recreate it and add all of the account details
manually.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ Unlike in earlier versions of FreeIPA, it is now possible to delete the <code
class="systemitem">admin</code> user. If, however, you delete all of
the <code class="systemitem">admin</code> users then you will need
to use the Directory Manager account to create a new administrative user. Alternatively,
if you have a user in the group management role, they can add a new <code
class="systemitem">admin</code> user.
+ </div></div></div><div class="section"
id="Deleting_IPA_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="Deleting_IPA_Users-Using_the_Command_Line">6.7.1. Using the Command
Line</h3></div></div></div><div class="para">
+ Use the <code class="command">ipa user-del</code> command to
delete user accounts. For example:
+ </div><div class="para">
+ To delete the <code class="systemitem">jsmith</code> user
account:
+ </div><div class="para">
+ $ ipa user-del jsmith
+ </div><div class="para">
+ If you intend to delete multiple users, you can use the <code
class="option">--continue</code> option to prevent the command from
stopping should it encounter any errors. For example:
+ </div><div class="para">
+ $ ipa user-del <code class="option">--continue</code> <em
class="parameter"><code>user_01</code></em> <em
class="parameter"><code>user_02</code></em> <em
class="parameter"><code>user_03</code></em>
+ </div><div class="para">
+ If you run this command without using the <code
class="option">--continue</code> option, FreeIPA will delete the listed
user accounts unless it encounters any errors, at which point it stops. For example, if
<em class="parameter"><code>user_02</code></em> did not
exist, the previous command would only delete <em
class="parameter"><code>user_01</code></em>; <em
class="parameter"><code>user_03</code></em> would not be
affected.
+ </div><div class="para">
+ The <code class="option">--continue</code> option returns a
summary of successes and failures to <code
class="systemitem">stdout</code>.
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="search-limits.html"><strong>Prev</strong>6.6. Setting
Default Search Limits</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="user-groups.html"><strong>Next</strong>6.8. Creating User
Groups</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Specifying_Default_User_Settings.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Specifying_Default_User_Settings.html
new file mode 100644
index 0000000..c6e56dc
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_IPA_Users-Specifying_Default_User_Settings.html
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.5. Specifying Default User Settings</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"
title="6.4. Activating and Deactivating User Accounts" /><link
rel="next" href="search-limits.html" title="6.6. Setting Default
Search Limits" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_IPA_Users-Specifying_Default_User_Settings"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_IPA_Users-Specifying_Default_User_Settings">6.5. Specifying
Default User Settings</h2></div></div></div><div
class="para">
+ You can configure the default settings for FreeIPA users to suit your deployment. For
example, you can specify the maximum username length, the default path to the <code
class="filename">/home</code> directory, the default shell, and other
attributes.
+ </div><div class="para">
+ FreeIPA supports the following User Settings:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ <span class="guilabel"><strong>Maximum Username
Length</strong></span> (<span
class="property">ipaMaxUsernameLength</span>): The maximum length of
any username. The default value is eight.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Root for Home
Directories</strong></span> (<span
class="property">ipaHomesRootDir</span>): The root directory for all
home directories. The default value is <code
class="filename">/home</code>.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default
Shell</strong></span> (<span
class="property">ipaDefaultLoginShell</span>): The default shell for
all user accounts. The default value is <code
class="filename">/bin/sh</code>.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default User
Group</strong></span> (<span
class="property">ipaDefaultPrimaryGroup</span>): The default group to
which all newly created accounts are added. The default value is <code
class="systemitem">ipausers</code>, which is automatically created
during the FreeIPA server installation process.
+ </div></li><li class="listitem"><div
class="para">
+ <span class="guilabel"><strong>Default E-mail
Domain</strong></span> (<span
class="property">ipaDefaultEmailDomain</span>): The default domain used
to create email addresses for all newly created accounts. The default is the domain to
which the FreeIPA server belongs.
+ </div></li></ul></div><div class="para">
+ Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. The following is an example of how to set the
maximum username length to 64 characters, and the default home directory to <code
class="filename">/users/home</code>:
+ </div><pre class="screen"># ipa config-mod --maxusername=64
--homedirectory=/users/home
+Max username length: 64
+Home directory base: /users/home
+Default shell: /bin/sh
+Default users group: ipausers
+Default e-mail domain:
mydomain.net
+Search time limit: 2
+Search size limit: 100
+User search fields: uid,givenname,sn,telephonenumber,ou,title
+Group search fields: cn,description
+Migration mode: FALSE
+Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
+ Refer to the <code class="command">ipa help config</code> page
for more information.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ The default root directory for all home directories is <code
class="filename">/home</code>, but it is the responsibility of the
system administrator to ensure that whatever value is specified for this attribute is
actually available.
+ </div><div class="para">
+ Fedora includes a <code class="systemitem">PAM</code> module
called <code class="systemitem module">pam_mkhomedir</code> that can
automatically create a home directory if one does not exist for the user authenticating
against the system. FreeIPA does not force the use of this module because it may try to
create home directories even when the shared storage is not available. It is the
responsibility of the system administrator to activate this module on the clients if
needed.
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong>6.4. Activating
and Deactivating User Accounts</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong>6.6. Setting
Default Search Limits</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Microsoft_Windows.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Microsoft_Windows.html
new file mode 100644
index 0000000..8073a51
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_Microsoft_Windows.html
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.2. Configuring a Microsoft Windows System as a FreeIPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="next"
href="Configuring_an_IPA_Client_on_Solaris.html" title="3.3. Configuring a
Solaris System as a FreeIPA Client" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a acc
esskey="p"
href="setting-up-clients.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_Microsoft_Windows"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_Microsoft_Windows">3.2. Configuring a Microsoft Windows
System as a FreeIPA Client</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ FreeIPA does <span
class="emphasis"><em>not</em></span> support Microsoft
Windows client authentication.
+ </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Download the MIT Kerberos 3.x package for Windows.
+ </div></li><li class="listitem"><div
class="para">
+ Run the <code class="filename">kfw-3.x-exe</code> file to
launch the MIT Kerberos Installation Wizard.
+ </div></li><li class="listitem"><div
class="para">
+ Read and accept the license agreement.
+ </div></li><li class="listitem"><div
class="para">
+ Install the KfW client. All other components are optional.
+ </div></li><li class="listitem"><div
class="para">
+ Accept the default destination path.
+ </div></li><li class="listitem"><div
class="para">
+ Select <span class="guilabel"><strong>Download from web
path</strong></span>, and enter the URL to the FreeIPA server. For example:
+ </div><pre
class="programlisting">http://ipaserver.example.com/ipa/conf...
class="listitem"><div class="para">
+ Select <span class="guilabel"><strong>Autostart the Network
Identity Manager each time you login to Windows</strong></span>.
+ </div></li><li class="listitem"><div
class="para">
+ Click <span
class="guibutton"><strong>Install</strong></span> to begin
the installation. When the installation is complete, click <span
class="guibutton"><strong>Finish</strong></span> to exit
the Wizard.
+ </div></li><li class="listitem"><div
class="para">
+ Edit the hosts file and add the FreeIPA server. For example:
+ </div><pre class="programlisting">1.2.3.4
ipaserver.example.com ipaserver</pre><div class="para">
+ Depending on the version of Windows, the HOSTS file could be located in different
directories.
+ </div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="setting-up-clients.html"><strong>Prev</strong>Chapter 3. Setting
up Systems as FreeIPA Clients</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Next</strong>3.3. Configuring
a Solaris System as a FreeIPA
Cl...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_AIX.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_AIX.html
index b3ce201..ce0f57c 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_AIX.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_AIX.html
@@ -1,22 +1,14 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.5. Configuring an AIX System as a FreeIPA Client</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.5. Configuring an AIX System as a FreeIPA Client</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 2. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_HP_UX.html" title="2.4. Configuring an
HP-UX System as a FreeIPA" /><link rel="next"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"
title="2.6. Configuring a Macintosh OS X System as a FreeIPA Client"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><
li class="previous"><a accesskey="p"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_AIX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_AIX">2.5. Configuring an AIX System as a
FreeIPA Client</h2></div></div></div><div
class="para">
- This chapter describes how to configure AIX as a FreeIPA client.
- </div><div class="para">
- Before starting the FreeIPA installation, update your system with all the latest
packages.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div><div class="para">
- Many of the following procedures and instructions use example host names, domain
names, and realm names for illustration purposes. You need to replace these example names
with those that apply to your own deployment.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1. Prerequisites</h3></div></div></div><div
class="para">
- Before you begin the configuration, ensure that the following software is installed
and up to date. This can be installed from your AIX media:
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_HP_UX.html" title="3.4. Configuring an
HP-UX System as a FreeIPA" /><link rel="next"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"
title="3.6. Configuring a Macintosh OS X System as a FreeIPA Client"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><
li class="previous"><a accesskey="p"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_AIX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_AIX">3.5. Configuring an AIX System as a
FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1. Prerequisites</h3></div></div></div><div
class="para">
+ Make sure that all of these packages are installed on the AIX machine before
beginning the client configuration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
v5.3 OS
</div></li><li class="listitem"><div
class="para">
@@ -37,26 +29,22 @@
openssl
</div></li><li class="listitem"><div
class="para">
modcrypt.base (for gssd)
- </div></li></ul></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2. Configuring
Client Authentication</h3></div></div></div><div
class="para">
- Before you begin the following procedures, ensure that NTP is correctly configured
and enabled, and that time is synchronized between the client and the FreeIPA master.
+ </div></li></ul></div><div class="para">
+ Configure and enable NTP and make sure that time is synchronized between the client
and the FreeIPA server.
+ </div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">3.5.2. Configuring
the AIX Client</h3></div></div></div><div
class="para">
+ Setting up an AIX client requires setting up the client to work in the FreeIPA
Kerberos domain and, optionally, to enable SSH authentication to the AIX client using
FreeIPA credentials.
</div><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
+ Kerberos configuration includes specifying the realm and domain details, and default
ticket attributes. Forwardable tickets are configured by default, which facilitates
connection to the administration interface from any operating system, and also provides
for auditing of administration operations. For example:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Configure the krb5 client settings as follows:
- </div><div class="para">
- <code class="command"># mkkrb5clnt -r
EXAMPLE.COM -d
example.com -c
ipaclient.example.com -s ipaserver.example.com</code>
- </div></li><li class="listitem"><div
class="para">
+ Configure the krb5 client settings to use the FreeIPA Kerberos domain:
+ </div><pre class="programlisting"><span
class="perl_Comment"># mkkrb5clnt -r
EXAMPLE.COM -d
example.com -c
ipaclient.example.com -s ipaserver.example.com</span></pre></li><li
class="listitem"><div class="para">
Get a Kerberos ticket:
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- Configure the LDAP client settings as follows:
- </div><div class="para">
- <code class="command"># mksecldap -c -h
ipaserver.example.com -d
cn=accounts,dc=example,dc=com -a uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com -p
secret</code>
- </div></li><li class="listitem"><div
class="para">
- In the <code class="filename">/etc/security/ldap</code>
directory, create the following map files:
+ </div><pre class="programlisting"><span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ Configure the LDAP client settings to use the FreeIPA directory services:
+ </div><pre class="programlisting"><span
class="perl_Comment"># mksecldap -c -h
ipaserver.example.com -d
cn=accounts,dc=example,dc=com -a uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com -p
secret</span></pre></li><li class="listitem"><div
class="para">
+ In the <code class="filename">/etc/security/ldap</code>
directory, create user and group map files:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- FreeIPAuser.map
+ For example, for the <code
class="filename">FreeIPAuser.map</code> file:
</div><pre class="programlisting">#FreeIPAuser.map file
keyobjectclass SEC_CHAR posixaccount s
@@ -70,13 +58,13 @@ gecos SEC_CHAR gecos s
spassword SEC_CHAR userpassword s
lastupdate SEC_INT shadowlastchange s
</pre></li><li class="listitem"><div
class="para">
- FreeIPAgroup.map
+ For example, for the <code
class="filename">FreeIPAgroup.map</code> file:
</div><pre class="programlisting">#FreeIPAgroup.map file
groupname SEC_CHAR cn s
id SEC_INT gidNumber s
users SEC_LIST member m
</pre></li></ul></div></li><li
class="listitem"><div class="para">
- Modify the <code
class="filename">/etc/security/ldap/ldap.cfg</code> file as follows.
Remember to specify your own REALM and basedn values.
+ Modify the <code
class="filename">/etc/security/ldap/ldap.cfg</code> file to set the
REALM and base DN values for the FreeIPA domain.
</div><pre
class="programlisting">userbasedn:cn=users,cn=accounts,dc=example,dc=com
groupbasedn:cn=groups,cn=accounts,dc=example,dc=com
@@ -86,13 +74,9 @@ groupattrmappath:/etc/security/ldap/FreeIPAgroup.map
userclasses:posixaccount
</pre></li><li class="listitem"><div
class="para">
Start the LDAP client daemon:
- </div><div class="para">
- <code class="command"># start-secldapclntd</code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment">#
start-secldapclntd</span></pre></li><li
class="listitem"><div class="para">
Test the LDAP client connection to the FreeIPA server:
- </div><div class="para">
- <code class="command"># lsldap -a passwd </code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># lsldap -a
passwd</span></pre></li><li class="listitem"><div
class="para">
Add the following sections to the <code
class="filename">/usr/lib/security/methods.cfg</code> file to configure
the system login to use Kerberos and LDAP:
<pre class="programlisting">KRB5A:
program = /usr/lib/security/KRB5A
@@ -108,84 +92,68 @@ options = auth=KRB5A,db=LDAP
</pre>
</div></li><li class="listitem"><div
class="para">
- Edit the <code class="filename">/etc/security/user</code>
file, and modify the "default" section as follows:
+ Edit the <code class="filename">/etc/security/user</code>
file, and modify the <code class="command">default</code> section to
use the Kerberos/LDAP system and the LDAP user registry.
<pre class="programlisting">SYSTEM = "KRB5ALDAP"
registry = LDAP
</pre>
- </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3. Configuring
Client SSH Access</h3></div></div></div><div
class="para">
- You can also configure the FreeIPA client to accept incoming SSH requests and
authenticate with the user's Kerberos credentials. After configuring the FreeIPA
client, use the following procedure to configure the FreeIPA client for SSH connections.
Remember to replace the example host and domain names with your own host and domain name.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- SSH syslog configuration:
- </div><pre class="programlisting">auth.info
/var/log/sshd.log
+ </div></li><li class="listitem"><div
class="para">
+ To test the Kerberos configuration, log in as a FreeIPA user and verify that the
user and group information is correct:
+ </div><pre class="programlisting">$ <span
class="perl_BString">id</span></pre></li><li
class="listitem"><div class="para">
+ Optionally, configure the FreeIPA client to accept incoming SSH requests and
authenticate with the user's Kerberos credentials.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Set the SSH syslog configuration:
+ </div><pre class="programlisting">auth.info
/var/log/sshd.log
auth.info /var/log/sshd.log
auth.crit /var/log/sshd.log
auth.warn /var/log/sshd.log
auth.notice /var/log/sshd.log
auth.err /var/log/sshd.log
</pre></li><li class="listitem"><div
class="para">
- SSH logging configuration:
- </div><pre class="programlisting">SyslogFacility AUTH
+ Set the SSH logging configuration:
+ </div><pre class="programlisting">SyslogFacility AUTH
LogLevel INFO
</pre></li><li class="listitem"><div
class="para">
- Configure sshd for GSSAPI (<code
class="filename">/etc/ssh/sshd_config</code>)
- </div><pre class="programlisting"># GSSAPI options
+ Configure <code class="systemitem">sshd</code> to use
GSSAPI:
+ </div><pre class="programlisting">vim /etc/ssh/sshd_config
+
+# GSSAPI options
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
</pre></li><li class="listitem"><div
class="para">
- Restart sshd:
- </div><div class="para">
- <code class="command"># stopsrc -s sshd</code>
- </div><div class="para">
- <code class="command"># startsrc -s sshd</code>
- </div></li><li class="listitem"><div
class="para">
- Restart syslogd:
- </div><div class="para">
- <code class="command"># stopsrc -s syslogd</code>
- </div><div class="para">
- <code class="command"># startsrc -s syslogd</code>
- </div></li><li class="listitem"><div
class="para">
- The <span class="package">ipa-admintools</span> package is
not available for AIX. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add a host service principal for the client.
- </div><div class="para">
- <code class="command"> # ipa service-add
host/ipaclient.example.com </code>
- </div></li><li class="listitem"><div
class="para">
- Retrieve the host keytab.
- </div><div class="para">
- <code class="command"> # ipa-getkeytab -s ipaserver -p
host/ipaclient.example.com -k /tmp/krb5.keytab -e des-cbc-crc </code>
- </div></li><li class="listitem"><div
class="para">
- Copy the keytab from the server to the client.
- </div><div class="para">
- <code class="command"> # scp /tmp/krb5.keytab
root@ipaclient.example.com:/tmp/krb5.keytab </code>
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
- </div><pre class="screen"># ktutil
+ Restart the <code class="filename">sshd</code> daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment"># stopsrc -s sshd</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># startsrc -s
sshd</span></pre></li><li class="listitem"><div
class="para">
+ Restart the <code class="filename">syslogd</code> daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment"># stopsrc -s syslogd</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># startsrc -s
syslogd</span></pre></li><li class="listitem"><div
class="para">
+ Add the client to the FreeIPA server's Kerberos configuration.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Add a host service principal for the client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/ipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ Retrieve the host keytab.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa-getkeytab -s ipaserver -p
host/ipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy the keytab from the server to the client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># scp /tmp/krb5.keytab
root@ipaclient.example.com:/tmp/krb5.keytab</span></pre></li></ol></div></li><li
class="listitem"><div class="para">
+ On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
+ </div><pre class="screen"># ktutil
ktutil: read_kt /tmp/krb5.keytab
ktutil: write_kt /etc/krb5/krb5.keytab
ktutil: q
</pre></li><li class="listitem"><div
class="para">
- Add a user that is only used for authentication. (This can be substituted with krb5
auth if that works from the ldap client). Otherwise go to the FreeIPA server and use
<code class="command">ldapmodify</code>, bind as Directory Manager
and create this user.
- </div><pre class="programlisting">dn:
uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com
+ On the FreeIPA server, add a user that is only used for authentication. (This can
be substituted with krb5 authentication if that works from the LDAP client). Otherwise go
to the FreeIPA server and use <code
class="command">ldapmodify</code>, bind as Directory Manager and create
this user. The user should be assigned a shared password.
+ </div><pre class="programlisting">ldapmodify -D
"cn=directory manager" -w secret -p 389 -h
ipaserver.example.com -x -a
+
+dn: uid=nss,cn=sysaccounts,cn=etc,dc=example,dc=com
objectClass: account
objectClass: simplesecurityobject
objectClass: top
uid: nss
-userPassword: Your own shared password here
+userPassword: secretpassword
</pre></li><li class="listitem"><div
class="para">
- On the FreeIPA server, get a ticket for the admin user.
- </div><div class="para">
- <code class="command"> # kinit admin </code>
- </div></li></ol></div><div class="para">
- You should be able to log in as admin using SSH without providing a password.
- </div><div class="para">
- <code class="command"> # ssh admin(a)ipaclient.example.com
</code>
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_AIX-Testing_System_Login"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_AIX-Testing_System_Login">2.5.4. Testing
System Login</h3></div></div></div><div
class="para">
- After you have completed the steps in <a class="xref"
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">Section 2.5.2,
“Configuring Client Authentication”</a> and <a class="xref"
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">Section 2.5.3,
“Configuring Client SSH Access”</a>, you should be able to log in as a FreeIPA user
on the AIX machine. Use the following tests to ensure that the configuration is working
correctly:
- </div><div class="para">
- On the system console, log in as a FreeIPA user. After you have logged in, open a
shell and run the following command:
- </div><div class="para">
- <code class="command">$ id</code> (ensure that the user IDs and
group IDs are correct)
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. You may need
to install bash (or link <code class="command">sh</code> to <code
class="command">/bin/bash</code> or modify admin to use <code
class="command">/bin/sh</code> or a shell available in all of your
systems) to be able to log in.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Prev</strong>2.4. Configuring
an HP-UX System as a FreeIPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Next</strong>2.6. Configuring
a Macintosh OS X System as a
Fre...</a></li></ul></body></html>
+ On the FreeIPA server, get a ticket for the admin user.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ To test the SSH configuration, try to log in as the admin user using SSH without
providing a password.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ssh
admin@ipaclient.example.com</span></pre></li></ol></div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. It may be
necessary to install bash to be able to log in.
+ </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Prev</strong>3.4. Configuring
an HP-UX System as a FreeIPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Next</strong>3.6. Configuring
a Macintosh OS X System as a
Fre...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_HP_UX.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_HP_UX.html
index b7ed54a..1f12db9 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_HP_UX.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_HP_UX.html
@@ -1,38 +1,28 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.4. Configuring an HP-UX System as a FreeIPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.4. Configuring an HP-UX System as a FreeIPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 2. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_Solaris.html" title="2.3. Configuring a
Solaris System as a FreeIPA Client" /><link rel="next"
href="Configuring_an_IPA_Client_on_AIX.html" title="2.5. Configuring an AIX
System as a FreeIPA Client" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="p
revious"><a accesskey="p"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_HP_UX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_HP_UX">2.4. Configuring an HP-UX System as a
FreeIPA</h2></div></div></div><div class="para">
- This chapter describes how to configure HP-UX as a FreeIPA client. It also includes
some verification tests to ensure that the configuration is working correctly.
- </div><div class="para">
- Before starting the FreeIPA installation, ensure that you update your system with all
the latest packages.
- </div><div class="para">
- To install an HP-UX client you need administrator privileges in the form of the
Directory Manager password. There is no other way to perform the installation.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_Solaris.html" title="3.3. Configuring a
Solaris System as a FreeIPA Client" /><link rel="next"
href="Configuring_an_IPA_Client_on_AIX.html" title="3.5. Configuring an AIX
System as a FreeIPA Client" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="p
revious"><a accesskey="p"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_HP_UX"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_HP_UX">3.4. Configuring an HP-UX System as a
FreeIPA</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP"><h5
class="formalpara">Configuring NTP</h5>
- Before proceeding with the following configuration steps, ensure that NTP is
correctly configured and enabled, and that time is synchronized between the client and the
FreeIPA server.
- </div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">2.4.1. Configuring
LDAP Authentication</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Install the ldapux client on the HP-UX 11.23 machine.
- </div><div class="para">
- <code class="command"> # swinstall -s
J4269AA_B.04.15.01_HP-UX_B.11.23_IA_PA.depot </code>
- </div></li><li class="listitem"><div
class="para">
- Change to the configuration directory and run the setup script.
- </div><div class="para">
- <code class="command"># cd /opt/ldapux/config/</code>
- </div><div class="para">
- <code class="command"># ./setup</code>
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You only need to perform this configuration on the first HP-UX client. All further
configurations only need to know where the LDAP profile is stored. All clients will then
use the same configuration.
+ </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1. Configuring
NTP</h3></div></div></div><div class="para">
+ Configure and enable NTP and make sure that time is synchronized between the client
and the FreeIPA server.
+ </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2. Configuring
LDAP Authentication</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Install the <code class="filename">ldapux</code> client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># swinstall -s
J4269AA_B.04.15.01_HP-UX_B.11.23_IA_PA.depot</span></pre></li><li
class="listitem"><div class="para">
+ Change to the configuration directory, and run the setup script.
+ </div><pre class="programlisting"><span
class="perl_Comment"># cd /opt/ldapux/config/</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span>
+<span class="perl_Comment"># ./setup</span></pre><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Running the setup script is only necessary for the first HP-UX client. Every
subsequent HP-UX client only needs to know where the LDAP profile is stored. All clients
will then use the same configuration.
</div><div class="para">
- The HP-UX guide for this procedure is located at <a
href="http://docs.hp.com/en/J4269-90075/ch02s07.html">http:/...
+ For more information on this, see the HP-UX documentation at <a
href="http://docs.hp.com/en/J4269-90075/ch02s07.html">http:/...;.
</div></div></div><div class="para">
- The following is a sample output from running the above script:
+ The setup script prompts for information about the FreeIPA LDAP service, such as
its port and host, Directory Manager credentials, and schema and directory suffixes.
</div><pre class="programlisting">Would you like to continue
with the setup? [Yes]
Select which Directory Server you want to connect to ? [RedHat Directory]
Directory server host ? [
ipaserver.example.com]
@@ -52,54 +42,36 @@ Bind time limit [5 seconds]
Search time limit [no limit]
Do you want client searches of the directory to follow referrals? [Yes]
Profile TTL [0 = infinite]
-Do you want to remap any of the standard <a
href="http://www.ietf.org/rfc/rfc2307.txt">RFC 2307</a> attribute?
[Yes]
+Do you want to remap any of the standard RFC 2307 attribute? [Yes]
Specify the service you want to map? [ 3=Group]
Specify the attribute you want to map [3 for memberuid ]
Type the name of the attribute memberuid should be mapped to [member]
Specify the service you want to map? [ 0 = exit ]
-Do you want to remap any of the standard <a
href="http://www.ietf.org/rfc/rfc2307.txt">RFC 2307</a> attribute? [ no
this time ]
+Do you want to remap any of the standard RFC 2307 attribute? [ no this time ]
Do you want to create custom search descriptors? [ No ]
</pre></li><li class="listitem"><div
class="para">
Ensure that the LDAP client daemon is running.
- </div><div class="para">
- <code class="command"># ps -ef | grep ldapclientd</code>
- </div><div class="para">
- If necessary, use the following command to start the daemon:
- </div><div class="para">
- <code class="command"># /opt/ldapux/bin/ldapclientd</code>
- </div></li><li class="listitem"><div
class="para">
- Run the following commands to ensure that the LDAP client is working:
- </div><div class="para">
- <code class="command"># nsquery passwd admin</code> (user
should be visible)
- </div><div class="para">
- <code class="command"># nsquery group admins</code> (group
and user should be visible)
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># ps -ef | grep
ldapclientd</span></pre><div class="para">
+ If necessary, start the daemon:
+ </div><pre class="programlisting"><span
class="perl_Comment">#
/opt/ldapux/bin/ldapclientd</span></pre></li><li
class="listitem"><div class="para">
+ Check that the user and group entries in the LDAP client are correct and
available:
+ </div><pre class="programlisting"><span
class="perl_Comment"># nsquery passwd admin</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># nsquery group
admins</span></pre></li><li class="listitem"><div
class="para">
Create a new group on the FreeIPA server.
- </div><div class="para">
- <code class="command"> # ipa group-add testgroup </code>
- </div></li><li class="listitem"><div
class="para">
- Add a test user to the new group created above.
- </div><div class="para">
- <code class="command"> # ipa group-add-member -a testuser testgroup
</code>
- </div></li><li class="listitem"><div
class="para">
- Run the <code class="command">nsquery</code> commands again
to validate the new user and group:
- </div><div class="para">
- <code class="command"># nsquery passwd testuser</code> (user
should be visible)
- </div><div class="para">
- <code class="command"># nsquery group testgroup</code> (group
and user should be visible)
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa group-add
testgroup</span></pre></li><li class="listitem"><div
class="para">
+ Add a test user to the new group.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa group-add-member -a testuser
testgroup</span></pre><div class="para">
+ Validate the new user and group:
+ </div><pre class="programlisting"><span
class="perl_Comment"># nsquery passwd testuser</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># nsquery group
testgroup</span></pre></li><li class="listitem"><div
class="para">
To ensure that the LDAP client daemon starts when the system boots, add the
following lines to the <code
class="filename">/etc/opt/ldapux/ldapclientd.conf</code> file:
<pre class="programlisting">[StartOnBoot]
enable=yes
</pre>
- </div></li></ol></div><div class="para">
- This concludes the LDAP client configuration.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2. Configuring
Kerberos and PAM</h3></div></div></div><div
class="para">
- The Kerberos and PAM configuration process is completely manual. Sample configuration
files are provided for reference, but you need to edit your own system files to reflect
your deployment.
- </div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos">2.4.2.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Edit the <code class="filename">/etc/krb5.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">[libdefaults]
+ </div></li></ol></div></div><div
class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3. Configuring
Kerberos</h3></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/krb5.conf</code> file to
reflect the Kerberos domain used by the FreeIPA server. Setting up the Kerberos
configuration includes specifying the realm and domain details, and default ticket
attributes. Forwardable tickets are configured by default, which facilitates connection to
the administration interface from any operating system, and also provides for auditing of
administration operations. For example:
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
default_tkt_enctypes = DES-CBC-CRC
default_tgs_enctypes = DES-CBC-CRC
@@ -121,46 +93,16 @@
example.com =
EXAMPLE.COM
kinit = {
forwardable = true
}
-</pre><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing administration operations.
- </div></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_PAM"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_PAM">2.4.2.2. Configuring
PAM</h4></div></div></div><div class="para">
- The PAM configuration differs slightly between different versions of HP-UX. These
configurations are described below.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_PAM-HP_UX_11i_v2"><h5
class="formalpara">HP-UX 11i v2</h5>
- Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">#
+</pre></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_PAM"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_PAM">3.4.4. Configuring
PAM</h3></div></div></div><div class="para">
+ The PAM configuration differs slightly between different versions of HP-UX.
+ </div><div class="section"
id="Configuring_PAM-HP_UX_11i_v2"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_PAM-HP_UX_11i_v2">3.4.4.1. HP-UX 11i
v2</h4></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/pam.conf</code> file so
that all of the required modules are loaded for authentication. For example:
+ </div><pre class="programlisting">#
# PAM configuration
#
# This pam.conf file is intended as an example only.
# see pam.conf(4) for more details
-#
-#
-################################################################
-# This sample file will authenticate the user who belongs to #
-# either Kerberos or Unix system. Using this configuration file#
-# if the user is authenticated through Kerberos then the Unix #
-# authentication will not be invoked. However,if the Kerberos #
-# authentication fails for the user, then the fallback #
-# authentication mechanism PAM-Unix will be invoked to #
-# authenticate the user.The assumption is the user is either #
-# present in Kerberos or in Unix system. #
-# #
-# In case, the administrator wants the password for all the #
-# users to be synchronous between Kerberos and Unix systems, #
-# then the control flag should to be set to "required" for all #
-# the entries with use_first_pass option set for pam_unix. #
-# If password synchronization is optional then try_first_pass #
-# option need to be set for pam_unix, so that the user can #
-# login using the appropriate passwords. #
-# #
-# The module pam_hpsec(5) is stacked as mandatory module above #
-# all the modules for making security checks before #
-# authentication. #
-
-################################################################
-#
-#
-
# Authentication management
#
login auth required libpam_hpsec.so.1
@@ -239,36 +181,15 @@ dtaction password required libpam_hpsec.so.1
dtaction password sufficient libpam_krb5.so.1
dtaction password required libpam_unix.so.1
OTHER password required libpam_unix.so.1
-</pre><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_PAM-HP_UX_11i_v1"><h5
class="formalpara">HP-UX 11i v1</h5>
- Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
- </div><pre class="programlisting">#
+</pre></div><div class="section"
id="Configuring_PAM-HP_UX_11i_v1"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_PAM-HP_UX_11i_v1">3.4.4.2. HP-UX 11i
v1</h4></div></div></div><div class="para">
+ Edit the <code class="filename">/etc/pam.conf</code> file to
reflect the following example:
+ </div><pre class="programlisting">#
# PAM configuration
#
# This pam.conf file is intended as an example only.
# see pam.conf(4) for more details
#
-################################################################
-# This sample file will authenticate the user who belongs to #
-# either Kerberos or Unix system. Using this configuration file#
-# if the user is authenticated through Kerberos then the Unix #
-# authentication will not be invoked. However,if the Kerberos #
-# authentication fails for the user, then the fallback #
-# authentication mechanism PAM-Unix will be invoked to #
-# authenticate the user.The assumption is the user is either #
-# present in Kerberos or in Unix system. #
-# #
-# In case, the administrator wants the password for all the #
-# users to be synchronous between Kerberos and Unix systems, #
-# then the control flag should to be set to "required" for all #
-# the entries with user_first_pass option set for pam_unix. #
-# If password synchronization is optional then try_first_pass #
-# option need to be set for pam_unix, so that the user can #
-# login using the appropriate passwords. #
-
-################################################################
-#
-
# Authentication management
#
login auth sufficient /usr/lib/security/libpam_krb5.1
@@ -321,52 +242,36 @@ dtlogin password required /usr/lib/security/libpam_unix.1
dtaction password sufficient /usr/lib/security/libpam_krb5.1
dtaction password required /usr/lib/security/libpam_unix.1
OTHER password required /usr/lib/security/libpam_unix.1
-</pre></div><div class="section"
id="Configuring_Kerberos_and_PAM-Configuring_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_and_PAM-Configuring_Access_Control">2.4.2.3. Configuring
Access Control</h4></div></div></div><div
class="para">
- On HP-UX systems a PAM module called pam_authz is available which can be used to
control login access to the system based on a user's group membership.
- </div><div class="para">
- Refer to the HP-UX documentation on pam_authz for details on how to configure access
control for HP-UX systems: <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3. Configuring
SSH</h3></div></div></div><div class="para">
- Before you can use SSH to connect to the FreeIPA server without using a password, you
need to install a suitable version of <code
class="command">ssh</code>, and set up the correct authentication
attributes in the SSH configuration file.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Ensure that you have version A.05.10.007 or later of <code
class="command">ssh</code> installed. Navigate to the following URL to
download a suitable version:
-<pre class="screen"><a
href="http://software.hp.com/portal/swdepot/displayProductInfo.do?pr...
-
+</pre></div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5. Configuring
SSH</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Ensure that you have version A.05.10.007 or later of <code
class="command">ssh</code> installed. A current package can be
downloaded from the HO website at <a
href="http://software.hp.com/portal/swdepot/displayProductInfo.do?pr...;.
</div></li><li class="listitem"><div
class="para">
- Make the following changes to the <code
class="filename">/etc/opt/ssh/ssh_config</code> file:
- <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Remove any "PreferredAuthentications" entries.
- </div></li><li class="listitem"><div
class="para">
- Add the following three lines:
+ Edit the <code
class="filename">/etc/opt/ssh/ssh_config</code> file:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Remove any <code
class="command">PreferredAuthentications</code> entries.
+ </div></li><li class="listitem"><div
class="para">
+ Add the following three lines:
<pre class="programlisting">Host *
GSSAPIAuthentication yes
PreferredAuthentications "gssapi-with-mic,publickey,password"
</pre>
- </div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
- Ensure that you include the tab character before the
"GSSAPIAuthentication" and "PreferredAuthentications" entries, and the
double quotes around the "PreferredAuthentications" argument.
- </div></div></div></li></ul></div>
-
- </div></li><li class="listitem"><div
class="para">
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ Include the tab character before the <code
class="command">GSSAPIAuthentication</code> and <code
class="command">PreferredAuthentications</code> lines, and include the
double quotes around the <code
class="command">PreferredAuthentications</code> value.
+ </div></div></div></li></ul></div></li><li
class="listitem"><div class="para">
Remove the <code class="filename">/etc/krb5.keytab</code>
file.
</div></li><li class="listitem"><div
class="para">
- On the FreeIPA server:
+ Set up the NFS/Kerberos mapping for the Solaris client <span
class="emphasis"><em>on the FreeIPA server</em></span>.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Add a host service principal for the HP-UX client.
- </div><div class="para">
- <code class="command"> # ipa service-add
host/hpuxipaclient.example.com </code>
- </div></li><li class="listitem"><div
class="para">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/hpuxipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
Create the host keytab file.
- </div><div class="para">
- <code class="command"> # ipa-getkeytab -s
ipaserver.example.com
-p
host/hpuxipaclient.example.com -k /tmp/krb5.keytab -e des-cbc-crc</code>
- </div></li><li class="listitem"><div
class="para">
- Copy this keytab to the HP-UX machine as <code
class="filename">/etc/krb5/krb5.keytab</code>.
- </div><div class="para">
- <code class="command"> # scp /tmp/krb5.keytab
root@hpuxipaclient.example.com:/etc/krb5/krb5.keytab </code>
- </div></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4. Configuring
Access Control</h3></div></div></div><div
class="para">
- HP-UX systems provide a PAM module called pam_authz which can be used to control
login access to the system based on a user's group membership. Refer to the following
HP-UX pam_authz documentation for details on how to configure access control for HP-UX
systems: <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...
- </div><div class="para">
- The following is a sample <code
class="filename">/etc/opt/ldapux/pam_authz.policy</code> file:
-<pre class="programlisting">
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa-getkeytab -s
ipaserver.example.com -p
host/hpuxipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy this keytab to the HP-UX machine, and save it as <code
class="filename">/etc/krb5/krb5.keytab</code>.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># scp /tmp/krb5.keytab
root@hpuxipaclient.example.com:/etc/krb5/krb5.keytab</span></pre></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6. Configuring
Access Control</h3></div></div></div><div
class="para">
+ HP-UX systems provide the <code
class="systemitem">pam_authz</code> PAM module, which can be used to
control login access to the system based on a user's group membership. For details on
how to configure access control with this module, see the HP documenttion at <a
href="http://docs.hp.com/en/B3921-60631/pam_authz.5.html">ht...;.
+ </div><div class="example"
id="ex.hp-pam-authz-mod"><h6>Example 3.1. pam_authz.policy File: Allow
User Access, Deny Admin Access</h6><div
class="example-contents"><div class="para">
+ This configuration in <code
class="filename">/etc/opt/ldapux/pam_authz.policy</code> prevents the
admin user from logging in while still allowing regular users to log in.
+ </div><pre class="programlisting">
# pam_authz.policy.template:
#
# An example file that could be copied over to /etc/opt/ldapux/pam_authz.policy.
@@ -400,26 +305,15 @@ OTHER password required /usr/lib/security/libpam_unix.1
deny:unix_group:admins
allow:unix_local_user
-</pre>
-
- </div><div class="para">
- This configuration will prevent the admin user from logging in, but local UNIX users
can still log in.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5. Testing
the Configuration</h3></div></div></div><div
class="para">
- Use the following tests to validate the PAM and Kerberos configuration:
+</pre></div></div><br class="example-break"
/></div><div class="section" id="hp-test"><div
class="titlepage"><div><div><h3 class="title"
id="hp-test">3.4.7. Testing the
Configuration</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. It may be
necessary to install bash to be able to log in.
+ </div></div></div><div class="para">
+ There are three quick ways to check the Kerberos and PAM configuration for the HP
client:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- On the HP-UX client machine, run <code class="command">kinit
admin</code> and enter the password.
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div><div class="para">
- <code class="command"># klist</code> (to verify that you
received a valid ticket)
- </div></li><li class="listitem"><div
class="para">
- From another Linux client machine, attempt to log in using SSH.
- </div><div class="para">
- <code class="command"> # ssh admin(a)hpuxipaclient.example.com
</code>
- </div><div class="para">
- The admin user should be able to log in using SSH without being asked for a
password.
- </div></li></ul></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
- On the HP-UX client console, at the login prompt, enter the Administrator's
login ID and password. The admin user should be able to log in from the console.
- </div></li></ul></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- By default, the admin user is given <code
class="command">/bin/bash</code> as the shell to use and <code
class="filename">/home/admin</code> as the home directory. You may need
to install bash (or link sh to /bin/bash or modify admin to use /bin/sh or a shell
available in all of your systems) to be able to log in.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Prev</strong>2.3. Configuring
a Solaris System as a FreeIPA Cl...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Next</strong>2.5. Configuring
an AIX System as a FreeIPA
Client</a></li></ul></body></html>
+ Attempt to log into the Kerberos realm <span
class="emphasis"><em>from the client machine</em></span> by
using the admin credentials:
+ </div><pre class="programlisting"><span
class="perl_Comment"># kinit admin</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span><span
class="perl_Comment"># klist</span></pre></li><li
class="listitem"><div class="para">
+ Attempt to log into the HP machine from another machine in the domain using SSH.
The admin user should be able to log in using SSH without being asked for a password.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ssh
admin(a)hpuxipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ Log into the FreeIPA web UI using the administrator credentials on the HP machine.
+ </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_Solaris.html"><strong>Prev</strong>3.3. Configuring
a Solaris System as a FreeIPA Cl...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Next</strong>3.5. Configuring
an AIX System as a FreeIPA
Client</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Macintosh_OS_X.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Macintosh_OS_X.html
index 3cb3c66..28333a6 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Macintosh_OS_X.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Macintosh_OS_X.html
@@ -1,46 +1,38 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.6. Configuring a Macintosh OS X System as a FreeIPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.6. Configuring a Macintosh OS X System as a FreeIPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 2. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_AIX.html" title="2.5. Configuring an AIX
System as a FreeIPA Client" /><link rel="next"
href="basic-usage.html" title="Chapter 3. Basic Usage"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_an_IPA_Clie
nt_on_AIX.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="basic-usage.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X">2.6. Configuring a Macintosh
OS X System as a FreeIPA Client</h2></div></div></div><div
class="para">
- This chapter describes how to configure Macintosh OS X as a FreeIPA client. These
instructions are specific to Mac OS X 10.4 (Tiger). This version of the OS includes a
partial install of the Kerberos tools you need by default, especially if you perform an
upgrade from 10.1 or 10.2.
- </div><div class="para">
- Before starting the FreeIPA installation, ensure that you update the system with all
the latest packages.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The FreeIPA client installation process requires that a FreeIPA server already
exist.
- </div><div class="para">
- Many of the following procedures and instructions use example host names, domain
names, and realm names for illustration purposes. You need to replace these example names
with those that apply to your own deployment.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1. Configuring
Kerberos Authentication</h3></div></div></div><div
class="para">
- The current version of FreeIPA does not provide for automatic configuration of
Macintosh clients. Configuring authentication is a manual process, and is described in the
following sections.
- </div><div class="section"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos">2.6.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Configuring the Macintosh to use Kerberos for authentication with FreeIPA is a
two-step process: First, Kerberos needs to be correctly installed and configured, and
second, the Kerberos authentication needs to be enabled.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_AIX.html" title="3.5. Configuring an AIX
System as a FreeIPA Client" /><link rel="next"
href="uninstalling-clients.html" title="3.7. Uninstalling a FreeIPA
Client" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="Con
figuring_an_IPA_Client_on_AIX.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X">3.6. Configuring a Macintosh
OS X System as a FreeIPA Client</h2></div></div></div><div
class="para">
+ These instructions are specific to Mac OS X 10.4 (Tiger) because this version includes
the required Kerberos tools by default.
+ </div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1. Configuring
Kerberos Authentication</h3></div></div></div><div
class="para">
+ Configuring the Macintosh to use Kerberos for authentication with FreeIPA is a
two-step process. First, Kerberos needs to be correctly installed and configured. Then,
Kerberos authentication needs to be enabled.
+ </div><div class="section"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Configuring_Kerberos">3.6.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
+ Setting up the Kerberos configuration includes specifying the realm and domain
details, and default ticket attributes. Forwardable tickets are configured by default,
which facilitates connection to the administration interface from any operating system,
and also provides for auditing of administration operations. For example, this is the
Kerberos configuration for Fedora systems:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Ensure that <code
class="filename">/System/Library/CFMSupport/Kerberos</code> is version
4.2 or higher. If that directory does not exist or is the wrong version, install the
Kerberos Extras support.
+ Make sure that the Kerberos version is 4.2 or higher. The Kerberos directory is
<code class="filename">/System/Library/CFMSupport/Kerberos</code>.
If that directory does not exist or is the wrong version, install the Kerberos Extras
support.
</div></li><li class="listitem"><div
class="para">
- Launch <span
class="application"><strong>/System/Library/Coreservices/Kerberos</strong></span>
+ Launch the Kerberos management application. This is in <code
class="filename">/System/Library/Coreservices/Kerberos</code>.
</div></li><li class="listitem"><div
class="para">
From the <span
class="guimenu"><strong>Edit</strong></span> menu, choose
<span class="guimenuitem"><strong>Edit
Realms</strong></span>.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Settings</strong></span> tab,
enter the FreeIPA server's Kerberos realm (for example,
EXAMPLE.COM).
+ In the <span
class="guilabel"><strong>Settings</strong></span> tab,
enter the FreeIPA server's Kerberos realm, for example,
EXAMPLE.COM.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Servers</strong></span> tab, leave
two lines, whose hostnames you then need to replace with the FreeIPA server's hostname
(for example,
ipaserver.example.com):
+ In the <span
class="guilabel"><strong>Servers</strong></span> tab, enter
the FreeIPA server's hostname for the <span
class="guilabel"><strong>kdc</strong></span> and <span
class="guilabel"><strong>admin</strong></span> values:
</div><pre class="programlisting">kdc
ipaserver.example.com
88
admin
ipaserver.example.com 749
</pre></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Domains</strong></span> tab,
replace the existing domains with the FreeIPA server's actual domain (such as
example.com):
+ In the <span
class="guilabel"><strong>Domains</strong></span> tab,
replace the existing domains with the FreeIPA server's actual domain, such as
example.com:
</div><pre
class="programlisting">.example.com
example.com
</pre></li><li class="listitem"><div
class="para">
Click <span class="guibutton"><strong>Make
default</strong></span> to create the necessary configuration file, and then
close the Kerberos tool.
</div><div class="para">
- This step creates the <code
class="filename">/Library/Preferences/edu.mit.kerberos</code> file, and
it is recommended that you check this file manually to ensure that it is correct.
- </div><div class="para">
- This file should look similar to the following example. Remember to replace the
example.com settings with your own FreeIPA server name, Kerberos realm and domain
details.
+ This creates the <code
class="filename">/Library/Preferences/edu.mit.kerberos</code> file.
Check this file manually to ensure that it is correct. For example:
</div><pre class="programlisting">[domain_realm]
example.com =
EXAMPLE.COM
.example.com = .EXAMPLE.COM
@@ -58,94 +50,90 @@
EXAMPLE.COM = {
default_domain =
example.com
kdc = ipaserver.example.com:88
}
-</pre></li></ol></div><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
- </div></div><div class="section"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication">2.6.1.2. Enabling
Kerberos Authentication</h4></div></div></div><div
class="para">
- You now need to modify the <code
class="filename">/private/etc/authorization</code> file to allow
Kerberos authentication.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Log in as the admin user and launch the <span
class="application"><strong>/Applications/Utilities/Terminal</strong></span>
application.
+</pre></li></ol></div></div><div
class="section"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Authentication-Enabling_Kerberos_Authentication">3.6.1.2. Enabling
Kerberos Authentication</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Log in as the admin user and launch a terminal.
</div></li><li class="listitem"><div
class="para">
Change to the <code class="filename">/private/etc</code>
directory and make a backup of the existing authorization file.
- </div><div class="para">
- <code class="command"># cd /private/etc</code>
- </div><div class="para">
- <code class="command"># cp -p authorization
authorization_bak</code>
- </div></li><li class="listitem"><div
class="para">
- Open the authorization file, and locate the string
"system.login.console".
- </div></li><li class="listitem"><div
class="para">
- Locate the <em
class="parameter"><code>dict</code></em> entry below this
string, and then locate the <em
class="parameter"><code>mechanisms</code></em> entry.
- </div></li><li class="listitem"><div
class="para">
- Change <em
class="parameter"><code>authinternal</code></em> to <em
class="parameter"><code>builtin:krb5authnoverify,privileged</code></em>
- </div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
- Several instances of <em
class="parameter"><code>authinternal</code></em> may occur
in this file. Ensure that you change the correct instance.
+ </div><pre class="programlisting"><span
class="perl_Comment"># cd /private/etc</span><span
class="perl_Comment"></span>
+<span class="perl_Comment"></span>
+<span class="perl_Comment"># cp -p authorization
authorization_bak</span></pre></li><li
class="listitem"><div class="para">
+ Open the authorization file.
+ </div><pre class="programlisting"><span
class="perl_Comment"># vim
/private/etc/authorization</span></pre></li><li
class="listitem"><div class="para">
+ Locate the string <code
class="command">system.login.console</code>, and then edit the <em
class="parameter"><code>dict</code></em> and the <em
class="parameter"><code>mechanisms</code></em> entry just
beneath this line.
+ </div></li><li class="listitem"><div
class="para">
+ Change <em
class="parameter"><code>authinternal</code></em> to <em
class="parameter"><code>builtin:krb5authnoverify,privileged</code></em>.
+ </div><div class="warning"><div
class="admonition_header"><h2>WARNING</h2></div><div
class="admonition"><div class="para">
+ Several instances of <em
class="parameter"><code>authinternal</code></em> may occur
in this file. Change only the instance for <code
class="command">system.login.console</code>.
</div></div></div></li><li
class="listitem"><div class="para">
Save and close the file.
</div></li><li class="listitem"><div
class="para">
Restart the machine to enable Kerberos authentication.
- </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2. Configuring
LDAP Authorization</h3></div></div></div><div
class="para">
- These instructions are specific to Mac OS X 10.4 (Tiger).
- </div><div class="section"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration">2.6.2.1. Creating
the LDAP Configuration</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Launch <span
class="application"><strong>/Applications/Utilities/Directory
Access</strong></span>.
+ </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2. Configuring
LDAP Authorization</h3></div></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Creating_the_LDAP_Configuration">3.6.2.1. Creating
the LDAP Configuration</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Launch the Directory Access utility.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Services</strong></span> tab,
clear all check boxes except LDAPv3 and Bonjour.
+ In the <span
class="guilabel"><strong>Services</strong></span> tab,
clear all check boxes except LDAPv3 and Bonjour.
</div></li><li class="listitem"><div
class="para">
- Select the <span
class="guilabel"><strong>LDAPv3</strong></span> entry and
click <span
class="guibutton"><strong>Configure</strong></span>.
+ Select the <span
class="guilabel"><strong>LDAPv3</strong></span> entry, and
click <span
class="guibutton"><strong>Configure</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Ensure the <span class="guilabel"><strong>Add DHCP-supplied
LDAP servers</strong></span> check box is not selected.
+ Make sure the <span class="guilabel"><strong>Add
DHCP-supplied LDAP servers</strong></span> checkbox is not selected.
</div></li><li class="listitem"><div
class="para">
Click the arrow next to the <span
class="guilabel"><strong>Show Options</strong></span>
label, and then click <span
class="guibutton"><strong>New</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Enter the Server Name (for example,
ipaserver.example.com).
+ Enter the server hostname in the <span
class="guilabel"><strong>Server Name</strong></span> field,
such as <code class="command">ipaserver.example.com</code>.
</div></li><li class="listitem"><div
class="para">
- Clear the <span class="guilabel"><strong>Encrypt using
SSL</strong></span> check box, and then click <span
class="guibutton"><strong>Manual</strong></span>.
+ Clear the <span class="guilabel"><strong>Encrypt using
SSL</strong></span> checkbox, and then click <span
class="guibutton"><strong>Manual</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Enter the Configuration Name (for example, "FreeIPA LDAP").
+ Enter the configuration name, such as <code
class="command">FreeIPA LDAP</code>.
</div></li><li class="listitem"><div
class="para">
- Ensure that the <span
class="guilabel"><strong>Enable</strong></span> check box
is selected, and that the <span
class="guilabel"><strong>SSL</strong></span> check box is
cleared.
- </div></li></ol></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">2.6.2.2. Setting
up the LDAP Service Configuration
Options</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Select the newly-created LDAP configuration and then click <span
class="guibutton"><strong>Edit</strong></span>.
+ Select the <span
class="guilabel"><strong>Enable</strong></span> checkbox,
and clear the <span
class="guilabel"><strong>SSL</strong></span> checkbox.
+ </div></li></ol></div></div><div
class="section"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">3.6.2.2. Setting
up the LDAP Service Configuration
Options</h4></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Select the newly-created LDAP configuration, and click <span
class="guibutton"><strong>Edit</strong></span>.
</div></li><li class="listitem"><div
class="para">
- On the <span
class="guilabel"><strong>Connection</strong></span> tab,
specify the following:
+ In the <span
class="guilabel"><strong>Connection</strong></span> tab,
specify the connection settings:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Open/close times out in: 10 seconds
- </div></li><li class="listitem"><div
class="para">
- Query times out in: 10 seconds
+ Open/close times out in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Re-bind attempted in: 10 seconds
+ Query times out in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Connection idles out in: 1 minute
+ Re-bind attempted in 10 seconds
</div></li><li class="listitem"><div
class="para">
- Clear all check boxes
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, specify the following:
+ Connection idles out in 1 minute
+ </div></li></ol></div><div class="para">
+ Clear all checkboxes.
+ </div></li><li class="listitem"><div
class="para">
+ In the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, set the <span
class="guilabel"><strong>Access this LDAP server
using</strong></span> value to <code
class="command">CUSTOM</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Still in the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, configure the naming attributes used by
entries:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Access this LDAP server using: CUSTOM
+ In the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, select <span
class="guilabel"><strong>Default Attribute
Types</strong></span>.
</div></li><li class="listitem"><div
class="para">
- In the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, select <span
class="guilabel"><strong>Default Attribute
Types</strong></span>, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ Click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, select <span
class="guilabel"><strong>RecordName</strong></span> from
the list, and then click <span
class="guibutton"><strong>OK</strong></span>.
+ Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, then select <span
class="guilabel"><strong>RecordName</strong></span> from
the list.
</div></li><li class="listitem"><div
class="para">
- Select the newly-added RecordName attribute, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
+ Select the newly-added <code
class="command">RecordName</code> attribute, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
</div></li><li class="listitem"><div
class="para">
- Type "uid" (without the quotes) in the text box. Click outside of the
text box to set the value.
+ Type <em
class="parameter"><code>uid</code></em> in the text box to
set the LDAP attribute used for naming. Click outside the text box to set the value.
</div></li></ol></div></li><li
class="listitem"><div class="para">
- Add a Users record, as follows:
+ Still in the <span class="guilabel"><strong>Search &
Mappings</strong></span> tab, add a users record:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Under the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Record
Types</strong></span> option, select <span
class="guilabel"><strong>Users</strong></span> from the
list, and then click <span
class="guibutton"><strong>OK</strong></span>.
+ Select the <span class="guilabel"><strong>Record
Types</strong></span> option, and select <span
class="guilabel"><strong>Users</strong></span> from the
list.
</div></li><li class="listitem"><div
class="para">
Select the newly-added <span
class="guilabel"><strong>Users</strong></span> record type,
and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
</div></li><li class="listitem"><div
class="para">
- Type "inetOrgPerson" (without the quotes) in the text box. Click
outside of the text box to set the value.
+ Type <em
class="parameter"><code>inetOrgPerson</code></em> in the
text box. Click outside the text box to set the value.
</div></li><li class="listitem"><div
class="para">
- In the <span class="guilabel"><strong>Search
base</strong></span> field, type "dc=example,dc=com" (without the
quotes), and select the <span class="guilabel"><strong>Search in all
subtrees</strong></span> option.
+ In the <span class="guilabel"><strong>Search
base</strong></span> field, type the base DN of the FreeIPA LDAP service, such
as <code class="command">dc=example,dc=com</code>
+ </div></li><li class="listitem"><div
class="para">
+ Select the <span class="guilabel"><strong>Search in all
subtrees</strong></span> option.
</div></li></ol></div></li><li
class="listitem"><div class="para">
- Add attributes to the Users record as appropriate for your deployment. The
following is an example of the required procedure.
+ Add attributes to the users record as appropriate.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Under the <span class="guilabel"><strong>Record Types and
Attributes</strong></span> panel, click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, and then use <span
class="keycap"><strong>Command</strong></span>+<span
class="mousebutton">Click</span> to select the attributes that you want
to add. For example, a typical deployment might include the following attributes:
+ Select the <span class="guilabel"><strong>Attribute
Types</strong></span> option, and then use <span
class="keycap"><strong>Ctrl</strong></span> to select
multiple attributes. Common attributes to add include:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
AuthenticationAuthority
</div></li><li class="listitem"><div
class="para">
@@ -158,44 +146,38 @@
EXAMPLE.COM = {
UniqueID
</div></li><li class="listitem"><div
class="para">
UserShell
- </div></li></ul></div></li><li
class="listitem"><div class="para">
- Click <span
class="guibutton"><strong>OK</strong></span> to add the
selected attributes to the <span
class="guilabel"><strong>Users</strong></span> record.
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- Specify appropriate mappings for the attributes that you just added. For example:
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Select the <span class="guilabel"><strong>Authentication
Authority</strong></span> record type, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel.
- </div></li><li class="listitem"><div
class="para">
- Type "#;Kerberosv5;;$uid$;EXAMPLE.COM" (without the quotes) in the
text box. Click outside of the text box to set the value.
- </div></li><li class="listitem"><div
class="para">
- Use the same procedure to map PrimaryGroupID to gidNumber.
+ </div></li></ul></div></li></ol></div></li><li
class="listitem"><div class="para">
+ Specify appropriate mappings for the new attributes. Select the <span
class="guilabel"><strong>Authentication
Authority</strong></span> record type, and then click <span
class="guibutton"><strong>Add</strong></span> under the
<span class="guilabel"><strong>Map to any items in
list</strong></span> panel. The attribute mappings have the format <code
class="command">#;</code><span
class="emphasis"><em>Mac-attribute</em></span><code
class="command">;;$</code><span
class="emphasis"><em>LDAP-attribute</em></span><code
class="command">$;</code><span
class="emphasis"><em>value</em></span>. For example, for
the Kerberosv5 principal, the UID, and the realm, the mapping is <code
class="command">#;Kerberosv5;;$uid$;EXAMPLE.COM</code>. These are
common mappings:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Kerberosv5 and UID
</div></li><li class="listitem"><div
class="para">
- Use the same procedure to map UniqueID to uidNumber.
+ PrimaryGroupID and gidNumber
</div></li><li class="listitem"><div
class="para">
- Continue until all required entries have been mapped, and then click <span
class="guibutton"><strong>OK</strong></span>.
- </div></li></ol></div></li><li
class="listitem"><div class="para">
+ UniqueID and uidNumber
+ </div></li></ul></div></li><li
class="listitem"><div class="para">
Click <span
class="guibutton"><strong>OK</strong></span> to finish
setting up the LDAP service configuration options.
- </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3. Configuring
the LDAP Authorization Options</h3></div></div></div><div
class="para">
- You now need to add the LDAP service to the list of locations used to search for user
authentication information.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- On the <span
class="guilabel"><strong>Authentication</strong></span>
tab, change the <span
class="guilabel"><strong>Search</strong></span> value to
<span class="guilabel"><strong>Custom
path</strong></span>, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ </div></li></ol></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3. Configuring
the LDAP Authorization Options</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ In the <span
class="guilabel"><strong>Authentication</strong></span>
tab, change the <span
class="guilabel"><strong>Search</strong></span> value to
<span class="guilabel"><strong>Custom
path</strong></span>.
+ </div></li><li class="listitem"><div
class="para">
+ Click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Select the configuration that you added in the Creating the LDAP Configuration
step, and then click <span
class="guibutton"><strong>Add</strong></span>.
+ Select the configuration created in <a class="xref"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_LDAP_Authorization-Setting_up_the_LDAP_Service_Configuration_Options">Section 3.6.2.2,
“Setting up the LDAP Service Configuration Options”</a>, and click <span
class="guibutton"><strong>Add</strong></span>.
</div></li><li class="listitem"><div
class="para">
- Click <span
class="guibutton"><strong>Apply</strong></span> to update
the LDAP configuration, and then exit the <span
class="application"><strong>Directory
Access</strong></span> application.
- </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4. Configuring
NTP</h3></div></div></div><div class="para">
- Open the Date & Time utility and point it to the FreeIPA server URL to set
the date and time automatically.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH">2.6.5. Accessing
the FreeIPA Server Using SSH</h3></div></div></div><div
class="para">
- After configuring client authentication, you should be able to use SSH to connect to
the FreeIPA server without being prompted for a password.
+ Click <span
class="guibutton"><strong>Apply</strong></span> to update
the LDAP configuration.
+ </div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4. Configuring
NTP</h3></div></div></div><div class="para">
+ Open the Date and Time utility and point it to the FreeIPA server URL to set the date
and time automatically.
+ </div></div><div class="section"
id="testing-config-on-mac"><div
class="titlepage"><div><div><h3 class="title"
id="testing-config-on-mac">3.6.5. Testing the
Configuration</h3></div></div></div><div
class="para">
+ If client authentication is properly configured, a user can connect to the FreeIPA
server using SSH without being prompted for a password.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Obtain a Kerberos ticket for the admin user.
- </div><div class="para">
- <code class="command"> # kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- If you have a valid Kerberos ticket, SSH should proceed with GSSAPI authentication
without asking for a password:
- </div><pre class="programlisting"><span
class="perl_Comment"># ssh
admin@ipaserver.example.com</span></pre></li></ol></div></div><div
class="section"
id="Macintosh_OS_X-Configuring_System_Login"><div
class="titlepage"><div><div><h3 class="title"
id="Macintosh_OS_X-Configuring_System_Login">2.6.6. Configuring System
Login</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- On the Macintosh login window, log in as a FreeIPA user.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># kinit admin</span></pre></li><li
class="listitem"><div class="para">
+ Log into the server using SSH.
+ </div><pre class="programlisting"><span
class="perl_Comment"># ssh
admin@ipaserver.example.com</span></pre></li></ol></div><div
class="para">
+ Also, check the system login.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Log in as a FreeIPA user.
</div></li><li class="listitem"><div
class="para">
- First, check the user ID to make sure that both the user and group IDs are correct
for the current account.
+ Check the user ID to make sure that both the user and group IDs are correct for the
current account.
</div><pre class="programlisting">$ <span
class="perl_BString">id</span>
<span class="perl_Others">uid=</span>10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span> <span
class="perl_Others">gid=</span>10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span> <span
class="perl_Others">groups=</span>3<span
class="perl_Others">(</span>sys<span
class="perl_Others">)</span>,100<span
class="perl_Others">(</span>users<span
class="perl_Others">)</span>,1070<span
class="perl_Others">(</span>devel2<span
class="perl_Others">)</span>,10678<span
class="perl_Others">(</span>jsmith<span
class="perl_Others">)</span></pre></li><li
class="listitem"><div class="para">
@@ -213,6 +195,4 @@ Valid starting Expires Service principal
Kerberos 4 ticket cache: /tmp/tkt10678
klist: You have no tickets cached</pre>
- </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- To open the Terminal application, navigate to <span
class="application"><strong>Applications/Utilities/Terminal.app</strong></span>
or use the keyboard shortcut <span
class="keycap"><strong>Command-Shift-U</strong></span>. You
can also drag the Terminal icon to the Dock to make it permanently available on your
Desktop.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Prev</strong>2.5. Configuring
an AIX System as a FreeIPA Client</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="basic-usage.html"><strong>Next</strong>Chapter 3. Basic
Usage</a></li></ul></body></html>
+ </div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_AIX.html"><strong>Prev</strong>3.5. Configuring
an AIX System as a FreeIPA Client</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong>3.7. Uninstalling
a FreeIPA Client</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Installing_the_IPA_Client_on_Red_Hat_Enterprise_Linux.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Installing_the_IPA_Client_on_Red_Hat_Enterprise_Linux.html
new file mode 100644
index 0000000..dc7e4bb
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Installing_the_IPA_Client_on_Red_Hat_Enterprise_Linux.html
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.2. Configuring a Red Hat Enterprise Linux System as an IPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as IPA
Clients" /><link rel="prev" href="setting-up-clients.html"
title="Chapter 3. Setting up Systems as IPA Clients" /><link
rel="next" href="Configuring_Microsoft_Windows.html"
title="3.3. Configuring a Microsoft Windows System as an IPA Client"
/></head><body><p id="title"><a class="left"
href="http:
//www.redhat.com"><img src="Common_Content/images/image_left.png"
alt="Product Site" /></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="setting-up-clients.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Microsoft_Windows.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Installing_the_IPA_Client_on_Red_Hat_Enterprise_Linux"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Installing_the_IPA_Client_on_Red_Hat_Enterprise_Linux">3.2. Configuring
a Red Hat Enterprise Linux System as an IPA
Client</h2></div></div></div><div class="para">
+ There are two elements to prepare before beginning the client setup process for the
Red Hat Enterprise Linux client:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ There must be a way to connect the client machine to the Kerberos domain, either by
having an available Kerberos identity (such as the admin user) or by manually adding the
client machine to the KDC on the server with a one-time password before beginning the
enrollment process for the client machine.
+ </div></li><li class="listitem"><div
class="para">
+ If the network environment uses an Active Directory DNS, then manually provide the
IPA server details during the client configuration. Active Directory has its own SRV
records for Kerberos and LDAP, and the <code
class="command">ipa-client-install</code> script retrieves those DNS
records instead of any records that were added for IPA.
+ </div></li></ul></div><div class="para">
+ The most efficient way to install the required client packages is to use the IPA
server as a yum repository. This allows client packages to be installed directly from the
IPA server.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Install the client packages. These packages are used only as a simple way to
configure the system; they do <span
class="emphasis"><em>not</em></span> install an agent or
daemon on the client machine.
+ </div><div class="para">
+ For a regular user system, this requires only the <code
class="filename">ipa-client</code> package:
+ </div><pre class="programlisting"><span
class="perl_Comment"># yum install ipa-client</span></pre><div
class="para">
+ An administrator machine requires the <code
class="filename">ipa-admintools</code> package, as well:
+ </div><pre class="programlisting"><span
class="perl_Comment"># yum install ipa-client
ipa-admintools</span></pre></li><li
class="listitem"><div class="para">
+ If the IPA server is configured as the DNS server and is in the same domain as the
client, add the server's IP address as the first entry in the client's <code
class="filename">/etc/resolv.conf</code> file.
+ </div></li><li class="listitem"><div
class="para">
+ Run the client setup command.
+ </div><pre class="programlisting"><span
class="perl_Comment">#
ipa-client-install</span></pre></li><li
class="listitem"><div class="para">
+ If prompted, enter the domain name for the IPA's DNS domain.
+ </div><pre class="programlisting">DNS discovery failed to
determine your DNS domain
+Please provide the domain name of your IPA server <span
class="perl_Keyword">(</span>ex: example.com<span
class="perl_Keyword">)</span>: example.com</pre></li><li
class="listitem"><div class="para">
+ Enter the fully-qualified domain name of the IPA server.
+ </div><pre class="programlisting">DNS discovery failed to
<span class="perl_BString">find</span> the IPA Server
+Please provide your IPA server name <span
class="perl_Keyword">(</span>ex: ipa.example.com<span
class="perl_Keyword">)</span>:
ipaserver.example.com</pre></li><li class="listitem"><div
class="para">
+ The client script then prompts for a Kerberos identity to use to contact and then
join the Kerberos realm. When these credentials are supplied, then the client is able to
join the IPA Kerberos domain and then complete the configuration:
+ </div><pre class="screen">
+Continue to configure the system with these values? [no]: yes
+Enrollment principal: admin
+Password for admin(a)EXAMPLE.COM:
+Enrolled in IPA realm
EXAMPLE.COM
+Created /etc/ipa/default.conf
+Configured /etc/sssd/sssd.conf
+Configured /etc/krb5.conf for IPA realm
EXAMPLE.COM
+SSSD enabled
+Kerberos 5 enabled
+NTP enabled
+Client configuration complete.
+</pre></li><li class="listitem"><div
class="para">
+ Test that the client can connect successfully to the IPA domain and can perform
basic tasks. For example, check that the IPA tools can be used to get user and group
information:
+ </div><pre class="programlisting">$ <span
class="perl_BString">id</span>
+$ <span class="perl_BString">getent</span> <span
class="perl_BString">passwd</span> userID
+$ <span class="perl_BString">getent</span> group
ipausers</pre></li><li class="listitem"><div
class="para">
+ Set up NFS to work with Kerberos.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Obtain a Kerberos ticket for the admin user.
+ </div><div class="para">
+
+<pre class="programlisting"><span class="perl_Comment">#
kinit admin</span></pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Add an NFS service principal on the client.
+ </div><div class="para">
+
+<pre class="programlisting"><span class="perl_Comment">#
ipa service-add nfs/ipaclient.example.com</span></pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Obtain a keytab for the NFS service principal.
+ </div><div class="para">
+
+<pre class="programlisting"><span class="perl_Comment">#
ipa-getkeytab -s
ipaserver.example.com -p
nfs/ipaclient.example.com -k
/etc/krb5.keytab</span></pre>
+
+ </div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Some versions of the Linux NFS implementation have limited encryption type
support. If the NFS server is hosted on a version older than Red Hat Enterprise Linux 6.1,
use the <code class="option">-e des-cbc-crc</code> option to the
<code class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs to set up, both on the server and on all clients.
This instructs the KDC to generate only DES keys.
+ </div><div class="para">
+ When using DES keys, all clients and servers that rely on this encryption type
need to have the <code class="option">allow_weak_crypto</code>
option enabled in the <code class="command">[libdefaults]</code>
section of the <code class="filename">/etc/krb5.conf</code> file.
Without these configuration changes, NFS clients and servers are unable to authenticate to
each other, and attempts to mount NFS filesystems may fail. The client's <code
class="command">rpc.gssd</code> and the server's <code
class="command">rpc.svcgssd</code> daemons may log errors indicating
that DES encryption types are not permitted.
+ </div></div></div></li><li
class="listitem"><div class="para">
+ Add the following line to the <code
class="filename">/etc/sysconfig/nfs</code> file:
+ </div><pre class="programlisting">SECURE_NFS=yes
+</pre></li><li class="listitem"><div
class="para">
+ Start the rpcgssd daemon.
+ </div><div class="para">
+
+<pre class="programlisting"><span class="perl_Comment">#
service rpcgssd start</span></pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Test the NFS-Kerberos configuration:
+ </div><pre class="programlisting"><span
class="perl_Comment"># mount -v -t nfs4 -o sec=krb5 ipaserver.example.com:/
/mnt</span></pre></li></ol></div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="setting-up-clients.html"><strong>Prev</strong>Chapter 3. Setting
up Systems as IPA Clients</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Microsoft_Windows.html"><strong>Next</strong>3.3. Configuring
a Microsoft Windows System as
an...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html
index 4c9be73..2d9779e 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html
@@ -1,25 +1,19 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.3. Configuring a Solaris System as a FreeIPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.3. Configuring a Solaris System as a FreeIPA
Client</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 2. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Using_Microsoft_Windows.html" title="2.2. Configuring a Microsoft
Windows System as a FreeIPA Client" /><link rel="next"
href="Configuring_an_IPA_Client_on_HP_UX.html" title="2.4. Configuring an
HP-UX System as a FreeIPA" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="previou
s"><a accesskey="p"
href="Using_Microsoft_Windows.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_Solaris"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Solaris">2.3. Configuring a Solaris System
as a FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10">2.3.1. Configuring
Solaris 10</h3></div></div></div><div
class="para">
- FreeIPA provides an automated method of configuring Solaris 10 to function as a
FreeIPA client. On your Solaris client, run the following command (ensure that you replace
the example domain name with your own):
-<pre class="screen"><code class="command"># ldapclient
init ipa.example.com</code></pre>
-
- </div><div class="para">
- When FreeIPA is installed it creates a configuration profile that will automatically
set up the necessary PAM and <code
class="filename">/etc/ldap.conf</code> configuration for Solaris.
- <div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You can add the <code class="option">-v</code> option to this
command to display more details about the command operation.
- </div></div></div>
-
- </div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Kerberos"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Kerberos">2.3.1.1. Configuring
Kerberos</h4></div></div></div><div class="para">
- Configure the <code
class="filename">/etc/krb5/krb5.conf</code> file as follows:
- </div><pre class="programlisting">[libdefaults]
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_Microsoft_Windows.html" title="3.2. Configuring a
Microsoft Windows System as a FreeIPA Client" /><link rel="next"
href="Configuring_an_IPA_Client_on_HP_UX.html" title="3.4. Configuring an
HP-UX System as a FreeIPA" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="p
revious"><a accesskey="p"
href="Configuring_Microsoft_Windows.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Next</strong></a></li></ul><div
class="section" id="Configuring_an_IPA_Client_on_Solaris"><div
class="titlepage"><div><div><h2 class="title"
id="Configuring_an_IPA_Client_on_Solaris">3.3. Configuring a Solaris System
as a FreeIPA Client</h2></div></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris_10"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10">3.3.1. Configuring Solaris
10</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"
id="st.sol1"><div class="para">
+ As with Fedora systems, FreeIPA provides an automated method of configuring Solaris
10 to function as a FreeIPA client. On the Solaris client, run the <code
class="command">ldapclient</code> with the name of the FreeIPA domain:
+ </div><pre class="programlisting"><span
class="perl_Comment"># ldapclient init
ipa.example.com
-v</span></pre><div class="para">
+ When the command is run, it creates a configuration profile that will automatically
set up the necessary PAM and <code
class="filename">/etc/ldap.conf</code> configuration.
+ </div></li><li class="listitem"><div
class="para">
+ Configure the <code
class="filename">/etc/krb5/krb5.conf</code> file. The Kerberos
configuration includes specifying the realm and domain details and default ticket
attributes. The default file created by <code
class="command">ldapclient</code> configures forwardable tickets by
default, which makes it possible to connect to the UI from any system and provides a way
to audit administration operations.
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
[realms]
@@ -45,79 +39,59 @@ kinit = {
renewable = true
forwardable= true
}
-</pre><div class="para">
- The Kerberos configuration includes specifying the realm and domain details, and
default ticket attributes. Forwardable tickets are configured by default, which
facilitates connection to the administration interface from any operating system, and also
provides for auditing of administration operations.
- </div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Client_SSH_Access"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_Client_SSH_Access">2.3.1.2. Configuring
Client SSH Access</h4></div></div></div><div
class="para">
- Use the following procedure to configure the Solaris FreeIPA client to accept
incoming SSH requests and authenticate with the user's Kerberos credentials. Remember
to replace the example host and domain names with your own host and domain name.
- </div><div class="para">
- The <span class="package">ipa-admintools</span> package is not
available for Solaris. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add a host service principal for the Solaris client.
- </div><div class="para">
-
-<pre class="screen"><code class="command"> # ipa
service-add
host/solarisipaclient.example.com </code></pre>
-
- </div></li><li class="listitem"><div
class="para">
- Create the host keytab file.
- </div><div class="para">
-
-<pre class="screen"><code class="command"># ipa-getkeytab
-s
ipaserver.example.com -p
host/solarisipaclient.example.com -k \</code>
-<code class="command">/tmp/krb5.keytab -e
des-cbc-crc</code></pre>
-
- </div></li><li class="listitem"><div
class="para">
- Copy this keytab to the Solaris machine as <code
class="filename">/etc/krb5/krb5.keytab</code>.
- </div><div class="para">
-
-<pre class="screen"><code class="command"># scp
/tmp/krb5.keytab root@solarisipaclient.example.com:/etc/krb5/krb5.keytab
</code></pre>
-
- </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- After you have performed all of the preceding configuration steps, reboot the
Solaris machine to ensure that all of the changes take effect.
- </div></div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_NFS_v4"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_10-Configuring_NFS_v4">2.3.1.3. Configuring
NFS v4</h4></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The NFS v4 configuration is only supported on Solaris 10.
- </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Obtain a Kerberos ticket for the admin user.
-<pre class="screen"><code class="command"># kinit admin
</code></pre>
+</pre></li><li class="listitem"
id="st.sol3"><div class="para">
+ Configure SSH access so that the Solaris FreeIPA client to accept incoming SSH
requests and authenticate with the user's Kerberos credentials.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ On the FreeIPA server, add a host service principal for the Solaris client.
+ </div><pre class="programlisting"> <span
class="perl_Comment"># ipa service-add
host/solarisipaclient.example.com</span></pre></li><li
class="listitem"><div class="para">
+ On the FreeIPA server, create the host keytab file.
+ </div><pre class="programlisting"><span
class="perl_Comment"># ipa-getkeytab -s
ipaserver.example.com -p
host/solarisipaclient.example.com -k /tmp/krb5.keytab -e
des-cbc-crc</span></pre></li><li
class="listitem"><div class="para">
+ Copy this keytab to the Solaris machine, and save it as <code
class="filename">/etc/krb5/krb5.keytab</code>.
+ </div><pre class="programlisting"><span
class="perl_Comment"># scp /tmp/krb5.keytab
root@solarisipaclient.example.com:/etc/krb5/krb5.keytab</span></pre></li><li
class="listitem"><div class="para">
+ Reboot the Solaris client machine.
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
+ Configure NFS to work with the Kerberos domain.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Obtain a Kerberos ticket for the admin user.
+<pre class="programlisting"><span class="perl_Comment">#
kinit admin</span></pre>
- </div></li><li class="listitem"><div
class="para">
- The <span class="package">ipa-admintools</span> package is
not available for Solaris. Consequently, you need to perform the following steps on the
FreeIPA server.
- </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Add an NFS service principal for the client.
-<pre class="screen"><code class="command"># ipa
service-add
nfs/solarisipaclient.example.com </code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Set up the NFS/Kerberos mapping for the Solaris client <span
class="emphasis"><em>on the FreeIPA server</em></span>.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Add an NFS service principal for the client.
+<pre class="programlisting"><span class="perl_Comment">#
ipa service-add nfs/solarisipaclient.example.com</span></pre>
- </div></li><li class="listitem"><div
class="para">
- Create the NFS keytab file.
-<pre class="screen"><code class="command"># ipa-getkeytab
-s
ipaserver.example.com -p
nfs/solarisipaclient.example.com -k \</code>
-<code class="command">/tmp/krb5.keytab -e
des-cbc-crc</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Create the NFS keytab file.
+<pre class="programlisting"><span class="perl_Comment">#
ipa-getkeytab -s
ipaserver.example.com -p
nfs/solarisipaclient.example.com -k
/tmp/krb5.keytab -e des-cbc-crc</span></pre>
- </div><div class="note"><div
class="admonition_header"><h2>NFS Encryption
Support</h2></div><div class="admonition"><div
class="para">
- Some versions of the Linux NFS implementation have limited encryption type
support. If your NFS server is hosted on a version older than Fedora 15, you may need to
use the <code class="option">-e des-cbc-crc</code> option to the
<code class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs you want to set up, both on the server and on all
clients. This instructs the KDC to generate only DES keys.
- </div><div class="para">
- If you use this option to generate DES keys, then all clients and servers that
rely on this encryption type need to have the <code
class="option">allow_weak_crypto</code> option enabled in the
[libdefaults] section of the <code
class="filename">/etc/krb5.conf</code> file. Without these
configuration changes, NFS clients and servers will be unable to authenticate to each
other, and attempts to mount NFS filesystems may fail. The client's rpc.gssd and the
server's rpc.svcgssd daemons may log errors indicating that DES encryption types are
not permitted.
- </div></div></div></li><li
class="listitem"><div class="para">
- Use the <code class="command">klist</code> command to
verify that the ticket was created:
-<pre class="screen"><code class="command"># klist -ket
/tmp/krb5.keytab</code></pre>
+ </div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ Some versions of the Linux NFS implementation have limited encryption type
support. If the NFS server is hosted on a version older than Fedora 15, use the <code
class="option">-e des-cbc-crc</code> option to the <code
class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs to set up, both on the server and on all clients.
This instructs the KDC to generate only DES keys.
+ </div><div class="para">
+ When using DES keys, all clients and servers that rely on this encryption type
need to have the <code class="option">allow_weak_crypto</code>
option enabled in the <code class="command">[libdefaults]</code>
section of the <code class="filename">/etc/krb5.conf</code> file.
Without these configuration changes, NFS clients and servers are unable to authenticate to
each other, and attempts to mount NFS filesystems may fail. The client's <code
class="command">rpc.gssd</code> and the server's <code
class="command">rpc.svcgssd</code> daemons may log errors indicating
that DES encryption types are not permitted.
+ </div></div></div></li><li
class="listitem"><div class="para">
+ Use the <code class="command">klist</code> command to
verify that the ticket was created:
+<pre class="programlisting"><span class="perl_Comment">#
klist -ket /tmp/krb5.keytab</span></pre>
- </div></li><li class="listitem"><div
class="para">
- Copy the keytab from the server to the client.
-<pre class="screen"><code class="command"># scp
/tmp/krb5.keytab root@solarisipaclient.example.com:/tmp/krb5.keytab
</code></pre>
+ </div></li><li class="listitem"><div
class="para">
+ Copy the keytab from the server to the client.
+<pre class="programlisting"><span class="perl_Comment">#
scp /tmp/krb5.keytab
root@solarisipaclient.example.com:/tmp/krb5.keytab</span></pre>
- </div></li></ol></div></li><li
class="listitem"><div class="para">
- On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
-<pre class="screen"><code class="command">#
ktutil</code>
-<code class="command">ktutil: read_kt /tmp/krb5.keytab</code>
-<code class="command">ktutil: write_kt
/etc/krb5/krb5.keytab</code>
-<code class="command">ktutil: q</code></pre>
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
+ On the FreeIPA client, use the <code
class="command">ktutil</code> command to import the contents into the
main host keytab.
+<pre class="programlisting"><span class="perl_Comment">#
ktutil</span><span class="perl_Comment"></span>
+<span class="perl_Comment"></span>ktutil: <span
class="perl_Reserved">read</span>_kt /tmp/krb5.keytab
+ktutil: <span class="perl_BString">write</span>_kt
/etc/krb5/krb5.keytab
+ktutil: q</pre>
- </div></li></ol></div><div class="para">
- The FreeIPA client should now be fully configured to mount NFS shares using Kerberos
credentials.
- </div></div></div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2. Configuring
Solaris 9</h3></div></div></div><div
class="para">
- The procedures for configuring Solaris 9 as a FreeIPA client are the same as those
for Solaris 10, with the exception of the PAM configuration. This is described below.
- </div><div class="section"
id="Configuring_an_IPA_Client_on_Solaris_9-Configuring_PAM_on_Solaris_9"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_an_IPA_Client_on_Solaris_9-Configuring_PAM_on_Solaris_9">2.3.2.1. Configuring
PAM on Solaris 9</h4></div></div></div><div
class="para">
- Configure the <code class="filename">/etc/pam.conf</code> file
to use PAM Kerberos. The following example shows how to set up PAM Kerberos authentication
on Solaris 9 for console login:
- </div><pre class="programlisting">login auth requisite
pam_authtok_get.so.1
+ </div></li></ol></div></li></ol></div></div><div
class="section"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2. Configuring
Solaris 9</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Perform steps <a class="xref"
href="Configuring_an_IPA_Client_on_Solaris.html#st.sol1">1</a> through
<a class="xref"
href="Configuring_an_IPA_Client_on_Solaris.html#st.sol3">3</a> in <a
class="xref"
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10">Section 3.3.1,
“Configuring Solaris 10”</a> to set up the Solaris 9 client.
+ </div></li><li class="listitem"><div
class="para">
+ Configure the <code class="filename">/etc/pam.conf</code>
file to use PAM Kerberos. For example:
+ </div><pre class="programlisting">login auth requisite
pam_authtok_get.so.1
login auth sufficient pam_krb5.so.1 use_first_pass
login auth sufficient pam_unix.so.1 use_first_pass
login auth required pam_dhkeys.so.1
login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
-</pre></div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Using_Microsoft_Windows.html"><strong>Prev</strong>2.2. Configuring
a Microsoft Windows System as a ...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Next</strong>2.4. Configuring
an HP-UX System as a FreeIPA</a></li></ul></body></html>
+</pre></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_Microsoft_Windows.html"><strong>Prev</strong>3.2. Configuring
a Microsoft Windows System as a ...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_an_IPA_Client_on_HP_UX.html"><strong>Next</strong>3.4. Configuring
an HP-UX System as a FreeIPA</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Document_Conventions.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Document_Conventions.html
index eaadefc..ea05a72 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Document_Conventions.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Document_Conventions.html
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2. Examples and Formatting</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2. Examples and Formatting</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Extending_the_Permissions_of_IPA_Managed_Hosts.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Extending_the_Permissions_of_IPA_Managed_Hosts.html
new file mode 100644
index 0000000..9df55d7
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Extending_the_Permissions_of_IPA_Managed_Hosts.html
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.3. Extending the Permissions of IPA Managed
Hosts</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="hosts.html" title="Chapter 7. Identity: Managing Hosts and Host
Groups" /><link rel="prev" href="host-groups.html"
title="7.2. Creating Host Groups" /><link rel="next"
href="kerberos.html" title="Chapter 8. Identity: Using IPA for a Kerberos
Domain" /></head><body><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Produc
t Site" /></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="host-groups.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Extending_the_Permissions_of_IPA_Managed_Hosts"><div
class="titlepage"><div><div><h2 class="title"
id="Extending_the_Permissions_of_IPA_Managed_Hosts">7.3. Extending the
Permissions of IPA Managed Hosts</h2></div></div></div><div
class="para">
+ As discussed in <a class="xref"
href="ipa-domains.html#IPA_Managed_Hosts">Section 1.2.2, “IPA Managed
Hosts”</a>, the definition of "manage" is "being able to retrieve a
keytab and certificates on behalf of another host or service". Every host and service
has a <em class="parameter"><code>managedby</code></em>
entry. By default, a host can manage itself and all of its services. It is also possible
to allow a host to manage other hosts, or services on other hosts, by updating the
appropriate delegations or providing a suitable <em
class="parameter"><code>managedby</code></em> entry.
+ <div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ If a host is provided with a <em
class="parameter"><code>managedby</code></em> entry to
another host, it does not mean management of all services on that host. Each delegation
has to be performed independently.
+ </div></div></div>
+
+ </div><div class="section"
id="Delegating_Service_Management"><div
class="titlepage"><div><div><h3 class="title"
id="Delegating_Service_Management">7.3.1. Delegating Service
Management</h3></div></div></div><div
class="para">
+ This section describes how to create a new host and a service on that host, and then
delegate management of that service to another host. In this example, the IPA server is
installed on <code class="systemitem">slinky.example.com</code>
+ </div><div class="procedure"
id="Delegating_Service_Management-To_delegate_service_management_to_another_host"><h6>Procedure 7.1. To
delegate service management to another host</h6><ol class="1"><li
class="step"><div class="para">
+ Create a new host:
+<pre class="screen"><code class="command"># kinit
admin</code>
+<code class="command"># ipa host-add
panther.example.com</code></pre>
+
+ </div></li><li class="step"><div
class="para">
+ Create a service on this host:
+<pre class="screen"><code class="command"># ipa
service-add test/panther.example.com</code></pre>
+
+ </div></li><li class="step"><div
class="para">
+ Delegate managing the service:
+<pre class="screen"><code class="command"># ipa
service-add-host --hosts=slinky panther</code></pre>
+
+ </div><div class="para">
+ You can now use the host service principal on <code
class="systemitem">slinky</code> to manage <code
class="systemitem">panther</code>:
+<pre class="screen"><code class="command"># kinit -kt
/etc/krb5.keytab host/`hostname`</code>
+<code class="command"># ipa-getkeytab -s `hostname` -k /tmp/test.keytab
-p test/panther.example.com</code>
+Keytab successfully retrieved and stored in: /tmp/test.keytab</pre>
+
+ </div></li><li class="step"><div
class="para">
+ To create a ticket for this service, create a CSR and then run the following
command:
+<pre class="screen"><code class="command"># ipa
cert-request --add --principal=test/panther.example.com panther.csr</code>
+ Certificate: MIICETCCAXqgA...[snip]
+ Subject:
CN=panther.example.com,O=EXAMPLE.COM
+ Issuer:
CN=EXAMPLE.COM Certificate Authority
+ Not Before: Tue Feb 08 18:51:51 2011 UTC
+ Not After: Mon Feb 08 18:51:51 2016 UTC
+ Fingerprint (MD5): c1:46:8b:29:51:a6:4c:11:cd:81:cb:9d:7c:5e:84:d5
+ Fingerprint (SHA1):
+ 01:43:bc:fa:b9:d8:30:35:ee:b6:54:dd:a4:e7:d2:11:b1:9d:bc:38
+ Serial number: 1005
+</pre>
+
+ </div></li></ol></div></div><div
class="section" id="Delegating_Host_Management"><div
class="titlepage"><div><div><h3 class="title"
id="Delegating_Host_Management">7.3.2. Delegating Host
Management</h3></div></div></div><div
class="para">
+ This section describes how to delegate management of one host to another host. This
example uses the same hosts as those used in the previous example.
+ </div><div class="procedure"
id="Delegating_Host_Management-To_delegate_host_management_to_another_host"><h6>Procedure 7.2. To
delegate host management to another host</h6><ol class="1"><li
class="step"><div class="para">
+ Ensure you have <code class="systemitem">admin</code>
credentials and then add the appropriate <em
class="parameter"><code>managedby</code></em> entry:
+<pre class="screen"><code class="command"># kinit
admin</code>
+<code class="command"># ipa host-add-managedby --hosts=slinky
panther</code></pre>
+
+ </div></li><li class="step"><div
class="para">
+ Obtain a TGT as the host <code
class="systemitem">slinky</code> and then retrieve a keytab for
<code class="systemitem">panther</code>:
+<pre class="screen"><code class="command"># kinit -kt
/etc/krb5.keytab host/`hostname`</code>
+<code class="command"># ipa-getkeytab -s `hostname` -k
/tmp/panther.keytab -p host/panther.example.com</code>
+Keytab successfully retrieved and stored in: /tmp/panther.keytab</pre>
+
+ </div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="host-groups.html"><strong>Prev</strong>7.2. Creating Host
Groups</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong>Chapter 8. Identity:
Using IPA for a Kerberos Dom...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/General_Troubleshooting_Tips-Client_Problems.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/General_Troubleshooting_Tips-Client_Problems.html
new file mode 100644
index 0000000..9195631
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/General_Troubleshooting_Tips-Client_Problems.html
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.6. Client Problems</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="prev" href="certs.html"
title="5.5. Configuring Certificate-Based Machine Authentication" /><link
rel="next" href="users.html" title="Chapter 6. Identity: Managing
Users and User Groups" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>P
rev</strong></a></li><li class="next"><a
accesskey="n"
href="users.html"><strong>Next</strong></a></li></ul><div
class="section"
id="General_Troubleshooting_Tips-Client_Problems"><div
class="titlepage"><div><div><h2 class="title"
id="General_Troubleshooting_Tips-Client_Problems">5.6. Client
Problems</h2></div></div></div><div class="para">
+ If you are unable to log into a machine or the standard NSS tools fail to return user
and group information (for example, <code class="command">getent passwd
admin</code> fails), inspect the SSSD logs in <code
class="filename">/var/log/sssd/</code>. You should start with the log
file for your domain (<code
class="filename">sssd_example.com.log</code>).
+ </div><div class="para">
+ To increase the log level, set <code
class="varname">debug_level</code> = 9 in the <code
class="literal">[domain/<em
class="replaceable"><code>example.com</code></em>]</code>
section of the <code class="filename">/etc/sssd/sssd.conf</code>
file, and restart the <code class="systemitem">sssd</code> daemon
for this change to take effect. Monitor the <code
class="filename">/var/log/sssd/sssd_example.com.log</code> file for any
relevant information.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>Prev</strong>5.5. Configuring
Certificate-Based Machine Authen...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="users.html"><strong>Next</strong>Chapter 6. Identity:
Managing Users and User Grou...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Glossary.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Glossary.html
index 27d28e4..08c4c28 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Glossary.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Glossary.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Glossary</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Glossary</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"
title="C.3. Performing a Client-based Migration" /><link
rel="next" href="ix01.html" title="Index"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="s
ect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ix01.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="glossary" id="Glossary"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Glossary</h2></div></div></div><div
class="glossdiv"><h3
class="title">A</h3><dl><dt>access control
instruction</dt><dd><p>See <a class="glosssee"
href="Glossary.html#aci">ACI</a>.</p></dd><dt>access
control list</dt><dd><p>See <a class="glosssee"
href="Glossary.html#ACL">ACL</a>.</p></dd><dt>access
rights</dt><dd><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"
title="D.3. Performing a Client-based Migration" /><link
rel="next" href="ix01.html" title="Index"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="s
ect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ix01.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="glossary" id="Glossary"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Glossary</h2></div></div></div><div
class="glossdiv"><h3
class="title">A</h3><dl><dt>access control
instruction</dt><dd><p>See <a class="glosssee"
href="Glossary.html#aci">ACI</a>.</p></dd><dt>access
control list</dt><dd><p>See <a class="glosssee"
href="Glossary.html#ACL">ACL</a>.</p></dd><dt>access
rights</dt><dd><div class="para">
In the context of access control, specify the level of access granted or denied. Access
rights are related to the type of operation that can be performed on the directory. The
following rights can be granted or denied: read, write, add, delete, search, compare,
selfwrite, proxy and all.
</div></dd><dt>account inactivation</dt><dd><div
class="para">
Disables a user account, group of accounts, or an entire domain so that all
authentication attempts are automatically rejected.
@@ -341,4 +341,4 @@
Speeds up the display of entries in the Directory Server Console. Virtual list view
indexes can be created on any branch point in the directory tree to improve display
performance.
</div><p>See Also <a class="glossseealso"
href="Glossary.html#browsing-index">browsing
index</a>.</p></dd></dl></div><div
class="glossdiv"><h3
class="title">X</h3><dl><dt>X.500
standard</dt><dd><div class="para">
The set of ISO/ITU-T documents outlining the recommended information model, object
classes and attributes used by directory server implementation.
-</div></dd></dl></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Prev</strong>C.3. Performing
a Client-based Migration</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ix01.html"><strong>Next</strong>Index</a></li></ul></body></html>
+</div></dd></dl></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Prev</strong>D.3. Performing
a Client-based Migration</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ix01.html"><strong>Next</strong>Index</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Installing_the_IPA_Server_Packages.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Installing_the_IPA_Server_Packages.html
index 3d5aae5..0d10c6e 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Installing_the_IPA_Server_Packages.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Installing_the_IPA_Server_Packages.html
@@ -1,18 +1,18 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.2. Installing the FreeIPA Server Packages</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.2. Installing the FreeIPA Server Packages</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 1. Installing a FreeIPA
Server" /><link rel="prev" href="installing-ipa.html"
title="Chapter 1. Installing a FreeIPA Server" /><link
rel="next" href="creating-server.html" title="1.3. Creating a
FreeIPA Server Instance" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong></a>
</li><li class="next"><a accesskey="n"
href="creating-server.html"><strong>Next</strong></a></li></ul><div
class="section" id="Installing_the_IPA_Server_Packages"><div
class="titlepage"><div><div><h2 class="title"
id="Installing_the_IPA_Server_Packages">1.2. Installing the FreeIPA Server
Packages</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 2. Installing a FreeIPA
Server" /><link rel="prev" href="installing-ipa.html"
title="Chapter 2. Installing a FreeIPA Server" /><link
rel="next" href="creating-server.html" title="2.3. Creating a
FreeIPA Server Instance" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong></a>
</li><li class="next"><a accesskey="n"
href="creating-server.html"><strong>Next</strong></a></li></ul><div
class="section" id="Installing_the_IPA_Server_Packages"><div
class="titlepage"><div><div><h2 class="title"
id="Installing_the_IPA_Server_Packages">2.2. Installing the FreeIPA Server
Packages</h2></div></div></div><div class="para">
Installing only the FreeIPA server requires a single package, . If the FreeIPA server
will also manage a DNS server, then it requires two additional packages to set up the
DNS.
</div><div class="para">
All of these packages can be installed using the <code
class="command">yum</code> command:
- </div><div class="para">
+ </div><pre class="programlisting"><span
class="perl_Comment"># yum install freeipa-server bind
bind-dyndb-ldap</span></pre><div class="para">
Installing the also installs a large number of dependencies, such as <span
class="package">389-ds-base</span> for the LDAP service and <span
class="package">krb5-server</span> for the Kerberos service, along with
FreeIPA tools.
</div><div class="para">
- After the packages are installed, the server instance must be created using the
<code class="command">ipa-server-install</code> command. The options
for configuring the new server instance are described in <a class="xref"
href="creating-server.html">Section 1.3, “Creating a FreeIPA Server
Instance”</a>.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong>Chapter 1. Installing
a FreeIPA Server</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="creating-server.html"><strong>Next</strong>1.3. Creating a
FreeIPA Server Instance</a></li></ul></body></html>
+ After the packages are installed, the server instance must be created using the
<code class="command">ipa-server-install</code> command. The options
for configuring the new server instance are described in <a class="xref"
href="creating-server.html">Section 2.3, “Creating a FreeIPA Server
Instance”</a>.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong>Chapter 2. Installing
a FreeIPA Server</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="creating-server.html"><strong>Next</strong>2.3. Creating a
FreeIPA Server Instance</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Managing-Unique_UID_and_GID_Attributes.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Managing-Unique_UID_and_GID_Attributes.html
new file mode 100644
index 0000000..85e0b1b
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Managing-Unique_UID_and_GID_Attributes.html
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.3. Managing Unique UID and GID Number
Assignments</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev" href="disabling-anon-binds.html"
title="13.2. Disabling Anonymous Binds" /><link rel="next"
href="Configuring_Certificates_and_Certificate_Authorities.html"
title="13.4. Configuring Certificates and Certificate Authorities"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey
="p"
href="disabling-anon-binds.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong></a></li></ul><div
class="section" id="Managing-Unique_UID_and_GID_Attributes"><div
class="titlepage"><div><div><h2 class="title"
id="Managing-Unique_UID_and_GID_Attributes">13.3. Managing Unique UID and GID
Number Assignments</h2></div></div></div><div
class="para">
+ A FreeIPA server must generate random UID and GID values and simultaneously ensure
that replicas never generate the same UID or GID value. The need for unique UID and GID
numbers might even cross FreeIPA domains, if a single organization has multiple disparate
domains.
+ </div><div class="para">
+ The UID and GID numbers are divided into <span
class="emphasis"><em>ranges</em></span>. By keeping
separate numeric ranges for individual servers and replicas, the chances are minimal that
any numbers issued by one server or replica will duplicate those from another. Ranges are
updated and shared intelligently between servers and replicas through the Dynamic Numeric
Assignment (DNA) Plug-in, as part of the backend 389 Directory Server instance for the
domain. The same range is used for user IDs (<em
class="parameter"><code>uidNumber</code></em>) and group
IDs (<em class="parameter"><code>gidNumber</code></em>).
A user and a group may have the same ID, but since the ID is set in different attributes,
there is no conflict. Using the same ID number for both a user and a group also allows an
administrator to configure user private groups, where a unique system group is created for
each user and the ID number is the same for both the user and the group.
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a user is created interactively or without specifying a UID or GID number, then
the user account is created with an ID number that is next available in the server or
replica range. This means that a user always has a unique number for its UID number and,
if configured, for its private group.
+ </div><div class="para">
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
user entry, the server does not validate that the <em
class="parameter"><code>uidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries. The same is true for group entries: a duplicate <em
class="parameter"><code>gidNumber</code></em> can be
manually assigned to the entry.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in a
search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa user-find
--all</code>.
+ </div></div></div><div class="section"
id="id-ranges-at-install"><div
class="titlepage"><div><div><h3 class="title"
id="id-ranges-at-install">13.3.1. About ID Range Assignments During
Installation</h3></div></div></div><div
class="para">
+ The FreeIPA administrator can initially define a range during server installation,
using the <code class="option">--idstart</code> and <code
class="option">--idmax</code> options with <code
class="command">ipa-server-install</code>. These options are not
required, so the setup script can assign random ranges during installation.
+ </div><div class="para">
+ If no range is set manually when the first FreeIPA server is installed, a range of
200,000 IDs is randomly selected. There are 10,000 possible ranges. Selecting a random
range from that number provides a high probability of non-conflicting IDs if two separate
FreeIPA domains are ever merged in the future.
+ </div><div class="para">
+ With a single FreeIPA server, IDs are assigned to entries in order through the range.
With replicas, the initial server ID range is split and distributed.
+ </div><div class="para">
+ When a replica is installed, it is configured with an invalid range. It also has a
directory entry (that is shared among replicas) that instructs the replica where it can
request a valid range. When the replica starts, or as its current range is depleted so
that less than 100 IDs are available, it can contact one of the available servers for a
new range allotment. A special extended operation splits the range in two, so that the
original server and the replica each have half of the available range.
+ </div></div><div class="section"
id="Assigning_UIDs_and_GIDs-Adding_New_Ranges"><div
class="titlepage"><div><div><h3 class="title"
id="Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2. Adding New
Ranges</h3></div></div></div><div class="para">
+ If the range for the entire domain is close to depletion, a new range can be manually
selected and assigned to one of the master servers. All replicas then request ID ranges
from the master as necessary.
+ </div><div class="para">
+ The changes to the range are done by editing the 389 Directory Server configuration
to change the DNA Plug-in instance. The range is defined in the <em
class="parameter"><code>dnaNextRange</code></em> parameter.
For example:
+ </div><pre class="screen">ldapmodify -x -D "cn=Directory
Manager" -W -h
server.example.com -p 389
+Enter LDAP Password: *******
+dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config
+changetype: modify
+add: dnaNextRange
+dnaNextRange: 123400000-123500000</pre><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ This command only adds the specified range of values; it does not check that the
values in that range are actually available. This check is performed when an attempt is
made to allocate those values. If a range is added that contains mostly values that were
already allocated, the system will cycle through the entire range searching for
unallocated values, and then the operation ultimately fails if none are available.
+ </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="disabling-anon-binds.html"><strong>Prev</strong>13.2. Disabling
Anonymous Binds</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong>13.4. Configuring
Certificates and Certificate
Au...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Migrating_from_a_Directory_Server_to_IPA.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Migrating_from_a_Directory_Server_to_IPA.html
index f426ab7..bcc363e 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Migrating_from_a_Directory_Server_to_IPA.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Migrating_from_a_Directory_Server_to_IPA.html
@@ -1,15 +1,15 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix C. Migrating from a Directory Server to
IPA</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix D. Migrating from a Directory Server to
IPA</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"
title="B.4. Using certmonger with IPA" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"
title="C.2. Performing a Server-based Migration" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/ima
ge_right.png" alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="Migrating_from_a_Directory_Server_to_IPA" lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Migrating from a Directory Server to
IPA</h1></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">C.1. Overview</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"
title="C.4. Using certmonger with IPA" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"
title="D.2. Performing a Server-based Migration" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/ima
ge_right.png" alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="Migrating_from_a_Directory_Server_to_IPA" lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Migrating from a Directory Server to
IPA</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity
_Management_Guide-Overview-Assumptions">D.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3.
Possible Scenarios</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4.
Initial and Final States</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guid
e-Overview-Implementation_Details">D.1.6. Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html">D.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1.
Phase 1: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2.
Phase 2: Updating the Client Configuration</a></s
pan></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt
<span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html">D.3.
Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">D.3.1.
Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_f
rom_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4.
Phase 4: Reconfigure non-SSSD Clients</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></div><div
class="section" id
="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1. Overview</h2></div></div></div><div
class="para">
This appendix addresses the situation where a customer has previously deployed an
internal Directory Server (DS) and is planning to use IPA instead. The customer needs to
transfer all user data from the DS to IPA so that IPA can function fully and correctly.
The goal is to perform this migration without requiring that users change their passwords
or perform some other specific action.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">C.1.1. Assumptions</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">D.1.1. Assumptions</h3></div></div></div><div
class="para">
It is not practical to identify and address each of the scenarios in which a DS and
IPA might be deployed, and where migration might be required. Consequently, the following
assumptions are made:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
This is a one-to-one transition from one DS realm to one IPA realm. No
consolidation is involved.
@@ -21,7 +21,7 @@
Some machines might be present that are managed by <code
class="systemitem">NIS</code> or are not part of the DS deployment, but
are planned to be part of the IPA domain
</div><div class="para">
Machines that cannot be moved from the <code
class="systemitem">NIS</code> domain to LDAP or IPA because they are
old and do not support <code class="systemitem">nss_ldap</code> are
assumed to remain in and be served by the <code
class="systemitem">NIS</code> domain. The migration of such machines to
the IPA domain, while possible, is a challenging task and is out of the scope of the
current use case.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">C.1.2. Known
Issues</h3></div></div></div><div class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2. Known
Issues</h3></div></div></div><div class="para">
A number of issues exist that need to be considered when planning the migration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
A generic DS uses a different schema and <em
class="firstterm">Directory Information Tree (DIT)</em> when compared
to IPA. No known DS uses the same flat DIT structure that IPA uses. IPA is optimized for
performance, and attempts to avoid any architectural design flaws that have occurred in
the past.
@@ -29,7 +29,7 @@
IPA uses Kerberos for authentication, and so each user requires that Kerberos keys
be stored in the IPA DS, in addition to the standard LDAP hashes used by the DS
</div><div class="para">
In order to generate these keys, the password needs to be available in clear text
to IPA's DS password plug-in. It is available when the user is created in IPA using
IPA tools or LDAP, but this is not the case when the user is migrated from other external
storage such as another DS. Consequently, the existing password hashes can be reloaded,
but the Kerberos hashes cannot be generated. IPA provides a number of solutions to
overcome this issue; these are described later in this appendix.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">C.1.3. Possible
Scenarios</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3. Possible
Scenarios</h3></div></div></div><div
class="para">
The following have been identified as typical migration scenarios:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Migrate an existing environment to IPA but do not use its Kerberos features for
now
@@ -37,13 +37,13 @@
Migrate an existing environment to IPA and use its Kerberos features using only
IPA v1 functionality. That is, do not use SSSD.
</div></li><li class="listitem"><div
class="para">
Migrate an existing environment to IPA and use its Kerberos features on some
machines, while some machines will use SSSD and some will not; this is the primary use
case.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">C.1.4. Initial
and Final States</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4. Initial
and Final States</h3></div></div></div><div
class="para">
The following sections describe the initial, pre‐migration state, and the final,
post‐migration state of a DS deployment when migrating to a single IPA domain.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State">C.1.4.1. Initial
State</h4></div></div></div><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Initial_State">D.1.4.1. Initial
State</h4></div></div></div><div class="para">
In the initial state, there is a single data source (the Directory Server) and a
single client machine configuration. This client configuration uses <code
class="systemitem">LDAP</code> to connect to the Directory Server and
retrieve information about users and groups. This configuration uses <code
class="systemitem">PAM_LDAP</code> and <code
class="systemitem">NSS_LDAP</code> for authentication and identity
lookups. These modules enable the client systems to use data retrieved from the DS just as
if it were stored in <code class="filename">/etc/passwd</code> or
<code class="filename">/etc/shadow</code>. The following diagram
illustrates this type of implementation, where <code
class="systemitem">LDAP</code> is used to connect to the DS for both
authentication and authorization. The case where <code
class="systemitem">Kerberos</code> is used for authentication and
<code class="systemitem">LDAP</code> for identity, and where these
two data stores are synchronized, is not
described here. Consequently, the initial state may not be as simple or as
straightforward as displayed here, however the approach and the final state will be
similar.
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Initial_State-Initial_state_of_deployment_before_migrating_to_IPA."><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Initial_State.png" alt="Initial state of
deployment before migrating to IPA."
/></div></div><h6>Figure C.1. Initial state of deployment before
migrating to IPA.</h6></div><br class="figure-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State">C.1.4.2. Final
State</h4></div></div></div><div class="para">
- In the final state, even though only a single data source exists, multiple possible
machine configurations are now possible. This is illustrated in <a
class="xref"
href="Migrating_from_a_Directory_Server_to_IPA.html#figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA">Figure C.2,
“Final state of deployment after migrating to IPA”</a>
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA"><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Final_State.png" alt="Final state of deployment
after migrating to IPA" /></div></div><h6>Figure C.2. Final
state of deployment after migrating to IPA</h6></div><br
class="figure-break" /><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options">C.1.4.2.1. Configuration
Options</h5></div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuration_Options-Connected_to_IPA_via_SSSD_Using_SSSDs_LDAP_Back_End"><h5
class="formalpara">Connected to IPA via SSSD Using SSSD's LDAP Back
End</h5>
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Initial_State-Initial_state_of_deployment_before_migrating_to_IPA."><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Initial_State.png" alt="Initial state of
deployment before migrating to IPA."
/></div></div><h6>Figure D.1. Initial state of deployment before
migrating to IPA.</h6></div><br class="figure-break"
/></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Initial_and_Final_States-Final_State">D.1.4.2. Final
State</h4></div></div></div><div class="para">
+ In the final state, even though only a single data source exists, multiple possible
machine configurations are now possible. This is illustrated in <a
class="xref"
href="Migrating_from_a_Directory_Server_to_IPA.html#figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA">Figure D.2,
“Final state of deployment after migrating to IPA”</a>
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Final_State-Final_state_of_deployment_after_migrating_to_IPA"><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_Migration_Final_State.png" alt="Final state of deployment
after migrating to IPA" /></div></div><h6>Figure D.2. Final
state of deployment after migrating to IPA</h6></div><br
class="figure-break" /><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Final_State-Configuration_Options">D.1.4.2.1. Configuration
Options</h5></div></div></div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuration_Options-Connected_to_IPA_via_SSSD_Using_SSSDs_LDAP_Back_End"><h5
class="formalpara">Connected to IPA via SSSD Using SSSD's LDAP Back
End</h5>
Clients connect to IPA via SSSD. SSSD is integrated into the PAM and NSS stacks by
means of PAM_SSS and NSS_SSS, respectively. SSSD's LDAP back end is configured for
both authentication and for identity lookups. In this use case, IPA functions like a
normal DS.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Kerberos authentication can be configured instead of LDAP authentication. In this
case, IPA acts as a normal DS for identity lookups and a normal KDC for Kerberos
authentication.
@@ -55,7 +55,7 @@
Clients connect directly to IPA and use PAM_KRB5 and NSS_LDAP. This is the same
configuration as that provided for IPA v1.x
</div><div class="para">
In the initial state, clients use LDAP to communicate with the Directory Server to
retrieve information about users and groups. <code
class="systemitem">PAM_LDAP</code> and <code
class="systemitem">NSS_LDAP</code> are modules that enable the client
systems to use data retrieved from the Directory Server as if it were stored in <code
class="filename">/etc/passwd</code> or <code
class="filename">/etc/shadow</code>. In the final state, IPA provides
all of the same functionality and many more features besides.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">C.1.5. Recommended
Sequence of Steps</h3></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5. Recommended
Sequence of Steps</h3></div></div></div><div
class="para">
The migration from DS to IPA requires:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Installing IPA on a suitable machine
@@ -79,13 +79,13 @@
Deploy SSSD first
</div></li></ul></div><div class="para">
Each approach is valid and accomplishes the same goal, but using a different sequence
of operations.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies">C.1.5.1. Comparison
of Migration Strategies</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Recommended_Sequence_of_Steps-Comparison_of_Migration_Strategies">D.1.5.1. Comparison
of Migration Strategies</h4></div></div></div><div
class="para">
Each approach has a different impact on the IT team and the users. You need to
select the approach that best suits your deployment. These scenarios can be modified to
meet the needs of your enterprise. Provided you understand the implications and reasoning
behind each step, there is no requirement to follow the steps in the given order. It is
important to understand that until the Kerberos keys are generated in IPA, users will not
be able to authenticate with Kerberos credentials using <code
class="systemitem">PAM_KRB5</code> or <code
class="command">kinit</code>.
</div><div class="para">
You should also consider an alternative migration scenario, where passwords are not
migrated. In this scenario, users are not migrated into IPA but rather added as new users
with new passwords. Users would then change their password the first time they
authenticate. The initial password would be defined by IT and sent to users by email or
communicated in some other way.
</div><div class="para">
Migrating users from an existing system provides a smoother transition but also
requires parallel management of DS and IPA during the migration. If you do not preserve
passwords, the migration can be performed more quickly and you can avoid the period of
double management of IPA and DS.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">C.1.6. Implementation
Details</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">D.1.6. Implementation
Details</h3></div></div></div><div class="para">
The following sequence of operations occurs when users are migrated using SSSD:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
A user tries to log in to the machine.
@@ -111,4 +111,4 @@
If the bind operation fails for any reason, the IPA identity provider back end will
fail authentication, otherwise it will continue.
</div></li><li class="listitem"><div
class="para">
The IPA identity provider back end will unbind and try Kerberos authentication
again. This time it is expected to succeed because the keys already exist in the entry.
- </div></li></ul></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Prev</strong>B.4. Using
certmonger with IPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Next</strong>C.2. Performing
a Server-based Migration</a></li></ul></body></html>
+ </div></li></ul></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Prev</strong>C.4. Using
certmonger with IPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Next</strong>D.2. Performing
a Server-based Migration</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preface.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preface.html
index 7fd9ef5..cf262d2 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preface.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preface.html
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Preface</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Preface</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preparing_for_an_IPA_Installation.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preparing_for_an_IPA_Installation.html
index 6f5cceb..f49530f 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preparing_for_an_IPA_Installation.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Preparing_for_an_IPA_Installation.html
@@ -1,13 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.2. Preparing to Install the IPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
-
- addID('Drafts.1');
-
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="installing-ipa.html" title="Chapter 2. Installing an IPA Server"
/><link rel="prev" href="installing-ipa.html"
title="Chapter 2. Installing an IPA Server" /><link rel="next"
href="Installing_the_IPA_Server_Packages.html" title="2.3. Installing the
IPA Server Packages" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong></a>
</li><li class="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong></a></li></ul><div
class="section" id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">2.2. Preparing to Install the IPA
Server</h2></div></div></div><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.2. Preparing to Install the IPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="installing-ipa.html" title="Chapter 2. Installing an IPA Server"
/><link rel="prev" href="installing-ipa.html"
title="Chapter 2. Installing an IPA Server" /><link rel="next"
href="Installing_the_IPA_Server_Packages.html" title="2.3. Installing the
IPA Server Packages" /></head><body><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt
="Product Site" /></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="installing-ipa.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong></a></li></ul><div
class="section" id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">2.2. Preparing to Install the IPA
Server</h2></div></div></div><div class="para">
Before you install IPA, ensure that the installation environment is suitably
configured. You also need to provide certain information during the installation and
configuration procedures, including realm names and certain usernames and passwords. This
section describes the information that you need to provide.
</div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.2.1. Hardware
Requirements</h3></div></div></div><div
class="para">
A basic user entry is about 1 KB in size, as is a simple host entry with a
certificate. The structure of the directory tree and the number of indexes in the
Directory Server instance can impact the hardware required for the best performance. <a
class="xref"
href="Preparing_for_an_IPA_Installation.html#tab.Minimum_hardware_requirements_for_IPA">Table 2.1,
“Minimum Hardware Requirements”</a> lists the recommended minimums. For customized
systems, additional indexes, or larger user entries, it is more effective to increase the
RAM than to increase the disk space because the Directory Server stores much of its data
in cache. Add info for disk layout/size recommendations, from
https://www.redhat.com/archives/freeipa-users/2011-May/msg00012.html
@@ -87,12 +80,12 @@
</td><td>
53
</td></tr><tr><td>
- NTP<sup>[<a id="id2715524" href="#ftn.id2715524"
class="footnote">b</a>]</sup>
+ NTP<sup>[<a id="id2768549" href="#ftn.id2768549"
class="footnote">b</a>]</sup>
</td><td>
123
</td></tr></tbody><tbody
class="footnotes"><tr><td colspan="2"><div
class="footnote" id="ft.udp-tcp"><p><sup>[<a
id="ftn.ft.udp-tcp" href="#ft.udp-tcp"
class="para">a</a>] </sup>
This service uses both TCP adn UDP ports.
- </p></div><div
class="footnote"><p><sup>[<a id="ftn.id2715524"
href="#id2715524" class="para">b</a>] </sup>
+ </p></div><div
class="footnote"><p><sup>[<a id="ftn.id2768549"
href="#id2768549" class="para">b</a>] </sup>
This service uses UDP ports only.
</p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS">2.2.3.4. DNS</h4></div></div></div><div
class="para">
IPA uses DNS for the IPA clients to find (<span
class="emphasis"><em>discover</em></span>) the IPA servers.
The DNS service can be managed by IPA itself, or IPA can use an existing DNS server.
Without a properly configured and working DNS, server discovery for clients and IPA
services like, LDAP, Kerberos, and SSL may fail to work.
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Uninstalling_IPA_Servers.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Uninstalling_IPA_Servers.html
index c1af97f..4e93659 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Uninstalling_IPA_Servers.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Uninstalling_IPA_Servers.html
@@ -1,14 +1,14 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.5. Uninstalling FreeIPA Servers and Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.5. Uninstalling FreeIPA Servers and Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 1. Installing a FreeIPA
Server" /><link rel="prev"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"
title="1.4. Setting up FreeIPA Replicas" /><link rel="next"
href="setting-up-clients.html" title="Chapter 2. Setting up Systems as
FreeIPA Clients" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey
="p"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="setting-up-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="Uninstalling_IPA_Servers"><div
class="titlepage"><div><div><h2 class="title"
id="Uninstalling_IPA_Servers">1.5. Uninstalling FreeIPA Servers and
Replicas</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 2. Installing a FreeIPA
Server" /><link rel="prev"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"
title="2.4. Setting up FreeIPA Replicas" /><link rel="next"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey
="p"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="setting-up-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="Uninstalling_IPA_Servers"><div
class="titlepage"><div><div><h2 class="title"
id="Uninstalling_IPA_Servers">2.5. Uninstalling FreeIPA Servers and
Replicas</h2></div></div></div><div class="para">
To uninstall both a FreeIPA server and a FreeIPA replica, pass the <code
class="option">--uninstall</code> option to the <code
class="command">ipa-server-install</code> command:
<pre class="programlisting"><span class="perl_Comment">#
ipa-server-install --uninstall</span></pre>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Prev</strong>1.4. Setting
up FreeIPA Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="setting-up-clients.html"><strong>Next</strong>Chapter 2. Setting
up Systems as FreeIPA Clients</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Prev</strong>2.4. Setting
up FreeIPA Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="setting-up-clients.html"><strong>Next</strong>Chapter 3. Setting
up Systems as FreeIPA Clients</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
new file mode 100644
index 0000000..3f10656
--- /dev/null
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.7. Creating DNS Entries for FreeIPA Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev" href="ipa-cluster.html"
title="13.6. Using FreeIPA in a Cluster" /><link rel="next"
href="promoting-replica.html" title="13.8. Promoting a Read-Only Replica to
a FreeIPA Server" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</str
ong></a></li><li class="next"><a
accesskey="n"
href="promoting-replica.html"><strong>Next</strong></a></li></ul><div
class="section"
id="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">13.7. Creating
DNS Entries for FreeIPA Replicas</h2></div></div></div><div
class="para">
+ You can use the <code class="option">--ip-address</code> option
with the <code class="command">ipa-replica-prepare</code> command to
pre-create DNS entries for a replica. If you include this option, FreeIPA will add the A
and PTR records for the replica to the DNS. For example:
+<pre class="screen">$ ipa-replica-prepare
master2.example.com
--ip-address 192.168.1.2</pre>
+
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</strong>13.6. Using FreeIPA
in a Cluster</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="promoting-replica.html"><strong>Next</strong>13.8. Promoting
a Read-Only Replica to a FreeIPA
...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/active-directory.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/active-directory.html
index c1ddcfd..86fb94a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/active-directory.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/active-directory.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 8. Identity: Integrating with Microsoft Active
Directory</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 9. Identity: Integrating with Microsoft Active
Directory</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="configuring-automount.html"
title="7.2. Configuring Automount" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"
title="8.2. Setting up Active Directory" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="confi
guring-automount.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="active-directory"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 8. Identity: Integrating with Microsoft Active
Directory</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="active-directory.html#about-active-directory">8.1. About Active
Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="active-directory.html#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html">8.2.
Setting up Active Directory</a></span></dt><d
t><span class="section"><a
href="configuring-active-directory.html">8.3. Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">8.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html">8.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1.
Changing the Default Synchronization Subtree</a></span></dt></dl>
</dd><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html">8.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html">8.7.
Winsync Agreement Failures</a></span></dt></dl></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="configuring-automount.html"
title="8.2. Configuring Automount" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"
title="9.2. Setting up Active Directory" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="confi
guring-automount.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="active-directory"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 9. Identity: Integrating with Microsoft Active
Directory</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="active-directory.html#about-active-directory">9.1. About Active
Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt><span
class="section"><a
href="active-directory.html#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html">9.2.
Setting up Active Directory</a></span></dt><d
t><span class="section"><a
href="configuring-active-directory.html">9.3. Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">9.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html">9.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1.
Changing the Default Synchronization Subtree</a></span></dt></dl>
</dd><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html">9.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html">9.7.
Winsync Agreement Failures</a></span></dt></dl></div><div
class="para">
To synchronize user identity information between 389 Directory Server and Windows
Active Directory, IPA employs a plug-in that extends the functionality of the 389
Directory Server Windows Sync utility. This plug-in allows IPA to perform the data
manipulation necessary to achieve synchronization between 389 Directory Server and Windows
Active Directory. The IPA Windows Sync plug-in uses the <em
class="parameter"><code>ipaWinSyncUserAttr</code></em>
parameter to specify which attributes and values to add to new users that are synchronized
from Active Directory.
- </div><div class="section"
id="about-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="about-active-directory">8.1. About Active Directory, IPA, and Identity
Management</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1. Domain
Name Considerations</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="about-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="about-active-directory">9.1. About Active Directory, IPA, and Identity
Management</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1. Domain
Name Considerations</h3></div></div></div><div
class="para">
IPA clients find, or discover, IPA servers using a process known as <em
class="firstterm">Service Discovery</em>. This can occur automatically,
using DNS, or manually, by entering the IPA server details during the client configuration
phase. If your Active Directory installation is in the same domain as the IPA server, it
is possible that when you install IPA clients they will not discover the IPA server, but
rather the Active Directory DNS. This means that IPA commands run on the client will fail
because the client cannot contact the IPA server.
</div><div class="para">
To avoid this situation, use a separate domain for your IPA and Active Directory
servers. If this is not possible, use the <em
class="parameter"><code>--force</code></em> parameter when
you run the <code class="command">ipa-client-install</code> script.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="configuring-automount.html"><strong>Prev</strong>7.2. Configuring
Automount</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Next</strong>8.2. Setting
up Active Directory</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="configuring-automount.html"><strong>Prev</strong>8.2. Configuring
Automount</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Next</strong>9.2. Setting
up Active Directory</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/adding-users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/adding-users.html
index 54e11bc..20d5602 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/adding-users.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/adding-users.html
@@ -1,25 +1,25 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.2. Adding Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.2. Adding Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev" href="users.html"
title="Chapter 5. Identity: Managing Users and User Groups" /><link
rel="next" href="editing-users.html" title="5.3. Editing
Users" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="users.html"><strong>Prev</strong></a></li><li
class="next"><a
accesskey="n"
href="editing-users.html"><strong>Next</strong></a></li></ul><div
class="section" id="adding-users"><div
class="titlepage"><div><div><h2 class="title"
id="adding-users">5.2. Adding
Users</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="users.html"
title="Chapter 6. Identity: Managing Users and User Groups" /><link
rel="next" href="editing-users.html" title="6.3. Editing
Users" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="users.html"><strong>Prev</strong></a></li><li
class="next"><a
accesskey="n"
href="editing-users.html"><strong>Next</strong></a></li></ul><div
class="section" id="adding-users"><div
class="titlepage"><div><div><h2 class="title"
id="adding-users">6.2. Adding
Users</h2></div></div></div><div class="para">
FreeIPA supports a wide range of <span
class="property">username</span> formats, but you need to be aware of
any restrictions that may apply to your particular environment. For example, a <span
class="property">username</span> that starts with a digit may cause
problems for some UNIX systems.
</div><div class="para">
The range of <span class="property">username</span> formats
supported by FreeIPA can be described by the following regular expression:
- </div><pre class="screen"><code
class="command">[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]</code></pre><div
class="para">
+ </div><pre
class="screen">[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]</pre><div
class="para">
The trailing $ symbol is permitted for Samba 3.x machine support.
</div><div class="para">
Use the <code class="command">ipa user-add</code> command to add
users to FreeIPA. You can pass attributes directly on the command line, or run the command
with no parameters to enter interactive mode. Interactive mode prompts you to enter the
basic attributes required to add a new user. You can add further attributes using the
<code class="command">ipa user-mod</code> command. Use the <code
class="command">ipa user-mod --list</code> command to view a list of
the attributes that you can modify using this command.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_the_Command_Line-To_create_the_user_jlamb_using_the_command_line"><h6>Procedure 5.1. To
create the user <code class="systemitem">jlamb</code> using the
command line:</h6><ul><li class="step"><div
class="para">
+ </div><div class="procedure"
id="Using_the_Command_Line-To_create_the_user_jlamb_using_the_command_line"><h6>Procedure 6.1. To
create the user <code class="systemitem">jlamb</code> using the
command line:</h6><ul><li class="step"><div
class="para">
Open a shell and run the following command:
</div><div class="para">
-<pre class="screen"><code class="command">$ ipa user-add
jlamb --first=John --last=Lamb --password</code></pre>
+<pre class="screen">$ ipa user-add jlamb --first=John --last=Lamb
--password</pre>
</div><div class="para">
This will prompt for a password and then complete the new entry with default
values.
@@ -44,4 +44,10 @@ UID: 387115841
Press <span
class="keycap"><strong>Enter</strong></span> at each prompt
to accept the default values (enclosed in square brackets), or type an alternative.
</div><div class="para">
Refer to the <code class="command">ipa user-add</code> help page
for more information.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="users.html"><strong>Prev</strong>Chapter 5. Identity:
Managing Users and User Grou...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="editing-users.html"><strong>Next</strong>5.3. Editing
Users</a></li></ul></body></html>
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a user is created without specifying a UID or GID number, then the user account
is automatically assigned an ID number that is next available in the server or replica
range. (Number ranges are described more in <a class="xref"
href="Managing-Unique_UID_and_GID_Attributes.html">Section 13.3, “Managing
Unique UID and GID Number Assignments”</a>.) This means that a user always has a
unique number for its UID number and, if configured, for its private group.
+ </div><div class="para">
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
user entry, the server does not validate that the <em
class="parameter"><code>uidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in a
search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa user-find
--all</code>.
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="users.html"><strong>Prev</strong>Chapter 6. Identity:
Managing Users and User Grou...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="editing-users.html"><strong>Next</strong>6.3. Editing
Users</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/authz.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/authz.html
index 2177400..389ac27 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/authz.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/authz.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 10. Policy: Configuring Authorization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 11. Policy: Configuring Authorization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="migrintg-from-nis.html"
title="9.3. Migrating from NIS to IPA" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"
title="10.2. HBAC Service Groups" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href=
"migrintg-from-nis.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="authz"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 10. Policy: Configuring
Authorization</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="authz.html#configuring-host-access">10.1. Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html">10.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html">10.3.
HBAC Services</a></span></dt></dl></div><div
class="section" id="configuring-host-access"><div
class="tit
lepage"><div><div><h2 class="title"
id="configuring-host-access">10.1. Configuring Host-Based Access
Control</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="migrintg-from-nis.html"
title="10.3. Migrating from NIS to IPA" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"
title="11.2. HBAC Service Groups" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href
="migrintg-from-nis.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="authz"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 11. Policy: Configuring
Authorization</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="authz.html#configuring-host-access">11.1. Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html">11.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html">11.3.
HBAC Services</a></span></dt></dl></div><div
class="section" id="configuring-host-access"><div
class="ti
tlepage"><div><div><h2 class="title"
id="configuring-host-access">11.1. Configuring Host-Based Access
Control</h2></div></div></div><div class="para">
Host-based access control (HBAC) uses <em
class="firstterm">rules</em> to determine who can access what services
on what hosts and from where. You can use HBAC to control which users or groups on a
source host can access a service, or group of services, on a target host. Target hosts and
source hosts in HBAC rules must be hosts managed by IPA.
</div><div class="para">
You can also specify a category of users, target hosts, and source hosts. This is
currently limited to "all", but might be expanded in the future.
</div><div class="para">
The available services and groups of services are controlled by the <code
class="systemitem">hbacsvc</code> and <code
class="systemitem">hbacsvcgroup</code> plug-ins, respectively.
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="migrintg-from-nis.html"><strong>Prev</strong>9.3. Migrating
from NIS to IPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Next</strong>10.2. HBAC
Service Groups</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="migrintg-from-nis.html"><strong>Prev</strong>10.3. Migrating
from NIS to IPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Next</strong>11.2. HBAC
Service Groups</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/automount.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/automount.html
index d1cf8bf..f78afe6 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/automount.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/automount.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 7. Identity: Using Automount</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 8. Identity: Using Automount</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"
title="6.6. Kerberos Errors" /><link rel="next"
href="configuring-automount.html" title="7.2. Configuring Automount"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="sect-Enterpris
e_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-automount.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="automount"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Using
Automount</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="automount.html#about-automount">7.1. About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-automount.html">7.2.
Configuring Automount</a></
span></dt><dd><dl><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">7.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4.
Links</a></span></dt></dl></dd></dl></div><div
class="section" id="about-automount"><div
class="titlepage"><div><div><h2 class="title"
id="about-automount">7.1. About Automount and
IPA</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"
title="7.6. Kerberos Errors" /><link rel="next"
href="configuring-automount.html" title="8.2. Configuring Automount"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="sect-Enterpris
e_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-automount.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="automount"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 8. Identity: Using
Automount</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="automount.html#about-automount">8.1. About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-automount.html">8.2.
Configuring Automount</a></
span></dt><dd><dl><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4.
Links</a></span></dt></dl></dd></dl></div><div
class="section" id="about-automount"><div
class="titlepage"><div><div><h2 class="title"
id="about-automount">8.1. About Automount and
IPA</h2></div></div></div><div class="para">
This chapter describes how to configure <code
class="command">automount</code> on <code
class="systemitem">Linux</code> and <code
class="systemitem">Solaris</code> for use with IPA. It details the
procedures and configuration changes necessary to set up <code
class="command">automount</code>, the <code
class="filename">auto.master</code> file and other map files used by
<code class="command">autofs</code>.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1. Known
Issues with Automount</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Known_Issues_with_Automount-Additional_Schema_Required_for_Some_Systems"><h5
class="formalpara">Additional Schema Required for Some Systems</h5>
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1. Known
Issues with Automount</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Known_Issues_with_Automount-Additional_Schema_Required_for_Some_Systems"><h5
class="formalpara">Additional Schema Required for Some Systems</h5>
If you are supporting <code class="systemitem">Solaris</code>
clients, you need to use the 2307bis-style <code
class="command">automount</code> schema, although Sun's version is
NOT identical to the one at <a
href="http://people.redhat.com/nalin/schema/autofs.schema">h...;.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2. Assumptions</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2. Assumptions</h3></div></div></div><div
class="para">
In order to illustrate the <code
class="command">automount</code> configuration procedures, this chapter
assumes that:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The IPA server is correctly installed and operational.
@@ -36,4 +36,4 @@
</div><pre class="programlisting">/home 192.168.1.0/16
(rw,fsid=0,insecure,no_subtree_check,sync,anonuid=65534,anongid=65534)
</pre><div class="para">
You should test that you can mount the <code
class="filename">/home</code> directory from the command line before
proceeding with the <code class="command">automount</code>
configuration. This makes troubleshooting easier if the configuration does not work.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Prev</strong>6.6. Kerberos
Errors</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-automount.html"><strong>Next</strong>7.2. Configuring
Automount</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Prev</strong>7.6. Kerberos
Errors</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-automount.html"><strong>Next</strong>8.2. Configuring
Automount</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/basic-usage.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/basic-usage.html
index 4c24552..ed6d27b 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/basic-usage.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/basic-usage.html
@@ -1,40 +1,14 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 3. Basic Usage</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 4. Basic UI Usage</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"
title="2.6. Configuring a Macintosh OS X System as a FreeIPA Client"
/><link rel="next" href="logging-in.html"
title="3.2. Logging into the IPA UI" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_an_IPA_Client_
on_Macintosh_OS_X.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="logging-in.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="basic-usage"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 3. Basic
Usage</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="basic-usage.html#using-the-ui">3.1. Using the IPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="basic-usage.html#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="basic-usage.html#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="loggi
ng-in.html">3.2. Logging into the IPA
UI</a></span></dt><dt><span class="section"><a
href="switching-users.html">3.3. Switching
Users</a></span></dt></dl></div><div
class="section" id="using-the-ui"><div
class="titlepage"><div><div><h2 class="title"
id="using-the-ui">3.1. Using the IPA
UI</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1. Using
a Browser on Another System</h3></div></div></div><div
class="para">
- If you are unable, or prefer not, to update <code
class="filename">/etc/krb5.conf</code> with the IPA realm information,
you can create another copy and set an appropriate environment variable. You can then run
<code class="command">kinit</code> as before and use your browser to
connect to IPA. This is especially useful if you need to manage multiple realms, and if
you have overlapping domains.
- </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- This procedure is not necessary if you use <code
class="command">ipa-client-install</code> to set up your client.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_a_Browser_on_Another_System-To_set_up_a_browser_on_another_system_that_already_has_Kerberos_set_up_for_a_different_realm"><h6>Procedure 3.1. To
set up a browser on another system that already has Kerberos set up for a different
realm:</h6><ol class="1"><li class="step"><div
class="para">
- Copy the <code class="filename">/etc/krb5.conf</code> file
from the IPA server to the client system. Do not overwrite the existing <code
class="filename">krb5.conf</code> file. Run the following command on
the IPA server:
- </div><div class="para">
-
-<pre class="screen"><code class="command"> # scp
/etc/krb5.conf root@ipaclient:/etc/krb5_ipa.conf </code></pre>
-
- </div></li><li class="step"><div
class="para">
- On the IPA client, open a shell and run the following commands:
-<pre class="screen"><code class="command">$ export
KRB5_CONFIG=/etc/krb5_ipa.conf</code>
-<code class="command">$ kinit user(a)EXAMPLE.COM</code>
-<code class="command">$ /usr/bin/firefox</code></pre>
-
- </div></li><li class="step"><div
class="para">
- Configure and test <span
class="application"><strong>Firefox</strong></span>.
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2. Enabling
Username/Password Authentication in Your
Browser</h3></div></div></div><div class="para">
- If Kerberos authentication fails, the browser login will also fail, preventing access
to the IPA web interface. You can configure IPA to display a username/password
authentication dialog box if this situation occurs.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Enabling_UsernamePassword_Authentication_in_Your_Browser-To_enable_failover_to_usernamepassword_authentication"><h6>Procedure 3.2. To
enable failover to username/password authentication:</h6><ol
class="1"><li class="step"><div
class="para">
- Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file, and change the
<em
class="parameter"><code>KrbMethodK5Passwd</code></em>
attribute from <code class="literal">off</code> to <code
class="literal">on</code>.
- </div></li><li class="step"><div
class="para">
- Restart the <code class="systemitem">httpd</code> service:
-<pre class="screen"><code class="command"># service httpd
restart</code></pre>
-
- </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- You need to perform this procedure on all of the IPA servers in your deployment.
- </div></li><li class="listitem"><div
class="para">
- This change may not be preserved between IPA updates.
- </div></li></ul></div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Prev</strong>2.6. Configuring
a Macintosh OS X System as a Fre...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="logging-in.html"><strong>Next</strong>3.2. Logging into the
IPA UI</a></li></ul></body></html>
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="uninstalling-clients.html"
title="3.7. Uninstalling a FreeIPA Client" /><link rel="next"
href="using-the-ui.html" title="4.2. Using the FreeIPA UI"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="uninstalling-clients.html"><strong>Prev</strong></a></li><li
class="next"><a
accesskey="n"
href="using-the-ui.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="basic-usage"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 4. Basic UI
Usage</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="basic-usage.html#ipa-ui">4.1. Looking at the FreeIPA
UI</a></span></dt><dt><span class="section"><a
href="using-the-ui.html">4.2. Using the FreeIPA
UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="using-the-ui.html#config-browser">4.2.1. Configuring the
Browser</a></span></dt><dt><span
class="section"><a href="using-the-ui.html#logging-in">4.2.2.
Logging into the FreeIPA UI</a></span></dt><dt><span
class="section"><a
href="using-the-ui.html#Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="using-the-ui.html#Enabling_UsernamePassword_Authentication_in_Your_
Browser">4.2.4. Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="switching-users.html">4.3. Switching
Users</a></span></dt></dl></div><div
class="para">
+ XXXXX introXXXXXXXX
+ </div><div class="section" id="ipa-ui"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-ui">4.1. Looking at the FreeIPA
UI</h2></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="uninstalling-clients.html"><strong>Prev</strong>3.7. Uninstalling
a FreeIPA Client</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="using-the-ui.html"><strong>Next</strong>4.2. Using the
FreeIPA UI</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certmonger-tools.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certmonger-tools.html
new file mode 100644
index 0000000..f9059df
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certmonger-tools.html
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.4. Certmonger Scripts</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="tools-reference.html" title="Appendix B. FreeIPA Tools
Reference" /><link rel="prev" href="client-tools.html"
title="B.3. Client Scripts" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix C. Services: Working with certmonger" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="client-tools.
html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Next</strong></a></li></ul><div
class="section" id="certmonger-tools"><div
class="titlepage"><div><div><h2 class="title"
id="certmonger-tools">B.4. Certmonger
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section" id="getcert"><div
class="titlepage"><div><div><h3 class="title"
id="getcert">B.4.1. getcert</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="getcert-location"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-location">B.4.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="getcert-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-syntax">B.4.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="getcert-options"><div
class="titlepage"><div><div><h4 class="title"
id="getcert-options">B.4.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ certmonger
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-getcert"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-getcert">B.4.2. ipa-getcert</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-getcert-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-location">B.4.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ certmonger
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-getcert-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-syntax">B.4.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-getcert-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getcert-options">B.4.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="client-tools.html"><strong>Prev</strong>B.3. Client
Scripts</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Next</strong>Appendix C. Services:
Working with certmonger</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certs.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certs.html
index 90e422a..efce36e 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certs.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/certs.html
@@ -1,26 +1,32 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.5. Configuring Certificate-Based Machine
Authentication</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.5. Configuring Certificate-Based Machine
Authentication</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="config-virt-machines.html" title="4.4. Reconfiguring Virtual
Machines" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"
title="4.6. Client Problems" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a
accesskey="p"
href="config-virt-machines.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"><strong>Next</strong></a></li></ul><div
class="section" id="certs"><div
class="titlepage"><div><div><h2 class="title"
id="certs">4.5. Configuring Certificate-Based Machine
Authentication</h2></div></div></div><div
class="para">
- IPA v2 extends the scope of authentication to include machines on the network. Machine
authentication is required for the FreeIPA server to trust the machine and to accept
FreeIPA connections from the client software installed on that machine. After
authenticating the client, the FreeIPA server can respond to its requests.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="config-virt-machines.html" title="5.4. Reconfiguring Virtual
Machines" /><link rel="next"
href="General_Troubleshooting_Tips-Client_Problems.html" title="5.6. Client
Problems" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="config-virt-machines.
html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="General_Troubleshooting_Tips-Client_Problems.html"><strong>Next</strong></a></li></ul><div
class="section" id="certs"><div
class="titlepage"><div><div><h2 class="title"
id="certs">5.5. Configuring Certificate-Based Machine
Authentication</h2></div></div></div><div
class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX bz646240
</div><div class="para">
- IPA supports two different approaches to machine authentication: Key Tables (or <em
class="firstterm">keytabs</em>, a symmetric key resembling to some
extent a user password); and Machine Certificates. FreeIPA clients use XML-RPC calls to
request keytabs and certificates. Keys and certificate requests are generated on machines
applying for certificates. Certificates are generated by the CA, in response to
certificate requests submitted to FreeIPA and stored in FreeIPA's DS, and at the same
time delivered to the machine for use in PKI machine authentication.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1. Authentication
Usage Scenarios</h3></div></div></div><div
class="para">
- Usage scenarios are split into the following categories:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Deployment of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Authentication using machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Revocation of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Renewal of machine credentials (keytab/certificate)
- </div></li><li class="listitem"><div
class="para">
- Recovery from destruction of FreeIPA server
- </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="config-virt-machines.html"><strong>Prev</strong>4.4. Reconfiguring
Virtual Machines</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"><strong>Next</strong>4.6. Client
Problems</a></li></ul></body></html>
+ Authentication includes machines on the network. Machine authentication is required
for the FreeIPA server to trust the machine and to accept FreeIPA connections from the
client software installed on that machine. After authenticating the client, the FreeIPA
server can respond to its requests.
+ </div><div class="para">
+ FreeIPA supports two different approaches to machine authentication: Key Tables (or
<em class="firstterm">keytabs</em>, a symmetric key resembling to
some extent a user password); and Machine Certificates. FreeIPA clients use XML-RPC calls
to request keytabs and certificates. Keys and certificate requests are generated on
machines applying for certificates. Certificates are generated by the CA, in response to
certificate requests submitted to FreeIPA and stored in FreeIPA's DS, and at the same
time delivered to the machine for use in PKI machine authentication.
+ </div><div class="para">
+ Usage scenarios are split into the following categories:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Deployment of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Authentication using machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Revocation of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Renewal of machine credentials (keytab/certificate)
+ </div></li><li class="listitem"><div
class="para">
+ Recovery from destruction of FreeIPA server
+ </div></li></ul></div><div class="para">
+ Machine authentication * Machines coming on the network and requesting services within
the IPA realm shall be authenticated against that realm * Machine authentication
credentials shall be used to provide mutual authentication/trust, encryption, and SSO
capabilities for the services and applications requesting resources and accessing other
services within the same IPA realm
+ </div><div class="para">
+ Note: Term "Machine" below means is either a physical host or a guest image
in virtual machine. * [1.1] Integrate DNS server into the IPA server (Planned) o [1.1.1]
Store DNS information in the DS (Planned) o [1.1.2] Allow IPA clients to automatically
discover IPA servers (using DNS configuration) (Planned) o [1.1.3] Allow management of the
DNS entries through the central IPA management console (Planned) o [1.1.4] Continue to
allow IPA to function with an external DNS server (Planned) * [1.2] Policy on an IPA
server shall determine the rules of the enrollment for the new machines. Options include:
o [1.2.1] The machine shall automatically be registered in IPA and configured with
settings that were pre-initialized (Planned) o [1.2.2] An Administrator is required to
manually authenticate to the IPA server and initialize the configuration settings
(Planned) * [1.3] When machine joins IPA realm the following operations shall be
performed: (Planned) o [1.3.1] A unique and perm
anent identifier (machine GUID) shall be set for each machine. (Planned) o [1.3.2] Assign
a kerberos principal to the machine. (Planned) o [1.3.3] Kerberos machine principal name
will be administrator assigned or automatically set (Planned) o [1.3.4] Kerberos machine
principal will default to the hostname (Planned) o [1.3.5] Capture attributes about the
machine (Planned to some extent) + [1.3.5.1] Hostname + [1.3.5.2] Identify operating
system on the machine + [1.3.5.3] In the case of administrator enrollment, the ID of the
administrator o [1.3.6] Generate and provision keytab for machine authentication (Planned)
o [1.3.7] Generate and provision machine certificate for the machine/VM to be used by
applications and services that require PKI authentication (Planned) * [1.6] Renewal o
[1.6.1] Automatically renew kerberos credential according to the centrally managed renewal
policies (Planned - do it yourself instructions) o [1.6.2] Automatically renew and
provision certificates
before their expiration according to the centrally managed policy (Planned) * [1.7]
Allow a machine to leave the realm, de-activating the identity from IPA and
destroying/revoking any certificates/keytabs. (Planned) o [1.7.1] The task of
de-activating a machine from a realm should not require access (physical or network) to
that client machine (Planned) o [1.7.2] Allow machine to be de-activated from IPA realm
through the IPA client software (Planned) o [1.7.3] Allow machine to be re-enrolled into
the IPA realm. (Planned) * [1.8] Update LDAP schema to support machine identity and
related policies (Planned - but only for identity part) * [1.9] Maintain the identity of
the machine or virtual machine after an upgrade of the OS including a major upgrade for
example from 4 to 5. (Planned)
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="config-virt-machines.html"><strong>Prev</strong>5.4. Reconfiguring
Virtual Machines</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="General_Troubleshooting_Tips-Client_Problems.html"><strong>Next</strong>5.6. Client
Problems</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html
index e6be335..d56570e 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html
@@ -1,48 +1,48 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix A. Frequently Asked Questions</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix A. Frequently Asked Questions</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="logging.html" title="12.13. IPA
Server Logging" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix B. Services: Working with certmonger" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="logging.html"><strong>Pr
ev</strong></a></li><li class="next"><a
accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Frequently Asked
Questions</h1></div></div></div><div
class="qandaset"><dl><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3131937">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="logging.html" title="13.9. FreeIPA
Server Logging" /><link rel="next"
href="tools-reference.html" title="Appendix B. FreeIPA Tools
Reference" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="logging.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" hre
f="tools-reference.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Frequently Asked
Questions</h1></div></div></div><div
class="qandaset"><dl><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3338797">
Is it possible to change the IP address of the master server?
- </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3277218">
+ </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3332554">
Why are there restrictions on the length of user and group names? How can I change
this?
- </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3041394">
+ </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3392362">
What is the difference between a replica and a master server?
- </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3266154">
+ </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3172238">
Can I promote a replica to function as the master? How?
- </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3223153">
+ </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3226783">
Why does the ipa-client-install script fail to find the IPA server on a network that
uses Active Directory DNS?
- </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3052348">
+ </a></dt><dt>Q: <a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html#id3285411">
Can an administrator who is connected to "Server B" revoke a certificate
issued by "Server A"?
- </a></dt></dl><div class="qandaset"><div
id="id3131937" class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </a></dt></dl><div class="qandaset"><div
id="id3338797" class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Is it possible to change the IP address of the master server?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Yes. If you are only changing the IP address then it is sufficient to update the
<code class="filename">/etc/hosts</code> file, the system
configuration and the DNS entry.
- </div></div></div></div><div id="id3277218"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3332554"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Why are there restrictions on the length of user and group names? How can I change
this?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
User and group name lengths are specified in the policy. The default maximum
username length is 32 characters. The maximum configurable length for user or group names
is 255 characters. This restriction was introduced because some non-Linux operating
systems have limitations on the length of username that they can support.
</div><div class="para">
You can modify these settings either in the user interface or on the command line.
For example, to specify the maximum username length, run the following command: <code
class="command">ipa config-mod --maxusername=INT</code>
- </div></div></div></div><div id="id3041394"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3392362"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
What is the difference between a replica and a master server?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
The only difference between a replica and the initial IPA install (the
"master") is that the first server owns the self-signed CA.
- </div></div></div></div><div id="id3266154"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3172238"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Can I promote a replica to function as the master? How?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
- Yes. Refer to <a class="xref"
href="promoting-replica.html">Section 12.12, “Promoting a Read-Only Replica
to an IPA Server”</a>.
- </div></div></div></div><div id="id3223153"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ Yes. Refer to <a class="xref"
href="promoting-replica.html">Section 13.8, “Promoting a Read-Only Replica to
a FreeIPA Server”</a>.
+ </div></div></div></div><div id="id3226783"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Why does the <code class="command">ipa-client-install</code>
script fail to find the IPA server on a network that uses Active Directory DNS?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
This is probably due to the fact that Active Directory has its own SRV records for
Kerberos and LDAP, and so the <code
class="command">ipa-client-install</code> script retrieves those
records instead of any that you may have added for IPA.
- </div></div></div></div><div id="id3052348"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
+ </div></div></div></div><div id="id3285411"
class="qandaentry"><div
class="question"><label>Q:</label><div
class="data"><div class="para">
Can an administrator who is connected to "Server B" revoke a certificate
issued by "Server A"?
</div></div></div><div
class="answer"><label>A:</label><div
class="data"><div class="para">
Yes, assuming that Servers A and B contain non-cloned CAs whose portion of internal
storage has been replicated to share revocation information only.
- </div></div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="logging.html"><strong>Prev</strong>12.13. IPA Server
Logging</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Next</strong>Appendix B. Services:
Working with certmonger</a></li></ul></body></html>
+ </div></div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="logging.html"><strong>Prev</strong>13.9. FreeIPA Server
Logging</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="tools-reference.html"><strong>Next</strong>Appendix B. FreeIPA
Tools Reference</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html
index 0d754d1..f01ffb5 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.4. Setting up FreeIPA Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.4. Setting up FreeIPA Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 1. Installing a FreeIPA
Server" /><link rel="prev" href="creating-server.html"
title="1.3. Creating a FreeIPA Server Instance" /><link
rel="next" href="Uninstalling_IPA_Servers.html"
title="1.5. Uninstalling FreeIPA Servers and Replicas"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="creating-server.html"><strong
Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Uninstalling_IPA_Servers.html"><strong>Next</strong></a></li></ul><div
class="section"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">1.4. Setting
up FreeIPA Replicas</h2></div></div></div><div
class="para">
+ </script><link
rel="home" href="index.html" title="FreeIPA: Identity/Policy
Management" /><link rel="up" href="installing-ipa.html"
title="Chapter 2. Installing a FreeIPA Server" /><link
rel="prev" href="creating-server.html" title="2.3. Creating a
FreeIPA Server Instance" /><link rel="next"
href="Uninstalling_IPA_Servers.html" title="2.5. Uninstalling FreeIPA
Servers and Replicas" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="creating-server.html"><strong
Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Uninstalling_IPA_Servers.html"><strong>Next</strong></a></li></ul><div
class="section"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas">2.4. Setting
up FreeIPA Replicas</h2></div></div></div><div
class="para">
In the FreeIPA domain, there are three types of
machines:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Servers, which manage all of the services used by domain members
@@ -19,17 +19,17 @@
A replica is a clone of a specific FreeIPA server. The server and replica share the
same internal information about users, machines, certificates, and configured policies.
These data are copied from the server to the replica in a process called <span
class="emphasis"><em>replication</em></span>. The two
Directory Server instances used by an FreeIPA server — the Directory Server instance used
by the FreeIPA server as a data store and the Directory Server instance used by the Dogtag
Certificate System to store certificate information — are replicated over to corresponding
consumer Directory Server instances used by the FreeIPA replica.
</div><div class="note"><div
class="admonition_header"><h2>TIP</h2></div><div
class="admonition"><div class="para">
If you are using the integrated Dogtag Certificate System instance as the CA for the
FreeIPA domain, then it is possible to make a replica of a replica. It is <span
class="emphasis"><em>not</em></span> possible to make a
replica of a replica if you use the <code
class="option">--selfsign</code> option for the original FreeIPA
server.
- </div></div></div><div class="section"
id="installing-replica"><div
class="titlepage"><div><div><h3 class="title"
id="installing-replica">1.4.1. Prepping and Installing the Replica
Server</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="installing-replica"><div
class="titlepage"><div><div><h3 class="title"
id="installing-replica">2.4.1. Prepping and Installing the Replica
Server</h3></div></div></div><div class="para">
Replicas are functionally the same as FreeIPA servers, so they have the same
installation requirements and packages.
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Make sure that the machine meets all of the prerequisites listed in <a
class="xref"
href="installing-ipa.html#Preparing_for_an_IPA_Installation">Section 1.1,
“Preparing to Install the FreeIPA Server”</a>.
+ Make sure that the machine meets all of the prerequisites listed in <a
class="xref"
href="installing-ipa.html#Preparing_for_an_IPA_Installation">Section 2.1,
“Preparing to Install the FreeIPA Server”</a>.
</div></li><li class="listitem"><div
class="para">
- Install the server packages as in <a class="xref"
href="Installing_the_IPA_Server_Packages.html">Section 1.2, “Installing the
FreeIPA Server Packages”</a>. However, do <span
class="emphasis"><em>not</em></span> run the <code
class="command">ipa-server-install</code> script.
+ Install the server packages as in <a class="xref"
href="Installing_the_IPA_Server_Packages.html">Section 2.2, “Installing the
FreeIPA Server Packages”</a>. However, do <span
class="emphasis"><em>not</em></span> run the <code
class="command">ipa-server-install</code> script.
</div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
The replica and the master server must be running the same version of FreeIPA.
</div></div></div></li><li
class="listitem"><div class="para">
If there is an existing Dogtag Certificate System or Red Hat Certificate System
instance on the replica machine, make sure that port <code
class="systemitem">7389</code> is free. This port is used by the master
FreeIPA server to communicate with the replica.
- </div></li></ul></div></div><div
class="section" id="creating-the-replica"><div
class="titlepage"><div><div><h3 class="title"
id="creating-the-replica">1.4.2. Creating the
Replica</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ </div></li></ul></div></div><div
class="section" id="creating-the-replica"><div
class="titlepage"><div><div><h3 class="title"
id="creating-the-replica">2.4.2. Creating the
Replica</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
Make sure that the replica machine exists in the server's DNS <span
class="emphasis"><em>before</em></span> beginning to
configure the replica. If the server cannot contact the replica machine during the
configuration process, then the replica configuration fails.
</div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
C\On the master server, create a <span
class="emphasis"><em>replica information file</em></span>.
This contains realm and configuration information taken from the master server which will
be used to configure the replica server.
@@ -83,7 +83,7 @@ $ ipa dnsrecord-add
example.com @ --ns-rec
ipareplica.example.com.</pre>
</div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
Use the fully-qualified domain name of the replica, including the final period
(.), otherwise BIND will treat the hostname as relative to the domain.
- </div></div></div></li></ol></div></div><div
class="section" id="troubleshooting-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-replica-install">1.4.3. Troubleshooting Replica
Installation</h3></div></div></div><div
class="para">
+ </div></div></div></li></ol></div></div><div
class="section" id="troubleshooting-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-replica-install">2.4.3. Troubleshooting Replica
Installation</h3></div></div></div><div
class="para">
If the replica installation fails on step 3 (<span class="bold
bold"><strong>[3/11]: configuring certificate server
instance</strong></span>), that usually means that the required port is not
available. This can be verified by checking the debug logs for the CA, <code
class="filename">/var/log/pki-ca/debug</code>, which may show error
messages about being unable to find certain entries. For example:
<pre class="screen">[04/Feb/2011:22:29:03][http-9445-Processor25]:
DatabasePanel
comparetAndWaitEntries ou=people,o=ipaca not found, let's wait</pre>
@@ -94,4 +94,4 @@ comparetAndWaitEntries ou=people,o=ipaca not found, let's
wait</pre>
</div><div class="para">
After uninstalling the replica, ensure that port 7389 on the replica is available,
and retry the replica installation.
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="creating-server.html"><strong>Prev</strong>1.3. Creating a
FreeIPA Server Instance</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Uninstalling_IPA_Servers.html"><strong>Next</strong>1.5. Uninstalling
FreeIPA Servers and Replicas</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="creating-server.html"><strong>Prev</strong>2.3. Creating a
FreeIPA Server Instance</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Uninstalling_IPA_Servers.html"><strong>Next</strong>2.5. Uninstalling
FreeIPA Servers and Replicas</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/client-tools.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/client-tools.html
new file mode 100644
index 0000000..8cf24c3
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/client-tools.html
@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.3. Client Scripts</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="tools-reference.html" title="Appendix B. FreeIPA Tools
Reference" /><link rel="prev" href="server-tools.html"
title="B.2. Server Scripts" /><link rel="next"
href="certmonger-tools.html" title="B.4. Certmonger Scripts"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-tools.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" hr
ef="certmonger-tools.html"><strong>Next</strong></a></li></ul><div
class="section" id="client-tools"><div
class="titlepage"><div><div><h2 class="title"
id="client-tools">B.3. Client
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section"
id="ipa-client-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-client-install">B.3.1. ipa-client-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-client-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-location">B.3.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-client-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-syntax">B.3.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-client-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-client-install-options">B.3.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-getkeytab"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-getkeytab">B.3.2. ipa-getkeytab</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-getkeytab-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-location">B.3.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-getkeytab-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-syntax">B.3.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-getkeytab-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-getkeytab-options">B.3.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-join"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-join">B.3.3. ipa-join</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-join-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-location">B.3.3.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-join-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-syntax">B.3.3.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-join-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-join-options">B.3.3.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-rmkeytab"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-rmkeytab">B.3.4. ipa-rmkeytab</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-rmkeytab-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-location">B.3.4.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-rmkeytab-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-syntax">B.3.4.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-rmkeytab-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-rmkeytab-options">B.3.4.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="server-tools.html"><strong>Prev</strong>B.2. Server
Scripts</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="certmonger-tools.html"><strong>Next</strong>B.4. Certmonger
Scripts</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/config-virt-machines.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/config-virt-machines.html
index 52ca1c8..29b7436 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/config-virt-machines.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/config-virt-machines.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.4. Reconfiguring Virtual Machines</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.4. Reconfiguring Virtual Machines</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="renaming-machines.html" title="4.3. Renaming Machines"
/><link rel="next" href="certs.html"
title="4.5. Configuring Certificate-Based Machine Authentication"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="renaming-machines.html"><strong>Prev</s
trong></a></li><li class="next"><a
accesskey="n"
href="certs.html"><strong>Next</strong></a></li></ul><div
class="section" id="config-virt-machines"><div
class="titlepage"><div><div><h2 class="title"
id="config-virt-machines">4.4. Reconfiguring Virtual
Machines</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="renaming-machines.html" title="5.3. Renaming Machines"
/><link rel="next" href="certs.html"
title="5.5. Configuring Certificate-Based Machine Authentication"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="renaming-machines.html"><strong>Prev</s
trong></a></li><li class="next"><a
accesskey="n"
href="certs.html"><strong>Next</strong></a></li></ul><div
class="section" id="config-virt-machines"><div
class="titlepage"><div><div><h2 class="title"
id="config-virt-machines">5.4. Reconfiguring Virtual
Machines</h2></div></div></div><div class="para">
There are two cases where it might be necessary to reconfigure a VM enrolled in a
FreeIPA domain:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The VM is copied.
@@ -18,7 +18,7 @@
</div></li></ul></div>
</div><div class="para">
- In each case, the procedure is identical to that described for renaming a FreeIPA
machine: <a class="xref"
href="renaming-machines.html#proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine">Procedure 4.3,
“To rename a FreeIPA machine:”</a>. Although it is possible to <span
class="emphasis"><em>not</em></span> completely unconfigure
the client, there is no real downside to doing this (that is, running the <code
class="command">ipa-client-install --uninstall</code> command).
+ In each case, the procedure is identical to that described for renaming a FreeIPA
machine: <a class="xref"
href="renaming-machines.html#proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine">Procedure 5.3,
“To rename a FreeIPA machine:”</a>. Although it is possible to <span
class="emphasis"><em>not</em></span> completely unconfigure
the client, there is no real downside to doing this (that is, running the <code
class="command">ipa-client-install --uninstall</code> command).
</div><div class="para">
If you cannot use the <code class="command">ipa-client-install
--uninstall</code> command, or it is failing for some reason, use the following
manual procedure to remove the FreeIPA configuration from the client. Bear in mind,
however, that this procedure cannot be undone:
</div><div class="procedure"><ol class="1"><li
class="step"><div class="para">
@@ -43,4 +43,4 @@
Add the new host to FreeIPA, or re-join using administrator privileges:
<pre class="programlisting"><code class="command">$
ipa-join</code></pre>
- </div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="renaming-machines.html"><strong>Prev</strong>4.3. Renaming
Machines</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="certs.html"><strong>Next</strong>4.5. Configuring
Certificate-Based Machine
Authen...</a></li></ul></body></html>
+ </div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="renaming-machines.html"><strong>Prev</strong>5.3. Renaming
Machines</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="certs.html"><strong>Next</strong>5.5. Configuring
Certificate-Based Machine
Authen...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-active-directory.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-active-directory.html
index 2aae9e8f..0a90ee2 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-active-directory.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-active-directory.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.3. Configuring Active Directory Synchronization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.3. Configuring Active Directory Synchronization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"
title="8.2. Setting up Active Directory" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"
title="8.4. Creating Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" href="http://docs
.fedoraproject.org"><img src="Common_Content/images/image_right.png"
alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-active-directory">8.3. Configuring Active Directory
Synchronization</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"
title="9.2. Setting up Active Directory" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"
title="9.4. Creating Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" href="http://docs
.fedoraproject.org"><img src="Common_Content/images/image_right.png"
alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-active-directory"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-active-directory">9.3. Configuring Active Directory
Synchronization</h2></div></div></div><div
class="para">
The Windows Sync plug-in is installed on the IPA server, and enables one-way
replication of users and groups from Windows to IPA. The <code
class="command">ipa-server-install</code> script automatically installs
the plug-in configuration entry and enables it by default. The Windows Sync plug-in is
only ever called if Windows Sync is used.
</div><div class="para">
The passsync plug-in for Windows uses a standard <code
class="command">ldapmodify</code> operation to change users'
passwords. These operations take effect immediately, and are still normally subject to
password policy settings. When the special user used by passsync sets the password, these
password policies should be bypassed and the password should not be set to immediately
expire, as is the case when a normal administrator resets a user password. To achieve
this, you need to add a list of passSync Manager DNs to the password plug-in
configuration. These users will be exempt from password policy enforcement in the same way
that the Directory Manager is exempt. This currently requires a manual configuration, as
follows:
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Windows_Sync_on_the_IPA_Server-To_add_a_list_of_passSync_Manager_DNs_to_the_password_plug_in_configuration"><h6>Procedure 8.2. To
add a list of passSync Manager DNs to the password plug-in configuration:</h6><ol
class="1"><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Windows_Sync_on_the_IPA_Server-To_add_a_list_of_passSync_Manager_DNs_to_the_password_plug_in_configuration"><h6>Procedure 9.2. To
add a list of passSync Manager DNs to the password plug-in configuration:</h6><ol
class="1"><li class="step"><div
class="para">
As Directory Manager, modify the entry <em
class="parameter"><code>cn=ipa_pwd_extop,cn=plugins,cn=config</code></em>
</div></li><li class="step"><div
class="para">
Add or update the <em
class="parameter"><code>passSyncManagersDNs</code></em>
attribute. This is a multi-valued list of DNs that bypass password policy.
@@ -25,4 +25,4 @@ add: passSyncManagersDNs
passSyncManagersDNs: uid=admin,cn=users,cn=accounts,dc=example,dc=com
</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The entry <em class="parameter"><code>cn=Directory
Manager</code></em> always bypasses policy and does not need to be explicitly
listed.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Prev</strong>8.2. Setting
up Active Directory</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Next</strong>8.4. Creating
Synchronization Agreements</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html"><strong>Prev</strong>9.2. Setting
up Active Directory</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Next</strong>9.4. Creating
Synchronization Agreements</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-automount.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-automount.html
index 2db66ff..7710b13 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-automount.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-automount.html
@@ -1,19 +1,19 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.2. Configuring Automount</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.2. Configuring Automount</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="automount.html" title="Chapter 7. Identity: Using Automount"
/><link rel="prev" href="automount.html"
title="Chapter 7. Identity: Using Automount" /><link rel="next"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="automount.html"><strong>Prev</str
ong></a></li><li class="next"><a
accesskey="n"
href="active-directory.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-automount"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-automount">7.2. Configuring
Automount</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="automount.html" title="Chapter 8. Identity: Using Automount"
/><link rel="prev" href="automount.html"
title="Chapter 8. Identity: Using Automount" /><link rel="next"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="automount.html"><strong>Prev</str
ong></a></li><li class="next"><a
accesskey="n"
href="active-directory.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-automount"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-automount">8.2. Configuring
Automount</h2></div></div></div><div
class="para">
IPA natively supports automount and so only minimal configuration is required. IPA 2.0
also introduces the concept of a <em
class="firstterm">location</em>, which allows for different sets of
maps for different purposes, or locations.
<div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You can direct different clients to use different map sets. These map sets use a
tree structure, which means that you cannot share maps between locations.
</div></div></div>
Any extra steps required for configuring automount on Linux or Solaris are described
below. Refer to the <code class="command">ipa help automount</code>
help page for more information and a list of available commands.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1. Configuring
autofs on Linux</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-To_configure_autofs_on_Linux"><h6>Procedure 7.1. To
configure autofs on Linux:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1. Configuring
autofs on Linux</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-To_configure_autofs_on_Linux"><h6>Procedure 8.1. To
configure autofs on Linux:</h6><ol class="1"><li
class="step"><div class="para">
Edit the <code class="filename">/etc/sysconfig/autofs</code>
file as follows. This specifies the attributes that <code
class="command">autofs</code> searches for:
</div><pre class="programlisting">#
# Other common LDAP naming
@@ -35,7 +35,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
<pre class="screen"><code class="command"># service
autofs restart</code></pre>
- </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration">7.2.1.1. Testing
the Configuration</h4></div></div></div><div
class="para">
+ </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_autofs_on_Linux-Testing_the_Configuration">8.2.1.1. Testing
the Configuration</h4></div></div></div><div
class="para">
Test the configuration by attempting to list a user's <code
class="filename">/home</code> directory:
</div><div class="para">
@@ -43,7 +43,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
</div><div class="para">
If this does not mount the remote file system, check the <code
class="filename">/var/log/messages</code> file for errors or other
indications of what the problem might be. You can also increase the debug level in the
<code class="filename">/etc/sysconfig/autofs</code> file by setting
the <em class="parameter"><code>LOGGING</code></em>
parameter to <code class="literal">debug</code>.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2. Solaris
automount</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2. Solaris
automount</h3></div></div></div><div
class="para">
The following procedure describes the steps required to configure <code
class="command">automount</code> for <code
class="systemitem">Solaris</code>.
</div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
If the <code class="systemitem">NFS</code> server is running
on <code class="systemitem">Linux</code>, you need to specify on the
<code class="systemitem">Solaris</code> machine that NFSv3 is the
maximum supported version. Edit the <code
class="filename">/etc/default/nfs</code> file and set the following
parameter:
@@ -68,7 +68,7 @@
SEARCH_BASE="cn=<location>,cn=automount,dc=example,dc=com"
<pre class="screen"><code class="command"># svcadm enable
svc:/system/filesystem/autofs</code></pre>
- </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration">7.2.2.1. Testing
the Configuration</h4></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Testing_the_Configuration-_To_test_the_automount_configuration_run_the_following_commands_"><h6>Procedure 7.2.
To test the <code class="command">automount</code> configuration,
run the following commands: </h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ol></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Solaris_automount-Testing_the_Configuration">8.2.2.1. Testing
the Configuration</h4></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Testing_the_Configuration-_To_test_the_automount_configuration_run_the_following_commands_"><h6>Procedure 8.2.
To test the <code class="command">automount</code> configuration,
run the following commands: </h6><ol class="1"><li
class="step"><div class="para">
<pre class="screen"><code class="command"># ldapclient -l
auto_master</code>
dn:
automountkey=/home,automountmapname=auto.master,cn=<location>,cn=automount,dc=example,dc=com
@@ -84,7 +84,7 @@ automountInformation: auto.home
<pre class="screen"><code class="command"># ls
/home/<username></code></pre>
- </div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">7.2.3. Configuring
Indirect Maps</h3></div></div></div><div
class="para">
+ </div></li></ol></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3. Configuring
Indirect Maps</h3></div></div></div><div
class="para">
An indirect map defines a container for mount points. For example, if you create an
indirect map <code class="filename">/share</code>, then all
automount keys are relative to that map. If you define an automount key <code
class="systemitem">ipauser</code>, the map would appear as <code
class="filename">/share/ipauser</code>. In other words, indirect maps
specify relative paths. Compare this to the absolute paths specified by direct maps.
</div><div class="para">
The following example creates an indirect map for <code
class="filename">/usr/man</code> using the built-in IPA commands. This
creates a single indirect map, <code
class="filename">/usr/man/man1</code>, which:
@@ -94,7 +94,7 @@ automountInformation: auto.home
Adds <code class="filename">auto.man</code> to <code
class="filename">auto.master</code> on the mount point <code
class="filename">/usr/man</code>
</div></li><li class="listitem"><div
class="para">
Adds an indirect mount of <code class="filename">man1</code>
to <code class="filename">auto.man</code>
- </div></li></ul></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-How_to_create_an_indirect_map"><h6>Procedure 7.3. How
to create an indirect map:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ul></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-How_to_create_an_indirect_map"><h6>Procedure 8.3. How
to create an indirect map:</h6><ol class="1"><li
class="step"><div class="para">
Create a new location:
</div><pre class="screen"><code
class="command">$ ipa automountlocation-add baltimore</code>
Location: baltimore</pre></li><li class="step"><div
class="para">
@@ -117,7 +117,7 @@ automountInformation: auto.home
On <code class="systemitem">Solaris</code>, use the following
arguments with the <code class="command">ldapclient</code> command:
</div><pre class="programlisting">-a
serviceSearchDescriptor=auto_man:automountMapName=auto.man, \
cn=<location>,cn=automount,dc=example,dc=com?one \
-</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps">7.2.3.1. Configuring
Direct Maps</h4></div></div></div><div
class="para">
+</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Indirect_Maps-Configuring_Direct_Maps">8.2.3.1. Configuring
Direct Maps</h4></div></div></div><div
class="para">
Direct maps list exact locations to mount specified maps, for example <code
class="filename">/usr/local/bin</code> or <code
class="filename">/mnt</code>. That is, they specify absolute paths as
mount points. Compare this to the relative paths specified by indirect maps.
</div><div class="para">
To add a direct map configuration, IPA requires a number of modifications to the
<code class="filename">auto.direct</code> file. The following two
entries are created during the installation process:
@@ -130,7 +130,7 @@ automountInformation: auto.home
automountMapName: auto.direct
</pre><div class="para">
Use the following procedure to add a mount to this direct map for the <code
class="filename">/share</code> directory:
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Direct_Maps-How_to_create_a_direct_map"><h6>Procedure 7.4. How
to create a direct map:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Direct_Maps-How_to_create_a_direct_map"><h6>Procedure 8.4. How
to create a direct map:</h6><ol class="1"><li
class="step"><div class="para">
Create a new location:
</div><pre class="screen"><code
class="command">$ ipa automountlocation-add brisbane</code>
Location: brisbane</pre></li><li class="step"><div
class="para">
@@ -142,7 +142,7 @@ automountInformation: auto.home
On <code class="systemitem">Solaris</code>, use the following
arguments with the <code class="command">ldapclient</code> command:
</div><pre class="programlisting">-a
serviceSearchDescriptor=auto_direct:automountMapName=auto.direct, \
cn=<location>,cn=automount,dc=example,dc=com?one \
-</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4. Links</h3></div></div></div><div
class="para">
+</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4. Links</h3></div></div></div><div
class="para">
The following pages were used as references for this work:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<a
href="http://efod.se/blog/archive/2006/06/27/autofs-and-ldap">http://efod.se/blog/archive/2006/06/27/autofs-and-ldap</a>
@@ -154,4 +154,4 @@ automountInformation: auto.home
<a
href="http://forums.fedoraforum.org/forum/showthread.php?t=135635&am...
</div></li><li class="listitem"><div
class="para">
<a
href="http://blogs.sun.com/rohanpinto/entry/nis_to_ldap_migration_gu...
- </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="automount.html"><strong>Prev</strong>Chapter 7. Identity:
Using Automount</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="active-directory.html"><strong>Next</strong>Chapter 8. Identity:
Integrating with Microsoft A...</a></li></ul></body></html>
+ </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="automount.html"><strong>Prev</strong>Chapter 8. Identity:
Using Automount</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="active-directory.html"><strong>Next</strong>Chapter 9. Identity:
Integrating with Microsoft A...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-sudo.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-sudo.html
index 851e76b..e91bb7d 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-sudo.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/configuring-sudo.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>11.2. Configuring sudo</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.2. Configuring sudo</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sudo.html" title="Chapter 11. Policy: Using sudo" /><link
rel="prev" href="sudo.html" title="Chapter 11. Policy: Using
sudo" /><link rel="next" href="server-config.html"
title="Chapter 12. Configuring the IPA Server" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sudo.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="ser
ver-config.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-sudo">11.2. Configuring
sudo</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sudo.html" title="Chapter 12. Policy: Using sudo" /><link
rel="prev" href="sudo.html" title="Chapter 12. Policy: Using
sudo" /><link rel="next" href="server-config.html"
title="Chapter 13. Configuring the FreeIPA Server" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sudo.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href=
"server-config.html"><strong>Next</strong></a></li></ul><div
class="section" id="configuring-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="configuring-sudo">12.2. Configuring
sudo</h2></div></div></div><div class="para">
To fully implement Sudo rules, you need to perform various configuration steps on both
the IPA server and client. You should first create a <em
class="firstterm">Sudo command object</em>, and optionally create any
<em class="firstterm">Sudo command groups</em>. Finally, create a
<em class="firstterm">Sudo rule</em>, which should contain at least
the following components:
<div class="itemizedlist"><div class="para">
One or more:
@@ -21,7 +21,7 @@
</div><div class="para">
These steps are described in detail in the following sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1. Server
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules"><h6>Procedure 11.1. How
to configure your server to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1. Server
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules"><h6>Procedure 12.1. How
to configure your server to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
Set up a host group, and add the client to the host group:
</div><ol class="a"><li class="step"><pre
class="screen"><code class="command">$ ipa hostgroup-add
bne_doc</code>
Description: BNE Documentation hosts
@@ -138,7 +138,7 @@ Number of members added 1
-------------------------
</pre>
- </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2. Client
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-How_to_configure_your_client_to_use_Sudo_rules"><h6>Procedure 11.2. How
to configure your client to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2. Client
Configuration for Sudo Rules</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-How_to_configure_your_client_to_use_Sudo_rules"><h6>Procedure 12.2. How
to configure your client to use Sudo rules:</h6><ol class="1"><li
class="step"><div class="para">
Configure <code class="command">sudo</code> to look to LDAP
for the <code class="filename">sudoers</code> file. Add the
following line to <code class="filename">/etc/nsswitch.conf</code>:
<pre class="programlisting">sudoers: ldap</pre>
@@ -171,7 +171,7 @@ timelimit 15
uri
ldap://ipaserver.ipadocs.org
</pre>
<div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- The sudo user's password in this configuration is the same password you set
up in <a class="xref"
href="configuring-sudo.html#proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules">Procedure 11.1,
“How to configure your server to use Sudo rules:”</a>.
+ The sudo user's password in this configuration is the same password you set
up in <a class="xref"
href="configuring-sudo.html#proc-Enterprise_Identity_Management_Guide-Server_Configuration_for_Sudo_Rules-How_to_configure_your_server_to_use_Sudo_rules">Procedure 12.1,
“How to configure your server to use Sudo rules:”</a>.
</div></div></div>
</div><div class="para">
@@ -186,7 +186,7 @@ uri
ldap://ipaserver.ipadocs.org
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
A bug has been filed in Fedora to have this configuration requirement addressed
during the boot process.
- </div></div></div></li></ol></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes">11.2.2.1. NIS
Configuration Notes</h4></div></div></div><div
class="para">
+ </div></div></div></li></ol></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Client_Configuration_for_Sudo_Rules-NIS_Configuration_Notes">12.2.2.1. NIS
Configuration Notes</h4></div></div></div><div
class="para">
Originally called <em class="firstterm">Yellow Pages
(YP)</em>, NIS was created by Sun Microsystems and stands for Network Information
Service. It was primarily used by UNIX to centrally manage authentication and enumeration
information such as user/password, host/IP address, POSIX groups, and netgroups. NIS (the
service) does not actually need to be configured on either the client or the server. Not
only is it unnecessary, but might be considered a security risk if it were running. NIS is
an RPC service and is insecure by today's standards, partly because:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
It provides no host authentication mechanisms
@@ -200,4 +200,4 @@ uri
ldap://ipaserver.ipadocs.org
The IPA LDAP implementation provides the schema to support NIS as defined in <a
href="http://tools.ietf.org/html/rfc2307">RFC 2307</a>. NIS objects are
automatically created inside of LDAP and NSS_LDAP, or SSSD fetches them using an encrypted
LDAP connection.
</div><div class="para">
Utilizing SSSD or NSS_LDAP, a client system can enumerate the necessary NIS
information using authenticated and encrypted queries to the back end LDAP service
provided by the IPA Server. This eliminates the need for NIS client configuration for
systems that can support NIS using LDAP when utilizing IPA.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sudo.html"><strong>Prev</strong>Chapter 11. Policy: Using
sudo</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="server-config.html"><strong>Next</strong>Chapter 12. Configuring
the IPA Server</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sudo.html"><strong>Prev</strong>Chapter 12. Policy: Using
sudo</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="server-config.html"><strong>Next</strong>Chapter 13. Configuring
the FreeIPA Server</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-roles.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-roles.html
index 6f30f14..01ac756 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-roles.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-roles.html
@@ -1,13 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.2. Creating Roles</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="server-config.html"
title="Chapter 12. Configuring the IPA Server" /><link
rel="next" href="self-service.html" title="12.3. Defining
Self-Service Settings" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-config.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="self-service.html"><strong>Next</strong></a></li></ul><div
class="section" id="creating-roles"><div
class="titlepage"><div><div><h2 class="title"
id="creating-roles">12.2. Creating
Roles</h2></div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_an_IPA_Role-To_set_up_a_new_role"><h6>Procedure 12.1. To
set up a new role:</h6><ol class="1"><li
class="step"><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.2. Creating Roles</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev" href="server-config.html"
title="Chapter 14. Configuring the IPA Server" /><link
rel="next" href="self-service.html" title="14.3. Defining
Self-Service Settings" /></head><body><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" hr
ef="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-config.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="self-service.html"><strong>Next</strong></a></li></ul><div
class="section" id="creating-roles"><div
class="titlepage"><div><div><h2 class="title"
id="creating-roles">14.2. Creating
Roles</h2></div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_an_IPA_Role-To_set_up_a_new_role"><h6>Procedure 14.1. To
set up a new role:</h6><ol class="1"><li
class="step"><div class="para">
Add the new role:
</div><pre class="screen"><code
class="command"># ipa role-add --desc="User Administrator"
useradmin</code>
------------------------
@@ -46,4 +39,4 @@
As the needs of your enterprise change, you may need to modify the roles that you have
established. For example, you may need to change the members of the role, or change the
privileges associated with the role. You can use the <code
class="command">ipa role-*</code> commands to perform these functions.
For example, to remove an existing privilege from a role, use the <code
class="command">ipa role-remove-privilege</code> command. To remove
members from a role, use the <code class="command">ipa
role-remove-member</code> command. Refer to the <code
class="command">ipa role help</code> pages for more information.
</div><div class="para">
You can use the <code class="command">ipa role-del</code>
command to delete IPA roles from your configuration. Bear in mind, however, that any
entities that rely on this role for access to IPA objects or to perform certain tasks will
no longer have that ability.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-config.html"><strong>Prev</strong>Chapter 12. Configuring
the IPA Server</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="self-service.html"><strong>Next</strong>12.3. Defining
Self-Service Settings</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-config.html"><strong>Prev</strong>Chapter 14. Configuring
the IPA Server</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="self-service.html"><strong>Next</strong>14.3. Defining
Self-Service Settings</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-server.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-server.html
index 4aa9198..c867009 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-server.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/creating-server.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.3. Creating a FreeIPA Server Instance</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>2.3. Creating a FreeIPA Server Instance</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 1. Installing a FreeIPA
Server" /><link rel="prev"
href="Installing_the_IPA_Server_Packages.html" title="1.2. Installing the
FreeIPA Server Packages" /><link rel="next"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"
title="1.4. Setting up FreeIPA Replicas" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a
accesskey="p"
href="Installing_the_IPA_Server_Packages.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Next</strong></a></li></ul><div
class="section" id="creating-server"><div
class="titlepage"><div><div><h2 class="title"
id="creating-server">1.3. Creating a FreeIPA Server
Instance</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="installing-ipa.html" title="Chapter 2. Installing a FreeIPA
Server" /><link rel="prev"
href="Installing_the_IPA_Server_Packages.html" title="2.2. Installing the
FreeIPA Server Packages" /><link rel="next"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"
title="2.4. Setting up FreeIPA Replicas" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a
accesskey="p"
href="Installing_the_IPA_Server_Packages.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Next</strong></a></li></ul><div
class="section" id="creating-server"><div
class="titlepage"><div><div><h2 class="title"
id="creating-server">2.3. Creating a FreeIPA Server
Instance</h2></div></div></div><div class="para">
The FreeIPA setup script creates a server instance, which includes configuring all of
the required services for the FreeIPA domain:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The network time daemon (ntpd)
@@ -28,21 +28,21 @@
</div></li></ul></div><div class="para">
The FreeIPA setup process can be minimal, where the administrator only supplies some
required information, or it can be very specific, with user-defined settings for many
parts of the FreeIPA services. The configuration is passed using arguments with the
<code class="command">ipa-install-server</code> script.
</div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
- The port numbers and directory locations used by FreeIPA are all defined
automatically, as defined in <a class="xref"
href="installing-ipa.html#prereq-ports">Section 1.1.3.3, “System
Ports”</a> and . These ports and directories <span
class="emphasis"><em>cannot</em></span> be changed or
customized.
- </div></div></div><div class="section"
id="install-command"><div
class="titlepage"><div><div><h3 class="title"
id="install-command">1.3.1. About
ipa-server-install</h3></div></div></div><div
class="para">
+ The port numbers and directory locations used by FreeIPA are all defined
automatically, as defined in <a class="xref"
href="installing-ipa.html#prereq-ports">Section 2.1.3.3, “System
Ports”</a> and . These ports and directories <span
class="emphasis"><em>cannot</em></span> be changed or
customized.
+ </div></div></div><div class="section"
id="install-command"><div
class="titlepage"><div><div><h3 class="title"
id="install-command">2.3.1. About
ipa-server-install</h3></div></div></div><div
class="para">
A FreeIPA server instance is created by running the <code
class="command">ipa-server-install</code> script. This script can
accept user-defined settings for services, like DNS nad Kerberos, that are used by the
FreeIPA instance, or it can supply predefined values for minimal input from the
administrator.
</div><div class="para">
While <code class="command">ipa-server-install</code> can be
run without any options, so that it prompts for the required information, it has numerous
arguments which allow the configuration process to be easily scripted or to supply
additional information which is not requested during an interactive installation.
</div><div class="para">
- <a class="xref"
href="creating-server.html#tab.ipa-server-install-param">Table 1.3,
“ipa-server-install Options”</a> lists the possible arguments with <code
class="command">ipa-server-install</code>, while <a
class="xref"
href="creating-server.html#install-examples">Section 1.3.3, “Examples of
Creating the FreeIPA Server”</a> has examples of some common installation scenarios.
In real life, the <code class="command">ipa-server-install</code>
options are versatile enough to be customized to the specific deployment environment.
- </div><div class="table"
id="tab.ipa-server-install-param"><h6>Table 1.3. ipa-server-install
Options</h6><div class="table-contents"><table
summary="ipa-server-install Options"
border="1"><colgroup><col width="33%" /><col
width="33%" /><col width="33%"
/></colgroup><thead><tr><th>
+ <a class="xref"
href="creating-server.html#tab.ipa-server-install-param">Table 2.3,
“ipa-server-install Options”</a> lists the possible arguments with <code
class="command">ipa-server-install</code>, while <a
class="xref"
href="creating-server.html#install-examples">Section 2.3.3, “Examples of
Creating the FreeIPA Server”</a> has examples of some common installation scenarios.
In real life, the <code class="command">ipa-server-install</code>
options are versatile enough to be customized to the specific deployment environment.
+ </div><div class="table"
id="tab.ipa-server-install-param"><h6>Table 2.3. ipa-server-install
Options</h6><div class="table-contents"><table
summary="ipa-server-install Options"
border="1"><colgroup><col width="33%" /><col
width="33%" /><col width="33%"
/></colgroup><thead><tr><th>
Argument
</th><th>
Alternate Argument
</th><th>
Description
</th></tr></thead><tbody><tr><td
colspan="3">
- <span class="bold bold"><strong>Required
Options</strong></span><sup>[<a id="id3087862"
href="#ftn.id3087862" class="footnote">a</a>]</sup>
+ <span class="bold bold"><strong>Required
Options</strong></span><sup>[<a id="id3430006"
href="#ftn.id3430006" class="footnote">a</a>]</sup>
</td></tr><tr><td>
-a <span
class="emphasis"><em>ipa_admin_password</em></span>
</td><td>
@@ -94,12 +94,6 @@
</td><td>
Points to the PKCS#10 file which contains the certificate that was generated by
an external CA. If an external CA is used, this is required in a second invocation of
<code class="command">ipa-server-install</code> to complete the
setup process.
</td></tr><tr><td>
- --external_ca_file=<span
class="emphasis"><em>CA_cert_chain_file</em></span>
- </td><td>
-
- </td><td>
- Instructs the installation script to generate a certificate request that can be
submitted to an external or third-party CA.
- </td></tr><tr><td>
--selfsign
</td><td>
@@ -229,9 +223,9 @@
</td><td>
Prints the version number of the <code
class="command">ipa-server-install</code> command.
- </td></tr></tbody><tbody
class="footnotes"><tr><td colspan="3"><div
class="footnote"><p><sup>[<a id="ftn.id3087862"
href="#id3087862" class="para">a</a>] </sup>
+ </td></tr></tbody><tbody
class="footnotes"><tr><td colspan="3"><div
class="footnote"><p><sup>[<a id="ftn.id3430006"
href="#id3430006" class="para">a</a>] </sup>
The installation script will prompt for these options if they are not passed
with the script.
- </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="install-interactive"><div
class="titlepage"><div><div><h3 class="title"
id="install-interactive">1.3.2. Setting up a FreeIPA Server: Basic
Interactive Installation</h3></div></div></div><div
class="para">
+ </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="install-interactive"><div
class="titlepage"><div><div><h3 class="title"
id="install-interactive">2.3.2. Setting up a FreeIPA Server: Basic
Interactive Installation</h3></div></div></div><div
class="para">
All that is required to set up a FreeIPA server is to run the <code
class="command">ipa-server-install</code> script. This launchs the
script interactively, which prompts for the required information to set up a server, but
without more advanced configuration like DNS and CA options.
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Run the <code class="command">ipa-server-install</code>
script.
@@ -317,10 +311,10 @@ Password <span class="perl_Keyword">for</span>
admin@EXAMPLE.COM:</pre></li><li
Member of <span class="perl_BString">groups</span>: admins
----------------------------
Number of entries returned 1
-
----------------------------</pre></li></ol></div></div><div
class="section" id="install-examples"><div
class="titlepage"><div><div><h3 class="title"
id="install-examples">1.3.3. Examples of Creating the FreeIPA
Server</h3></div></div></div><div class="para">
+
----------------------------</pre></li></ol></div></div><div
class="section" id="install-examples"><div
class="titlepage"><div><div><h3 class="title"
id="install-examples">2.3.3. Examples of Creating the FreeIPA
Server</h3></div></div></div><div class="para">
The way that a FreeIPA server is installed can be different depending on the network
environment, security requirements within the organization, and the desired topology.
These example illustrate some common options when installing the server. These examples
are not mutually exclusive; it is entirely possible to use CA options, DNS options, and
FreeIPA configuration options in the same server invocation. These are called out
separately simply to make it more clear what each configuration area requires.
- </div><div class="section" id="install-normal"><div
class="titlepage"><div><div><h4 class="title"
id="install-normal">1.3.3.1. Non-Interactive Basic
Installation</h4></div></div></div><div
class="para">
- As shown in <a class="xref"
href="creating-server.html#install-interactive">Section 1.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>, only a few pieces of
information are required to configured a FreeIPA server. While the setup script can prompt
for this information in interactive mode, this information can also be passed with the
setup command to allow automated and unattended configuration:
+ </div><div class="section" id="install-normal"><div
class="titlepage"><div><div><h4 class="title"
id="install-normal">2.3.3.1. Non-Interactive Basic
Installation</h4></div></div></div><div
class="para">
+ As shown in <a class="xref"
href="creating-server.html#install-interactive">Section 2.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>, only a few pieces of
information are required to configured a FreeIPA server. While the setup script can prompt
for this information in interactive mode, this information can also be passed with the
setup command to allow automated and unattended configuration:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Passwords for the FreeIPA administrative user and the Directory Server super user
(Directory Manager)
</div></li><li class="listitem"><div
class="para">
@@ -331,7 +325,7 @@ Password <span class="perl_Keyword">for</span>
admin@EXAMPLE.COM:</pre></li><li
The DNS domain name
</div></li></ul></div><div class="para">
This information can be passed with the <code
class="command">ipa-server-install</code>, along with the <code
class="option">-U</code> to force it to run without requiring user
interaction.
- </div><div class="example"
id="ex.basic-opts"><h6>Example 1.1. Basic Installation without
Interaction</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U</span></pre><div class="para">
+ </div><div class="example"
id="ex.basic-opts"><h6>Example 2.1. Basic Installation without
Interaction</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U</span></pre><div class="para">
The script then prints the submitted values:
</div><pre class="programlisting">To accept the default shown
in brackets, press the Enter key.
@@ -339,18 +333,18 @@ The IPA Master Server will be configured with
Hostname:
ipa2.server.example.com
IP address: 1.2.3.4
Domain name: example.com</pre><div class="para">
- Then the script runs through the configuration progress for each FreeIPA service,
as in <a class="xref"
href="creating-server.html#install-interactive">Section 1.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
- </div></div></div><br class="example-break"
/></div><div class="section"
id="install-ca-options"><div
class="titlepage"><div><div><h4 class="title"
id="install-ca-options">1.3.3.2. Using Different
CAs</h4></div></div></div><div class="para">
+ Then the script runs through the configuration progress for each FreeIPA service,
as in <a class="xref"
href="creating-server.html#install-interactive">Section 2.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
+ </div></div></div><br class="example-break"
/></div><div class="section"
id="install-ca-options"><div
class="titlepage"><div><div><h4 class="title"
id="install-ca-options">2.3.3.2. Using Different
CAs</h4></div></div></div><div class="para">
The default installation of FreeIPA uses an integrated Dogtag Certificate System
instance as a certificate authority to issue certificates. However, this configuration is
not required. FreeIPA only requires <span
class="emphasis"><em>a</em></span> certificate authority.
This can be an external CA like Verisign or a corporate CA inconjunction with the internal
Certificate System, or it can even be the FreeIPA server itself, using a self-signed
certificate.
</div><div class="para">
For the FreeIPA server itself to work as a CA, it uses a self-signed certificate,
meaning that it approved and issued its own certificate. This is done by using the
<code class="option">--selfsign</code> option with the <code
class="command">ipa-server-install</code> command. When the FreeIPA
server uses a self-signed certificate, the setup process is exactly the same as a normal
installation, except that no Dogtag Certificate System instance is created. There is still
a <code class="filename">cacert.p12</code> file created that can be
used by replicas and the domain functions exactly the same. The only difference is what CA
issues the certificates.
- </div><div class="example"
id="ex.selfsigned"><h6>Example 1.2. Using a Self-Signed
Certificate</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U
--selfsign</span></pre></div></div><br
class="example-break" /><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
+ </div><div class="example"
id="ex.selfsigned"><h6>Example 2.2. Using a Self-Signed
Certificate</h6><div class="example-contents"><pre
class="programlisting"><span class="perl_Comment">#
ipa-server-install -a secret12 --hostname=ipa2.server.example.com -r
EXAMPLE.COM -p
secret12 -n
example.com -U
--selfsign</span></pre></div></div><br
class="example-break" /><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
A self-signed certificate should only be used for a testing or development
environment. A production environment should use the Dogtag Certificate System instance or
an external, public CA.
</div></div></div><div class="para">
Alternatively, the FreeIPA server can use a certificate issued by an external CA.
This can be a corporate CA or a third-party CA like Verisign or Thawte. As with a normal
setup process, using an external CA still uses a Dogtag Certificate System instance for
the FreeIPA server for issuing all of its client and replica certificates; the initial CA
certificate is simply issued by a different CA.
</div><div class="para">
When using an external CA, there are two additional steps that must be performed:
submit the generated certificate request to the external CA and then load the CA
certificate and issued server certificate to complete the setup.
- </div><div class="example"
id="ex.externalca"><h6>Example 1.3. Using an External
CA</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ </div><div class="example"
id="ex.externalca"><h6>Example 2.3. Using an External
CA</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
Run the <code class="command">ipa-server-install</code>
script, using the <code class="option">--external-ca</code> option.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install -a secret12 -r
EXAMPLE.COM -P
password -p secret12 -n
ipa.server.example.com
--external-ca</span></pre></li><li
class="listitem"><div class="para">
The script sets up the NTP and Directory Server services as normal.
@@ -368,12 +362,12 @@ The next step is to get /root/ipa.csr signed by your CA and re-run
ipa-server-in
</div></li><li class="listitem"><div
class="para">
Rerun <code class="command">ipa-server-install</code>,
specifying the locations and names of the certificate and CA chain files. For example:
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install
--external_cert_file=/tmp/servercert20110601.p12
--external_ca_file=/tmp/cacert.p12</span></pre></li><li
class="listitem"><div class="para">
- Complete the setup process and verify that everything is working as expected, as
in <a class="xref"
href="creating-server.html#install-interactive">Section 1.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
- </div></li></ol></div></div></div><br
class="example-break" /></div><div class="section"
id="install-dns"><div
class="titlepage"><div><div><h4 class="title"
id="install-dns">1.3.3.3. Using
DNS</h4></div></div></div><div class="para">
+ Complete the setup process and verify that everything is working as expected, as
in <a class="xref"
href="creating-server.html#install-interactive">Section 2.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
+ </div></li></ol></div></div></div><br
class="example-break" /></div><div class="section"
id="install-dns"><div
class="titlepage"><div><div><h4 class="title"
id="install-dns">2.3.3.3. Using
DNS</h4></div></div></div><div class="para">
FreeIPA can be configured to manage its own DNS, use an existing DNS, or not use DNS
services at all (which is the default). Running the setup script alone does not configure
DNS; this requires the <code class="option">--setup-dns</code>
option.
</div><div class="para">
As with a basic setup, the DNS setup can either prompt for the required information
or the DNS information can be passed with the script to allow an automatic or unattended
setup process.
- </div><div class="example"
id="ex.dns-w-prompts"><h6>Example 1.4. Interactive DNS
Setup</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ </div><div class="example"
id="ex.dns-w-prompts"><h6>Example 2.4. Interactive DNS
Setup</h6><div class="example-contents"><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
Run the <code class="command">ipa-server-install</code>
script, using the <code class="option">--setup-dns</code> option.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install -a secret12 -r
EXAMPLE.COM -P
password -p secret12 -n
ipa.server.example.com
--setup-dns</span></pre></li><li
class="listitem"><div class="para">
The script configures the hostname and domain name as normal.
@@ -398,16 +392,16 @@ Configuring named:
<span class="perl_Keyword">done</span> configuring named.
==============================================================================
Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"><div class="para">
- Verify that everything is working as expected, as in <a class="xref"
href="creating-server.html#install-interactive">Section 1.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
+ Verify that everything is working as expected, as in <a class="xref"
href="creating-server.html#install-interactive">Section 2.3.2, “Setting up a
FreeIPA Server: Basic Interactive Installation”</a>.
</div></li></ol></div></div></div><br
class="example-break" /><div class="para">
If DNS is used with FreeIPA, then two pieces of information are required: any DNS
forwarders that will be used and using (or not) reverse DNS. To perform a non-interactive
setup, this information can be passed using the <code
class="option">--forwarder | --no-forwarders</code> option and <code
class="option">--no-reverse</code> option.
- </div><div class="example"
id="ex.dns-script"><h6>Example 1.5. Setting up DNS
Non-Interactively</h6><div class="example-contents"><div
class="para">
+ </div><div class="example"
id="ex.dns-script"><h6>Example 2.5. Setting up DNS
Non-Interactively</h6><div class="example-contents"><div
class="para">
To use DNS always requires the <code
class="option">--setup-dns</code>. To user forwarders, use the <code
class="option">--forwarder</code> with a comma-separated list of
forwarders.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--forwarder=1.2.3.0,1.2.255.0</span></pre><div class="para">
Some kind of forwarder information is required. If no external forwarders will be
used with the FreeIPA DNS service, then use the <code
class="option">--no-forwarders</code> option to indicate that only root
servers will be used.
</div><div class="para">
The script always assumes that reverse DNS is configured along with DNS, so it is
not necessary to use any options to <span
class="emphasis"><em>enable</em></span> reverse DNS. To
disable reverse DNS, use the <code
class="option">--no-reverse</code> option.
- </div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--no-reverse</span></pre></div></div><br
class="example-break" /></div></div><div
class="section" id="troubleshooting-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-install">1.3.4. Troubleshooting Installation
Problems</h3></div></div></div><div
class="formalpara"><h5 class="formalpara"
id="id3219347">GSS Failures When Running IPA Commands</h5>
+ </div><pre class="programlisting"><span
class="perl_Comment"># ipa-server-install ... --setup-dns
--no-reverse</span></pre></div></div><br
class="example-break" /></div></div><div
class="section" id="troubleshooting-install"><div
class="titlepage"><div><div><h3 class="title"
id="troubleshooting-install">2.3.4. Troubleshooting Installation
Problems</h3></div></div></div><div
class="formalpara"><h5 class="formalpara"
id="id3404734">GSS Failures When Running IPA Commands</h5>
Immediately after installation, there can be Kerberos problems when trying to run an
<code class="command">ipa-*</code> command. For example:
</div><pre class="programlisting">ipa: ERROR: Kerberos error:
('Unspecified GSS failure. Minor code may provide more information',
851968)/('Decrypt integrity check failed', -1765328353)</pre><div
class="para">
There are two potential causes for this:
@@ -415,7 +409,7 @@ Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"
DNS is not properly configured.
</div></li><li class="listitem"><div
class="para">
Active Directory is in the same domain as the FreeIPA server.
- </div></li></ul></div><div
class="formalpara"><h5 class="formalpara"
id="id3060987">named Daemon Fails to Start</h5>
+ </div></li></ul></div><div
class="formalpara"><h5 class="formalpara"
id="id3404783">named Daemon Fails to Start</h5>
If a FreeIPA server is configured to manage DNS and is set up successfully, but the
<code class="systemitem">named</code> service fails to start, this
can indicate that there is a package conflict. Check the <code
class="filename">/var/log/messages</code> file for error messages
related to the <code class="command">named</code> service and the
<code class="filename">ldap.so</code> library:
</div><pre class="screen">ipaserver named[6886]: failed to
dynamically load driver 'ldap.so': libldap-2.4.so.2: cannot open shared object
file: No such file or directory</pre><div class="para">
This usually means that the <span
class="package">bind-chroot</span> package is installed and is
preventing the <code class="systemitem">named</code> service from
starting. To resolve this issue, remove the <span
class="package">bind-chroot</span> package and then restart the FreeIPA
server.
@@ -423,4 +417,4 @@ Setup <span
class="perl_Reserved">complete</span></pre></li><li
class="listitem"
<span class="perl_Comment"></span>
<span class="perl_Comment"># ipactl restart</span></pre>
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Installing_the_IPA_Server_Packages.html"><strong>Prev</strong>1.2. Installing
the FreeIPA Server Packages</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Next</strong>1.4. Setting
up FreeIPA Replicas</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Installing_the_IPA_Server_Packages.html"><strong>Prev</strong>2.2. Installing
the FreeIPA Server Packages</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html"><strong>Next</strong>2.4. Setting
up FreeIPA Replicas</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/deployment-scenarios.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/deployment-scenarios.html
index 6d415b7..10ac60a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/deployment-scenarios.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/deployment-scenarios.html
@@ -1,12 +1,5 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.4. Planning IPA</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
-
- addID('Drafts.1');
-
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to IPA"
/><link rel="prev" href="policy.html" title="1.3. Defining
Policies: Authorization" /><link rel="next"
href="installing-ipa.html" title="Chapter 2. Installing an IPA Server"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="policy.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="
installing-ipa.html"><strong>Next</strong></a></li></ul><div
class="section" id="deployment-scenarios"><div
class="titlepage"><div><div><h2 class="title"
id="deployment-scenarios">1.4. Planning
IPA</h2></div></div></div><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.4. Planning IPA</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to IPA"
/><link rel="prev" href="policy.html" title="1.3. Defining
Policies: Authorization" /><link rel="next"
href="installing-ipa.html" title="Chapter 2. Installing an IPA Server"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" href="http://docs.red
hat.com"><img src="Common_Content/images/image_right.png"
alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="policy.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="installing-ipa.html"><strong>Next</strong></a></li></ul><div
class="section" id="deployment-scenarios"><div
class="titlepage"><div><div><h2 class="title"
id="deployment-scenarios">1.4. Planning
IPA</h2></div></div></div><div class="para">
XXXXXXXXXX fix me XXXXXXXX
</div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="policy.html"><strong>Prev</strong>1.3. Defining Policies:
Authorization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="installing-ipa.html"><strong>Next</strong>Chapter 2. Installing
an IPA Server</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/disabling-anon-binds.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/disabling-anon-binds.html
index e5e0727..987326c 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/disabling-anon-binds.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/disabling-anon-binds.html
@@ -1,23 +1,23 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.6. Disabling Anonymous Binds</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.2. Disabling Anonymous Binds</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="search-limits.html"
title="12.5. Setting Default Search Limits" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"
title="12.7. Implementing Unique UID and GID Attributes"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li c
lass="previous"><a accesskey="p"
href="search-limits.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Next</strong></a></li></ul><div
class="section" id="disabling-anon-binds"><div
class="titlepage"><div><div><h2 class="title"
id="disabling-anon-binds">12.6. Disabling Anonymous
Binds</h2></div></div></div><div class="para">
- Even though the XML-RPC and WebUI always require authentication, the default IPA
configuration allows anonymous binds to the LDAP port by anyone in the same domain as the
IPA server, and consequent retrieval of a range of data, including user, group, netgroup,
host, host group, and service records. This is generally considered insecure, and some RFC
standards require that it be disabled to achieve compliance. With anonymous binds
disabled, all connections to the directory server need to provide a valid identity.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev" href="server-config.html"
title="Chapter 13. Configuring the FreeIPA Server" /><link
rel="next" href="Managing-Unique_UID_and_GID_Attributes.html"
title="13.3. Managing Unique UID and GID Number Assignments"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="serv
er-config.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Managing-Unique_UID_and_GID_Attributes.html"><strong>Next</strong></a></li></ul><div
class="section" id="disabling-anon-binds"><div
class="titlepage"><div><div><h2 class="title"
id="disabling-anon-binds">13.2. Disabling Anonymous
Binds</h2></div></div></div><div class="para">
+ Even though the XML-RPC and WebUI always require authentication, the default FreeIPA
configuration allows anonymous binds to the LDAP port by anyone in the same domain as the
FreeIPA server, and consequent retrieval of a range of data, including user, group,
netgroup, host, host group, and service records. This is generally considered insecure,
and some RFC standards require that it be disabled to achieve compliance. With anonymous
binds disabled, all connections to the directory server need to provide a valid identity.
</div><div class="para">
To disable anonymous binds, perform this LDAP modification:
-<pre class="screen"><code class="command"># ldapmodify -x
-D "cn=Directory Manager" -W</code>
+<pre class="screen"># ldapmodify -x -D "cn=Directory Manager"
-W
Enter LDAP Password:
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: off
-<code class="command"># service dirsrv restart</code></pre>
+# service dirsrv restart</pre>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="search-limits.html"><strong>Prev</strong>12.5. Setting
Default Search Limits</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Next</strong>12.7. Implementing
Unique UID and GID Attributes</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="server-config.html"><strong>Prev</strong>Chapter 13. Configuring
the FreeIPA Server</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Managing-Unique_UID_and_GID_Attributes.html"><strong>Next</strong>13.3. Managing
Unique UID and GID Number
Assignme...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/doc-history.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/doc-history.html
index 8c2db1c..84c3518 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/doc-history.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/doc-history.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4. Document Change History</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4. Document Change History</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Preface.html" title="Preface" /><link rel="prev"
href="feedback.html" title="3. Giving Feedback" /><link
rel="next" href="installing-ipa.html"
title="Chapter 1. Installing a FreeIPA Server" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="feedback.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="installing-ipa.html"><strong>
Next</strong></a></li></ul><div xml:lang="en-US"
class="section" id="doc-history" lang="en-US"><div
class="titlepage"><div><div><h2 class="title"
id="doc-history">4. Document Change
History</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Preface.html" title="Preface" /><link rel="prev"
href="feedback.html" title="3. Giving Feedback" /><link
rel="next" href="introduction.html"
title="Chapter 1. Introduction to FreeIPA" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="feedback.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="introduction.html"><strong>Next</st
rong></a></li></ul><div xml:lang="en-US"
class="section" id="doc-history" lang="en-US"><div
class="titlepage"><div><div><h2 class="title"
id="doc-history">4. Document Change
History</h2></div></div></div><div class="para">
<div class="revhistory"><table border="0"
width="100%" summary="Revision history"><tr><th
align="left" valign="top" colspan="3"><b>Revision
History</b></th></tr><tr><td align="left">Revision
2.1.0-1</td><td align="left">May 10, 2011</td><td
align="left"><span class="author"><span
class="firstname">Ella Deon</span> <span
class="surname">Lackey</span></span></td></tr><tr><td
align="left" colspan="3">
<table border="0" summary="Simple list"
class="simplelist"><tr><td>Beginning draft for the Fedora docs
project.</td></tr></table>
</td></tr></table></div>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="feedback.html"><strong>Prev</strong>3. Giving
Feedback</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="installing-ipa.html"><strong>Next</strong>Chapter 1. Installing
a FreeIPA Server</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="feedback.html"><strong>Prev</strong>3. Giving
Feedback</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="introduction.html"><strong>Next</strong>Chapter 1. Introduction
to FreeIPA</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/editing-users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/editing-users.html
index 03e8ff9..a01e3f3 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/editing-users.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/editing-users.html
@@ -1,22 +1,18 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.3. Editing Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.3. Editing Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev" href="adding-users.html"
title="5.2. Adding Users" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"
title="5.4. Activating and Deactivating User Accounts"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="pr
evious"><a accesskey="p"
href="adding-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Next</strong></a></li></ul><div
class="section" id="editing-users"><div
class="titlepage"><div><div><h2 class="title"
id="editing-users">5.3. Editing
Users</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="adding-users.html"
title="6.2. Adding Users" /><link rel="next"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"
title="6.4. Activating and Deactivating User Accounts"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="adding-user
s.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Next</strong></a></li></ul><div
class="section" id="editing-users"><div
class="titlepage"><div><div><h2 class="title"
id="editing-users">6.3. Editing
Users</h2></div></div></div><div class="para">
Use the <code class="command">ipa user-mod</code> command to
modify user account details, such as adding, removing or changing attributes. Refer to the
following examples:
</div><div class="para">
To update attributes for the user <code
class="systemitem">jsmith</code>:
- </div><div class="para">
- <code class="command">$ ipa user-mod jsmith <code
class="option">--email=johnsmith(a)mydomain.com</code> <code
class="option">--title=Editor</code></code>
- </div><div class="para">
+ </div><pre class="screen">$ ipa user-mod jsmith
--email=johnsmith(a)mydomain.com --title=Editor</pre><div
class="para">
To retrieve a list of attributes for a user:
- </div><div class="para">
- <code class="command">$ ipa user-show --raw <user
name></code>
- </div><div class="para">
+ </div><pre class="screen">$ ipa user-show --raw <em
class="replaceable"><code>userName</code></em></pre><div
class="para">
The list of attributes corresponds to those available in the web interface, not
including any custom attributes that may have been defined.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="adding-users.html"><strong>Prev</strong>5.2. Adding
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Next</strong>5.4. Activating
and Deactivating User Accounts</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="adding-users.html"><strong>Prev</strong>6.2. Adding
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Next</strong>6.4. Activating
and Deactivating User Accounts</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/enrolling-machines.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/enrolling-machines.html
index 6a9a9b4..53f03dc 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/enrolling-machines.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/enrolling-machines.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.2. Enrolling Machines</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.2. Enrolling Machines</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="next"
href="renaming-machines.html" title="4.3. Renaming Machines"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="managing-clients.html"><strong>Prev
</strong></a></li><li class="next"><a
accesskey="n"
href="renaming-machines.html"><strong>Next</strong></a></li></ul><div
class="section" id="enrolling-machines"><div
class="titlepage"><div><div><h2 class="title"
id="enrolling-machines">4.2. Enrolling
Machines</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="next"
href="renaming-machines.html" title="5.3. Renaming Machines"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="managing-clients.html"><strong>Prev
</strong></a></li><li class="next"><a
accesskey="n"
href="renaming-machines.html"><strong>Next</strong></a></li></ul><div
class="section" id="enrolling-machines"><div
class="titlepage"><div><div><h2 class="title"
id="enrolling-machines">5.2. Enrolling
Machines</h2></div></div></div><div class="para">
Enrollment is the process whereby a host entry is created and saved in the directory
server, and a keytab for that host entry is generated on the server and provisioned to the
client. This keytab is saved with specific ownership and permission properties in a
specific directory on the client.
</div><div class="para">
With the host entry successfully created and the keytab in place, enrollment is
complete and the client machine can now automatically connect to and communicate with the
FreeIPA server.
@@ -25,7 +25,7 @@
</div><div class="para">
These are examined in more detail below.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1. Manual
Host Enrollment with Privileged
Administrator</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1. Manual
Host Enrollment with Privileged
Administrator</h3></div></div></div><div
class="para">
This scenario implements the following sequence of operations:
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
The Administrator logs into the machine that they want to enroll with FreeIPA.
@@ -48,8 +48,8 @@
</div><div class="para">
At this stage the enrollment is complete and the machine can now automatically
connect to and communicate with the FreeIPA server.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2. Manual
Host Enrollment with Separation of
Duties</h3></div></div></div><div class="para">
- This scenario assumes that there are different administrators with different levels
of privileges regarding host-related operations. One administrator (A) can add and edit
host entries, and thus enroll the hosts as described in <a class="xref"
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">Section 4.2.1,
“Manual Host Enrollment with Privileged Administrator”</a>. The second administrator
(B) has insufficient permissions to create host entries, but is allowed to enroll
machines. The following sequence of operations is engaged:
+ </div></div><div class="section"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2. Manual
Host Enrollment with Separation of
Duties</h3></div></div></div><div class="para">
+ This scenario assumes that there are different administrators with different levels
of privileges regarding host-related operations. One administrator (A) can add and edit
host entries, and thus enroll the hosts as described in <a class="xref"
href="enrolling-machines.html#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">Section 5.2.1,
“Manual Host Enrollment with Privileged Administrator”</a>. The second administrator
(B) has insufficient permissions to create host entries, but is allowed to enroll
machines. The following sequence of operations is engaged:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Administrator A authorizes enrollment of a host by creating the host entry in the
back end using the webUI or command-line script.
</div></li><li class="listitem"><div
class="para">
@@ -67,7 +67,7 @@
The keytab is saved with <code
class="systemitem">root:root</code> ownership and 0600 permissions, and
in a specific directory on the client machine.
</div></li></ol></div><div class="para">
At this stage the enrollment is complete and the machine can now automatically
connect to and communicate with the FreeIPA server.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3. Bulk
Host Deployment</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Enrollment_Scenarios-Bulk_Host_Deployment"><div
class="titlepage"><div><div><h3 class="title"
id="Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3. Bulk Host
Deployment</h3></div></div></div><div
class="para">
This scenario is very useful for automatic provisioning of multiple hosts (or virtual
machines). In this scenario you can pre-create a number of hosts on the FreeIPA server and
set passwords on them. You can use your kickstart operation to perform the enrollment. For
example, the <span
class="application"><strong>cobbler</strong></span> utility
makes this relatively easy because you can store variables in the <span
class="application"><strong>cobbler</strong></span> system
configuration.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
There are two ways to set the password. You can either supply your own or have
FreeIPA generate a random one.
@@ -99,4 +99,4 @@
</div></li><li class="listitem"><div
class="para">
Because the password is set to expire, the Kerberos keytab will be generated and
the password attribute cleared.
- </div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="managing-clients.html"><strong>Prev</strong>Chapter 4. Managing
Clients in the FreeIPA Domain</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="renaming-machines.html"><strong>Next</strong>4.3. Renaming
Machines</a></li></ul></body></html>
+ </div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="managing-clients.html"><strong>Prev</strong>Chapter 5. Managing
Clients in the FreeIPA Domain</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="renaming-machines.html"><strong>Next</strong>5.3. Renaming
Machines</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/feedback.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/feedback.html
index 23a824b..8ffe679 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/feedback.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/feedback.html
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3. Giving Feedback</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3. Giving Feedback</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/host-groups.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/host-groups.html
index 8a0396e..ad199da 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/host-groups.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/host-groups.html
@@ -1,12 +1,5 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.2. Creating Host Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
-
- addID('Drafts.1');
-
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="hosts.html" title="Chapter 7. Identity: Managing Hosts and Host
Groups" /><link rel="prev" href="hosts.html"
title="Chapter 7. Identity: Managing Hosts and Host Groups" /><link
rel="next" href="kerberos.html" title="Chapter 8. Identity: Using
IPA for a Kerberos Domain" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="hosts.html"><strong>Prev</strong></a></li><l
i class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong></a></li></ul><div
class="section" id="host-groups"><div
class="titlepage"><div><div><h2 class="title"
id="host-groups">7.2. Creating Host
Groups</h2></div></div></div><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.2. Creating Host Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="hosts.html" title="Chapter 7. Identity: Managing Hosts and Host
Groups" /><link rel="prev" href="hosts.html"
title="Chapter 7. Identity: Managing Hosts and Host Groups" /><link
rel="next" href="Extending_the_Permissions_of_IPA_Managed_Hosts.html"
title="7.3. Extending the Permissions of IPA Managed Hosts"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img src="Common_Content/ima
ges/image_left.png" alt="Product Site" /></a><a
class="right" href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="hosts.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Extending_the_Permissions_of_IPA_Managed_Hosts.html"><strong>Next</strong></a></li></ul><div
class="section" id="host-groups"><div
class="titlepage"><div><div><h2 class="title"
id="host-groups">7.2. Creating Host
Groups</h2></div></div></div><div class="para">
XXXXXXXXXXX FIX ME XXXXXXXX
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="hosts.html"><strong>Prev</strong>Chapter 7. Identity:
Managing Hosts and Host Grou...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong>Chapter 8. Identity:
Using IPA for a Kerberos Dom...</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="hosts.html"><strong>Prev</strong>Chapter 7. Identity:
Managing Hosts and Host Grou...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Extending_the_Permissions_of_IPA_Managed_Hosts.html"><strong>Next</strong>7.3. Extending
the Permissions of IPA Managed
Hos...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/hosts.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/hosts.html
index 27e291d..d262088 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/hosts.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/hosts.html
@@ -1,13 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 7. Identity: Managing Hosts and Host
Groups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
-
- addID('Drafts.1');
-
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="index.html" title="Enterprise Identity Management Guide"
/><link rel="prev" href="searching.html"
title="6.8. Searching for Users and Groups" /><link rel="next"
href="host-groups.html" title="7.2. Creating Host Groups"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="searching.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="host-groups.h
tml"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="hosts"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Managing Hosts and Host
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="hosts.html#adding-hosts">7.1. Adding and Editing
Hosts</a></span></dt><dt><span
class="section"><a href="host-groups.html">7.2. Creating Host
Groups</a></span></dt></dl></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 7. Identity: Managing Hosts and Host
Groups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="index.html" title="Enterprise Identity Management Guide"
/><link rel="prev" href="searching.html"
title="6.8. Searching for Users and Groups" /><link rel="next"
href="host-groups.html" title="7.2. Creating Host Groups"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" hr
ef="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="searching.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="host-groups.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="hosts"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Managing Hosts and Host
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="hosts.html#adding-hosts">7.1. Adding and Editing
Hosts</a></span></dt><dt><span
class="section"><a href="host-groups.html">7.2. Creating Host
Groups</a></span></dt><dt><span
class="section"><a
href="Extending_the_Permissions_of_IPA_Managed_Hosts.html">7.3. Extending the
Permissions of IPA Managed
Hosts</a></span></dt><dd><dl><dt><span
class="section"><a
href="Extending_the_Permissions_of_IPA_Managed_Hosts.html#Delegating_Servi
ce_Management">7.3.1. Delegating Service
Management</a></span></dt><dt><span
class="section"><a
href="Extending_the_Permissions_of_IPA_Managed_Hosts.html#Delegating_Host_Management">7.3.2.
Delegating Host
Management</a></span></dt></dl></dd></dl></div><div
class="para">
XXXXX introXXXXXXXX
</div><div class="section" id="adding-hosts"><div
class="titlepage"><div><div><h2 class="title"
id="adding-hosts">7.1. Adding and Editing
Hosts</h2></div></div></div><div class="para">
XXXXXXXXXXX FIX ME XXXXXXXX
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.png
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.png
index 7fc4bc1..78c6e73 100644
Binary files a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.png and
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.png differ
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.svg
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.svg
new file mode 100644
index 0000000..5b93d60
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/images/IPA_arch.svg
@@ -0,0 +1,4075 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!-- Created with Inkscape (
http://www.inkscape.org/) -->
+<svg
+
xmlns:a="http://ns.adobe.com/AdobeSVGViewerExtensions/3.0/"
+
xmlns:ns="http://creativecommons.org/ns#"
+
xmlns:dc="http://purl.org/dc/elements/1.1/"
+
xmlns:cc="http://web.resource.org/cc/"
+
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+
xmlns:svg="http://www.w3.org/2000/svg"
+
xmlns="http://www.w3.org/2000/svg"
+
xmlns:xlink="http://www.w3.org/1999/xlink"
+
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd&q...
+
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+ width="1771.6536"
+ height="2505.1182"
+ id="svg2"
+ version="1.1"
+ inkscape:version="0.45"
+ sodipodi:docname="IPA_arch.svg"
+
inkscape:export-filename="/home/dlackey/NotBackedUp/freeipa-guide/ipa-admin/en-US/images/IPA_arch.png"
+ inkscape:export-xdpi="90"
+ inkscape:export-ydpi="90"
+ sodipodi:version="0.32"
+ inkscape:output_extension="org.inkscape.output.svg.inkscape"
+
sodipodi:docbase="/home/dlackey/NotBackedUp/freeipa-guide/ipa-admin/en-US/images"
+ sodipodi:modified="TRUE">
+ <sodipodi:namedview
+ id="base"
+ pagecolor="#ffffff"
+ bordercolor="#666666"
+ borderopacity="1.0"
+ inkscape:pageopacity="0.0"
+ inkscape:pageshadow="2"
+ inkscape:zoom="1"
+ inkscape:cx="467.40385"
+ inkscape:cy="1838.6964"
+ inkscape:document-units="px"
+ inkscape:current-layer="layer1"
+ showgrid="false"
+ inkscape:window-width="1680"
+ inkscape:window-height="975"
+ inkscape:window-x="0"
+ inkscape:window-y="25"
+ inkscape:window-maximized="1" />
+ <defs
+ id="defs4">
+ <marker
+ inkscape:stockid="TriangleInM"
+ orient="auto"
+ refY="0.0"
+ refX="0.0"
+ id="marker13197"
+ style="overflow:visible">
+ <path
+ id="path13100"
+ d="M 5.77,0.0 L -2.88,5.0 L -2.88,-5.0 L 5.77,0.0 z "
+
style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none"
+ transform="scale(-0.4)" />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow2Mend"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mend"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+ id="path4731"
+ transform="scale(0.6) rotate(180) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow1Mend"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow1Mend"
+ refX="0.0">
+ <path
+
style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+ id="path4713"
+ transform="scale(0.4) rotate(180) translate(10,0)"
+ d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+ id="path4728"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Lstart"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Lstart"
+ refX="0.0">
+ <path
+
style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+ id="path4722"
+ transform="scale(1.1) translate(1,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart9"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart9"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#cc0000;stroke-width:0.62500000;fill:#cc0000"
+ id="path5720"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <marker
+ style="overflow:visible;"
+ id="Arrow2MendZ"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2MendZ"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#cc0000;stroke-width:0.62500000;fill:#cc0000"
+ id="path5723"
+ transform="scale(0.6) rotate(180) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7555"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7553"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7551"
+ fx="544.67078"
+ fy="121.54527"
+ gradientUnits="userSpaceOnUse"
+ cy="121.54527"
+ cx="544.67078"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(0.5604948,1.2174777,3.3361275,-0.1439944,-164.90878,-535.94519)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7549"
+ fx="-9.7009583"
+ fy="49.478912"
+ gradientUnits="userSpaceOnUse"
+ cy="49.478912"
+ cx="-9.7009583"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(-2.5380798,-1.9868115,-7.6428562,-0.5295237,895.73911,119.97539)"
/>
+ <linearGradient
+ id="linearGradient7547"
+ gradientUnits="userSpaceOnUse"
+ y2="57.699898"
+ x2="-17.546682"
+ xlink:href="#linearGradient5797"
+ y1="35.501328"
+ x1="-50.000641" />
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7545"
+ fx="548.88446"
+ fy="124.24792"
+ gradientUnits="userSpaceOnUse"
+ cy="124.24792"
+ cx="548.88446"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(-0.2726891,1.9344663,-1.6230761,-0.2287946,890.03812,-924.13616)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7543"
+ fx="-11.992359"
+ fy="49.12331"
+ gradientUnits="userSpaceOnUse"
+ cy="49.12331"
+ cx="-11.992359"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(1.2348139,-3.1568708,3.7183643,-0.8413672,374.017,118.06465)"
/>
+ <linearGradient
+ id="linearGradient7541"
+ gradientUnits="userSpaceOnUse"
+ y2="19.587532"
+ x2="-33.330555"
+ xlink:href="#linearGradient5557"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="64.869919"
+ x1="-33.330555" />
+ <linearGradient
+ id="linearGradient7539"
+ gradientUnits="userSpaceOnUse"
+ y2="57.769058"
+ x2="777.69415"
+ xlink:href="#linearGradient5931"
+ y1="67.561554"
+ x1="806.19238" />
+ <linearGradient
+ id="linearGradient7537"
+ gradientUnits="userSpaceOnUse"
+ y2="87.987663"
+ x2="553.82892"
+ xlink:href="#linearGradient8317"
+ y1="143.48891"
+ x1="498.3277" />
+ <linearGradient
+ id="linearGradient7535"
+ gradientUnits="userSpaceOnUse"
+ y2="69.928268"
+ x2="-32.08812"
+ xlink:href="#linearGradient5813"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="73.162025"
+ x1="-31.529013" />
+ <linearGradient
+ id="linearGradient7533"
+ gradientUnits="userSpaceOnUse"
+ y2="66.058411"
+ x2="-33.10799"
+ xlink:href="#linearGradient5805"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="68.874535"
+ x1="-32.349804" />
+ <linearGradient
+ id="linearGradient7531"
+ gradientUnits="userSpaceOnUse"
+ y2="57.699898"
+ x2="-17.546682"
+ xlink:href="#linearGradient5797"
+ y1="35.501328"
+ x1="-50.000641" />
+ <radialGradient
+ r="15.172215"
+ id="radialGradient7529"
+ fx="548.88446"
+ fy="124.24792"
+ gradientUnits="userSpaceOnUse"
+ cy="124.24792"
+ cx="548.88446"
+ xlink:href="#linearGradient10494"
+
gradientTransform="matrix(-0.2726891,1.9344663,-1.6230761,-0.2287946,890.03812,-924.13616)"
/>
+ <radialGradient
+ r="9.4923868"
+ id="radialGradient7527"
+ fx="-11.992359"
+ fy="49.12331"
+ gradientUnits="userSpaceOnUse"
+ cy="49.12331"
+ cx="-11.992359"
+ xlink:href="#linearGradient5541"
+
gradientTransform="matrix(1.2348139,-3.1568708,3.7183643,-0.8413672,374.017,118.06465)"
/>
+ <linearGradient
+ id="linearGradient7525"
+ gradientUnits="userSpaceOnUse"
+ y2="19.587532"
+ x2="-33.330555"
+ xlink:href="#linearGradient5557"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="64.869919"
+ x1="-33.330555" />
+ <linearGradient
+ id="linearGradient7523"
+ gradientUnits="userSpaceOnUse"
+ y2="57.769058"
+ x2="777.69415"
+ xlink:href="#linearGradient8317"
+ y1="70.580994"
+ x1="802.88586" />
+ <linearGradient
+ id="linearGradient7521"
+ gradientUnits="userSpaceOnUse"
+ y2="87.987663"
+ x2="553.82892"
+ xlink:href="#linearGradient8317"
+ y1="143.48891"
+ x1="498.3277" />
+ <linearGradient
+ id="linearGradient7519"
+ gradientUnits="userSpaceOnUse"
+ y2="66.058411"
+ x2="-33.10799"
+ xlink:href="#linearGradient5805"
+
gradientTransform="matrix(1.5142659,7.3025328e-2,0,1.5018504,580.58851,46.687445)"
+ y1="68.874535"
+ x1="-32.349804" />
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7517"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7515"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7513"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7511"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <linearGradient
+ id="linearGradient7509"
+ gradientUnits="userSpaceOnUse"
+ y2="33.083126"
+ x2="37.686401"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.5872951,1.7391712,2.827181,-0.6473735,475.35417,90.180114)"
+ y1="35.072224"
+ x1="55.874207" />
+ <linearGradient
+ id="linearGradient7507"
+ gradientUnits="userSpaceOnUse"
+ y2="36.286098"
+ x2="40.255276"
+ xlink:href="#linearGradient6478"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.187798"
+ x1="45.470558" />
+ <linearGradient
+ id="linearGradient7505"
+ gradientUnits="userSpaceOnUse"
+ y2="144.12111"
+ x2="603.7171"
+ xlink:href="#linearGradient6414"
+ y1="140.36218"
+ x1="603.25" />
+ <linearGradient
+ id="linearGradient7503"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7501"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7499"
+ gradientUnits="userSpaceOnUse"
+ y2="33.830193"
+ x2="35.096169"
+ xlink:href="#linearGradient10554"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.527008"
+ x1="48.126881" />
+ <linearGradient
+ id="linearGradient7497"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7495"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7493"
+ gradientUnits="userSpaceOnUse"
+ y2="28.369732"
+ x2="48.511173"
+ xlink:href="#linearGradient5669"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="33.643894"
+ x1="23.121851" />
+ <linearGradient
+ id="linearGradient7491"
+ gradientUnits="userSpaceOnUse"
+ y2="38.493023"
+ x2="13.912579"
+ xlink:href="#linearGradient5677"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.069866"
+ x1="19.892136" />
+ <linearGradient
+ id="linearGradient7489"
+ gradientUnits="userSpaceOnUse"
+ y2="25.829727"
+ x2="6.7207007"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="50.84045"
+ x1="16.030468" />
+ <linearGradient
+ id="linearGradient7487"
+ gradientUnits="userSpaceOnUse"
+ y2="33.722939"
+ x2="20.776503"
+ xlink:href="#linearGradient5573"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="46.597134"
+ x1="27.247866" />
+ <linearGradient
+ id="linearGradient7485"
+ gradientUnits="userSpaceOnUse"
+ y2="37.98819"
+ x2="17.47529"
+ xlink:href="#linearGradient7808"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="27.37009"
+ x1="37.260498" />
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7483"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <radialGradient
+ r="8.3085051"
+ id="radialGradient7481"
+ fx="483.13071"
+ fy="264.64523"
+ gradientUnits="userSpaceOnUse"
+ cy="264.64523"
+ cx="483.13071"
+ xlink:href="#linearGradient7359"
+ gradientTransform="matrix(0.8510635,0,0,0.8510635,71.9558,39.415337)"
/>
+ <linearGradient
+ id="linearGradient7479"
+ gradientUnits="userSpaceOnUse"
+ y2="33.830193"
+ x2="35.096169"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.5872951,1.7391712,2.827181,-0.6473735,475.35417,64.680114)"
+ y1="36.17104"
+ x1="53.072731" />
+ <linearGradient
+ id="linearGradient7477"
+ gradientUnits="userSpaceOnUse"
+ y2="35.376236"
+ x2="44.599358"
+ xlink:href="#linearGradient6478"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,55.780107)"
+ y1="36.09766"
+ x1="41.126476" />
+ <linearGradient
+ id="linearGradient7475"
+ gradientUnits="userSpaceOnUse"
+ y2="141.11491"
+ x2="603.48352"
+ xlink:href="#linearGradient6414"
+ gradientTransform="translate(0,-29.000003)"
+ y1="145.48944"
+ x1="603.48352" />
+ <linearGradient
+ id="linearGradient7473"
+ gradientUnits="userSpaceOnUse"
+ y2="124.13597"
+ x2="610.89215"
+ xlink:href="#linearGradient6398"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7471"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7469"
+ gradientUnits="userSpaceOnUse"
+ y2="124.13597"
+ x2="610.89215"
+ xlink:href="#linearGradient6414"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7467"
+ gradientUnits="userSpaceOnUse"
+ y2="30.0221"
+ x2="42.382099"
+ xlink:href="#linearGradient5685"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,59.28011)"
+ y1="42.648251"
+ x1="42.074207" />
+ <linearGradient
+ id="linearGradient7465"
+ gradientUnits="userSpaceOnUse"
+ y2="113.69411"
+ x2="606.94116"
+ xlink:href="#linearGradient10566"
+ y1="103.70177"
+ x1="605.41681" />
+ <linearGradient
+ id="linearGradient7463"
+ gradientUnits="userSpaceOnUse"
+ y2="112.46191"
+ x2="601.25159"
+ xlink:href="#linearGradient5565"
+ y1="96.853073"
+ x1="599.35095" />
+ <linearGradient
+ id="linearGradient7461"
+ gradientUnits="userSpaceOnUse"
+ y2="28.369732"
+ x2="48.511173"
+ xlink:href="#linearGradient5669"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="33.643894"
+ x1="23.121851" />
+ <linearGradient
+ id="linearGradient7459"
+ gradientUnits="userSpaceOnUse"
+ y2="38.493023"
+ x2="13.912579"
+ xlink:href="#linearGradient5677"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="35.069866"
+ x1="19.892136" />
+ <linearGradient
+ id="linearGradient7457"
+ gradientUnits="userSpaceOnUse"
+ y2="25.829727"
+ x2="6.7207007"
+ xlink:href="#linearGradient5565"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="51.641129"
+ x1="17.246363" />
+ <linearGradient
+ id="linearGradient7455"
+ gradientUnits="userSpaceOnUse"
+ y2="30.312105"
+ x2="34.585835"
+ xlink:href="#linearGradient5573"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="44.46735"
+ x1="21.322929" />
+ <linearGradient
+ id="linearGradient7453"
+ gradientUnits="userSpaceOnUse"
+ y2="19.512289"
+ x2="46.277946"
+ xlink:href="#linearGradient7576"
+
gradientTransform="matrix(0.6503762,1.9259748,3.1308472,-0.7169076,461.93064,84.78011)"
+ y1="49.1087"
+ x1="33.149971" />
+ <linearGradient
+ id="linearGradient6398">
+ <stop
+ offset="0"
+ style="stop-color:#333333;stop-opacity:1"
+ id="stop6400" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop6402" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6392"
+ gradientUnits="userSpaceOnUse"
+ y2="33.279999"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ x1="234.81" />
+ <mask
+ id="mask7570">
+ <rect
+ style="fill:url(#linearGradient7574);fill-opacity:1"
+ id="rect7572"
+ width="86"
+ y="60.362179"
+ x="536"
+ height="111" />
+ </mask>
+ <linearGradient
+ id="linearGradient7574"
+ gradientUnits="userSpaceOnUse"
+ y2="460.97229"
+ x2="596.48529"
+ xlink:href="#linearGradient8481"
+ gradientTransform="translate(0,-337)"
+ y1="416.72614"
+ x1="596.48529" />
+ <linearGradient
+ id="linearGradient8481">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop8483" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop8485" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7576">
+ <stop
+ offset="0"
+ style="stop-color:#898989;stop-opacity:1"
+ id="stop7578" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7580" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5573">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5575" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5577" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5565">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5567" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5569" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5677">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5679" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5681" />
+ </linearGradient>
+ <filter
+ id="filter8351">
+ <feGaussianBlur
+ stdDeviation="0.21855907"
+ id="feGaussianBlur8353"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5669">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5671" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5673" />
+ </linearGradient>
+ <filter
+ height="1.0124482"
+ id="filter8323"
+ y="-0.0062240968"
+ width="1.3332899"
+ x="-0.16664496">
+ <feGaussianBlur
+ stdDeviation="0.15442502"
+ id="feGaussianBlur8325"
+ inkscape:collect="always" />
+ </filter>
+ <filter
+ id="filter10486">
+ <feGaussianBlur
+ stdDeviation="0.36649474"
+ id="feGaussianBlur10488"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient10566">
+ <stop
+ offset="0"
+ style="stop-color:#666666;stop-opacity:1"
+ id="stop10568" />
+ <stop
+ offset="1"
+ style="stop-color:#888a85;stop-opacity:0"
+ id="stop10570" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5685">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5687" />
+ <stop
+ offset="1"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5689" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6414">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop6416" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop6418" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6478">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop6480" />
+ <stop
+ offset="1"
+ style="stop-color:#d3d7cf;stop-opacity:0"
+ id="stop6482" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7359">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7361" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7363" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7808">
+ <stop
+ offset="0"
+ style="stop-color:#ababab;stop-opacity:1"
+ id="stop7810" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7812" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient10554">
+ <stop
+ offset="0"
+ style="stop-color:#a8a8a8;stop-opacity:1"
+ id="stop10556" />
+ <stop
+ offset="1"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop10558" />
+ </linearGradient>
+ <filter
+ id="filter10534">
+ <feGaussianBlur
+ stdDeviation="0.50670758"
+ id="feGaussianBlur10536"
+ inkscape:collect="always" />
+ </filter>
+ <mask
+ id="mask7729">
+ <rect
+ style="fill:url(#linearGradient7733);fill-opacity:1"
+ id="rect7731"
+ width="103.35121"
+ y="71.481766"
+ x="483.75613"
+ height="123.26292" />
+ </mask>
+ <linearGradient
+ id="linearGradient7733"
+ gradientUnits="userSpaceOnUse"
+ y2="595.06226"
+ x2="20.999998"
+ xlink:href="#linearGradient7584"
+
gradientTransform="matrix(0.9481763,0,0,0.9481763,560.55843,-440.53343)"
+ y1="539.95715"
+ x1="20.999998" />
+ <linearGradient
+ id="linearGradient7584">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7586" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7588" />
+ </linearGradient>
+ <filter
+ height="1.4388067"
+ id="filter9847"
+ y="-0.21940336"
+ width="1.2520971"
+ x="-0.12604854">
+ <feGaussianBlur
+ stdDeviation="1.7113675"
+ id="feGaussianBlur9849"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5805">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop5807" />
+ <stop
+ offset="1"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5809" />
+ </linearGradient>
+ <filter
+ height="1.3127669"
+ id="filter5917"
+ y="-0.15638345"
+ width="1.1948662"
+ x="-0.09743309">
+ <feGaussianBlur
+ stdDeviation="0.60257196"
+ id="feGaussianBlur5919"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5813">
+ <stop
+ offset="0"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop5815" />
+ <stop
+ offset="1"
+ style="stop-color:#eeeeee;stop-opacity:1"
+ id="stop5817" />
+ </linearGradient>
+ <filter
+ height="1.233731"
+ id="filter9827"
+ y="-0.11686549"
+ width="1.2466146"
+ x="-0.12330729">
+ <feGaussianBlur
+ stdDeviation="13.567379"
+ id="feGaussianBlur9829"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient8317">
+ <stop
+ offset="0"
+ style="stop-color:#cccccc;stop-opacity:1"
+ id="stop8319" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop8321" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5557">
+ <stop
+ offset="0"
+ style="stop-color:#0093d9;stop-opacity:1"
+ id="stop5559" />
+ <stop
+ offset="1"
+ style="stop-color:#7bd5ff;stop-opacity:1"
+ id="stop5561" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient5541">
+ <stop
+ offset="0"
+ style="stop-color:#7bd5ff;stop-opacity:1"
+ id="stop5543" />
+ <stop
+ offset="1"
+ style="stop-color:#7bd5ff;stop-opacity:0"
+ id="stop5545" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient10494">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:0.75490195"
+ id="stop10496" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop10498" />
+ </linearGradient>
+ <filter
+ id="filter10668">
+ <feGaussianBlur
+ stdDeviation="0.40041338"
+ id="feGaussianBlur10670"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5797">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5799" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop5801" />
+ </linearGradient>
+ <filter
+ id="filter8391">
+ <feGaussianBlur
+ stdDeviation="0.23516584"
+ id="feGaussianBlur8393"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient5931">
+ <stop
+ offset="0"
+ style="stop-color:#a2a2a2;stop-opacity:1"
+ id="stop5933" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop5935" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3766"
+ gradientUnits="userSpaceOnUse"
+ y2="412.13812"
+ x2="252.93071"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,19.68022,-347.67491)"
+ y1="411.73941"
+ x1="277.4801" />
+ <linearGradient
+ id="linearGradient3746"
+ gradientUnits="userSpaceOnUse"
+ y2="33.279999"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ x1="234.81" />
+ <filter
+ height="1.5162802"
+ id="filter3712"
+ y="-0.25814009"
+ width="1.2335186"
+ x="-0.11675928">
+ <feGaussianBlur
+ stdDeviation="2.4864777"
+ id="feGaussianBlur3714"
+ inkscape:collect="always" />
+ </filter>
+ <radialGradient
+ r="19.990965"
+ id="radialGradient3628"
+ fx="31.988766"
+ fy="61.259193"
+ gradientUnits="userSpaceOnUse"
+ cy="61.259193"
+ cx="31.988766"
+ xlink:href="#linearGradient3931"
+
gradientTransform="matrix(-5.1508322e-2,0.977161,-2.2237504,-0.1172188,164.9592,23.790713)"
/>
+ <radialGradient
+ r="24"
+ id="radialGradient3626"
+ fx="948"
+ fy="209.00021"
+ gradientUnits="userSpaceOnUse"
+ cy="209.00021"
+ cx="948"
+ xlink:href="#linearGradient7126" />
+ <linearGradient
+ id="linearGradient3624"
+ gradientUnits="userSpaceOnUse"
+ y2="41.366924"
+ x2="37.213612"
+ xlink:href="#linearGradient3534"
+ gradientTransform="matrix(0.9077599,0,0,0.9071973,3.9015111,3.6781471)"
+ y1="26.265114"
+ x1="37.213612" />
+ <linearGradient
+ id="linearGradient3622"
+ gradientUnits="userSpaceOnUse"
+ y2="39.879005"
+ x2="500.77838"
+ xlink:href="#linearGradient3335"
+
gradientTransform="matrix(0.6231149,0,0,0.7353233,-280.80293,-9.807703)"
+ y1="78.13385"
+ x1="500.77838" />
+ <radialGradient
+ r="20.016653"
+ id="radialGradient3620"
+ fx="29.256323"
+ fy="34.171967"
+ gradientUnits="userSpaceOnUse"
+ cy="34.171967"
+ cx="29.256323"
+ xlink:href="#linearGradient7126"
+ gradientTransform="matrix(1,0,0,0.4522501,0,18.71769)" />
+ <linearGradient
+ id="linearGradient3618"
+ gradientUnits="userSpaceOnUse"
+ y2="151.51437"
+ x2="605.57886"
+ xlink:href="#linearGradient16859"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="158.12231"
+ x1="599.39917" />
+ <linearGradient
+ id="linearGradient3616"
+ gradientUnits="userSpaceOnUse"
+ y2="170.16"
+ x2="613.84003"
+ xlink:href="#x5002_"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="170.77318"
+ x1="600.74371" />
+ <linearGradient
+ id="linearGradient3614"
+ gradientUnits="userSpaceOnUse"
+ y2="174.23"
+ x2="609.98999"
+ xlink:href="#x5004_"
+
gradientTransform="matrix(0.2898773,0.8565172,1.0818369,-0.2295031,-323.82326,-445.09822)"
+ y1="156.45"
+ x1="592.20001" />
+ <radialGradient
+ r="14.494606"
+ id="radialGradient3576"
+ fx="22.315165"
+ fy="28.67547"
+ gradientUnits="userSpaceOnUse"
+ cy="28.67547"
+ cx="22.315165"
+ xlink:href="#linearGradient7322"
+ gradientTransform="matrix(1.9021006,0,0,0.538973,-18.842698,6.3225458)"
/>
+ <linearGradient
+ id="linearGradient3574"
+ gradientUnits="userSpaceOnUse"
+ y2="18.02874"
+ x2="208.65283"
+ xlink:href="#XMLID_419_"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.2,-5.2)"
+ y1="37.113522"
+ x1="240.48146" />
+ <linearGradient
+ id="linearGradient3570"
+ gradientUnits="userSpaceOnUse"
+ y2="33.29771"
+ x2="212.93233"
+ xlink:href="#linearGradient7484"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.2,-5.2)"
+ y1="33.29771"
+ x1="231.07658" />
+ <linearGradient
+ id="linearGradient2466"
+ gradientUnits="userSpaceOnUse"
+ y2="383.08859"
+ x2="246.338"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,-137.09795,-315.67491)"
+ y1="382.31308"
+ x1="294.08597" />
+ <linearGradient
+ id="linearGradient2462"
+ gradientUnits="userSpaceOnUse"
+ y2="371.83398"
+ x2="257.22992"
+ xlink:href="#linearGradient6075"
+
gradientTransform="matrix(0.9998681,1.6239512e-2,-1.6239512e-2,0.9998681,84.01832,-264.05611)"
+ y1="371.49814"
+ x1="277.90814" />
+ <linearGradient
+ id="linearGradient6596"
+ gradientUnits="userSpaceOnUse"
+ y2="264.5452"
+ x2="529.6897"
+ xlink:href="#linearGradient5721"
+ gradientTransform="matrix(0.944077,0,0,1.2450981,37.731315,12.80904)"
+ y1="294.61005"
+ x1="529.6897" />
+ <linearGradient
+ id="linearGradient5934"
+ gradientUnits="userSpaceOnUse"
+ y2="264.5452"
+ x2="529.6897"
+ xlink:href="#linearGradient5721"
+ gradientTransform="matrix(0.944077,0,0,1.2450981,37.731315,12.80904)"
+ y1="294.61005"
+ x1="529.6897" />
+ <linearGradient
+ id="linearGradient5932"
+ gradientUnits="userSpaceOnUse"
+ y2="311.5975"
+ x2="500.71109"
+ xlink:href="#linearGradient3518"
+
gradientTransform="matrix(1.2450981,0,0,1.2450981,-93.721513,10.007569)"
+ y1="244.95538"
+ x1="500.71109" />
+ <filter
+ height="1.2029091"
+ id="filter5126"
+ y="-0.10145455"
+ x="-0.021882353"
+ width="1.0437647">
+ <feGaussianBlur
+ stdDeviation="1.1579412"
+ id="feGaussianBlur5128"
+ inkscape:collect="always" />
+ </filter>
+ <radialGradient
+ r="265"
+ id="radialGradient4153"
+ fx="146.23947"
+ fy="830.26575"
+ gradientUnits="userSpaceOnUse"
+ cy="830.26575"
+ cx="146.23947"
+ xlink:href="#linearGradient3987"
+
gradientTransform="matrix(2.0005884,0,0,0.5009881,-214.15585,-66.462114)" />
+ <linearGradient
+ id="x5004_"
+ gradientUnits="userSpaceOnUse"
+ y2="174.23"
+ x2="609.98999"
+ gradientTransform="matrix(1.12,0,0,1.12,-649.08,-160.62)"
+ y1="156.45"
+ x1="592.20001">
+ <stop
+ offset="0"
+ style="stop-color:#d9d9d9;stop-opacity:1"
+ id="stop29157" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop29159" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#FFFFFF" />
+ </linearGradient>
+ <linearGradient
+ id="x5002_"
+ gradientUnits="userSpaceOnUse"
+ x1="601.48999"
+ x2="613.84003"
+ y1="170.16"
+ y2="170.16">
+ <stop
+ offset="0"
+ style="stop-color:#d9d9d9;stop-opacity:1"
+ id="stop29134" />
+ <stop
+ offset="0.2"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop29136" />
+ <stop
+ offset="1"
+ style="stop-color:#999999;stop-opacity:1"
+ id="stop29138" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#D9D9D9" />
+ <a:midPointStop
+ offset="0.20"
+ style="stop-color:#FFFFFF" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#FFFFFF" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#999999" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient16859"
+ gradientUnits="userSpaceOnUse"
+ x1="592.31"
+ x2="609.32001"
+ y1="162.60001"
+ y2="145.59">
+ <stop
+ offset="0"
+ style="stop-color:#f2f2f2;stop-opacity:1"
+ id="stop16861" />
+ <stop
+ offset="1"
+ style="stop-color:#b5b5b5;stop-opacity:1"
+ id="stop16863" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#F2F2F2" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#F2F2F2" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#E5E5E5" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7126">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7128" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7130" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3335">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop3337" />
+ <stop
+ offset="1"
+ style="stop-color:#eeeeec;stop-opacity:0"
+ id="stop3339" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient3534">
+ <stop
+ offset="0"
+ style="stop-color:#888a85;stop-opacity:1"
+ id="stop3536" />
+ <stop
+ offset="1"
+ style="stop-color:#888a85;stop-opacity:0"
+ id="stop3538" />
+ </linearGradient>
+ <filter
+ height="1.2617458"
+ id="filter3605"
+ y="-0.13087288"
+ x="-0.093524978"
+ width="1.18705">
+ <feGaussianBlur
+ stdDeviation="8.2187489"
+ id="feGaussianBlur3607"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient7484"
+ gradientUnits="userSpaceOnUse"
+ x1="228.35001"
+ x2="215.42999"
+ y1="33.279999"
+ y2="33.279999">
+ <stop
+ offset="0"
+ style="stop-color:#858882;stop-opacity:1"
+ id="stop7486" />
+ <stop
+ offset="0.36000001"
+ style="stop-color:#6e6f6b;stop-opacity:1"
+ id="stop3939" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7490" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#D3D3D3" />
+ </linearGradient>
+ <linearGradient
+ id="lg1900"
+ gradientUnits="userSpaceOnUse"
+ x1="228.35001"
+ x2="215.42999"
+ y1="33.279999"
+ y2="33.279999">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="s1902" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="s1906" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#575757" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#D3D3D3" />
+ </linearGradient>
+ <clipPath
+ id="clipPath17035">
+ <path
+ style="opacity:1;fill:#2e3436"
+ id="path17037"
+ d="M 9,14.568887 L 9,20.015678 C 9,23.815678 15.49,26.895678
23.49,26.895678 C 31.49,26.895678 37.97,23.815678 37.97,20.015678 L 37.97,14.568887 L
9,14.568887 z" />
+ </clipPath>
+ <filter
+ height="1.3295043"
+ id="filter7696"
+ y="-0.16475213"
+ x="-0.12240516"
+ width="1.2448103">
+ <feGaussianBlur
+ stdDeviation="0.82797329"
+ id="feGaussianBlur7698"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="XMLID_419_"
+ gradientUnits="userSpaceOnUse"
+ x1="224.31"
+ x2="214.33"
+ y1="19.450001"
+ y2="11.46">
+ <stop
+ offset="0"
+ style="stop-color:#666666;stop-opacity:1"
+ id="s1903" />
+ <stop
+ offset="0.33000001"
+ style="stop-color:#6d6d6d;stop-opacity:1"
+ id="s1905" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="s1907" />
+ <a:midPointStop
+ offset="0"
+ style="stop-color:#404040" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#404040" />
+ <a:midPointStop
+ offset="0.33"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="0.5"
+ style="stop-color:#6D6D6D" />
+ <a:midPointStop
+ offset="1"
+ style="stop-color:#E9E9E9" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient7322">
+ <stop
+ offset="0"
+ style="stop-color:#ffffff;stop-opacity:1"
+ id="stop7324" />
+ <stop
+ offset="1"
+ style="stop-color:#ffffff;stop-opacity:0"
+ id="stop7326" />
+ </linearGradient>
+ <filter
+ id="filter3968">
+ <feGaussianBlur
+ stdDeviation="0.10634363"
+ id="feGaussianBlur3970"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient3931">
+ <stop
+ offset="0"
+ style="stop-color:#2e3436;stop-opacity:1"
+ id="stop3933" />
+ <stop
+ offset="1"
+ style="stop-color:#2e3436;stop-opacity:0"
+ id="stop3935" />
+ </linearGradient>
+ <filter
+ height="1.5828062"
+ id="filter16947"
+ y="-0.29140311"
+ x="-0.093153283"
+ width="1.1863066">
+ <feGaussianBlur
+ stdDeviation="1.5518534"
+ id="feGaussianBlur16949"
+ inkscape:collect="always" />
+ </filter>
+ <pattern
+ patternTransform="matrix(1.0388269,0,0,1.7996829,-2437.2069,574.63695)"
+ id="pattern18092"
+ xlink:href="#pattern2491" />
+ <pattern
+ patternTransform="matrix(0.9061767,0,0,0.9061767,-1355.2548,122.94984)"
+ id="pattern2491"
+ xlink:href="#pattern2509" />
+ <pattern
+ patternTransform="matrix(0.3312501,0,0,0.4963236,0.6164603,638.17579)"
+ id="pattern2509"
+ xlink:href="#pattern6159" />
+ <pattern
+ patternTransform="matrix(0.349912,0,0,0.5273435,0.6511897,640.41412)"
+ id="pattern6159"
+ xlink:href="#pattern4062" />
+ <pattern
+ patternTransform="matrix(0.349912,0,0,0.4713685,-128.11646,125.58505)"
+ id="pattern4062"
+ xlink:href="#pattern4015" />
+ <pattern
+ patternTransform="matrix(0.375,0,0,0.375,379,437.7952)"
+ id="pattern4015"
+ xlink:href="#white-spots" />
+ <pattern
+ height="32"
+ id="white-spots"
+ patternUnits="userSpaceOnUse"
+ patternTransform="matrix(0.375,0,0,0.375,379,400)"
+ width="32">
+ <g
+ inkscape:label="#g3035"
+ transform="translate(-484.3997,-513.505)"
+ id="white-spot">
+ <path
+ style="opacity:0.3;fill:white"
+ id="path3033"
+ sodipodi:nodetypes="czzzz"
+ d="M 509.39967,529.50504 C 509.39967,534.47304 505.36767,538.50504
500.39967,538.50504 C 495.43167,538.50504 491.39967,534.47304 491.39967,529.50504 C
491.39967,524.53704 495.43167,520.50504 500.39967,520.50504 C 505.36767,520.50504
509.39967,524.53704 509.39967,529.50504 z " />
+ </g>
+ </pattern>
+ <linearGradient
+ id="linearGradient3987">
+ <stop
+ offset="0"
+ style="stop-color:#e3dcc0;stop-opacity:0"
+ id="stop3989" />
+ <stop
+ offset="1"
+ style="stop-color:#e3dcc0;stop-opacity:1"
+ id="stop3991" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(0.4083909,0,0,0.356123,-354.11689,547.24482)"
+ id="pattern4156"
+ xlink:href="#pattern18092" />
+ <filter
+ height="1.8680604"
+ id="filter4009"
+ y="-0.43403015"
+ width="1.1872287"
+ x="-0.093614347">
+ <feGaussianBlur
+ stdDeviation="3.9786096"
+ id="feGaussianBlur4011"
+ inkscape:collect="always" />
+ </filter>
+ <linearGradient
+ id="linearGradient3518">
+ <stop
+ offset="0"
+ style="stop-color:#000000;stop-opacity:1"
+ id="stop3520" />
+ <stop
+ offset="1"
+ style="stop-color:#000000;stop-opacity:0"
+ id="stop3522" />
+ </linearGradient>
+ <linearGradient
+ id="linearGradient6075">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop6077" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop6079" />
+ </linearGradient>
+ <marker
+ style="overflow:visible"
+ id="TriangleInM"
+ refY="0"
+ orient="auto"
+ refX="0">
+ <path
+ transform="scale(-0.5,-0.5)"
+ style="fill:#555753"
+ d="M 5.77,0 L -2.88,5 L -2.88,-5 L 5.77,0 z"
+ id="path4167" />
+ </marker>
+ <linearGradient
+ id="linearGradient5721">
+ <stop
+ offset="0"
+ style="stop-color:#ac0000;stop-opacity:1"
+ id="stop5723" />
+ <stop
+ offset="1"
+ style="stop-color:#f50606;stop-opacity:1"
+ id="stop5725" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(-0.5192722,0,0,0.2435722,255.93517,810.58927)"
+ id="pattern18096"
+ xlink:href="#pattern4829" />
+ <pattern
+
patternTransform="matrix(-0.4861985,0,0,0.2614488,-192.25611,762.71923)"
+ id="pattern4829"
+ xlink:href="#pattern2505" />
+ <pattern
+
patternTransform="matrix(-0.3479763,0,0,0.1472112,-35.000248,822.25127)"
+ id="pattern2505"
+ xlink:href="#pattern6248" />
+ <pattern
+ patternTransform="matrix(-0.3479763,0,0,0.1472112,-21.53871,822.25127)"
+ id="pattern6248"
+ xlink:href="#pattern3587" />
+ <pattern
+ patternTransform="matrix(-0.369281,0,0,0.1304123,49.607712,674.9142)"
+ id="pattern3587"
+ xlink:href="#pattern4704" />
+ <pattern
+ patternTransform="matrix(0.369281,0,0,0.167673,358.678,807.3634)"
+ id="pattern4704"
+ xlink:href="#pattern4396" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,41.1944,774.2561)"
+ id="pattern4396"
+ xlink:href="#pattern4315" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,253.6944,752.2561)"
+ id="pattern4315"
+ xlink:href="#pattern4038" />
+ <pattern
+ patternTransform="matrix(0.361895,0,0,0.361895,-33.80556,922.2561)"
+ id="pattern4038"
+ xlink:href="#black-spots" />
+ <pattern
+ height="32"
+ id="black-spots"
+ patternUnits="userSpaceOnUse"
+ patternTransform="matrix(0.455007,0,0,0.455007,20.99995,116)"
+ width="32">
+ <g
+ inkscape:label="#g3039"
+ transform="translate(-448.3997,-513.505)"
+ id="black-spot">
+ <path
+ style="opacity:0.1;fill:black"
+ d="M 473.39967,529.50504 C 473.39967,534.47304 469.36767,538.50504
464.39967,538.50504 C 459.43167,538.50504 455.39967,534.47304 455.39967,529.50504 C
455.39967,524.53704 459.43167,520.50504 464.39967,520.50504 C 469.36767,520.50504
473.39967,524.53704 473.39967,529.50504 z "
+ sodipodi:nodetypes="czzzz"
+ id="path2961" />
+ </g>
+ </pattern>
+ <radialGradient
+ r="75"
+ id="radialGradient18146"
+ fx="55.217297"
+ fy="846.34479"
+ gradientUnits="userSpaceOnUse"
+ cy="846.42249"
+ cx="99.411484"
+ xlink:href="#linearGradient3579"
+
gradientTransform="matrix(1.8817339,4.3553205e-6,-8.3755671e-5,12.649087,-349.11235,-9832.1102)"
/>
+ <linearGradient
+ id="linearGradient3579">
+ <stop
+ offset="0"
+ style="stop-color:#555753;stop-opacity:1"
+ id="stop3581" />
+ <stop
+ offset="1"
+ style="stop-color:#555753;stop-opacity:0"
+ id="stop3583" />
+ </linearGradient>
+ <pattern
+ patternTransform="matrix(-0.4732794,0,0,0.2435722,245.17945,810.58927)"
+ id="pattern7559"
+ xlink:href="#pattern18096" />
+ <linearGradient
+ id="linearGradient4899"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5175"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5199"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5372"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <linearGradient
+ id="linearGradient5478"
+ gradientUnits="userSpaceOnUse"
+ inkscape:collect="always"
+ x1="234.81"
+ x2="225.54341"
+ xlink:href="#lg1900"
+ gradientTransform="matrix(1.33,0,0,1.31,-274.61189,-4.9345764)"
+ y1="33.279999"
+ y2="33.279999" />
+ <marker
+ style="overflow:visible"
+ id="Arrow2Mstart9v"
+ orient="auto"
+ refY="0.0"
+ inkscape:stockid="Arrow2Mstart9v"
+ refX="0.0">
+ <path
+
style="stroke-linejoin:round;font-size:12.0;fill-rule:evenodd;stroke:#0093d9;stroke-width:0.62500000;fill:#0093d9"
+ id="path10095"
+ transform="scale(0.6) translate(0,0)"
+ d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C
6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z " />
+ </marker>
+ </defs>
+ <metadata
+ id="metadata7">
+ <rdf:RDF>
+ <ns:Work
+ rdf:about="">
+ <dc:format>image/svg+xml</dc:format>
+ <dc:type
+
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+ <dc:title />
+ </ns:Work>
+ <cc:Work
+ rdf:about="">
+ <dc:format>image/svg+xml</dc:format>
+ <dc:type
+
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+ </cc:Work>
+ </rdf:RDF>
+ </metadata>
+ <g
+ inkscape:label="Layer 1"
+ transform="translate(0,1452.7559)"
+ inkscape:groupmode="layer"
+ id="layer1">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ transform="matrix(0.6271072,0,0,0.7145671,376.72591,-255.70746)"
+ id="g5534">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,573.78795,-1052.4741)"
+ id="g5536">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5538"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5540" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-1.685529e-2,-4.746485e-2,-0.224161,7.960202e-2,621.66584,-999.13082)"
+ id="g5542">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5544"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5546" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5548"
+
transform="matrix(-2.921073e-2,-4.103348e-2,-0.1937877,0.1379527,598.97529,-1030.6012)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5550"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5552" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,636.18656,-959.07472)"
+ id="g5554">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5556"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5558" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5560"
+
transform="matrix(5.036077e-2,8.978861e-4,-4.24042e-3,0.2378374,494.60965,-1079.7903)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5562"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5564" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.020022e-2,4.11723e-3,-1.944433e-2,0.2370792,513.08159,-1076.323)"
+ id="g5566">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g5568">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5570"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5572" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5574"
+
transform="matrix(-4.958209e-2,8.86732e-3,4.187746e-2,0.23416,451.60934,-1076.4369)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5576"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5578" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,546.6803,-1065.9821)"
+ id="g5580">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g5582">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5584"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5586" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-4.26541e-2,-2.678882e-2,0.1265148,-0.2014414,398.28257,-798.80129)"
+ id="g5588">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5590"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5592" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(1.533881e-2,4.797639e-2,0.2265768,-7.24402e-2,350.59028,-853.23898)"
+ id="g5594">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5596"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5598" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5600"
+
transform="matrix(2.921073e-2,4.103348e-2,0.1937877,-0.1379527,373.09523,-820.67414)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5602"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5604" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-8.25158e-3,-4.968827e-2,0.2346615,-3.896948e-2,337.38396,-890.70066)"
+ id="g5606">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5608"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5610" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5612"
+
transform="matrix(-5.036077e-2,-8.978861e-4,4.24042e-3,-0.2378374,477.46087,-771.4851)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5614"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5616" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.020022e-2,-4.11723e-3,1.944433e-2,-0.2370792,458.98893,-774.95242)"
+ id="g5618">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g5620">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5622"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5624" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5626"
+
transform="matrix(4.958209e-2,-8.86732e-3,-4.187746e-2,-0.23416,520.46118,-774.83848)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5628"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5630" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-4.892827e-2,-1.195983e-2,5.648239e-2,-0.2310722,425.39022,-785.29326)"
+ id="g5632">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g5634">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5636"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5638" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(0.1370167,0.9905687,-0.9905687,0.1370167,791.30445,-1278.2371)"
+ id="g5640">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5642"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5644"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5646" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5648"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5650"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5652" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)"
+ id="g5654">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5656"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5658" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5660"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5662"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5664" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)"
+ id="g5666">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5668"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5670" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5672"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5674"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5676"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5678" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)"
+ id="g5680">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5682"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5684" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5686"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5688"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5690"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5692" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5694"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5696"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5698" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-0.1370167,-0.9905687,0.9905687,-0.1370167,180.69554,-573.19557)"
+ id="g5700">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5702"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5704"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5706" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5708"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5710"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5712" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)"
+ id="g5714">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5716"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5718" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5720"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5722"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5724" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)"
+ id="g5726">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5728"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5730" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5732"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5734"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5736"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5738" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)"
+ id="g5740">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5742"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5744" />
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5746"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)">
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5748"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5750"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5752" />
+ </g>
+ </g>
+ <g
+ style="stroke:#0093d9;stroke-opacity:1"
+ id="g5754"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#0093d9;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path5756"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path5758" />
+ </g>
+ </g>
+ </g>
+ <g
+ id="g5205"
+ transform="matrix(0.7656945,0,0,0.8407731,-91.12755,-100.88643)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3759"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,573.78795,-1052.4741)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3775"
+
transform="matrix(-1.685529e-2,-4.746485e-2,-0.224161,7.960202e-2,621.66584,-999.13082)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.921073e-2,-4.103348e-2,-0.1937877,0.1379527,598.97529,-1030.6012)"
+ id="g3781">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3787"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,636.18656,-959.07472)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.036077e-2,8.978861e-4,-4.24042e-3,0.2378374,494.60965,-1079.7903)"
+ id="g3835">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3841"
+
transform="matrix(5.020022e-2,4.11723e-3,-1.944433e-2,0.2370792,513.08159,-1076.323)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3875"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-4.958209e-2,8.86732e-3,4.187746e-2,0.23416,451.60934,-1076.4369)"
+ id="g3847">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3853"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,546.6803,-1065.9821)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3871"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3759-2"
+
transform="matrix(-4.26541e-2,-2.678882e-2,0.1265148,-0.2014414,398.28257,-798.80129)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-8"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3775-1"
+
transform="matrix(1.533881e-2,4.797639e-2,0.2265768,-7.24402e-2,350.59028,-853.23898)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(2.921073e-2,4.103348e-2,0.1937877,-0.1379527,373.09523,-820.67414)"
+ id="g3781-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-6"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-3" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3787-2"
+
transform="matrix(-8.25158e-3,-4.968827e-2,0.2346615,-3.896948e-2,337.38396,-890.70066)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-3"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-5.036077e-2,-8.978861e-4,4.24042e-3,-0.2378374,477.46087,-771.4851)"
+ id="g3835-1">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-3"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3841-7"
+
transform="matrix(-5.020022e-2,-4.11723e-3,1.944433e-2,-0.2370792,458.98893,-774.95242)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3875-6"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-2"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-3" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.958209e-2,-8.86732e-3,-4.187746e-2,-0.23416,520.46118,-774.83848)"
+ id="g3847-2">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-8" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3853-5"
+
transform="matrix(-4.892827e-2,-1.195983e-2,5.648239e-2,-0.2310722,425.39022,-785.29326)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3871-2"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-9"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-6" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g4029"
+
transform="matrix(0.1370167,0.9905687,-0.9905687,0.1370167,791.30445,-1278.2371)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)"
+ id="g3759-1">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-0"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)"
+ id="g3775-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-4" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3781-2"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-1"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)"
+ id="g3787-25">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-1"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-0" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3835-7"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-8"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-66" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)"
+ id="g3841-5">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g3875-3">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-2" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3847-4"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-2"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-0" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)"
+ id="g3853-2">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g3871-28">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-5"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-60" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)"
+ id="g4057">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path4059"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path4061" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g4029-2"
+
transform="matrix(-0.1370167,-0.9905687,0.9905687,-0.1370167,180.69554,-573.19557)">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.26541e-2,2.678882e-2,-0.1265148,0.2014414,401.46544,226.66601)"
+ id="g3759-1-8">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path2987-0-4"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3757-6-2" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-1.533881e-2,-4.797639e-2,-0.2265768,7.24402e-2,451.18604,291.98423)"
+ id="g3775-7-6">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3777-4-7"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3779-4-4" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3781-2-4"
+
transform="matrix(-3.361002e-2,-3.751506e-2,-0.1771713,0.1587291,417.8994,242.25087)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3783-1-5"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3785-1-1" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(8.25158e-3,4.968827e-2,-0.2346615,3.896948e-2,460.78836,329.95692)"
+ id="g3787-25-3">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3789-1-1"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3791-0-9" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3835-7-1"
+
transform="matrix(5.021459e-2,3.93803e-3,-1.859802e-2,0.2371471,330.20805,195.98214)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3837-8-3"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3839-66-6" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(5.003581e-2,5.78198e-3,-2.730638e-2,0.2363027,344.98101,201.46682)"
+ id="g3841-5-3">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9976905,1.43827e-2,-0.3207864,0.9976905,107.39345,-2.6314002)"
+ id="g3875-3-2">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3843-0-0"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3845-2-5" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+ id="g3847-4-5"
+
transform="matrix(-5.033852e-2,-1.74534e-3,-8.24266e-3,0.2377324,298.61269,194.91807)">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3849-2-9"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3851-0-2" />
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(4.892827e-2,1.195983e-2,-5.648239e-2,0.2310722,375.12711,211.24535)"
+ id="g3853-2-2">
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(0.9973409,1.543142e-2,-0.3441767,0.9973409,-73.320634,-8.0648826)"
+ id="g3871-28-7">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path3855-5-6"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ sodipodi:cx="-148.57143"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path3857-60-8" />
+ </g>
+ </g>
+ <g
+ style="stroke:#cc0000;stroke-opacity:1"
+
transform="matrix(-2.700326e-2,-4.251867e-2,-0.2008018,0.1275275,434.74262,261.28125)"
+ id="g4057-8">
+ <path
+ sodipodi:type="arc"
+
style="opacity:0.71238942;fill:none;stroke:#cc0000;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="path4059-0"
+ sodipodi:cx="-148.57143"
+ sodipodi:cy="396.64789"
+ sodipodi:open="true"
+ d="M -51.428566,396.64789 A 97.14286,47.889969 0 1 1
-245.71429,396.64789"
+ sodipodi:start="0"
+ sodipodi:end="3.1415927"
+ sodipodi:rx="97.14286"
+ sodipodi:ry="47.889969" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:4;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M -245.57143,397.21933 L -149.42857,-816.06639 L
-51.178571,397.18361"
+ sodipodi:nodetypes="ccc"
+ id="path4061-3" />
+ </g>
+ </g>
+ </g>
+ <g
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-803.55188)"
+ id="g3769-8">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2985-39"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3759-2"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3761-57"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect3763-1"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3765-2"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3767-8"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <g
+ transform="matrix(0.7309234,0,0,0.7309234,-1132.9133,-954.93068)"
+ id="g4113" />
+ <g
+ transform="translate(-1309.0315,-1084.2958)"
+ id="g6262" />
+ <g
+ id="g2415"
+ transform="translate(118,-135)">
+ <g
+ id="g3769"
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2985"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3759"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3761"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect3763"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3765"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path3767"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text3777"
+ sodipodi:linespacing="89.999998%"
+ y="-893.63776"
+ x="85"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan3787"
+ y="-893.63776"
+ x="85">KERBEROS</tspan><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan2403"
+ y="-872.03776"
+ x="85">KDC</tspan></text>
+ </g>
+ <rect
+
style="fill:none;stroke:#000000;stroke-width:5.43862295;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect4636-0"
+ width="327.00906"
+ ry="0"
+ y="-1130.9185"
+ x="112.21931"
+ height="579.91339" />
+ <g
+ transform="translate(-284.99996,-670)"
+ id="g4694">
+ <rect
+ style="fill:#ffffff;fill-opacity:1;stroke:none"
+ id="rect4664-5"
+ width="160"
+ y="-476.63776"
+ x="406"
+ height="32" />
+ <text
+
style="font-size:25px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text4666-4"
+ sodipodi:linespacing="125%"
+ y="-453.63776"
+ x="411"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+ style="font-weight:bold;font-family:Liberation Sans"
+ id="tspan4668-7"
+ y="-453.63776"
+ x="411">IPA SERVER</tspan></text>
+ </g>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 329.024,-942.99127 L 300.976,-998.28421"
+ sodipodi:nodetypes="cc"
+ id="path4699" />
+ <g
+ id="g2427"
+ transform="translate(118,37)">
+ <g
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)"
+ id="g2429">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2431"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2433"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2435"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2437"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2439"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2441"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text2443"
+ sodipodi:linespacing="89.999998%"
+ y="-893.63776"
+ x="85"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ id="tspan2447"
+ y="-893.63776"
+ x="85">DIRECTORY</tspan><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ id="tspan2451"
+ y="-872.03776"
+ x="85">SERVER</tspan></text>
+ </g>
+ <g
+ transform="translate(118,209)"
+ id="g2453">
+ <g
+ id="g2455"
+ transform="matrix(0.3450185,0,0,0.2867534,-48.942846,-672.52717)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2457"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2459"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2461"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect2463"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2465"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path2467"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:20px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:89.99999762%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text2469"
+ sodipodi:linespacing="89.999998%"
+ y="-885.63776"
+ x="81"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan2473"
+ y="-885.63776"
+ x="81">DNS</tspan></text>
+ </g>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#cc0000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:none;marker-end:url(#Arrow2MendZ);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 282.82016,-753.19511 L 315.17984,-806.08037"
+ sodipodi:nodetypes="cc"
+ id="path3458" />
+ <g
+ transform="matrix(0.5093683,0,0,0.3913042,1644.9712,-1251.712)"
+ id="g7496">
+ <use
+ id="use7494"
+ width="1000"
+ transform="translate(0,73)"
+ y="0"
+ xlink:href="#g7452"
+ x="0"
+ height="700" />
+ <g
+ style="opacity:1"
+ transform="matrix(0.8937066,0,0,0.8937066,-85.24089,192.26027)"
+ id="g7452">
+ <g
+ transform="matrix(7.659747,0,0,7.659747,-3413.2328,-6201.7396)"
+ id="g7454">
+ <g
+ transform="matrix(1.0634304,0,0,1.1520362,59.093881,903.66323)"
+ id="g7456">
+ <path
+
transform="matrix(0.1373667,0,0,0.1268015,-199.43287,-50.397161)"
+
style="opacity:1;fill:#000000;fill-opacity:1;filter:url(#filter3605)"
+ id="path14856"
+ d="M 1622.8438,458.84375 C 1566.5114,458.84375 1520.8125,482.32514
1520.8125,511.3125 C 1520.8125,511.65225 1520.8313,512.00553 1520.8438,512.34375 L
1517.3438,512.34375 L 1517.3438,555.3125 C 1517.3437,585.28059 1564.6055,609.5625
1622.8438,609.5625 C 1681.082,609.56252 1728.25,585.28059 1728.25,555.3125 L
1728.25,512.34375 L 1724.75,512.34375 C 1724.7625,512.00553 1724.7813,511.65225
1724.7812,511.3125 C 1724.7813,482.32514 1679.1762,458.84375 1622.8438,458.84375 z "
/>
+ <path
+ style="opacity:1;fill:url(#linearGradient3570)"
+ d="M 9,14.568887 L 9,20.015678 C 9,23.815678 15.49,26.895678
23.49,26.895678 C 31.49,26.895678 37.97,23.815678 37.97,20.015678 L 37.97,14.568887 L
9,14.568887 z "
+ id="path7458" />
+ <path
+ clip-path="url(#clipPath17035)"
+
style="opacity:1;fill:url(#linearGradient5372);filter:url(#filter7696)"
+ id="path7460"
+ d="M 23.078104,27.161102 C 31.078104,27.161102 37.535262,24.081102
37.535262,20.281102 L 37.535262,14.834311 C 36.15966,17.910315 29.359518,20.506549
23.683466,22.066208 C 23.731682,23.328921 15.078104,27.161102 23.078104,27.161102 z "
/>
+ <path
+ style="opacity:1;fill:url(#linearGradient3574)"
+ d="M 37.97,14.568887 C 37.97,18.368887 31.49,21.448887
23.49,21.448887 C 15.49,21.448887 9,18.368887 9,14.568887 C 9,10.768887 15.49,7.6888865
23.49,7.6888865 C 31.49,7.6888865 37.97,10.768887 37.97,14.568887 z "
+ id="path7462" />
+ <path
+
style="opacity:0.68983956;fill:none;fill-opacity:1;stroke:url(#radialGradient3576);stroke-width:0.57768553;stroke-miterlimit:4;stroke-opacity:1;filter:url(#filter3968)"
+ d="M 37.728925,14.725637 C 37.728925,18.43144 31.409556,21.43509
23.607865,21.43509 C 15.806175,21.43509 9.4770534,18.43144 9.4770534,14.725637 C
9.4770534,11.019835 15.806175,8.016182 23.607865,8.016182 C 31.409556,8.016182
37.728925,11.019835 37.728925,14.725637 z "
+ id="path7464" />
+ </g>
+ </g>
+ </g>
+ <use
+ id="use5130"
+ width="1000"
+ transform="translate(0,-79.242113)"
+ y="0"
+ xlink:href="#g7452"
+ x="0"
+ height="700" />
+ </g>
+ <rect
+
style="fill:none;stroke:#000000;stroke-width:4.1328311;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect5398"
+ width="244.31485"
+ ry="0"
+ y="-1129.2472"
+ x="550.84259"
+ height="448.21921" />
+ <g
+ transform="translate(234.27619,-667.67601)"
+ id="g5400">
+ <rect
+ style="fill:#ffffff;fill-opacity:1;stroke:none"
+ id="rect5402"
+ width="145"
+ y="-476.63776"
+ x="406"
+ height="33" />
+ <text
+
style="font-size:25px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;font-family:Aharoni"
+ id="text5404"
+ sodipodi:linespacing="125%"
+ y="-453.63776"
+ x="411"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+ style="font-weight:bold;font-family:Liberation Sans"
+ id="tspan5406"
+ y="-453.63776"
+ x="411">IPA CLIENT</tspan></text>
+ </g>
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect11007"
+ width="107"
+ height="566"
+ x="442"
+ y="-1139.6377" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 310.2762,-1055.3138 L 572.2762,-1055.3138"
+ sodipodi:nodetypes="cc"
+ id="path5452" />
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:#cc0000;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8771"
+ width="273"
+ transform="translate(0,-1452.7559)"
+ y="841.11816"
+ x="133"
+ height="57" />
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8773"
+ sodipodi:linespacing="89.999998%"
+ y="-576.63776"
+ x="148"
+ xml:space="preserve"><tspan
+
style="font-size:22px;fill:#cc0000;fill-opacity:1;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8775"
+ y="-576.63776"
+ x="148">management interface</tspan></text>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8789"
+ sodipodi:linespacing="89.999998%"
+ y="-1020.6378"
+ x="620"
+ xml:space="preserve"><tspan
+ style="font-size:24px;fill:#ffffff;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8791"
+ y="-1020.6378"
+ x="620">SSSD</tspan></text>
+ <g
+ id="g8793"
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-651.55188)">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8795"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8797"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8799"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8801"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8803"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8805"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:middle;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8807"
+ sodipodi:linespacing="89.999998%"
+ y="-868.63782"
+ x="644"
+ xml:space="preserve"><tspan
+ sodipodi:role="line"
+
style="font-size:24px;text-align:center;text-anchor:middle;fill:#ffffff;font-family:AvantGarde"
+ id="tspan8809"
+ y="-868.63782"
+ x="644">nss_ldap</tspan></text>
+ <g
+ transform="matrix(0.3464207,0,0,0.2866087,512.70864,-529.55188)"
+ id="g8811">
+ <rect
+
style="fill:#cc0000;fill-opacity:1;stroke:#8c8f91;stroke-width:4;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8813"
+ width="442.85715"
+ rx="0"
+ transform="translate(0,-1452.7559)"
+ y="553.68958"
+ ry="37.807339"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8815"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#9e292b;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8817"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ <rect
+
style="fill:#0093d9;fill-opacity:1;stroke:#8c8f91;stroke-width:5.6473918;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect8819"
+ width="442.85715"
+ rx="0"
+ ry="37.807339"
+ y="553.68958"
+ transform="translate(0,-1452.7559)"
+ x="171.42857"
+ height="242.85715" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8821"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 171.07143,552.33245 L 360,462.26102 L 724.57143,462.68959 L
613.42857,554.11816"
+ transform="translate(0,-1452.7559)" />
+ <path
+
style="fill:#046d9e;fill-opacity:1;stroke:#8c8f91;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ id="path8823"
+ sodipodi:nodetypes="cccc"
+ inkscape:connector-curvature="0"
+ d="M 615.5,795.33245 L 726.78571,692.83245 L 726.92281,464.11812 L
615.92857,555.33245"
+ transform="translate(0,-1452.7559)" />
+ </g>
+ <text
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:center;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:middle;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ id="text8825"
+ sodipodi:linespacing="89.999998%"
+ y="-746.63782"
+ x="650"
+ xml:space="preserve"><tspan
+
style="font-size:24px;text-align:center;text-anchor:middle;fill:#ffffff;font-family:AvantGarde"
+ sodipodi:role="line"
+ id="tspan8827"
+ y="-746.63782"
+ x="650">certmonger</tspan></text>
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 392.51781,-867.66656 L 573.51781,-866.66656"
+ sodipodi:nodetypes="cc"
+ id="path12002" />
+ <path
+ id="path12004"
+ sodipodi:nodetypes="ccc"
+ d="M 392.51781,-891.66656 L 509.99656,-891.01751 L
509.51781,-1055.6666"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ inkscape:connector-curvature="0" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 305.01786,-706.75326 L 549.01786,-705.75326"
+ sodipodi:nodetypes="cc"
+ id="path12006" />
+ <path
+ inkscape:connector-curvature="0"
+
style="fill:none;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 411.2366,-589.73088 L 559.9979,-589.1212 L 559.2366,-680.73088"
+ sodipodi:nodetypes="ccc"
+ id="path13200" />
+ <path
+ id="path13202"
+ sodipodi:nodetypes="ccc"
+ d="M 411.77848,-572.84262 L 611.25723,-572.19357 L 610.77848,-736.8427"
+
style="fill:none;stroke:#0093d9;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart9v);marker-end:none;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ inkscape:connector-curvature="0" />
+ <rect
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+ id="rect13204"
+ width="98"
+ height="517"
+ x="11"
+ y="-1144.6377" />
+ <rect
+ y="-1123.4711"
+ x="797.33331"
+ height="517"
+ width="106.66666"
+ id="rect14199"
+
style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none;stroke-width:3;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
/>
+ <text
+ xml:space="preserve"
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ x="169"
+ y="-478.63773"
+ id="text14201"
+ sodipodi:linespacing="89.999998%"><tspan
+ sodipodi:role="line"
+ id="tspan14203"
+ x="169"
+ y="-478.63773"
+ style="font-size:24px;font-family:AvantGarde">web
UI</tspan></text>
+ <text
+ xml:space="preserve"
+
style="font-size:10px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:89.99999762%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Liberation
Sans"
+ x="281.741"
+ y="-479.92575"
+ id="text14205"
+ sodipodi:linespacing="89.999998%"><tspan
+ sodipodi:role="line"
+ id="tspan14207"
+ x="281.741"
+ y="-479.92575"
+
style="font-size:24px;text-align:start;text-anchor:start;font-family:AvantGarde">command-line</tspan><tspan
+ sodipodi:role="line"
+ x="281.741"
+ y="-458.32575"
+
style="font-size:24px;text-align:start;text-anchor:start;font-family:AvantGarde"
+ id="tspan14209">tools</tspan></text>
+ <path
+
style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+ d="M 237,-545.16462 C 237,-502.16462 237,-502.16462 237,-502.16462"
+ id="path14219" />
+ <path
+ id="path15214"
+ d="M 289,-545.16462 C 289,-502.16462 289,-502.16462 289,-502.16462"
+
style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:3;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
/>
+ </g>
+</svg>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/index.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/index.html
index a0df423..6369c7d 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/index.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/index.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>FreeIPA: Identity/Policy Management</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><meta name="description" content="Identity and policy management —
for both users and machines — is a core function for almost any enterprise environment.
IPA provides a way to create an identity domain that allows machines to enroll to a domain
and immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and cl
ients. This guide is intended for IT and systems administrators." /><script
type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>FreeIPA: Identity/Policy Management</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><meta name="description" content="Identity and policy management —
for both users and machines — is a core function for almost any enterprise environment.
IPA provides a way to create an identity domain that allows machines to enroll to a domain
and immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and cl
ients. This guide is intended for IT and systems administrators." /><script
type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="next"
href="Preface.html" title="Preface" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"></li><li class="next"><a
accesskey="n"
href="Preface.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="book" id="id4236462"
lang="en-US"><div class="titlepage"><div><div
class="producttitle"><span
class="productname">Fedora</span> <span
class="productnumber">15</span></div><div
<h1 id="id4236462" class="title">FreeIPA:
Identity/Policy Management</h1></div><div><h2
class="subtitle">Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks</h2></div><p class="edition">Edition
0.1</p><div><h3 class="corpauthor">
+
</script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="next"
href="Preface.html" title="Preface" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"></li><li class="next"><a
accesskey="n"
href="Preface.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="book" id="id4457317"
lang="en-US"><div class="titlepage"><div><div
class="producttitle"><span
class="productname">Fedora</span> <span
class="productnumber">15</span></div><div
<h1 id="id4457317" class="title">FreeIPA:
Identity/Policy Management</h1></div><div><h2
class="subtitle">Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks</h2></div><p class="edition">Edition
0.1</p><div><h3 class="corpauthor">
<span
class="inlinemediaobject"><object
data="Common_Content/images/title_logo.svg" type="image/svg+xml">
</object></span>
- </h3></div><div><div class="authorgroup"><div
class="author"><h3 class="author"><span
class="firstname">Ella Deon</span> <span
class="surname">Lackey</span></h3><code
class="email"><a class="email"
href="mailto:dlackey@redhat.com">dlackey@redhat.com</a></code></div></div></div><hr
/><div><div id="id3228334" class="legalnotice"><h1
class="legalnotice">Legal Notice</h1><div
class="para">
+ </h3></div><div><div class="authorgroup"><div
class="author"><h3 class="author"><span
class="firstname">Ella Deon</span> <span
class="surname">Lackey</span></h3><code
class="email"><a class="email"
href="mailto:dlackey@redhat.com">dlackey@redhat.com</a></code></div></div></div><hr
/><div><div id="id3117807" class="legalnotice"><h1
class="legalnotice">Legal Notice</h1><div
class="para">
Copyright <span class="trademark"></span>© 2011 Red Hat.
</div><div class="para">
The text of and illustrations in this document are licensed by Red Hat under a Creative
Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An
explanation of CC-BY-SA is available at <a
href="http://creativecommons.org/licenses/by-sa/3.0/">http:/...;.
The original authors of this document, and Red Hat, designate the Fedora Project as the
"Attribution Party" for purposes of CC-BY-SA. In accordance with CC-BY-SA, if
you distribute this document or an adaptation of it, you must provide the URL for the
original version.
@@ -26,4 +26,4 @@
All other trademarks are the property of their respective owners.
</div></div></div><div><div
class="abstract"><h6>Abstract</h6><div
class="para">
Identity and policy management — for both users and machines — is a core function for
almost any enterprise environment. IPA provides a way to create an identity domain that
allows machines to enroll to a domain and immediately access identity information reuqired
for single sign-on and authentication services, as well as policy settings that govern
authorization and access. This manual covers all aspects of installing, configuring, and
managing IPA domains, including both servers and clients. This guide is intended for IT
and systems administrators.
- </div></div></div></div><hr /></div><div
class="toc"><dl><dt><span class="preface"><a
href="Preface.html">Preface</a></span></dt><dd><dl><dt><span
class="section"><a href="Preface.html#audience">1. Audience
and Purpose</a></span></dt><dt><span
class="section"><a href="Document_Conventions.html">2.
Examples and
Formatting</a></span></dt><dd><dl><dt><span
class="section"><a
href="Document_Conventions.html#bracketsexamples">2.1.
Brackets</a></span></dt><dt><span
class="section"><a
href="Document_Conventions.html#tool-locations">2.2. Client Tool
Information</a></span></dt><dt><span
class="section"><a
href="Document_Conventions.html#guide-formatting">2.3. Text Formatting and
Styles</a></span></dt></dl></dd><dt><span
class="section"><a href="feedback.html">3. Giving
Feedback</a></span></dt><dt><span
class="section"><a href="doc-history.html">4. Document Change
History</a></span></dt></dl></dd><dt><span
class="chapter"><a href="installing-ipa.html">1. Installing a
FreeIPA Server<
/a></span></dt><dd><dl><dt><span
class="section"><a
href="installing-ipa.html#Preparing_for_an_IPA_Installation">1.1. Preparing
to Install the FreeIPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#prerequisites">1.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="Installing_the_IPA_Server_Packages.html">1.2. Installing the FreeIPA
Server Packages</a></span></dt><dt><span
class="section"><a href="creating-server.html">1.3. Creating
a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a href=
"creating-server.html#install-command">1.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-interactive">1.3.2. Setting up a FreeIPA
Server: Basic Interactive Installation</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-examples">1.3.3. Examples of Creating the
FreeIPA Server</a></span></dt><dt><span
class="section"><a
href="creating-server.html#troubleshooting-install">1.3.4. Troubleshooting
Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html">1.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#installing-replica">1.4.1.
Prepping and Installing the Replica
Server</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.ht
ml#creating-the-replica">1.4.2. Creating the
Replica</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#troubleshooting-replica-install">1.4.3.
Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="Uninstalling_IPA_Servers.html">1.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></dd><dt><span
class="chapter"><a href="setting-up-clients.html">2. Setting
up Systems as FreeIPA
Clients</a></span></dt><dd><dl><dt><span
class="section"><a
href="setting-up-clients.html#fedora-client-setup">2.1. Setting up a Fedora
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="setting-up-clients.html#fedora-pkgs">2.1.1. Installing the Client
Configuration Packages and Setup
Script</a></span></dt><dt><span
class="section"><a
href="setting-up-clients.html#Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2
. Configuring Kerberos</a></span></dt><dt><span
class="section"><a
href="setting-up-clients.html#fedora-Configuring_NFS_v4_with_Kerberos">2.1.3.
Configuring NFS v4 with
Kerberos</a></span></dt></dl></dd><dt><span
class="section"><a href="Using_Microsoft_Windows.html">2.2.
Configuring a Microsoft Windows System as a FreeIPA
Client</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html">2.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10">2.3.1.
Configuring Solaris 10</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html">2.4
. Configuring an HP-UX System as a
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">2.4.1.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2.
Configuring Kerberos and PAM</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3.
Configuring SSH</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5.
Testing the Configuration</a></span></d
t></dl></dd><dt><span class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html">2.5. Configuring an AIX System
as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2.
Configuring Client Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3.
Configuring Client SSH Access</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Testing_System_Login">2.5.4.
Testing System
Login</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html">2.6. Configuring a M
acintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a href="Configuring_an_IPA_Client_on_Macin
tosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH">2.6.5.
Accessing the FreeIPA Server Using SSH</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Macintosh_OS_X-Configuring_System_Login">2.6.6.
Configuring System
Login</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="basic-usage.html">3. Basic
Usage</a></span></dt><dd><dl><dt><span
class="section"><a href="basic-usage.html#using-the-ui">3.1.
Using the IPA UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="basic-usage.html#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">3.1.1.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="basic-usage.html#sect-Enterprise_Identity_Management_Guide-Configuring_a_Browser_to_Work_with_IPA-Enabling_UsernamePassword_Authentication_in_Your_Browser">3.1.2.
Enabling Username
/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="logging-in.html">3.2. Logging into
the IPA UI</a></span></dt><dt><span
class="section"><a href="switching-users.html">3.3. Switching
Users</a></span></dt></dl></dd><dt><span
class="chapter"><a href="managing-clients.html">4. Managing
Clients in the FreeIPA
Domain</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2.
Removing Hosts from a FreeIPA DNS</a></span></dt><dt><span
class=
"section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones">4.1.3.
Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="enrolling-machines.html">4.2.
Enrolling Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1.
Manual Host Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="sec
tion"><a href="renaming-machines.html">4.3. Renaming
Machines</a></span></dt><dt><span
class="section"><a href="config-virt-machines.html">4.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="certs.html">4.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dd><dl><dt><span
class="section"><a
href="certs.html#sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1.
Authentication Usage
Scenarios</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html">4.6.
Client Problems</a></span></dt><dt><span
class="section"><a href="uninstalling-clients.html">4.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></dd><dt><span
class="chapter"><a href="users.html">5. Identity: Managing
Users and User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a href="users.html#home-di
rectories">5.1. Managing User Home
Directories</a></span></dt><dt><span
class="section"><a href="adding-users.html">5.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="editing-users.html">5.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html">5.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html#sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">5.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html">5.5.
Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a href="sect-Enterprise
_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html#sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="user-groups.html">5.6. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1.
Creating FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2.
Editing FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3.
Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="user-pwdpolicy.html">5.7. Setting an
Individual Password Policy</a></span></dt>
<dd><dl><dt><span class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4.
Editing the Password Policy</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guid
e-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">5.7.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9.
Using Local Logins</a></span
</dt></dl></dd><dt><span
class="section"><a href="searching.html">5.8. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="searching.html#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="searching.html#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2.
Searching for
Groups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="kerberos.html">6. Identity: Using
FreeIPA for a Kerberos
Domain</a></span></dt><dd><dl><dt><span
class="section"><a href="kerberos.html#about-kerberos">6.1.
About Kerberos</a></span></dt><dt><span
class="section"><a href="kerb-policies.html">6.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Prin
cipals.html">6.3. Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">6.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html">6.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section
"><a href="rotating-keys.html">6.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html">6.6.
Kerberos Errors</a></span></dt></dl></dd><dt><span
class="chapter"><a href="automount.html">7. Identity: Using
Automount</a></span></dt><dd><dl><dt><span
class="section"><a href="automount.html#about-automount">7.1.
About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">7.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">7.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-automount.html">7.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a href="configuring-auto
mount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">7.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">7.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">7.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">7.2.4.
Links</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="active-directory.html">8. Identity:
Integrating with Microsoft Active
Directory</a></span></dt><dd><dl><dt><span
class="section"><a
href="active-directory.html#about-active-directory">8.1. About Active
Directory, IPA, and Identity Ma
nagement</a></span></dt><dd><dl><dt><span
class="section"><a
href="active-directory.html#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">8.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html">8.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a
href="configuring-active-directory.html">8.3. Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">8.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html">8.5.
Modifying Synchronization Agr
eements</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html">8.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html">8.7.
Winsync Agreement
Failures</a></span></dt></dl></dd><dt><span
class="chapter"><a href="nis.html">9. Identity: Integrating
with NIS Domains and
Netgroups</a></span></dt><dd><dl><dt><span
class="sectio
n"><a href="nis.html#about-nis">9.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="nis.html#adding-netgroups">9.1.3.
Adding Netgroups</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html">9.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a href="sect-Enterprise_Id
entity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="migrintg-from-nis.html">9.3.
Migrating from NIS to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="authz.html">10. Policy: Configuring
Authorization</a></span></dt><dd><dl><dt><span
class="section"><a
href="authz.html#configuring-host-access">10.1.
Configuring Host-Based Access
Control</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html">10.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html">10.3.
HBAC Services</a></span></dt></dl></dd><dt><span
class="chapter"><a href="sudo.html">11. Policy: Using
sudo</a></span></dt><dd><dl><dt><span
class="section"><a href="sudo.html#about-sudo">11.1. About
sudo and IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span clas
s="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">11.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">11.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-sudo.html">11.2.
Configuring sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></dd><
dt><span class="chapter"><a
href="server-config.html">12. Configuring the IPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#managing-access-to-ipa">12.1. Defining Access
Controls within
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1.
Server-side Access
Control</a></span></dt></dl></dd><dt><span
class="section"><a href="creating-roles.html">12.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="self-service.html">12.3. Defining
Self-Service Settings</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html">12.4.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="search-limits.html">12.5. Setting
Default Search Limits</a></span></dt><dt><span
class="section"><a href="disabling-anon-binds.ht
ml">12.6. Disabling Anonymous
Binds</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html">12.7.
Implementing Unique UID and GID
Attributes</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html#sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1.
Assigning UIDs and
GIDs</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html">12.8.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_an
d_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1. Installing
Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#Using_OCSP">12.8.3.
Using OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-apache.html">12.9. Setting an
IPA Server as an Apache Virtual Host</a></span></dt><dt><span
class="section"><a href="ipa-cluster.html">12.10. Using IPA
in a Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-cluster.html#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Cluster
ed_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="ipa-cluster.html#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html">12.11.
Creating DNS Entries for FreeIPA
Replicas</a></span></dt><dt><span
class="section"><a href="promoting-replica.html">12.12.
Promoting a Read-Only Replica to an IPA
Server</a></span></dt><dt><span
class="section"><a href="logging.html">12.13. IPA Server
Logging</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html">A.
Frequently Asked Questions</a></span></dt><dt><span
class="appendix"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html">B.
Services: Working with
certmonger</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">B.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html">B.2.
Using certmonger</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html">B.3.
Using certmonger with NSS</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html">B.4.
Using certmonger with
IPA</a></span></dt></dl></dd><dt><span
class="a
ppendix"><a
href="Migrating_from_a_Directory_Server_to_IPA.html">C. Migrating from a
Directory Server to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">C.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">C.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">C.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">C.1.3.
Possible Scenarios</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterpr
ise_Identity_Management_Guide-Overview-Initial_and_Final_States">C.1.4. Initial
and Final States</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">C.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">C.1.6.
Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html">C.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_
Migration-Phase_1_Migrating_Existing_Data_to_IPA">C.2.1. Phase 1: Migrating
Existing Data to IPA</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">C.2.2.
Phase 2: Updating the Client
Configuration</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">C.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Managem
ent_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">C.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">C.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html">C.3.
Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">C.3.1.
Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">C.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">C.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">C
.3.4. Phase 4: Reconfigure non-SSSD
Clients</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">C.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></dd><dt><span
class="glossary"><a
href="Glossary.html">Glossary</a></span></dt><dt><span
class="index"><a
href="ix01.html">Index</a></span></dt></dl></div></div><ul
class="docnav"><li class="previous"></li><li
class="next"><a accesskey="n"
href="Preface.html"><strong>Next</strong>Preface</a></li></ul></body></html>
+ </div></div></div></div><hr /></div><div
class="toc"><dl><dt><span class="preface"><a
href="Preface.html">Preface</a></span></dt><dd><dl><dt><span
class="section"><a href="Preface.html#audience">1. Audience
and Purpose</a></span></dt><dt><span
class="section"><a href="Document_Conventions.html">2.
Examples and
Formatting</a></span></dt><dd><dl><dt><span
class="section"><a
href="Document_Conventions.html#bracketsexamples">2.1.
Brackets</a></span></dt><dt><span
class="section"><a
href="Document_Conventions.html#tool-locations">2.2. Client Tool
Information</a></span></dt><dt><span
class="section"><a
href="Document_Conventions.html#guide-formatting">2.3. Text Formatting and
Styles</a></span></dt></dl></dd><dt><span
class="section"><a href="feedback.html">3. Giving
Feedback</a></span></dt><dt><span
class="section"><a href="doc-history.html">4. Document Change
History</a></span></dt></dl></dd><dt><span
class="chapter"><a href="introduction.html">1. Introduction
to FreeIPA</a></s
pan></dt><dd><dl><dt><span
class="section"><a href="introduction.html#ipa-v-ldap">1.1.
FreeIPA v. LDAP: A More Focused Type of
Service</a></span></dt><dt><span
class="section"><a href="ipa-domains.html">1.2. About FreeIPA
Domains</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-domains.html#The_IPA_Core">1.2.1. The FreeIPA
Server</a></span></dt><dt><span
class="section"><a
href="ipa-domains.html#IPA_Managed_Hosts">1.2.2. FreeIPA Managed
Hosts</a></span></dt><dt><span
class="section"><a
href="ipa-domains.html#external-work">1.2.3. Integration with Non-Fedora
Services</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-components.html">1.3. Identity
Management: Authentication</a></span></dt><dt><span
class="section"><a href="policy.html">1.4. Defining Policies:
Authorization</a></span></dt></dl></dd><dt><span
class="chapter"><a href="installing-ipa.html">2. Installing a
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a href="installing
-ipa.html#Preparing_for_an_IPA_Installation">2.1. Preparing to Install the
FreeIPA Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#prerequisites">2.1.3. System
Prerequisites</a></span></dt></dl></dd><dt><span
class="section"><a
href="Installing_the_IPA_Server_Packages.html">2.2. Installing the FreeIPA
Server Packages</a></span></dt><dt><span
class="section"><a href="creating-server.html">2.3. Creating
a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a
href="creating-server.html#install-command">2.3.1. About ipa-server-insta
ll</a></span></dt><dt><span class="section"><a
href="creating-server.html#install-interactive">2.3.2. Setting up a FreeIPA
Server: Basic Interactive Installation</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-examples">2.3.3. Examples of Creating the
FreeIPA Server</a></span></dt><dt><span
class="section"><a
href="creating-server.html#troubleshooting-install">2.3.4. Troubleshooting
Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html">2.4.
Setting up FreeIPA
Replicas</a></span></dt><dd><dl><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#installing-replica">2.4.1.
Prepping and Installing the Replica
Server</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#creating-the-replica">2.4.2.
Creating the Replica</a></span></dt>
<dt><span class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#troubleshooting-replica-install">2.4.3.
Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="Uninstalling_IPA_Servers.html">2.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></dd><dt><span
class="chapter"><a href="setting-up-clients.html">3. Setting
up Systems as FreeIPA
Clients</a></span></dt><dd><dl><dt><span
class="section"><a
href="setting-up-clients.html#what-happens-clients">3.1. What Happens in
Client Setup</a></span></dt><dt><span
class="section"><a
href="Configuring_Microsoft_Windows.html">3.2. Configuring a Microsoft
Windows System as a FreeIPA Client</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html">3.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configu
ring_an_IPA_Client_on_Solaris_10">3.3.1. Configuring Solaris
10</a></span></dt><dt><span class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html">3.4. Configuring an HP-UX
System as a
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3.
Configuring Kerberos</a></span></dt><dt><span
class="section">
<a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_Kerberos_and_PAM-Configuring_PAM">3.4.4.
Configuring PAM</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5.
Configuring SSH</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#hp-test">3.4.7. Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html">3.5. Configuring an AIX System
as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a href="Configuring_an_IPA_Cli
ent_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">3.5.2.
Configuring the AIX
Client</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html">3.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3.
Configuring the LDAP Authorization Options</a></span></dt><dt>
<span class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#testing-config-on-mac">3.6.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="uninstalling-clients.html">3.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></dd><dt><span
class="chapter"><a href="basic-usage.html">4. Basic UI
Usage</a></span></dt><dd><dl><dt><span
class="section"><a href="basic-usage.html#ipa-ui">4.1.
Looking at the FreeIPA UI</a></span></dt><dt><span
class="section"><a href="using-the-ui.html">4.2. Using the
FreeIPA UI</a></span></dt><dd><dl><dt><span
class="section"><a
href="using-the-ui.html#config-browser">4.2.1. Configuring the
Browser</a></span></dt><dt><span
class="section"><a href="using-the-ui.html#logging-in">4.2.2.
Logging into the FreeIPA UI</a></
span></dt><dt><span class="section"><a
href="using-the-ui.html#Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3.
Using a Browser on Another System</a></span></dt><dt><span
class="section"><a
href="using-the-ui.html#Enabling_UsernamePassword_Authentication_in_Your_Browser">4.2.4.
Enabling Username/Password Authentication in Your
Browser</a></span></dt></dl></dd><dt><span
class="section"><a href="switching-users.html">4.3. Switching
Users</a></span></dt></dl></dd><dt><span
class="chapter"><a href="managing-clients.html">5. Managing
Clients in the FreeIPA
Domain</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#IPA_Command_Line_Tools-Working_with_DNS">5.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a href="managing-clients.html#Working_with_DN
S-Removing_Hosts_from_an_IPA_DNS">5.1.2. Removing Hosts from a FreeIPA
DNS</a></span></dt><dt><span class="section"><a
href="managing-clients.html#Working_with_DNS-Managing_DNS_Zones">5.1.3.
Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="enrolling-machines.html">5.2.
Enrolling Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1.
Manual Host Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="renaming-machines.html">5.3.
Renaming Machines<
/a></span></dt><dt><span class="section"><a
href="config-virt-machines.html">5.4. Reconfiguring Virtual
Machines</a></span></dt><dt><span
class="section"><a href="certs.html">5.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dt><span
class="section"><a
href="General_Troubleshooting_Tips-Client_Problems.html">5.6. Client
Problems</a></span></dt></dl></dd><dt><span
class="chapter"><a href="users.html">6. Identity: Managing
Users and User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a href="users.html#home-directories">6.1.
Managing User Home Directories</a></span></dt><dt><span
class="section"><a href="adding-users.html">6.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="editing-users.html">6.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html">6.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html#Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html">6.5.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="search-limits.html">6.6. Setting
Default Search Limits</a></span></dt><dt><span
class="section"><a
href="Configuring_IPA_Users-Deleting_IPA_Users.html">6.7. Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_IPA_Users-Deleting_IPA_Users.html#Deleting_IPA_Users-Using_the_Command_Line">6.7.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="user-groups.html">6.8. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-groups.html#Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1.
Creating FreeIPA Group
s</a></span></dt><dt><span class="section"><a
href="user-groups.html#Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2.
Editing FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3.
Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="user-pwdpolicy.html">6.9. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3.
Changing Passwords as a Regular User</a></span></d
t><dt><span class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4.
Editing the Password Policy</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Using_Loca
l_Logins">6.9.9. Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="searching.html">6.10. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="searching.html#Searching_for_Users_and_Groups-Searching_for_Users">6.10.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="searching.html#Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2.
Searching for
Groups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="kerberos.html">7. Identity: Using
FreeIPA for a Kerberos
Domain</a></span></dt><dd><dl><dt><span
class="section"><a href="kerberos.html#about-kerberos">7.1.
About Kerberos</a></span></dt><dt><span
class="section"><a href="kerb-policies.html">7.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html">7.3.
Creating and Using
Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">7.3.1.
Creating a FreeIPA Service</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html">7.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="rotating-keys.html">7.5.
Rotating Keys</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html">7.6.
Kerberos Errors</a></span></dt></dl></dd><dt><span
class="chapter"><a href="automount.html">8. Identity: Using
Automount</a></span></dt><dd><dl><dt><span
class="section"><a href="automount.html#about-automount">8.1.
About Automount and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Known_Issues_with_Automount">8.1.1.
Known Issues with Automount</a></span></dt><dt><span
class="section"><a
href="automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Assumptions">8.1.2.
Assumptions</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-automount.html">8.2.
Configuring
Automount</a></span></dt><dd><dl><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_
Management_Guide-Configuring_Automount-Configuring_autofs_on_Linux">8.2.1.
Configuring autofs on Linux</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Solaris_automount">8.2.2.
Solaris automount</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Configuring_Indirect_Maps">8.2.3.
Configuring Indirect Maps</a></span></dt><dt><span
class="section"><a
href="configuring-automount.html#sect-Enterprise_Identity_Management_Guide-Configuring_Automount-Links">8.2.4.
Links</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="active-directory.html">9. Identity:
Integrating with Microsoft Active
Directory</a></span></dt><dd><dl><dt><span
class="section"><a
href="active-directory.html#about-active-directory">9.1. About Active
Directory, IPA, and Identity
Management</a></span></dt><dd><dl><dt>
<span class="section"><a
href="active-directory.html#sect-Enterprise_Identity_Management_Guide-Prerequisites-Domain_Name_Considerations">9.1.1.
Domain Name
Considerations</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html">9.2.
Setting up Active Directory</a></span></dt><dt><span
class="section"><a
href="configuring-active-directory.html">9.3. Configuring Active Directory
Synchronization</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">9.4.
Creating Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html">9.5.
Modifying Synchronization
Agreements</a></span></dt><dd><dl><dt><
span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html#sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1.
Changing the Default Synchronization
Subtree</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html">9.6.
Deleting Synchronization Agreements</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html">9.7.
Winsync Agreement
Failures</a></span></dt></dl></dd><dt><span
class="chapter"><a href="nis.html">10. Identity: Integrating
with NIS Domains and
Netgroups</a></span></dt><dd><dl><dt><span
class="section"><a href="nis.html#about-nis">10.
1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2.
The IPA Approach to Netgroups</a></span></dt><dt><span
class="section"><a href="nis.html#adding-netgroups">10.1.3.
Adding Netgroups</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html">10.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Confi
guring_the_Network_Information_Service_NIS.html#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="migrintg-from-nis.html">10.3.
Migrating from NIS to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter"><a href="authz.html">11. Policy: Configuring
Authorization</a></span></dt><dd><dl><dt><span
class="section"><a
href="authz.html#configuring-host-access">11.1. Configuring Host-Based A
ccess Control</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html">11.2.
HBAC Service Groups</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html">11.3.
HBAC Services</a></span></dt></dl></dd><dt><span
class="chapter"><a href="sudo.html">12. Policy: Using
sudo</a></span></dt><dd><dl><dt><span
class="section"><a href="sudo.html#about-sudo">12.1. About
sudo and IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">12.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a href="sudo
.html#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">12.1.3.
Benefits of the IPA Alternative Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">12.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-sudo.html">12.2.
Configuring sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></dd><dt><span
class="chapter">
<a href="server-config.html">13. Configuring the FreeIPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#managing-access-to-ipa">13.1. Defining Access
Controls within
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#Server_side_Access_Control">13.1.1. Server-side
Access Control</a></span></dt><dt><span
class="section"><a
href="server-config.html#creating-roles">13.1.2. Creating
Roles</a></span></dt><dt><span
class="section"><a
href="server-config.html#self-service">13.1.3. Defining Self-Service
Settings</a></span></dt></dl></dd><dt><span
class="section"><a href="disabling-anon-binds.html">13.2.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a
href="Managing-Unique_UID_and_GID_Attributes.html">13.3. Managing Unique UID
and GID Number
Assignments</a></span></dt><dd><dl><dt><span
class="section"><a
href="Managing-Unique_UID_and_GID_Attributes.html#id-ranges-at-install">13.3.1.
About ID
Range Assignments During Installation</a></span></dt><dt><span
class="section"><a
href="Managing-Unique_UID_and_GID_Attributes.html#Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2.
Adding New
Ranges</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html">13.4.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">13.4.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Using_OCSP
">13.4.3. Using
OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-apache.html">13.5. Setting a
FreeIPA Server as an Apache Virtual
Host</a></span></dt><dt><span
class="section"><a href="ipa-cluster.html">13.6. Using
FreeIPA in a
Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-cluster.html#Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="ipa-cluster.html#Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html">13.7.
Creating DNS Entries for FreeIPA
Replicas</a></span></dt><dt><span
class="section"><a href="promoting-replica.html">13.8. Prom
oting a Read-Only Replica to a FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="logging.html">13.9. FreeIPA Server
Logging</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html">A.
Frequently Asked Questions</a></span></dt><dt><span
class="appendix"><a href="tools-reference.html">B. FreeIPA
Tools Reference</a></span></dt><dd><dl><dt><span
class="section"><a href="tools-reference.html#ipa">B.1.
ipa</a></span></dt><dd><dl><dt><span
class="section"><a
href="tools-reference.html#ipa-location">B.1.1.
Location</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-syntax">B.1.2.
Syntax</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-commands">B.1.3.
Commands</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-options">B.1.4.
Options</a></span></dt><dt><span
class="section"><a href="tools-reference.html#ipa-command-au
tomount">B.1.5. ipa
automountlocation*</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-command-automountmap">B.1.6. ipa
automountmap*</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-command-automountkey">B.1.7. ipa
automountkey*</a></span></dt></dl></dd><dt><span
class="section"><a href="server-tools.html">B.2. Server
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-tools.html#ipa-compat-manage">B.2.1.
ipa-compat-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-compliance">B.2.2.
ipa-compliance</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-dns-install">B.2.3.
ipa-dns-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-host-net-manage">B.2.4.
ipa-host-net-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa_kpasswd">B.2.5.
ipa_kpasswd</a></span></dt><dt><span
class="section"><a href="server-
tools.html#ipa-ldap-updater">B.2.6.
ipa-ldap-updater</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-nis-manage">B.2.7.
ipa-nis-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-install">B.2.8.
ipa-replica-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-manage">B.2.9.
ipa-replica-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-prepare">B.2.10.
ipa-replica-prepare</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-server-certinstall">B.2.11.
ipa-server-certinstall</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-server-install">B.2.12.
ipa-server-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-ugradeconfig">B.2.13.
ipa-upgradeconfig</a></span></dt><dt><span
class="section"><a href="server-tools.html#ipactl">B.2.14.
ipactl</a></span></dt></dl></dd><dt><span
class="
section"><a href="client-tools.html">B.3. Client
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a
href="client-tools.html#ipa-client-install">B.3.1.
ipa-client-install</a></span></dt><dt><span
class="section"><a
href="client-tools.html#ipa-getkeytab">B.3.2.
ipa-getkeytab</a></span></dt><dt><span
class="section"><a href="client-tools.html#ipa-join">B.3.3.
ipa-join</a></span></dt><dt><span
class="section"><a
href="client-tools.html#ipa-rmkeytab">B.3.4.
ipa-rmkeytab</a></span></dt></dl></dd><dt><span
class="section"><a href="certmonger-tools.html">B.4.
Certmonger Scripts</a></span></dt><dd><dl><dt><span
class="section"><a
href="certmonger-tools.html#getcert">B.4.1.
getcert</a></span></dt><dt><span
class="section"><a
href="certmonger-tools.html#ipa-getcert">B.4.2.
ipa-getcert</a></span></dt></dl></dd></dl></dd><dt><span
class="appendix"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html">C.
Services: Working with certmonger</a></span></dt>
<dd><dl><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html">C.2.
Using certmonger</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html">C.3.
Using certmonger with NSS</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html">C.4.
Using certmonger with
IPA</a></span></dt></dl></dd><dt><span
class="appendix"><a
href="Migrating_from_a_Directory_Server_to_IPA.html">D. Migrating from a
Directory Server to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a href="Migrating_from_a_Directory_Server_t
o_IPA.html#sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Overview">D.1.
Overview</a></span></dt><dd><dl><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Assumptions">D.1.1.
Assumptions</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Known_Issues">D.1.2.
Known Issues</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Possible_Scenarios">D.1.3.
Possible Scenarios</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Initial_and_Final_States">D.1.4.
Initial and Final States</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Ente
rprise_Identity_Management_Guide-Overview-Recommended_Sequence_of_Steps">D.1.5.
Recommended Sequence of Steps</a></span></dt><dt><span
class="section"><a
href="Migrating_from_a_Directory_Server_to_IPA.html#sect-Enterprise_Identity_Management_Guide-Overview-Implementation_Details">D.1.6.
Implementation
Details</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html">D.2.
Performing a Server-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1.
Phase 1: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_fro
m_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2.
Phase 2: Updating the Client
Configuration</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3.
Phase 3: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4.
Phase 4: Migrating Users</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrati
ng_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5.
Phase 5: Decommission the
DS</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html">D.3.
Performing a Client-based
Migration</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD">D.3.1.
Phase 1: Installing and Configuring
SSSD</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identi
ty_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2.
Phase 2: Migrating Existing Data to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3.
Phase 3: Migrate SSSD Clients from LDAP to
IPA</a></span></dt><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4.
Phase 4: Reconfigure non-SSSD Clients</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based
_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5.
Phase 5: Decommission the Directory
Server</a></span></dt></dl></dd></dl></dd><dt><span
class="glossary"><a
href="Glossary.html">Glossary</a></span></dt><dt><span
class="index"><a
href="ix01.html">Index</a></span></dt></dl></div></div><ul
class="docnav"><li class="previous"></li><li
class="next"><a accesskey="n"
href="Preface.html"><strong>Next</strong>Preface</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html
index f4cf3ca..1d316b0 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/installing-ipa.html
@@ -1,25 +1,25 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 1. Installing a FreeIPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 2. Installing a FreeIPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="doc-history.html"
title="4. Document Change History" /><link rel="next"
href="Installing_the_IPA_Server_Packages.html" title="1.2. Installing the
FreeIPA Server Packages" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="doc-history.html"><strong>Prev</strong></a></li><li
c
lass="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="installing-ipa"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 1. Installing a FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="installing-ipa.html#Preparing_for_an_IPA_Installation">1.1. Preparing
to Install the FreeIPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#prerequisites">1.1.3. System
Prerequisites</a></span></dt></dl>
</dd><dt><span class="section"><a
href="Installing_the_IPA_Server_Packages.html">1.2. Installing the FreeIPA
Server Packages</a></span></dt><dt><span
class="section"><a href="creating-server.html">1.3. Creating
a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a
href="creating-server.html#install-command">1.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-interactive">1.3.2. Setting up a FreeIPA
Server: Basic Interactive Installation</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-examples">1.3.3. Examples of Creating the
FreeIPA Server</a></span></dt><dt><span
class="section"><a
href="creating-server.html#troubleshooting-install">1.3.4. Troubleshooting
Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html">1.4.
Setting up FreeIPA Replicas</a></span></dt><dd><dl>
<dt><span class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#installing-replica">1.4.1.
Prepping and Installing the Replica
Server</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#creating-the-replica">1.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#troubleshooting-replica-install">1.4.3.
Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="Uninstalling_IPA_Servers.html">1.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="policy.html" title="1.4. Defining
Policies: Authorization" /><link rel="next"
href="Installing_the_IPA_Server_Packages.html" title="2.2. Installing the
FreeIPA Server Packages" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="policy.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="installing-ipa"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 2. Installing a FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="installing-ipa.html#Preparing_for_an_IPA_Installation">2.1. Preparing
to Install the FreeIPA
Server</a></span></dt><dd><dl><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.1.1.
Hardware Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2.
Software Requirements</a></span></dt><dt><span
class="section"><a
href="installing-ipa.html#prerequisites">2.1.3. System
Prerequisites</a></span></dt></dl
</dd><dt><span class="section"><a
href="Installing_the_IPA_Server_Packages.html">2.2. Installing the FreeIPA
Server Packages</a></span></dt><dt><span
class="section"><a href="creating-server.html">2.3. Creating
a FreeIPA Server
Instance</a></span></dt><dd><dl><dt><span
class="section"><a
href="creating-server.html#install-command">2.3.1. About
ipa-server-install</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-interactive">2.3.2. Setting up a FreeIPA
Server: Basic Interactive Installation</a></span></dt><dt><span
class="section"><a
href="creating-server.html#install-examples">2.3.3. Examples of Creating the
FreeIPA Server</a></span></dt><dt><span
class="section"><a
href="creating-server.html#troubleshooting-install">2.3.4. Troubleshooting
Installation
Problems</a></span></dt></dl></dd><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html">2.4.
Setting up FreeIPA Replicas</a></span></dt><dd><dl
<dt><span class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#installing-replica">2.4.1.
Prepping and Installing the Replica
Server</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#creating-the-replica">2.4.2.
Creating the Replica</a></span></dt><dt><span
class="section"><a
href="chap-Enterprise_Identity_Management_Guide-Setting_up_IPA_Replicas.html#troubleshooting-replica-install">2.4.3.
Troubleshooting Replica
Installation</a></span></dt></dl></dd><dt><span
class="section"><a href="Uninstalling_IPA_Servers.html">2.5.
Uninstalling FreeIPA Servers and
Replicas</a></span></dt></dl></div><div
class="para">
The FreeIPA domain is defined and managed by a FreeIPA
<span class="emphasis"><em>server</em></span> which is
essentially a domain controller. There can be multiple domain controllers within a domain
for load-balancing and failover tolerance. These additional servers are called <span
class="emphasis"><em>replicas</em></span> of the master
FreeIPA server.
</div><div class="para">
Both FreeIPA servers and replicas only run on Fedora systems. For both servers and
replicas, the necessary packages must be installed and then the FreeIPA server or replica
itself is configured through setup scripts, which configure all of the requisite
services.
- </div><div class="section"
id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">1.1. Preparing to Install the FreeIPA
Server</h2></div></div></div><div class="para">
+ </div><div class="section"
id="Preparing_for_an_IPA_Installation"><div
class="titlepage"><div><div><h2 class="title"
id="Preparing_for_an_IPA_Installation">2.1. Preparing to Install the FreeIPA
Server</h2></div></div></div><div class="para">
Before you install FreeIPA, ensure that the installation environment is suitably
configured. You also need to provide certain information during the installation and
configuration procedures, including realm names and certain usernames and passwords. This
section describes the information that you need to provide.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">1.1.1. Hardware
Requirements</h3></div></div></div><div
class="para">
- A basic user entry is about 1 KB in size, as is a simple host entry with a
certificate. The structure of the directory tree and the number of indexes in the
Directory Server instance can impact the hardware required for the best performance. <a
class="xref"
href="installing-ipa.html#tab.Minimum_hardware_requirements_for_IPA">Table 1.1,
“Minimum Hardware Requirements”</a> lists the recommended minimums. For customized
systems, additional indexes, or larger user entries, it is more effective to increase the
RAM than to increase the disk space because the Directory Server stores much of its data
in cache. Add info for disk layout/size recommendations, from
https://www.redhat.com/archives/freeipa-users/2011-May/msg00012.html
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Hardware_Requirements">2.1.1. Hardware
Requirements</h3></div></div></div><div
class="para">
+ A basic user entry is about 1 KB in size, as is a simple host entry with a
certificate. The structure of the directory tree and the number of indexes in the
Directory Server instance can impact the hardware required for the best performance. <a
class="xref"
href="installing-ipa.html#tab.Minimum_hardware_requirements_for_IPA">Table 2.1,
“Minimum Hardware Requirements”</a> lists the recommended minimums. For customized
systems, additional indexes, or larger user entries, it is more effective to increase the
RAM than to increase the disk space because the Directory Server stores much of its data
in cache. Add info for disk layout/size recommendations, from
https://www.redhat.com/archives/freeipa-users/2011-May/msg00012.html
</div><div class="note"><div
class="admonition_header"><h2>TIP</h2></div><div
class="admonition"><div class="para">
The Directory Server instance used by the FreeIPA server can be tuned to increase
performance. For tuning information, see the Directory Server documentation at <a
href="http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2...;.
</div></div></div><div class="para">
The system requirements for both 32-bit and 64-bit platforms are the same.
- </div><div class="table"
id="tab.Minimum_hardware_requirements_for_IPA"><h6>Table 1.1. Minimum
Hardware Requirements</h6><div class="table-contents"><table
summary="Minimum Hardware Requirements"
border="1"><colgroup><col width="25%"
align="center" /><col width="25%" align="center"
/><col width="25%" align="center" /><col
width="25%" align="center"
/></colgroup><thead><tr><th align="center">
+ </div><div class="table"
id="tab.Minimum_hardware_requirements_for_IPA"><h6>Table 2.1. Minimum
Hardware Requirements</h6><div class="table-contents"><table
summary="Minimum Hardware Requirements"
border="1"><colgroup><col width="25%"
align="center" /><col width="25%" align="center"
/><col width="25%" align="center" /><col
width="25%" align="center"
/></colgroup><thead><tr><th align="center">
Minimum Hardware Requirements
</th><th align="center">
10,000 - 250,000 Entries
@@ -47,21 +47,21 @@
4 GB
</td><td align="center">
8 GB
- </td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">1.1.2. Software
Requirements</h3></div></div></div><div
class="para">
+ </td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Software_Requirements">2.1.2. Software
Requirements</h3></div></div></div><div
class="para">
Most of the packages that a FreeIPA server depends on are installed as dependencies
when the FreeIPA packages are installed. There are some packages, however, which are
required before installing the FreeIPA packages:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Kerberos 1.9
</div></li><li class="listitem"><div
class="para">
The <span class="package">named</span> and <span
class="package">bind-dyndb-ldap</span> packages for DNS
- </div></li></ul></div></div><div
class="section" id="prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="prerequisites">1.1.3. System
Prerequisites</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section" id="prerequisites"><div
class="titlepage"><div><div><h3 class="title"
id="prerequisites">2.1.3. System
Prerequisites</h3></div></div></div><div
class="para">
The FreeIPA server is set up using a configuration script, and this script makes
certain assumption about the host system. If the system does not meet these prerequisites,
then server configuration may fail.
- </div><div class="section" id="prereq-ds"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ds">1.1.3.1. Directory
Server</h4></div></div></div><div class="para">
+ </div><div class="section" id="prereq-ds"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ds">2.1.3.1. Directory
Server</h4></div></div></div><div class="para">
There must not be any instances of 389 Directory Server installed on the host
machine.
- </div></div><div class="section"
id="prereq-system"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-system">1.1.3.2. System Files
</h4></div></div></div><div class="para">
+ </div></div><div class="section"
id="prereq-system"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-system">2.1.3.2. System Files
</h4></div></div></div><div class="para">
The server script overwrites system files to set up the FreeIPA domain. The system
should be clean, without custom configuration for services like DNS and Kerberos, before
configuring the FreeIPA server.
- </div></div><div class="section"
id="prereq-ports"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ports">1.1.3.3. System
Ports</h4></div></div></div><div class="para">
- FreeIPA uses a number of ports to communicate with its services. These ports, listed
in <a class="xref"
href="installing-ipa.html#tab.ipa-ports">Table 1.2, “FreeIPA
Ports”</a>, must be open and available for FreeIPA to work. They cannot be in use by
another service or blocked by a firewall. To make sure that these ports are available, try
<code class="command">iptables</code> to list the available ports or
<code class="command">nc</code>, <code
class="command">telnet</code>, or <code
class="command">nmap</code> to connect to a port or run a port scan.
- </div><div class="table"
id="tab.ipa-ports"><h6>Table 1.2. FreeIPA Ports</h6><div
class="table-contents"><table summary="FreeIPA Ports"
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ </div></div><div class="section"
id="prereq-ports"><div
class="titlepage"><div><div><h4 class="title"
id="prereq-ports">2.1.3.3. System
Ports</h4></div></div></div><div class="para">
+ FreeIPA uses a number of ports to communicate with its services. These ports, listed
in <a class="xref"
href="installing-ipa.html#tab.ipa-ports">Table 2.2, “FreeIPA
Ports”</a>, must be open and available for FreeIPA to work. They cannot be in use by
another service or blocked by a firewall. To make sure that these ports are available, try
<code class="command">iptables</code> to list the available ports or
<code class="command">nc</code>, <code
class="command">telnet</code>, or <code
class="command">nmap</code> to connect to a port or run a port scan.
+ </div><div class="table"
id="tab.ipa-ports"><h6>Table 2.2. FreeIPA Ports</h6><div
class="table-contents"><table summary="FreeIPA Ports"
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
Service
</th><th>
Ports
@@ -89,16 +89,16 @@
</td><td>
53
</td></tr><tr><td>
- NTP<sup>[<a id="id3065571" href="#ftn.id3065571"
class="footnote">b</a>]</sup>
+ NTP<sup>[<a id="id3109200" href="#ftn.id3109200"
class="footnote">b</a>]</sup>
</td><td>
123
</td></tr></tbody><tbody
class="footnotes"><tr><td colspan="2"><div
class="footnote" id="ft.udp-tcp"><p><sup>[<a
id="ftn.ft.udp-tcp" href="#ft.udp-tcp"
class="para">a</a>] </sup>
This service uses both TCP adn UDP ports.
- </p></div><div
class="footnote"><p><sup>[<a id="ftn.id3065571"
href="#id3065571" class="para">b</a>] </sup>
+ </p></div><div
class="footnote"><p><sup>[<a id="ftn.id3109200"
href="#id3109200" class="para">b</a>] </sup>
This service uses UDP ports only.
- </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS">1.1.3.4. DNS</h4></div></div></div><div
class="para">
+ </p></div></td></tr></tbody></table></div></div><br
class="table-break" /></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-DNS">2.1.3.4. DNS</h4></div></div></div><div
class="para">
FreeIPA uses DNS for the FreeIPA clients to find (<span
class="emphasis"><em>discover</em></span>) the FreeIPA
servers. The DNS service can be managed by FreeIPA itself, or FreeIPA can use an existing
DNS server. Without a properly configured and working DNS, server discovery for clients
and FreeIPA services like, LDAP, Kerberos, and SSL may fail to work.
- </div><div class="section"
id="dns-requirements"><div
class="titlepage"><div><div><h5 class="title"
id="dns-requirements">1.1.3.4.1. DNS
Requirements</h5></div></div></div><div
class="para">
+ </div><div class="section"
id="dns-requirements"><div
class="titlepage"><div><div><h5 class="title"
id="dns-requirements">2.1.3.4.1. DNS
Requirements</h5></div></div></div><div
class="para">
Regardless of whether the DNS is within the FreeIPA server or external, the server
host must have DNS properly configured:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The server's machine name must be set and resolve to its public IP address.
The fully-qualified domain name cannot resolve to the loopback address. It must resolve to
the machine's public IP address, not to <code
class="systemitem">127.0.0.1</code>. The output of the <code
class="command">hostname</code> command cannot be <code
class="systemitem">localhost</code> or <code
class="systemitem">localhost6</code>.
@@ -110,12 +110,12 @@
The DNS must be correctly configured to resolve forward and reverse addresses.
The DNS does not need to be on the same machine as the FreeIPA server, but it does need to
be fully functional.
</div><div class="para">
If you do not have a functional DNS, you can use the <code
class="option">--setup-dns</code> option when you install FreeIPA to
automatically configure a suitable DNS.
- </div></li></ul></div></div><div
class="section" id="dns-file"><div
class="titlepage"><div><div><h5 class="title"
id="dns-file">1.1.3.4.2. FreeIPA-Generated DNS
File</h5></div></div></div><div class="para">
+ </div></li></ul></div></div><div
class="section" id="dns-file"><div
class="titlepage"><div><div><h5 class="title"
id="dns-file">2.1.3.4.2. FreeIPA-Generated DNS
File</h5></div></div></div><div class="para">
To help create and configure a suitable DNS setup, the FreeIPA installation script
creates a sample zone file. During the installation, FreeIPA displays a message similar to
the following:
</div><pre class="screen">Sample zone file for bind has been
created in /tmp/sample.zone.F_uMf4.db
</pre><div class="para">
You should use this file in your DNS zone file.
- </div></div><div class="section"
id="DNS-IPA_DNS_and_NSCD"><div
class="titlepage"><div><div><h5 class="title"
id="DNS-IPA_DNS_and_NSCD">1.1.3.4.3. IPA, DNS, and
NSCD</h5></div></div></div><div class="para">
+ </div></div><div class="section"
id="DNS-IPA_DNS_and_NSCD"><div
class="titlepage"><div><div><h5 class="title"
id="DNS-IPA_DNS_and_NSCD">2.1.3.4.3. IPA, DNS, and
NSCD</h5></div></div></div><div class="para">
<span class="emphasis"><em>It is strongly
recommended</em></span> that you avoid or restrict the use of <code
class="systemitem">nscd</code> (Name Service Caching Daemon) in a
FreeIPA deployment. The <code class="systemitem">nscd</code> service
is extremely useful for reducing the load on the server, and for making clients more
responsive, but drawbacks also exist. This is especially true in deployments that take
advantage of SSSD, which performs its own caching.
</div><div class="para">
<code class="systemitem">nscd</code> performs caching
operations for all services that perform queries via the nsswitch interface, including
<code class="command">getent</code>. Because <code
class="systemitem">nscd</code> performs both positive and negative
caching, if a request determines that a specific FreeIPA user does not exist, it marks
this as a negative cache. Values stored in the cache remain until the cache expires,
regardless of any changes that may occur on the server. The results of such caching is
that new users and memberships may not be visible, and users and memberships that have
been removed may still be visible.
@@ -125,7 +125,7 @@
negative-time-to-live group 60
positive-time-to-live hosts 3600
negative-time-to-live hosts 20
-</pre></div><div class="section"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos"><div
class="titlepage"><div><div><h5 class="title"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos">1.1.3.4.4. DNS
and Kerberos</h5></div></div></div><div
class="para">
+</pre></div><div class="section"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos"><div
class="titlepage"><div><div><h5 class="title"
id="form-Enterprise_Identity_Management_Guide-DNS-DNS_and_Kerberos">2.1.3.4.4. DNS
and Kerberos</h5></div></div></div><div
class="para">
The Kerberos server requires a valid DNS A record, and reverse DNS needs to work
correctly. It is safe to use CNAMEs if they point to the A name that corresponds to the
principal name used to create SPNs (Service Principal Names) for the host. You should
avoid the use of DDNS names, however, as this can cause major problems later on.
</div><div class="para">
If necessary, add the hostname to the <code
class="filename">/etc/hosts</code> file, as long as the fully qualified
hostname must be listed first. For example:
@@ -141,7 +141,7 @@ negative-time-to-live hosts 20
DNS forwarders must be specified as IP addresses, not as hostnames.
</div></div></div>
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking">1.1.3.5. Configuring
Networking</h4></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services">1.1.3.5.1. Configuring
Networking Services</h5></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Preparing_for_an_IPA_Installation-Configuring_Networking">2.1.3.5. Configuring
Networking</h4></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_Networking_Services">2.1.3.5.1. Configuring
Networking Services</h5></div></div></div><div
class="para">
The default networking service used by Fedora is NetworkManager, and due to the way
this service works, it can cause problems with FreeIPA and the KDC. Consequently, it is
highly recommended that you use the <code
class="systemitem">network</code> service to manage the networking
requirements in a FreeIPA environment and disable the NetworkManager service.
</div><div class="orderedlist"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Networking_Services-To_configure_networking_services_for_IPA"><ol><li
class="listitem"><div class="para">
Boot the machine into single-user mode and run the following commands:
@@ -155,7 +155,7 @@ negative-time-to-live hosts 20
Ensure that static networking is correctly configured.
</div></li><li class="listitem"><div
class="para">
Restart the system.
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File">1.1.3.5.2. Configuring
the /etc/hosts File</h5></div></div></div><div
class="para">
+ </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Networking-Configuring_the_etchosts_File">2.1.3.5.2. Configuring
the /etc/hosts File</h5></div></div></div><div
class="para">
You need to ensure that your <code
class="filename">/etc/hosts</code> file is configured correctly. A
misconfigured file can prevent the FreeIPA command-line tools from functioning correctly
and can prevent the FreeIPA web interface from connecting to the FreeIPA server.
</div><div class="para">
Configure the <code class="filename">/etc/hosts</code> file
to list the FQDN for the FreeIPA server <span
class="emphasis"><em>before</em></span> any aliases. Also
ensure that the hostname is not part of the <code
class="literal">localhost</code> entry. The following is an example of
a valid hosts file:
@@ -164,4 +164,4 @@ negative-time-to-live hosts 20
192.168.1.1
ipaserver.example.com ipaserver
</pre><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Do not omit the <code class="systemitem">IPv4</code> entry
in the <code class="filename">/etc/hosts</code> file. This entry is
required by the FreeIPA web service.
- </div></div></div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="doc-history.html"><strong>Prev</strong>4. Document Change
History</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong>1.2. Installing
the FreeIPA Server Packages</a></li></ul></body></html>
+ </div></div></div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="policy.html"><strong>Prev</strong>1.4. Defining Policies:
Authorization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Installing_the_IPA_Server_Packages.html"><strong>Next</strong>2.2. Installing
the FreeIPA Server Packages</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/introduction.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/introduction.html
index f0a2818..66eb7f6 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/introduction.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/introduction.html
@@ -1,112 +1,22 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 1. Introduction to IPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 1. Introduction to FreeIPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
- addID('Drafts.1');
+ addID('Fedora.15');
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="index.html" title="Enterprise Identity Management Guide"
/><link rel="prev" href="doc-history.html"
title="4. Document Change History" /><link rel="next"
href="ipa-components.html" title="1.2. Identity Management:
Authentication" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="doc-history.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="
ipa-components.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="introduction"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 1. Introduction to
IPA</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="introduction.html#what-is-ipa">1.1. IPA
Defined</a></span></dt><dd><dl><dt><span
class="section"><a href="introduction.html#ipa-v-ldap">1.1.1.
IPA v. LDAP: A More Focused Type of
Service</a></span></dt><dd><dl><dt><span
class="section"><a
href="introduction.html#sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-The_IPA_Core">1.1.1.1.
The IPA Core</a></span></dt><dt><span
class="section"><a
href="introduction.html#sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Management_Stations">1.1.1.2.
IPA Management Stations</a></span></dt><dt><span
class="section"><a
href="introduction.html#sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture
-IPA_Managed_Hosts">1.1.1.3. IPA Managed
Hosts</a></span></dt></dl></dd><dt><span
class="section"><a
href="introduction.html#ipa-domains">1.1.2. About IPA
Domains</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-components.html">1.2. Identity
Management: Authentication</a></span></dt><dt><span
class="section"><a href="policy.html">1.3. Defining Policies:
Authorization</a></span></dt><dt><span
class="section"><a href="deployment-scenarios.html">1.4.
Planning IPA</a></span></dt></dl></div><div
class="para">
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="doc-history.html"
title="4. Document Change History" /><link rel="next"
href="ipa-domains.html" title="1.2. About FreeIPA Domains"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="doc-history.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="ipa-d
omains.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="introduction"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 1. Introduction to
FreeIPA</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="introduction.html#ipa-v-ldap">1.1. FreeIPA v. LDAP: A More Focused Type
of Service</a></span></dt><dt><span
class="section"><a href="ipa-domains.html">1.2. About FreeIPA
Domains</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-domains.html#The_IPA_Core">1.2.1. The FreeIPA
Server</a></span></dt><dt><span
class="section"><a
href="ipa-domains.html#IPA_Managed_Hosts">1.2.2. FreeIPA Managed
Hosts</a></span></dt><dt><span
class="section"><a
href="ipa-domains.html#external-work">1.2.3. Integration with Non-Fedora
Services</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-components.html">1.3. Identity
Management: Authentication</a></span></dt><dt><span
class="section"><a href="
policy.html">1.4. Defining Policies:
Authorization</a></span></dt></dl></div><div
class="para">
XXXXX introXXXXXXXX
- </div><div class="section" id="what-is-ipa"><div
class="titlepage"><div><div><h2 class="title"
id="what-is-ipa">1.1. IPA
Defined</h2></div></div></div><div class="para">
+ </div><div class="para">
+ FreeIPA is an integrated security information management solution which combines
Fedora, 389 Directory Server, MIT Kerberos, DNS, Certificate System CA, and NTP. Its
numerous administration tools allow an administrator to quickly install, set up, and
administer servers for centralized authentication and identity management. FreeIPA also
supports for host identities, netgroups, automount by location and other features.
+ </div><div class="para">
+ FreeIPA focuses on making centralized identity and policy easy to manage in Linux and
Unix environments and includes interoperability with the Windows environment.
+ </div><div class="section" id="ipa-v-ldap"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-v-ldap">1.1. FreeIPA v. LDAP: A More Focused Type of
Service</h2></div></div></div><div class="para">
XXXXXXXXXX fix me XXXXXXXX
</div><div class="para">
- IPA is an integrated security information management solution which combines Red Hat
Enterprise Linux, Red Hat Directory Server, MIT Kerberos, and NTP. It provides web browser
and command-line interfaces, and its numerous administration tools allow an administrator
to quickly install, set up, and administer one or more servers for centralized
authentication and identity management.
+ For efficiency, compliance and risk mitigation, organizations need to centrally manage
and correlate vital security information including: * Identity (machine, user, virtual
machines, groups, authentication credentials) * Policy (host based access control, sudo)
Because of its vital importance and the way it is interrelated, we think identity, policy,
and audit information should be open, interoperable, and manageable. Our focus is on
making identity, policy, and audit (some day) easy to centrally manage for the Linux and
Unix world. Of course, we will need to interoperate well with Windows and much more. We
are looking to take concrete and useful steps and so have chosen initially to focus on
Identity solutions for the Unix/Linux world. For policy we focus on the host based access
control management and enforcement. As for other aspects of the policy management related
to systems management and configuration management, after serious evaluation we decided
not to address
these segments for now. There are other projects that are working in this direction. We
will closely monitor those projects and integrate with them as interfaces become
available. We did a lot of research and evaluation in the audit area and realized that
this is a significant effort and might require a project of its own. For now we decided
not to disperse our energy and work more on improving the identity and authentication
aspects of the system. But we will continue to monitor open source projects in the audit
related space. One of such projects that was created as a result of our evaluation is
ELAPI. We will continue investing into that project.
</div><div class="para">
- The latest version of IPA extends the integration of DNS, includes a Certificate
System Server, an enhanced administrative framework, support for host identities,
netgroups, automount by location and other features.
- </div><div class="para">
- IPA focuses on making centralized identity and policy easy to manage in Linux and Unix
environments, and includes interoperability with the Windows environment.
- </div><div class="section" id="ipa-v-ldap"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-v-ldap">1.1.1. IPA v. LDAP: A More Focused Type of
Service</h3></div></div></div><div class="para">
- XXXXXXXXXX fix me XXXXXXXX
- </div><div class="para">
- The following diagram provides a high-level view of the current IPA architecture. It
is broken down into three main components: the IPA core; the management station; and the
managed host. Each of these components is described in more detail below.
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-High_level_IPA_Architecture"><div
class="figure-contents"><div class="mediaobject"><img
src="./images/IPA_arch.png" alt="High-level IPA Architecture"
/></div></div><h6>Figure 1.1. High-level IPA
Architecture</h6></div><br class="figure-break" /><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-The_IPA_Core"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-The_IPA_Core">1.1.1.1. The
IPA Core</h4></div></div></div><div class="para">
- The IPA core consists of the servers, services, and other utilities necessary to
provide the fundamental IPA functionality. This includes the management framework, the
directory server, the KDC, the web server, and the DNS.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-Kerberos_KDC"><h5
class="formalpara">Kerberos KDC</h5>
- The Kerberos KDC is the Kerberos authentication server, and provides authentication
services for users, hosts, and services. It stores its data in the directory server.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-Directory_Server"><h5
class="formalpara">Directory Server</h5>
- The directory server is the core storage system of the IPA server. The directory
server stores all of the information about user accounts used by the KDC for
authentication, groups, hosts, services, netgroups and policy information. If configured
and used, DNS uses the same instance of the directory server to store DNS information. The
directory server provides a multi-master replication capability so that multiple IPA
replicas can be deployed.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-Management_Framework"><h5
class="formalpara">Management Framework</h5>
- The management framework is an abstraction layer which provides some business logic
on top of the directory server. The management of data in the DS is performed over the
XML-RPC interface through the management framework.
- </div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
- Direct modifications to the DS data is strongly discouraged unless explicitly
mentioned in the documentation.
- </div></div></div><div class="para">
- The management framework uses a pluggable architecture that allows adding or
extending existing objects in IPA by third parties.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-DNS"><h5
class="formalpara">DNS</h5>
- The DNS is the Domain Name Service. This is an optional component that can be
installed and configured at any time. Alternatively, an existing DNS server can be used.
In this case, however, there will be no tight integration between DNS management and the
management of hosts that IPA provides.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-Web_UI"><h5
class="formalpara">Web UI</h5>
- The web UI provides web-based management services for the IPA server.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Core-NTP"><h5
class="formalpara">NTP</h5>
- NTP is an optional service, but can be enabled on the IPA server, in which case the
IPA server becomes the NTP server for the deployment. You can use other NTP servers as
desired.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Management_Stations"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Management_Stations">1.1.1.2. IPA
Management Stations</h4></div></div></div><div
class="para">
- The management station is used to perform administrative tasks on the IPA server.
IPA provides two interfaces for these tasks.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-IPA_Management_Stations-Command_Line_Interface_CLI"><h5
class="formalpara">Command Line Interface (CLI)</h5>
- The CLI performs management tasks using the management framework over the XML-RPC
interface. Every management operation that can be performed against the IPA server can be
done using this interface. The client side of the administrative interface is a package
that needs to be installed on the Management Station.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-IPA_Management_Stations-Browser_Interface"><h5
class="formalpara">Browser Interface</h5>
- The browser interface is used for web-based management. It connects to the
management framework using the JSON RPC.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Managed_Hosts"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Managed_Hosts">1.1.1.3. IPA
Managed Hosts</h4></div></div></div><div
class="para">
- An IPA <em class="firstterm">managed host</em> is a host that
is managed by IPA. The definition of "manage" in this context can be stated as
"being able to retrieve a keytab and certificates on behalf of another host or
service". This management is established by enrolling the host with IPA, a task
performed by the <code class="command">ipa-client-install</code>
command. As a result of this enrollment, <code
class="systemitem">SSSD</code> and <code
class="systemitem">certmonger</code> are configured (they are aware of
the location of the IPA server), the keytab is provisioned and the host certificate is
created. The host certificate is not used by IPA but is created nonetheless, for possible
use by services that might be running on the host. The web server is one example of this.
- </div><div class="para">
- As a result of user authentication against the KDC, the TGT (ticket-granting ticket)
is stored on the client machine. That ticket is used to access different services that are
members of the same Kerberos domain. All services need to be registered in IPA and have a
keytab provisioned for them. To do this, you need to create a service record in IPA and
then execute the <code class="command">ipa-getkeytab</code> on the
host where the service will be running. Note that this operation is independent of making
the host a managed host. The service can run on either a managed host or an unmanaged
host.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-IPA_Managed_Hosts-SSSD"><h5
class="formalpara">SSSD</h5>
- When configured to use IPA via its IPA back end, SSSD provides user authentication,
identity look ups and HBAC (Host-based Access Control) enforcement. The host enrollment
and configuration of SSSD are performed automatically by the <code
class="command">ipa-client-install</code> command.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-IPA_Managed_Hosts-certmonger"><h5
class="formalpara">certmonger</h5>
- <code class="systemitem">certmonger</code> is an unattended
service that can monitor the certificates on the client system and renew them on a
scheduled basis when they are about to expire. It can also be used to request new
certificates for the services running on the system or for a different system, for example
when a management server or hypervisor requests certificates for a set of virtual
machines.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Managed_Hosts-Extending_the_Permissions_of_IPA_Managed_Hosts"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Managed_Hosts-Extending_the_Permissions_of_IPA_Managed_Hosts">1.1.1.3.1. Extending
the Permissions of IPA Managed Hosts</h5></div></div></div><div
class="para">
- As discussed in <a class="xref"
href="introduction.html#sect-Enterprise_Identity_Management_Guide-High_level_IPA_Architecture-IPA_Managed_Hosts">Section 1.1.1.3,
“IPA Managed Hosts”</a>, the definition of "manage" is "being able to
retrieve a keytab and certificates on behalf of another host or service". Every host
and service has a <em
class="parameter"><code>managedby</code></em> entry. By
default, a host can manage itself and all of its services. It is also possible to allow a
host to manage other hosts, or services on other hosts, by updating the appropriate
delegations or providing a suitable <em
class="parameter"><code>managedby</code></em> entry.
- <div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- If a host is provided with a <em
class="parameter"><code>managedby</code></em> entry to
another host, it does not mean management of all services on that host. Each delegation
has to be performed independently.
- </div></div></div>
-
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Extending_the_Permissions_of_IPA_Managed_Hosts-Delegating_Service_Management"><div
class="titlepage"><div><div><h6 class="title"
id="sect-Enterprise_Identity_Management_Guide-Extending_the_Permissions_of_IPA_Managed_Hosts-Delegating_Service_Management">1.1.1.3.1.1. Delegating
Service Management</h6></div></div></div><div
class="para">
- This section describes how to create a new host and a service on that host, and
then delegate management of that service to another host. In this example, the IPA server
is installed on <code class="systemitem">slinky.example.com</code>
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Delegating_Service_Management-To_delegate_service_management_to_another_host"><h6>Procedure 1.1. To
delegate service management to another host</h6><ol class="1"><li
class="step"><div class="para">
- Create a new host:
-<pre class="screen"><code class="command"># kinit
admin</code>
-<code class="command"># ipa host-add
panther.example.com</code></pre>
-
- </div></li><li class="step"><div
class="para">
- Create a service on this host:
-<pre class="screen"><code class="command"># ipa
service-add test/panther.example.com</code></pre>
-
- </div></li><li class="step"><div
class="para">
- Delegate managing the service:
-<pre class="screen"><code class="command"># ipa
service-add-host --hosts=slinky panther</code></pre>
-
- </div><div class="para">
- You can now use the host service principal on <code
class="systemitem">slinky</code> to manage <code
class="systemitem">panther</code>:
-<pre class="screen"><code class="command"># kinit -kt
/etc/krb5.keytab host/`hostname`</code>
-<code class="command"># ipa-getkeytab -s `hostname` -k /tmp/test.keytab
-p test/panther.example.com</code>
-Keytab successfully retrieved and stored in: /tmp/test.keytab</pre>
-
- </div></li><li class="step"><div
class="para">
- To create a ticket for this service, create a CSR and then run the following
command:
-<pre class="screen"><code class="command"># ipa
cert-request --add --principal=test/panther.example.com panther.csr</code>
- Certificate: MIICETCCAXqgA...[snip]
- Subject:
CN=panther.example.com,O=EXAMPLE.COM
- Issuer:
CN=EXAMPLE.COM Certificate Authority
- Not Before: Tue Feb 08 18:51:51 2011 UTC
- Not After: Mon Feb 08 18:51:51 2016 UTC
- Fingerprint (MD5): c1:46:8b:29:51:a6:4c:11:cd:81:cb:9d:7c:5e:84:d5
- Fingerprint (SHA1):
- 01:43:bc:fa:b9:d8:30:35:ee:b6:54:dd:a4:e7:d2:11:b1:9d:bc:38
- Serial number: 1005
-</pre>
-
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Extending_the_Permissions_of_IPA_Managed_Hosts-Delegating_Host_Management"><div
class="titlepage"><div><div><h6 class="title"
id="sect-Enterprise_Identity_Management_Guide-Extending_the_Permissions_of_IPA_Managed_Hosts-Delegating_Host_Management">1.1.1.3.1.2. Delegating
Host Management</h6></div></div></div><div
class="para">
- This section describes how to delegate management of one host to another host.
This example uses the same hosts as those used in the previous example.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Delegating_Host_Management-To_delegate_host_management_to_another_host"><h6>Procedure 1.2. To
delegate host management to another host</h6><ol class="1"><li
class="step"><div class="para">
- Ensure you have <code class="systemitem">admin</code>
credentials and then add the appropriate <em
class="parameter"><code>managedby</code></em> entry:
-<pre class="screen"><code class="command"># kinit
admin</code>
-<code class="command"># ipa host-add-managedby --hosts=slinky
panther</code></pre>
-
- </div></li><li class="step"><div
class="para">
- Obtain a TGT as the host <code
class="systemitem">slinky</code> and then retrieve a keytab for
<code class="systemitem">panther</code>:
-<pre class="screen"><code class="command"># kinit -kt
/etc/krb5.keytab host/`hostname`</code>
-<code class="command"># ipa-getkeytab -s `hostname` -k
/tmp/panther.keytab -p host/panther.example.com</code>
-Keytab successfully retrieved and stored in: /tmp/panther.keytab</pre>
-
- </div></li></ol></div></div></div></div></div><div
class="section" id="ipa-domains"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-domains">1.1.2. About IPA
Domains</h3></div></div></div><div class="para">
- XXXXXXXXXX fix me XXXXXXXX
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="doc-history.html"><strong>Prev</strong>4. Document Change
History</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-components.html"><strong>Next</strong>1.2. Identity
Management: Authentication</a></li></ul></body></html>
+ What are the problems freeIPA is trying to solve? * Focus on solving identity
management across the enterprise providing a reliable open source alternative to existing
solutions * Vendor focus on Web identity management problems has meant less well developed
solutions for central management of the Linux and Unix world's vital security info.
Organizations are forced to maintain a hodgepodge of internal and proprietary solutions at
high TCO. * Proprietary security products don't easily provide access to the vital
security information they collect or manage. This makes it difficult to synchronize and
analyze effectively.
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="doc-history.html"><strong>Prev</strong>4. Document Change
History</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-domains.html"><strong>Next</strong>1.2. About FreeIPA
Domains</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-apache.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-apache.html
index 7b0ac10..7b618f6 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-apache.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-apache.html
@@ -1,31 +1,31 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.9. Setting an IPA Server as an Apache Virtual
Host</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.5. Setting a FreeIPA Server as an Apache Virtual
Host</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"
title="12.8. Configuring Certificates and Certificate Authorities" /><link
rel="next" href="ipa-cluster.html" title="12.10. Using IPA in a
Cluster" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li cl
ass="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-cluster.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-apache"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-apache">12.9. Setting an IPA Server as an Apache Virtual
Host</h2></div></div></div><div class="para">
- If you have a standard Apache instance running on port 80, you can configure IPA to
run on a secondary port, for example, on port 8089. You should be aware, however, that in
this configuration, IPA does not use <code
class="systemitem">SSL</code>; all requests will use standard <code
class="systemitem">HTTP</code>.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev"
href="Configuring_Certificates_and_Certificate_Authorities.html"
title="13.4. Configuring Certificates and Certificate Authorities" /><link
rel="next" href="ipa-cluster.html" title="13.6. Using FreeIPA in
a Cluster" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" hre
f="Configuring_Certificates_and_Certificate_Authorities.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-cluster.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-apache"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-apache">13.5. Setting a FreeIPA Server as an Apache Virtual
Host</h2></div></div></div><div class="para">
+ If you have a standard Apache instance running on port 80, you can configure FreeIPA
to run on a secondary port, for example, on port 8089. You should be aware, however, that
in this configuration, FreeIPA does not use <code
class="systemitem">SSL</code>; all requests will use standard <code
class="systemitem">HTTP</code>.
</div><div class="para">
- The following procedure assumes that IPA is configured to run on port 80, and that you
want to move it to port 8089.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_IPA_to_run_as_an_Apache_Virtual_Host-To_configure_IPA_to_run_on_port_8089"><h6>Procedure 12.4. To
configure IPA to run on port 8089:</h6><ol class="1"><li
class="step"><div class="para">
+ The following procedure assumes that FreeIPA is configured to run on port 80, and that
you want to move it to port 8089.
+ </div><div class="orderedlist"><h6>To configure FreeIPA to
run on port 8089:</h6><ol><li class="listitem"><div
class="para">
Log in as the <code class="systemitem">root</code> user.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file. Add the
following three lines to the beginning of the file:
</div><pre class="programlisting">Listen 8089
NameVirtualHost *:8089
<VirtualHost *:8089>
-</pre></li><li class="step"><div
class="para">
+</pre></li><li class="listitem"><div
class="para">
Add the following line to the end of the file:
</div><pre class="programlisting"></VirtualHost>
</pre><div class="para">
- This wraps the entire IPA configuration in a virtual host, and ensures that Apache
is listening to that port.
+ This wraps the entire FreeIPA configuration in a virtual host, and ensures that
Apache is listening to that port.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot use port 8080. This port is used by the <code
class="systemitem">ipa_webgui</code> service.
- </div></div></div></li><li
class="step"><div class="para">
+ </div></div></div></li><li
class="listitem"><div class="para">
Comment out the following rewrite rules from the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file:
</div><pre
class="programlisting">----------------------------------------------------------------------
# Redirect to the fully-qualified hostname. Not redirecting to secure
@@ -39,12 +39,12 @@ RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{REQUEST_URI} !^/(errors|config|favicon.ico)
RewriteRule ^/(.*)
https://host.foo.com/$1 [L,R=301,NC]
---------------------------------------------------------------------
-</pre></li><li class="step"><div
class="para">
+</pre></li><li class="listitem"><div
class="para">
Reload the <code class="systemitem">httpd</code> service.
</div><div class="para">
-<pre class="screen"><code class="command"># service httpd
reload</code></pre>
+<pre class="screen"># service httpd reload</pre>
</div></li></ol></div><div class="para">
- This configures IPA to run on port 8089, leaving port 80 free for your normal web
site.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Prev</strong>12.8. Configuring
Certificates and Certificate Au...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-cluster.html"><strong>Next</strong>12.10. Using IPA in
a Cluster</a></li></ul></body></html>
+ This configures FreeIPA to run on port 8089, leaving port 80 free for your normal web
site.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_Certificates_and_Certificate_Authorities.html"><strong>Prev</strong>13.4. Configuring
Certificates and Certificate Au...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-cluster.html"><strong>Next</strong>13.6. Using FreeIPA
in a Cluster</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-cluster.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-cluster.html
index c657898..824a348 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-cluster.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-cluster.html
@@ -1,29 +1,29 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.10. Using IPA in a Cluster</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.6. Using FreeIPA in a Cluster</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="ipa-apache.html"
title="12.9. Setting an IPA Server as an Apache Virtual Host" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"
title="12.11. Creating DNS Entries for FreeIPA Replicas"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class=
"docnav"><li class="previous"><a accesskey="p"
href="ipa-apache.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-cluster"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-cluster">12.10. Using IPA in a
Cluster</h2></div></div></div><div class="para">
- The IPA server currently does not specifically handle the case of a service running in
a cluster. That is, the IPA server is not <em class="firstterm">cluster
aware</em>. It is possible to configure a clustered service to be part of IPA,
although a certain amount of manual configuration is required. This involves sharing and
synchronizing Kerberos keys across all of the participating hosts, and also configuring
services running on the hosts to respond to whatever names the clients want to use.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1. Configuring
Kerberos Credentials for a Clustered
Environment</h3></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev" href="ipa-apache.html"
title="13.5. Setting a FreeIPA Server as an Apache Virtual Host" /><link
rel="next"
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"
title="13.7. Creating DNS Entries for FreeIPA Replicas"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a acc
esskey="p"
href="ipa-apache.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-cluster"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-cluster">13.6. Using FreeIPA in a
Cluster</h2></div></div></div><div class="para">
+ The FreeIPA server currently does not specifically handle the case of a service
running in a cluster. That is, the FreeIPA server is not <em
class="firstterm">cluster aware</em>. It is possible to configure a
clustered service to be part of FreeIPA, although a certain amount of manual configuration
is required. This involves sharing and synchronizing Kerberos keys across all of the
participating hosts, and also configuring services running on the hosts to respond to
whatever names the clients want to use.
+ </div><div class="section"
id="Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1. Configuring
Kerberos Credentials for a Clustered
Environment</h3></div></div></div><div
class="para">
Use the following procedure to set up the Kerberos credentials for an environment
where your managed host is a cluster of nodes.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment"><h6>Procedure 12.5. Configuring
Kerberos Credentials for a Clustered Environment</h6><ol
class="1"><li class="step"><div
class="para">
- Enroll all of the hosts in the IPA domain, and collect any keytabs that have been
set up. At a minimum, this is <code
class="filename">/etc/krb5.keytab</code>, although additional services
may have their keys in other files.
- </div></li><li class="step"><div
class="para">
+ </div><div class="orderedlist"><h6>Configuring Kerberos
Credentials for a Clustered Environment</h6><ol><li
class="listitem"><div class="para">
+ Enroll all of the hosts in the FreeIPA domain, and collect any keytabs that have
been set up. At a minimum, this is <code
class="filename">/etc/krb5.keytab</code>, although additional services
may have their keys in other files.
+ </div></li><li class="listitem"><div
class="para">
Use the <code class="command">ktutil</code> command to
produce a single keytab file that contains the contents of all of the keytab files.
- </div><ol class="a"><li class="step"><div
class="para">
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
For each file, use the <code class="command">rkt</code>
command to read the keys from that file.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Use the <code class="command">wkt</code> command to write
all of the keys which have been read to a new keytab file.
- </div></li></ol></li><li
class="step"><div class="para">
+ </div></li></ol></div></li><li
class="listitem"><div class="para">
Replace the keytab files on each host with the newly-created keytab file.
</div></li></ol></div><div class="para">
Each host in this cluster should now be able to impersonate any other host.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration">12.10.1.1. Service-specific
Configuration</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-Service_specific_Configuration">13.6.1.1. Service-specific
Configuration</h4></div></div></div><div
class="para">
Additional service-specific configuration may be required if cluster members do not
reset their hostnames when they take over for a failed service.
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
For <code class="systemitem">sshd</code>, set <em
class="parameter"><code>GSSAPIStrictAcceptorCheck
no</code></em> in <code
class="filename">/etc/ssh/sshd_config</code>
@@ -31,14 +31,14 @@
For <code class="systemitem">mod_auth_kerb</code>, set
<em class="parameter"><code>KrbServiceName
Any</code></em> in <code
class="filename">/etc/httpd/conf.d/auth_kerb.conf</code>
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration">12.10.1.2. SSL
Server Configuration</h4></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Kerberos_Credentials_for_a_Clustered_Environment-SSL_Server_Configuration">13.6.1.2. SSL
Server Configuration</h4></div></div></div><div
class="para">
For SSL servers, it is important that the subject name or a <em
class="parameter"><code>subjectAlternativeName</code></em>
value for the server's certificate look correct when a client connects to the
clustered item. The simplest way to do this is to keep the private key and certificate
synchronized across all of the hosts, but it is better to share the private key if
possible. Ensuring that certificates issued to each cluster member contain <em
class="parameter"><code>subjectAlternativeName</code></em>
values naming all of the cluster members should satisfy any client connection
requirements.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2. Using
the Same Service Principal for Multiple
Services</h3></div></div></div><div class="para">
- One aspect of applying IPA in a cluster use case is using the same service principal
for multiple services, spread across different machines. This is a simple procedure and
could be implemented as follows:
+ </div></div></div><div class="section"
id="Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services"><div
class="titlepage"><div><div><h3 class="title"
id="Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2. Using
the Same Service Principal for Multiple
Services</h3></div></div></div><div class="para">
+ One aspect of applying FreeIPA in a cluster use case is using the same service
principal for multiple services, spread across different machines. This is a simple
procedure and could be implemented as follows:
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
Retrieve a service principal in the normal way, using the <code
class="command">ipa-getkeytab</code> command, or use the keytab that is
set up when the host joins the realm. That is, by using <code
class="command">ipa-join</code>, which creates or updates the <code
class="filename">/etc/krb5.keytab</code> file with a host/principal.
</div></li><li class="listitem"><div
class="para">
When you have the principal in a keytab on the system, you can direct multiple
servers or services to use the same file, or you can copy the file to discrete locations
as required.
</div></li></ol></div>
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-apache.html"><strong>Prev</strong>12.9. Setting an IPA
Server as an Apache Virtual ...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Next</strong>12.11. Creating
DNS Entries for FreeIPA
Replicas</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-apache.html"><strong>Prev</strong>13.5. Setting a
FreeIPA Server as an Apache Virtu...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Next</strong>13.7. Creating
DNS Entries for FreeIPA
Replicas</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-components.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-components.html
index 5987c52..ddea330 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-components.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-components.html
@@ -1,12 +1,14 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.2. Identity Management: Authentication</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.3. Identity Management: Authentication</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
- addID('Drafts.1');
+ addID('Fedora.15');
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to IPA"
/><link rel="prev" href="introduction.html"
title="Chapter 1. Introduction to IPA" /><link rel="next"
href="policy.html" title="1.3. Defining Policies: Authorization"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="introduction.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="p
olicy.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-components"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-components">1.2. Identity Management:
Authentication</h2></div></div></div><div
class="para">
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to FreeIPA"
/><link rel="prev" href="ipa-domains.html"
title="1.2. About FreeIPA Domains" /><link rel="next"
href="policy.html" title="1.4. Defining Policies: Authorization"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-domains.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="
n"
href="policy.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-components"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-components">1.3. Identity Management:
Authentication</h2></div></div></div><div
class="para">
XXXXXXXXXX fix me XXXXXXXX
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="introduction.html"><strong>Prev</strong>Chapter 1. Introduction
to IPA</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="policy.html"><strong>Next</strong>1.3. Defining Policies:
Authorization</a></li></ul></body></html>
+ </div><div class="para">
+ What will be freeIPA's first steps around Identity? We are looking to take
concrete and useful steps, and so have chosen to focus our first efforts on centralized
Identity Management and Authentication for Linux and Unix * This solution will initially
consist of an MIT Kerberos 5 server using a Fedora Directory Server backend. The goal is
to make it easy for developers and administrators to set up centralized identity
management for their world using the directory as the central username and password store
and kerberos as the means of authentication and single sign on. * In version 1 we
provided: a fixed schema, simple configuration tools to easily set up an IPA server and
replication, and command line tools and an intuitive GUI for user and group management. *
In version 2 we are working on: integrating Dogtag Certificate Server, DNS server, added
support for hosts, centrally managed netgroups, different automount maps for different
locations, extensible UI/CLI framework
, host based access control and more. * We want to make sure this solution can manage
identity and authentication well for Linux and Unix boxes and we hope our efforts inspire
upstream package owners to kerberize a lot more packages.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-domains.html"><strong>Prev</strong>1.2. About FreeIPA
Domains</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="policy.html"><strong>Next</strong>1.4. Defining Policies:
Authorization</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-domains.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-domains.html
new file mode 100644
index 0000000..f9fa631
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-domains.html
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.2. About FreeIPA Domains</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to FreeIPA"
/><link rel="prev" href="introduction.html"
title="Chapter 1. Introduction to FreeIPA" /><link rel="next"
href="ipa-components.html" title="1.3. Identity Management:
Authentication" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="introduction.html"><strong>Prev</strong></a></li><li
class
="next"><a accesskey="n"
href="ipa-components.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-domains"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-domains">1.2. About FreeIPA
Domains</h2></div></div></div><div class="para">
+ XXXXXXXXXX fix me XXXXXXXX
+ </div><div class="para">
+ FreeIPA is broken down into three main components: the FreeIPA server and the FreeIPA
client.
+ </div><div class="figure"
id="figHigh_level_IPA_Architecture"><div
class="figure-contents"><div class="mediaobject"><img
src="images/IPA_arch.png" width="600" alt="FreeIPA
Interactions" /></div></div><h6>Figure 1.1. FreeIPA
Interactions</h6></div><br class="figure-break" /><div
class="section" id="The_IPA_Core"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Core">1.2.1. The FreeIPA
Server</h3></div></div></div><div class="para">
+ The FreeIPA core consists of the servers, services, and other utilities necessary to
provide the fundamental FreeIPA functionality. This includes the management framework, the
directory server, the KDC, the web server, and the DNS.
+ </div><div class="formalpara"
id="The_IPA_Core-Kerberos_KDC"><h5
class="formalpara">Kerberos KDC</h5>
+ The Kerberos KDC is the Kerberos authentication server, and provides authentication
services for users, hosts, and services. It stores its data in the directory server.
+ </div><div class="para">
+ What is Kerberos? Kerberos is a network authentication protocol created by MIT, and
uses symmetric-key cryptography to authenticate users to network services, which means
that passwords are never actually sent over the network. Consequently, when users
authenticate to network services using Kerberos, unauthorized users attempting to gather
passwords by monitoring network traffic are effectively thwarted. The primary design goal
of Kerberos is to eliminate the transmission of unencrypted passwords across the network.
If used properly, Kerberos effectively eliminates the threat that packet sniffers would
otherwise pose on a network. [edit] How IPA and Kerberos Work Together The IPA
implementation of Kerberos differs from a typical Kerberos implementation mainly in that
it uses Directory Server to store data instead of a flat file. Access control is also
provided by the directory. The IPA Kerberos implementation does not use the native tools
because by default the KDC is no
t aware of Directory Server. IPA provides its own set of tools for working with Kerberos.
Kerberos' native tools, for example, those provided by kadmin.local, should not be
used. For many reasons, kadmin.local does not currently have permission to operate outside
of cn=kerberos. One reason is that it does not understand LDAP, which means that you
cannot create principals where you want. Another reason is that it cannot proxy a password
change to the IPA plugin. Consequently, if a password change is performed via
kadmin.local, then the user entry would be corrupted. Image:Note.png Note: It is highly
recommended that you avoid the use of kadmin and kadmin.local in an IPA deployment. [edit]
IPA, Kerberos, and Service Principals A Service Principal is needed by a server program in
order to perform Kerberos authentication. Kerberos authentication works by obtaining an
encrypted ticket for a service, a ticket that only the service can decrypt (and therefore
verify that the user ob
tained it from the KDC, indirectly proving that the client was able to authenticate to
the KDC and is therefore trustworthy). The Service Principal is therefore needed to make
it possible for the client to tell the KDC which service it needs a ticket for, and for
the KDC to be able to store and provide a secret to the service at the moment the Service
Principal is created. Service Principals are typically released per service, although it
is possible for one Service Principal to be used for more services. For example,
host/fqdn@REALM is used for both the SSH service and also as the generic "host"
principal. [edit] IPA, Kerberos, and DNS As discussed in How IPA and DNS Work Together,
IPA relies heavily on a fully-functional DNS for correct operation. Because of its tight
integration with IPA, Kerberos also requires that the DNS be configured correctly. Using
CNAME and A Records When Kerberos requests a ticket to begin authentication, it will
always resolve a CNAME to its corr
esponding A record; Kerberos libraries will never use a CNAME to ask for a ticket. This
means that when you create service or host principals you need to use the host A record.
For example, consider the following zone file entry: CNAME
www.example.com -> A
name
web-01.example.com If you use the following command to connect to the host via SSH
and want GSSAPI authentication: $ ssh
www.example.com it will actually request a ticket
for host/web-01.example.com(a)EXAMPLE.COM This is the service principal that you must use to
obtain and save tickets in /etc/krb5.keytab for this host.
+ </div><div class="formalpara"
id="Directory_Server"><h5 class="formalpara">Directory
Server</h5>
+ The directory server is the core storage system of the FreeIPA server. The directory
server stores all of the information about user accounts used by the KDC for
authentication, groups, hosts, services, netgroups and policy information. If configured
and used, DNS uses the same instance of the directory server to store DNS information. The
directory server provides a multi-master replication capability so that multiple FreeIPA
replicas can be deployed.
+ </div><div class="para">
+ FDS is an integral part of IPA. In freeIPA, FDS serves as the data store, maintaining
all of an organization's information. The Directory Server also controls access to all
directory information; IPA users are restricted in the level of access they have to FDS
information by the controls in place within FDS itself. FDS access control cannot be
overridden by permissions, delegations, or other controls in IPA.
+ </div><div class="formalpara"><h5
class="formalpara" id="id3040212">DNS</h5>
+ The DNS is the Domain Name Service. This is an optional component that can be
installed and configured at any time. Alternatively, an existing DNS server can be used.
In this case, however, there will be no tight integration between DNS management and the
management of hosts that FreeIPA provides.
+ </div><div class="para">
+ What is DNS? A Domain Name Service (DNS) associates hostnames with their respective
IP addresses, so that when users want to connect to other machines on the network, they
can refer to them by name, without having to remember IP addresses. DNS is normally
implemented using centralized servers that are authoritative for some domains and refer to
other DNS servers for other domains. [edit] How IPA and DNS Work Together IPA clients
find, or discover, IPA servers using a process known as Service Discovery. This can occur
automatically, using DNS, or manually, by entering the IPA server details during the
client configuration phase. [edit] Service Discovery using DNS The recommended method for
ensuring that IPA clients discover IPA servers is via DNS. This requires adding special
records to the DNS configuration. The IPA Server installation generates a sample zone file
which contains sample records for this purpose. In particular, it includes records for the
LDAP servers, Ker
beros realm, and Kerberos servers required in an IPA deployment. These records can be
added to an existing DNS infrastructure - even one hosted on a different OS - or they can
be added to a new DNS server if one does not already exist. The following is an extract
from a zone file where the IPA server, KDC, and DNS server all exist on the same machine
(ipaserver) in the realm
EXAMPLE.COM: ; ldap servers _ldap._tcp IN SRV 0 100 389 ipaserver
;kerberos realm _kerberos IN TXT
EXAMPLE.COM ; kerberos servers _kerberos._tcp IN SRV 0
100 88 ipaserver _kerberos._udp IN SRV 0 100 88 ipaserver _kerberos-master._tcp IN SRV 0
100 88 ipaserver _kerberos-master._udp IN SRV 0 100 88 ipaserver _kpasswd._tcp IN SRV 0
100 464 ipaserver _kpasswd._udp IN SRV 0 100 464 ipaserver If you already have DNS
configured on your network, you can add this to the existing zone file (in this example,
/var/named/example.com.zone.db) so that the IPA clients know where to find the LDAP and
Kerberos servers. Cl
ients will attempt to discover the IPA server first using parameters passed via the
command line, then using the configuration file (/etc/ipa/ipa.conf), and then via DNS.
[edit] Service Discovery without using DNS It is possible, but not recommended, to operate
without these records. If you do not use DNS for service discovery, then your clients will
not automatically find other IPA services in a high-availability setup. During an IPA
client installation, if you do not have DNS correctly configured so that the client can
discover the IPA server, you will need to enter the appropriate information manually.
[edit] Using IPA with Multi-Homed Machines Some of the machines in your IPA deployment may
support multiple Network Interface Cards (NICs). This is often the case for servers or
other machines where high availability or failover is required. These muti-homed machines
will typically have multiple IPs all assigned to the same hostname. Normally this will not
cause any issues
for IPA, as it listens on all available interfaces except localhost. The KDC does not
listen on this interface; it only listens to the machine's public IP addresses. For a
server that has multiple NICs and IP addresses, you need to configure the DNS with the
appropriate A records if the IPA server is to be available via any NIC. For example, the
zone file on the DNS server might have the following A records for an IPA server
(
ipaserver.example.com) with three NICs: ipaserver IN A 192.168.1.100 ipaserver IN A
192.168.1.101 ipaserver IN A 192.168.1.102 This allows IPA clients to discover the IPA
server using any of the available network interfaces.
+ </div><div class="formalpara" id="NTP"><h5
class="formalpara">NTP</h5>
+ NTP is an optional service, but can be enabled on the FreeIPA server, in which case
the FreeIPA server becomes the NTP server for the deployment. You can use other NTP
servers as desired.
+ </div><div class="para">
+ What is NTP? Many computer services (for example, Kerberos) require that the time
differential between different hosts on a network be kept to a minimum for correct or
accurate operation. The Network Time Protocol (NTP) is a protocol used to synchronize
computer clocks over the network. Most operating systems can be configured to synchronize
their clocks with any of a number of time servers. [edit] How IPA and NTP Work Together
IPA combines a number of different technologies, many of which constantly communicate with
each other over the network. In order for these technologies to work together correctly,
the time differential between the clients and servers on the network must be kept to a
minimum. Kerberos, for example, only tolerates a five minute time difference between the
KDC and a client requesting authentication. A time difference greater than five minutes
will result in a failed authentication. System Administrators also rely on accurate time
keeping for correlat
ion of system logs across machines on the network. In the event of problems on the
network or other aspects of a deployment, it may be necessary to inspect the log files of
various machines to determine if specific problems occur at the same time. Without NTP or
another time synchronization system, such troubleshooting would be all but impossible. The
IPA startup process ensures that the NTP service is started and that the time and date is
synchronized before any other IPA-related processes are started. This is to avoid problems
with certificates, LDAP entry creation dates, password expiration dates, account
expiration dates, and any other date-related issues.
+ </div><div class="para">
+ mention the CA and certificates
+ </div><div class="para">
+ mention replicas, replication, and how it works with servers
+ </div></div><div class="section"
id="IPA_Managed_Hosts"><div
class="titlepage"><div><div><h3 class="title"
id="IPA_Managed_Hosts">1.2.2. FreeIPA Managed
Hosts</h3></div></div></div><div class="para">
+ An FreeIPA <em class="firstterm">managed host</em> is a host
that is managed by FreeIPA. The definition of "manage" in this context can be
stated as "being able to retrieve a keytab and certificates on behalf of another host
or service". This management is established by enrolling the host with FreeIPA, a
task performed by the <code
class="command">ipa-client-install</code> command. As a result of this
enrollment, <code class="systemitem">SSSD</code> and <code
class="systemitem">certmonger</code> are configured (they are aware of
the location of the FreeIPA server), the keytab is provisioned and the host certificate is
created. The host certificate is not used by FreeIPA but is created nonetheless, for
possible use by services that might be running on the host. The web server is one example
of this.
+ </div><div class="para">
+ As a result of user authentication against the KDC, the TGT (ticket-granting ticket)
is stored on the client machine. That ticket is used to access different services that are
members of the same Kerberos domain. All services need to be registered in FreeIPA and
have a keytab provisioned for them. To do this, you need to create a service record in
FreeIPA and then execute the <code
class="command">ipa-getkeytab</code> on the host where the service will
be running. Note that this operation is independent of making the host a managed host. The
service can run on either a managed host or an unmanaged host.
+ </div><div class="formalpara" id="SSSD"><h5
class="formalpara">SSSD</h5>
+ When configured to use FreeIPA via its FreeIPA back end, SSSD provides user
authentication, identity look ups and HBAC (Host-based Access Control) enforcement. The
host enrollment and configuration of SSSD are performed automatically by the <code
class="command">ipa-client-install</code> command.
+ </div><div class="formalpara" id="certmonger"><h5
class="formalpara">certmonger</h5>
+ <code class="systemitem">certmonger</code> is an unattended
service that can monitor the certificates on the client system and renew them on a
scheduled basis when they are about to expire. It can also be used to request new
certificates for the services running on the system or for a different system, for example
when a management server or hypervisor requests certificates for a set of virtual
machines.
+ </div></div><div class="section"
id="external-work"><div
class="titlepage"><div><div><h3 class="title"
id="external-work">1.2.3. Integration with Non-Fedora
Services</h3></div></div></div><div class="para">
+ windows and AD samba solaris, hp, mac
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="introduction.html"><strong>Prev</strong>Chapter 1. Introduction
to FreeIPA</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-components.html"><strong>Next</strong>1.3. Identity
Management: Authentication</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-files.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-files.html
index 8d58117..69c939a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-files.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ipa-files.html
@@ -1,12 +1,7 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.4. A Summary of IPA Server Configuration Files and
Directories</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
-
- addID('Drafts.1');
-
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="basic-usage.html" title="Chapter 4. Basic Usage" /><link
rel="prev" href="switching-users.html" title="4.3. Switching
Users" /><link rel="next" href="managing-clients.html"
title="Chapter 5. Managing Clients in the IPA Domain" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="switching-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" hr
ef="managing-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-files"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-files">4.4. A Summary of IPA Server Configuration Files and
Directories</h2></div></div></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.4. A Summary of IPA Server Configuration Files and
Directories</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="basic-usage.html" title="Chapter 4. Basic Usage" /><link
rel="prev" href="switching-users.html" title="4.3. Switching
Users" /><link rel="next" href="managing-clients.html"
title="Chapter 5. Managing Clients in the IPA Domain"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site" />
</a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="switching-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="managing-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="ipa-files"><div
class="titlepage"><div><div><h2 class="title"
id="ipa-files">4.4. A Summary of IPA Server Configuration Files and
Directories</h2></div></div></div><div
class="para">
XXXXXXXXXXX FIX ME XXXXXXXX
+ </div><div class="para">
+ /.ipa /.ipa/log /.ipa/log/cli.log /etc/ipa /root/.ipa /root/.ipa/log
/root/.ipa/log/cli.log /etc/httpd/conf/ipa.keytab /etc/httpd/conf.d/ipa-rewrite.conf
/etc/httpd/conf.d/ipa.conf /etc/ipa/ca.crt /etc/ipa/default.conf /etc/ipa/html
/usr/share/ipa /usr/lib64/sssd/ /etc/sssd/sssd.api.d/sssd-ipa.conf
/etc/sysconfig/ipa_kpasswd /etc/ipa/html/unauthorized.html /etc/rc.d/init.d/ipa
/etc/rc.d/init.d/ipa_kpasswd /usr/share/ipa/05rfc2247.ldif /usr/share/ipa/60basev2.ldif
/usr/share/ipa/60ipaconfig.ldif /usr/share/ipa/60ipasudo.ldif
/usr/share/ipa/60kerberos.ldif /usr/share/ipa/60samba.ldif
/usr/share/ipa/anonymous-vlv.ldif /usr/share/ipa/bind.named.conf.template
/usr/share/ipa/bind.zone.db.template /usr/share/ipa/bootstrap-template.ldif
/usr/share/ipa/caJarSigningCert.cfg.template /usr/share/ipa/certmap.conf.template
/usr/share/ipa/default-aci.ldif /usr/share/ipa/default-hbac.ldif
/usr/share/ipa/default-keytypes.ldif /usr/share/ipa/default-pwpolicy.ldif
/usr/share/ipa/delegation.
ldif /usr/share/ipa/dna.ldif /usr/share/ipa/dns.ldif /usr/share/ipa/ds-nfiles.ldif
/usr/share/ipa/enrollment-conf.ldif /usr/share/ipa/entryusn.ldif
/usr/share/ipa/host_nis_groups.ldif /usr/share/ipa/html /usr/share/ipa/indices.ldif
/usr/share/ipa/ipa-rewrite.conf /usr/share/ipa/ipa-winsync-conf.ldif
/usr/share/ipa/ipa.conf /usr/share/ipa/ipaclient /usr/share/ipa/kdc.conf.template
/usr/share/ipa/kdc_extensions.template /usr/share/ipa/kdc_req.conf.template
/usr/share/ipa/kerberos.ldif /usr/share/ipa/krb.con.template
/usr/share/ipa/krb5.conf.template /usr/share/ipa/krb5.ini.template
/usr/share/ipa/krbrealm.con.template /usr/share/ipa/ldapi.ldif
/usr/share/ipa/lockout-conf.ldif /usr/share/ipa/master-entry.ldif
/usr/share/ipa/memberof-conf.ldif /usr/share/ipa/memberof-task.ldif
/usr/share/ipa/migration /usr/share/ipa/modrdn-conf.ldif
/usr/share/ipa/modrdn-krbprinc.ldif /usr/share/ipa/nis.uldif
/usr/share/ipa/preferences.html.template /usr/share/ipa/pwd-extop-conf.ldif /usr/share/
ipa/referint-conf.ldif /usr/share/ipa/replica-acis.ldif /usr/share/ipa/root-autobind.ldif
/usr/share/ipa/schema_compat.uldif /usr/share/ipa/sudobind.ldif /usr/share/ipa/ui
/usr/share/ipa/unique-attributes.ldif /usr/share/ipa/updates
/usr/share/ipa/user_private_groups.ldif /usr/share/ipa/uuid-conf.ldif
/usr/share/ipa/uuid-ipauniqueid.ldif /usr/share/ipa/version-conf.ldif
/usr/share/ipa/wsgi.py /usr/share/ipa/wsgi.pyc /usr/share/ipa/wsgi.pyo
/usr/share/ipa/html/browserconfig.html /usr/share/ipa/html/ca.crt
/usr/share/ipa/html/configure.jar /usr/share/ipa/html/ipa_error.css
/usr/share/ipa/html/krb.con /usr/share/ipa/html/krb5.ini /usr/share/ipa/html/krbrealm.con
/usr/share/ipa/html/preferences.html /usr/share/ipa/html/ssbrowser.html
/usr/share/ipa/html/unauthorized.html /usr/share/ipa/ipaclient/ipa.cfg
/usr/share/ipa/ipaclient/ipa.js /usr/share/ipa/migration/error.html
/usr/share/ipa/migration/index.html /usr/share/ipa/migration/invalid.html
/usr/share/ipa/migration/ipa_migrati
on.css /usr/share/ipa/migration/migration.py /usr/share/ipa/migration/migration.pyc
/usr/share/ipa/migration/migration.pyo /var/lock/subsys/ipa_kpasswd
/var/log/ipaclient-install.log /var/log/ipaserver-install.log /var/run/ipa_kpasswd.pid
/usr/share/ipa/ui/ /var/cache/ipa /var/cache/ipa/kpasswd /var/cache/ipa/sessions
/var/lib/ipa /var/lib/ipa-client /var/lib/dirsrv/slapd-PKI-IPA/db/ipaca
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/DBVERSION
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/aci.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/ancestorid.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/certstatus.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/cn.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/dateOfCreate.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/description.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/duration.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/entryrdn.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/extension.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/id2entry.db4 /var/lib/dirsrv/slapd-PKI-I
PA/db/ipaca/issuedby.db4 /var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/mail.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/metaInfo.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/notafter.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/notbefore.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/nsuniqueid.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/numsubordinates.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/objectclass.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/parentid.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/publicKeyData.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/requestid.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/requeststate.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/requesttype.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/serialno.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/sn.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/subjectname.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/uid.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/uniquemember.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allcertspkicaindex.
db4 /var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allinvalidcertsnotbeforepkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allinvalidcertspkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allnonrevokedcertspkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allvalidcertsnotafterpkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allvalidcertspkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#allvalidorrevokedcertspkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#caallpkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#cacompleteenrollmentpkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#cacompletepkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#caenrollmentpkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#capendingenrollmentpkicaindex.db4
/var/lib/dirsrv/slapd-PKI-IPA/db/ipaca/vlv#capendingpkicaindex.db4
/var/lib/dirsrv/slapd-RHTS-ENG-BOS-REDHAT-COM/db/userRoot/krbPrincipalName.db4
/var/lib/ipa/sysrestor
e /var/lib/ipa/sysrestore/05dc7b721c386301-nss.conf
/var/lib/ipa/sysrestore/3631a797347950f9-krb5.conf
/var/lib/ipa/sysrestore/4bf489ebf770b1ac-ntpd
/var/lib/ipa/sysrestore/6752f4f82809d5d7-dirsrv
/var/lib/ipa/sysrestore/6d81fae58431156f-kdc.conf
/var/lib/ipa/sysrestore/7a8ae0875bb8a711-ntp.conf
/var/lib/ipa/sysrestore/c453a0dba2552ccf-krb5kdc
/var/lib/ipa/sysrestore/feb41fffae648db3-limits.conf
/var/lib/ipa/sysrestore/sysrestore.index /var/lib/ipa/sysrestore/sysrestore.state
/var/lib/ipa-client/sysrestore /var/lib/ipa-client/sysrestore/c738a8ecbf7bc601-sssd.conf
/var/lib/ipa-client/sysrestore/sysrestore.index
</div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="switching-users.html"><strong>Prev</strong>4.3. Switching
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="managing-clients.html"><strong>Next</strong>Chapter 5. Managing
Clients in the IPA Domain</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ix01.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ix01.html
index 760b44b..6b83b27 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ix01.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/ix01.html
@@ -1,10 +1,10 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Index</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Index</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="Glossary.html"
title="Glossary" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Glossary.html"><strong>Prev</strong></a></li><li
class="next"></li></ul><div class="index"
id="id3027682"><div
class="titlepage"><div><div><h2
class="title">Index</h2></div></div></div><div
clas
s="index"></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Glossary.html"><strong>Prev</strong>Glossary</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li></ul></body></html>
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="Glossary.html"
title="Glossary" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Glossary.html"><strong>Prev</strong></a></li><li
class="next"></li></ul><div class="index"
id="id3303543"><div
class="titlepage"><div><div><h2
class="title">Index</h2></div></div></div><div
clas
s="index"></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Glossary.html"><strong>Prev</strong>Glossary</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerb-policies.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerb-policies.html
index dd453e5..421cbfe 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerb-policies.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerb-policies.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.2. Setting Kerberos Ticket Policies</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.2. Setting Kerberos Ticket Policies</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 6. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev" href="kerberos.html"
title="Chapter 6. Identity: Using FreeIPA for a Kerberos Domain" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"
title="6.3. Creating and Using Service Principals" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Sit
e" /></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="kerberos.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Next</strong></a></li></ul><div
class="section" id="kerb-policies"><div
class="titlepage"><div><div><h2 class="title"
id="kerb-policies">6.2. Setting Kerberos Ticket
Policies</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev" href="kerberos.html"
title="Chapter 7. Identity: Using FreeIPA for a Kerberos Domain" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"
title="7.3. Creating and Using Service Principals" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Sit
e" /></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="kerberos.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Next</strong></a></li></ul><div
class="section" id="kerb-policies"><div
class="titlepage"><div><div><h2 class="title"
id="kerb-policies">7.2. Setting Kerberos Ticket
Policies</h2></div></div></div><div class="para">
Kerberos tickets are issued subject to the restraints of the <em
class="firstterm">Kerberos ticket policy</em>. This policy defines the
maximum ticket lifetime and also the maximum renewal age, the period during which the
ticket is renewable. You can use the <code
class="command">ipa krbtpolicy-mod</code> command to modify the policy
to suit your environment. You can also use the <code
class="command">ipa krbtpolicy-reset</code> command to reset the policy
to the default values.
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Any change to the global Kerberos ticket policy requires a restart of the KDC for the
changes to take effect. Use the following command to restart the KDC:
@@ -23,4 +23,4 @@
</div><div class="para">
Changes to per-user policies take effect immediately for newly-requested tickets, for
example, when the user next runs <code
class="command">kinit</code>.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="kerberos.html"><strong>Prev</strong>Chapter 6. Identity:
Using FreeIPA for a Kerberos...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Next</strong>6.3. Creating
and Using Service Principals</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="kerberos.html"><strong>Prev</strong>Chapter 7. Identity:
Using FreeIPA for a Kerberos...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Next</strong>7.3. Creating
and Using Service Principals</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerberos.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerberos.html
index 1b769f7..1d4b07b 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerberos.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/kerberos.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 6. Identity: Using FreeIPA for a Kerberos
Domain</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 7. Identity: Using FreeIPA for a Kerberos
Domain</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="searching.html"
title="5.8. Searching for Users and Groups" /><link rel="next"
href="kerb-policies.html" title="6.2. Setting Kerberos Ticket
Policies" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="searching.html"><strong>Prev</strong></a></li><li
class="next"><a accessk
ey="n"
href="kerb-policies.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="kerberos"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 6. Identity: Using FreeIPA for a Kerberos
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="kerberos.html#about-kerberos">6.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="kerb-policies.html">6.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html">6.3.
Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Servic
e">6.3.1. Creating a FreeIPA
Service</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html">6.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="rotating-keys.html">6.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html">6.6.
Kerberos Errors</a></span></dt></dl></div><div
class="section" id="about-kerberos"><div
class="titlepage"><div><div><h2 class="title"
id="about-kerberos">6.1.
About Kerberos</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="searching.html"
title="6.10. Searching for Users and Groups" /><link rel="next"
href="kerb-policies.html" title="7.2. Setting Kerberos Ticket
Policies" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="searching.html"><strong>Prev</strong></a></li><li
class="next"><a access
key="n"
href="kerb-policies.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="kerberos"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 7. Identity: Using FreeIPA for a Kerberos
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="kerberos.html#about-kerberos">7.1. About
Kerberos</a></span></dt><dt><span
class="section"><a href="kerb-policies.html">7.2. Setting
Kerberos Ticket Policies</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html">7.3.
Creating and Using Service
Principals</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Servi
ce">7.3.1. Creating a FreeIPA
Service</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html#sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2.
Configuring an NFS Service Principal on the FreeIPA
Server</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html">7.4.
Refreshing Kerberos Tickets</a></span></dt><dt><span
class="section"><a href="rotating-keys.html">7.5. Rotating
Keys</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html">7.6.
Kerberos Errors</a></span></dt></dl></div><div
class="section" id="about-kerberos"><div
class="titlepage"><div><div><h2 class="title"
id="about-kerberos">7.1
. About Kerberos</h2></div></div></div><div
class="para">
The Kerberos server is a part of FreeIPA. When you run the <code
class="command">kinit</code> command you invoke a client that connects
to the Kerberos server. As a result of the authentication the client receives a <em
class="firstterm">ticket</em>. This ticket is a temporary pass; or a
better description might be a pass-book. The best example from real life might be a pass
to a movie festival. A single pass to such a festival would allow someone to attend
different movies at their discretion. Kerberos is very similar. When a user tries to
access any resource that is protected by Kerberos, that resource requires the user to
present a valid ticket, the same as in the movies.
</div><div class="para">
To obtain such a ticket the user needs to prove their identity; that they are who they
claim to be. Asking the user to constantly authenticate with their password would soon
prove to be too annoying and hard to manage. This is why a multi-tier process exists,
where the user first authenticates and obtains a so-called <em
class="firstterm">ticket-granting ticket</em> (TGT). This ticket can
then be presented to the Kerberos server at any time and a new ticket specific to the
resource that the user wants to access can be acquired. All of these tickets have a
configurable expiration time, so the user occasionally needs to re-authenticate, but it is
much less of a burden.
@@ -51,4 +51,4 @@
Failure to export an updated keytab can cause problems that are difficult to isolate.
For example, existing service connections may continue to function, but no new connections
may be possible.
</div><div class="para">
Due to the critical role that keytabs play in authenticating users and services, and
the issues that can arise if they are compromised, ensure that all keytab files are
appropriately secured, and have suitable file ownership and permissions established.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="searching.html"><strong>Prev</strong>5.8. Searching for
Users and Groups</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerb-policies.html"><strong>Next</strong>6.2. Setting
Kerberos Ticket Policies</a></li></ul></body></html>
+ </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="searching.html"><strong>Prev</strong>6.10. Searching for
Users and Groups</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerb-policies.html"><strong>Next</strong>7.2. Setting
Kerberos Ticket Policies</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging-in.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging-in.html
index 49561cc..0d404b9 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging-in.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging-in.html
@@ -1,28 +1,21 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.2. Logging into the IPA UI</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="basic-usage.html" title="Chapter 3. Basic Usage" /><link
rel="prev" href="basic-usage.html" title="Chapter 3. Basic
Usage" /><link rel="next" href="switching-users.html"
title="3.3. Switching Users" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="basic-usage.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="switching-users
.html"><strong>Next</strong></a></li></ul><div
class="section" id="logging-in"><div
class="titlepage"><div><div><h2 class="title"
id="logging-in">3.2. Logging into the IPA
UI</h2></div></div></div><div class="para">
- To be able to perform any administrative task you need to authenticate to the server.
During the configuration step you were prompted to create two users. The first of these,
<code class="literal">Directory Manager</code>, is the superuser,
used to perform rare, low-level tasks. The second user, <code
class="literal">admin</code>, is used to perform normal administrative
activities.
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.2. Logging into the IPA UI</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="basic-usage.html" title="Chapter 4. Basic Usage" /><link
rel="prev" href="basic-usage.html" title="Chapter 4. Basic
Usage" /><link rel="next" href="switching-users.html"
title="4.3. Switching Users" /></head><body><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img src="Com
mon_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="basic-usage.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="switching-users.html"><strong>Next</strong></a></li></ul><div
class="section" id="logging-in"><div
class="titlepage"><div><div><h2 class="title"
id="logging-in">4.2. Logging into the IPA
UI</h2></div></div></div><div class="para">
+ To be able to perform any administrative task you need to authenticate to the server.
During the configuration step you were prompted to create two users. The first of these,
Directory Manager, is the superuser, used to perform rare, low-level tasks. The second
user, admin, is used to perform normal administrative activities.
</div><div class="para">
- To authenticate as the <code class="literal">admin</code> user:
- </div><div class="procedure"><ol class="1"><li
class="step"><div class="para">
+ To authenticate as the admin user:
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Open a new terminal window. This is to ensure that all default aspects of the
environment (especially paths) are set correctly.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
In this window, type <code class="command">kinit
admin</code>.
- </div></li><li class="step"><div
class="para">
- When you are prompted to enter a password, use the password that you specified
during the configuration step for the <code
class="literal">admin</code> user.
+ </div></li><li class="listitem"><div
class="para">
+ When you are prompted to enter a password, use the password that you specified
during the configuration step for the admin user.
</div></li></ol></div><div class="para">
As a result of this operation you will acquire what is known as a Kerberos <em
class="firstterm">ticket</em>. You can use the <code
class="command">klist</code> command to inspect the details of the
ticket that you have acquired.
</div><div class="para">
- You can now authenticate using the newly-created user and temporary password. Type
<code class="command">kinit <user login></code> to log
in to IPA. This will prompt you for a password and then immediately request a password
change.
+ You can now authenticate using the newly-created user and temporary password. Type
<code class="command">kinit</code> <em
class="replaceable"><code>userLogin</code></em> to log in
to IPA. This will prompt you for a password and then immediately request a password
change.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The <span
class="application"><strong>Kerberos</strong></span> client
libraries used by the <code class="command">kinit</code> utility
have some limitations. One of these limitations is the fact that the on-disc ticket
storage is overwritten with any new invocation of <code
class="command">kinit</code>. This means that if you authenticated as
<code class="systemitem">admin</code>, then added user <code
class="systemitem">foo</code>, set their password and then tried to
authenticate as that user, the administrator's ticket would be lost. To prevent this
from happening, a special environment variable, <code
class="varname">KRB5CCNAME</code>, can be used. This allows you to keep
credential caches separate in different shells. Refer to the <code
class="command">kinit</code> man page for more information.
</div></div></div><div class="para">
You can browse the IPA man pages and help system to explore other IPA commands. Please
take some time to become familiar with the ways other IPA objects can be created and
modified.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="basic-usage.html"><strong>Prev</strong>Chapter 3. Basic
Usage</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="switching-users.html"><strong>Next</strong>3.3. Switching
Users</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="basic-usage.html"><strong>Prev</strong>Chapter 4. Basic
Usage</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="switching-users.html"><strong>Next</strong>4.3. Switching
Users</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging.html
index 6e67051..0dc9fa1 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/logging.html
@@ -1,27 +1,27 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.13. IPA Server Logging</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.9. FreeIPA Server Logging</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="promoting-replica.html"
title="12.12. Promoting a Read-Only Replica to an IPA Server" /><link
rel="next"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"
title="Appendix A. Frequently Asked Questions" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous">
<a accesskey="p"
href="promoting-replica.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Next</strong></a></li></ul><div
class="section" id="logging"><div
class="titlepage"><div><div><h2 class="title"
id="logging">12.13. IPA Server
Logging</h2></div></div></div><div class="para">
- If you are using the IPA command-line tools or the WebUI to manage IPA data then you
should refer to the following sections to help troubleshoot any problems.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev" href="promoting-replica.html"
title="13.8. Promoting a Read-Only Replica to a FreeIPA Server" /><link
rel="next"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"
title="Appendix A. Frequently Asked Questions" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="prev
ious"><a accesskey="p"
href="promoting-replica.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Next</strong></a></li></ul><div
class="section" id="logging"><div
class="titlepage"><div><div><h2 class="title"
id="logging">13.9. FreeIPA Server
Logging</h2></div></div></div><div class="para">
+ If you are using the FreeIPA command-line tools or the WebUI to manage FreeIPA data
then you should refer to the following sections to help troubleshoot any problems.
</div><div class="para">
You should first check the <code
class="filename">/var/log/httpd/error_log</code> file. This may contain
more information on the error and/or a python stacktrace.
</div><div class="para">
To see the LDAP queries that are being made by the framework you can inspect the
<code class="filename">/var/log/dirsrv/slapd-INSTANCE/access</code>
file. Note that this file is buffered and so it only writes to disk about every 30
seconds.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Server-Increasing_Server_Debugging_Output"><h5
class="formalpara">Increasing Server Debugging Output</h5>
+ </div><div class="formalpara"
id="Server-Increasing_Server_Debugging_Output"><h5
class="formalpara">Increasing Server Debugging Output</h5>
To increase the server debugging output you can create the <code
class="filename">/etc/ipa/server.conf</code> file and include the
following entry:
<pre class="programlisting">[global]
debug=True</pre>
You need to restart the <code class="systemitem">httpd</code>
daemon for this change to take effect.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Server-Increasing_Client_Debugging_Output"><h5
class="formalpara">Increasing Client Debugging Output</h5>
+ </div><div class="formalpara"
id="Server-Increasing_Client_Debugging_Output"><h5
class="formalpara">Increasing Client Debugging Output</h5>
You can increase debugging output on the client with the <code
class="option">-v</code> global option:
-<pre class="screen"><code class="command">$ ipa -v
user-show admin</code></pre>
+<pre class="screen">$ ipa -v user-show admin</pre>
You can use the <code class="option">-v</code> option twice to
display the XML-RPC exchange:
-<pre class="screen"><code class="command">$ ipa -vv
user-show admin</code></pre>
+<pre class="screen">$ ipa -vv user-show admin</pre>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="promoting-replica.html"><strong>Prev</strong>12.12. Promoting
a Read-Only Replica to an IPA Se...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Next</strong>Appendix A. Frequently
Asked Questions</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="promoting-replica.html"><strong>Prev</strong>13.8. Promoting
a Read-Only Replica to a FreeIPA ...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Next</strong>Appendix A. Frequently
Asked Questions</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/managing-clients.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/managing-clients.html
index 0ee1488..746cbde 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/managing-clients.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/managing-clients.html
@@ -1,33 +1,33 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 4. Managing Clients in the FreeIPA Domain</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 5. Managing Clients in the FreeIPA Domain</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="switching-users.html"
title="3.3. Switching Users" /><link rel="next"
href="enrolling-machines.html" title="4.2. Enrolling Machines"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="switching-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href=
"enrolling-machines.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="managing-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 4. Managing Clients in the FreeIPA
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2.
Removing Hosts from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="managing-clients.html#sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing
_DNS_Zones">4.1.3. Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="enrolling-machines.html">4.2.
Enrolling Machines</a></span></dt><dd><dl><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">4.2.1.
Manual Host Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">4.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#sect-Enterprise_Identity_Management_Guide-Enrollment_Scenarios-Bulk_Host_Deployment">4.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="renaming-machines.html">4.3.
Renaming Machines</a></span></dt><dt><span
class="section"><a hr
ef="config-virt-machines.html">4.4. Reconfiguring Virtual
Machines</a></span></dt><dt><span
class="section"><a href="certs.html">4.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dd><dl><dt><span
class="section"><a
href="certs.html#sect-Enterprise_Identity_Management_Guide-Configuring_Machine_Authentication-Authentication_Usage_Scenarios">4.5.1.
Authentication Usage
Scenarios</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html">4.6.
Client Problems</a></span></dt><dt><span
class="section"><a href="uninstalling-clients.html">4.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Command_Line_Tools-Working_with_DNS">4.1. Working
with DNS</h2><
/div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="switching-users.html"
title="4.3. Switching Users" /><link rel="next"
href="enrolling-machines.html" title="5.2. Enrolling Machines"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="switching-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href=
"enrolling-machines.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="managing-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 5. Managing Clients in the FreeIPA
Domain</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="managing-clients.html#IPA_Command_Line_Tools-Working_with_DNS">5.1.
Working with DNS</a></span></dt><dd><dl><dt><span
class="section"><a
href="managing-clients.html#Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1.
Adding Hosts to a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="managing-clients.html#Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">5.1.2.
Removing Hosts from a FreeIPA DNS</a></span></dt><dt><span
class="section"><a
href="managing-clients.html#Working_with_DNS-Managing_DNS_Zones">5.1.3.
Managing DNS
Zones</a></span></dt></dl></dd><dt><span
class="section"><a href="enrolling-machines.html">5.2.
Enrolling Machines</a></span></dt><dd><d
l><dt><span class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Manual_Host_Enrollment_with_Privileged_Administrator">5.2.1.
Manual Host Enrollment with Privileged
Administrator</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Manual_Host_Enrollment_with_Separation_of_Duties">5.2.2.
Manual Host Enrollment with Separation of
Duties</a></span></dt><dt><span
class="section"><a
href="enrolling-machines.html#Enrollment_Scenarios-Bulk_Host_Deployment">5.2.3.
Bulk Host
Deployment</a></span></dt></dl></dd><dt><span
class="section"><a href="renaming-machines.html">5.3.
Renaming Machines</a></span></dt><dt><span
class="section"><a href="config-virt-machines.html">5.4.
Reconfiguring Virtual Machines</a></span></dt><dt><span
class="section"><a href="certs.html">5.5. Configuring
Certificate-Based Machine
Authentication</a></span></dt><dt><span
class="section"><a
href="General_Troubleshooting_Tips-Client_Problems.html">5.6. C
lient Problems</a></span></dt></dl></div><div
class="section"
id="IPA_Command_Line_Tools-Working_with_DNS"><div
class="titlepage"><div><div><h2 class="title"
id="IPA_Command_Line_Tools-Working_with_DNS">5.1. Working with
DNS</h2></div></div></div><div class="para">
A number of benefits exist if you take advantage of FreeIPA's ability to
automatically install and configure a DNS, in particular the ability to ease the
modification of DNS records when adding hosts to FreeIPA. For example, options exist to
add and remove IP addresses, A entries, PTR entries, etc. These options are not available
if you are not using a FreeIPA-based DNS.
</div><div class="para">
IPA stores all DNS information as discrete records in LDAP, and communicates with LDAP
using the <span class="package">bind-dyndb-ldap</span> plug-in and
the <code class="filename">install/share/60basev2.ldif</code>
schema. You can install and configure the DNS as part of the FreeIPA server installation,
using the <code class="option">--setup-dns</code> option, or you can
add it later using the <code class="command">ipa-dns-install</code>
command.
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
The following options are currently only available with IPv4 addresses.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">4.1.1. Adding
Hosts to a FreeIPA DNS</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Working_with_DNS-Adding_Hosts_to_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Adding_Hosts_to_an_IPA_DNS">5.1.1. Adding Hosts to a
FreeIPA DNS</h3></div></div></div><div
class="para">
If you are using a FreeIPA-based DNS system, you can use the <code
class="option">--ip-address</code> and <code
class="option">--force</code> options to the <code
class="command">ipa host-add</code> command to provide the IP address
and hostname of the FreeIPA machine to the DNS. For example,
<pre class="screen"><code class="command">$ ipa host-add
--force --ip-address=192.168.166.31
puma.example.com </code></pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">4.1.2. Removing
Hosts from a FreeIPA DNS</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Working_with_DNS-Removing_Hosts_from_an_IPA_DNS"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Removing_Hosts_from_an_IPA_DNS">5.1.2. Removing Hosts
from a FreeIPA DNS</h3></div></div></div><div
class="para">
IPA provides the <code class="command">ipa host-del</code>
command to delete FreeIPA hosts. You can pass the <code
class="option">--updatedns</code> option to this command to remove the
associated records from the DNS. It will attempt to remove any record, A, AAAA, PTR, NS,
SRV, and other entries that reference this host. For example,
<pre class="screen"><code class="command">$ ipa host-del
--updatedns puma</code></pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Managing_DNS_Zones">4.1.3. Managing
DNS Zones</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Working_with_DNS-Managing_DNS_Zones"><div
class="titlepage"><div><div><h3 class="title"
id="Working_with_DNS-Managing_DNS_Zones">5.1.3. Managing DNS
Zones</h3></div></div></div><div class="para">
IPA provides all the necessary commands to create and manage zones in a
FreeIPA-managed DNS server. You can create and delete zones and add entries to any of
these zones using the appropriate FreeIPA commands.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_DNS_Zones">4.1.3.1. Adding
DNS Zones</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Managing_DNS_Zones-Adding_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Adding_DNS_Zones">5.1.3.1. Adding DNS
Zones</h4></div></div></div><div class="para">
Use the <code class="command">ipa dnszone-add</code> command
to add a new zone to your DNS server. You can pass optional attributes on the command
line, and you will be prompted for any required information. The following example
demonstrates adding a new zone to your top-level domain.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You need to restart the <code class="systemitem">named</code>
service whenever you create a new zone, otherwise the DNS server will not reply
successfully to queries asking for records in the new zone. This is a one-time operation;
any subsequent changes to the zone do not require any further action to be effective.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_add_the_sub_domain_translation_to_the_ipadocs.org_domain"><h6>Procedure 4.1. To
add the sub-domain "translation" to the
ipadocs.org domain</h6><ol
class="1"><li class="step"><div
class="para">
+ </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_add_the_sub_domain_translation_to_the_ipadocs.org_domain"><h6>Procedure 5.1. To
add the sub-domain "translation" to the
ipadocs.org domain</h6><ol
class="1"><li class="step"><div
class="para">
Ensure you have a valid Kerberos ticket:
<pre class="screen"><code class="command">$ kinit
admin</code>
Password for admin@IPADOCS.ORG:</pre>
@@ -55,12 +55,12 @@ Password for admin@IPADOCS.ORG:</pre>
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-Using_Dynamic_DNS_Updates"><h5
class="formalpara">Using Dynamic DNS Updates</h5>
Dynamic DNS updates are not enabled by default for new DNS zones served by FreeIPA;
that is, zones added by the <code class="command">ipa
dnszone-add</code> command. This may lead to errors in the <code
class="command">ipa-client-install</code> script when it joins this
domain and tries to add a DNS record pointing to this new client.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_enable_dynamic_DNS_updates"><h6>Procedure 4.2. To
enable dynamic DNS updates</h6><ul><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Adding_DNS_Zones-To_enable_dynamic_DNS_updates"><h6>Procedure 5.2. To
enable dynamic DNS updates</h6><ul><li class="step"><div
class="para">
Use the following command to enable dynamic updates:
</div><pre class="screen"><code
class="command">$ ipa dnszone-mod
clients.example.com --allow-dynupdate \
</code>
<code class="command">--update-policy="grant
TESTRELM krb5-self * A; grant TESTRELM krb5-self *
AAAA;"</code></pre><div class="para">
In this example, <code
class="systemitem">clients.example.com</code> is the custom DNS domain
managed by the FreeIPA server and TESTRELM is the Kerberos realm.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_Records_to_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Adding_Records_to_DNS_Zones">4.1.3.2. Adding
Records to DNS Zones</h4></div></div></div><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="Managing_DNS_Zones-Adding_Records_to_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Adding_Records_to_DNS_Zones">5.1.3.2. Adding Records
to DNS Zones</h4></div></div></div><div
class="para">
Use the <code class="command">ipa dnsrecord-add</code> command
to add various types of records to DNS zones. The following examples demonstrate adding
some of these types of records.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Adding_Records_to_DNS_Zones-Adding_IPv4_Type_A_Resource_Records"><h5
class="formalpara">Adding IPv4 (Type A) Resource Records</h5>
Type A resource records map hostnames to IPv4 addresses. To add a type A resource
record, run the following command:
@@ -86,7 +86,7 @@ Password for admin@IPADOCS.ORG:</pre>
<pre class="programlisting">A, AAAA, A6, AFSDB, APL, CERT, CNAME, DHCID,
DLV, DNAME, DNSKEY, DS, HIP, IPSECKEY, KX, LOC,
MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF, SRV, SSHFP, TA,
TXT</pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Deleting_Records_from_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Managing_DNS_Zones-Deleting_Records_from_DNS_Zones">4.1.3.3. Deleting
Records from DNS Zones</h4></div></div></div><div
class="para">
+ </div></div><div class="section"
id="Managing_DNS_Zones-Deleting_Records_from_DNS_Zones"><div
class="titlepage"><div><div><h4 class="title"
id="Managing_DNS_Zones-Deleting_Records_from_DNS_Zones">5.1.3.3. Deleting
Records from DNS Zones</h4></div></div></div><div
class="para">
Use the <code class="command">ipa dnsrecord-del</code> command
to remove records from DNS zones. The following examples demonstrate how to remove the
records added in the preceding examples.
</div><div class="para">
To remove the A type record from the "www" record, run the following
command:
@@ -102,4 +102,4 @@ MX, NAPTR, NS, NSEC, NSEC3, NSEC3PARAM, PTR, RRSIG, RP, SIG, SPF, SRV,
SSHFP, TA
You can also delegate zones if you want to allow other areas of your company
intranet to reach your DNS server, or if you want to allow access from outside your
firewalls. Refer to the <a
href="http://www.isc.org/software/bind/documentation">ISC BIND
documentation</a> for further information.
</div><div class="para">
Refer to the <code class="command">ipa help dns</code> help
page for more information about working with DNS and FreeIPA.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="switching-users.html"><strong>Prev</strong>3.3. Switching
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="enrolling-machines.html"><strong>Next</strong>4.2. Enrolling
Machines</a></li></ul></body></html>
+ </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="switching-users.html"><strong>Prev</strong>4.3. Switching
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="enrolling-machines.html"><strong>Next</strong>5.2. Enrolling
Machines</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/migrintg-from-nis.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/migrintg-from-nis.html
index 604a179..a401b7a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/migrintg-from-nis.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/migrintg-from-nis.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.3. Migrating from NIS to IPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>10.3. Migrating from NIS to IPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="nis.html" title="Chapter 9. Identity: Integrating with NIS Domains
and Netgroups" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"
title="9.2. Configuring the Network Information Service (NIS)" /><link
rel="next" href="authz.html" title="Chapter 10. Policy:
Configuring Authorization" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul clas
s="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="authz.html"><strong>Next</strong></a></li></ul><div
class="section" id="migrintg-from-nis"><div
class="titlepage"><div><div><h2 class="title"
id="migrintg-from-nis">9.3. Migrating from NIS to
IPA</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="nis.html" title="Chapter 10. Identity: Integrating with NIS Domains
and Netgroups" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"
title="10.2. Configuring the Network Information Service (NIS)" /><link
rel="next" href="authz.html" title="Chapter 11. Policy:
Configuring Authorization" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul cl
ass="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="authz.html"><strong>Next</strong></a></li></ul><div
class="section" id="migrintg-from-nis"><div
class="titlepage"><div><div><h2 class="title"
id="migrintg-from-nis">10.3. Migrating from NIS to
IPA</h2></div></div></div><div class="para">
The IPA development team researched the topic of how netgroups are typically used in
order to better determine an optimal migration design solution. This research shows that
the main use cases for netgroups are the aggregation of users and the aggregation of
hosts, but not both at the same time. IPA does not provide a special script or command to
facilitate the migration of customers' existing netgroups to IPA. This operation must
be performed by the system administrator himself or with the help of professional
services. This chapter provides some guidelines to ease the process of migrating netgroups
to IPA.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1. Preparing
Your Environment</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1. Preparing
Your Environment</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
These procedures are guidelines only, and are provided to help clean your
environment and make it more manageable. It is not a definitive set of instructions, and
administrators need to be creative and factor in the real constraints present in their
environment. If any steps described below are not possible due to independent conditions,
we recommend migrating netgroups on a one-to-one basis. This is described later in this
chapter.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment"><h6>Procedure 9.1. To
prepare your environment</h6><ol class="1"><li
class="step"><div class="para">
+ </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment"><h6>Procedure 10.1. To
prepare your environment</h6><ol class="1"><li
class="step"><div class="para">
Inspect your client applications and determine which kind of grouping information
they need from the central server. For example, if netgroups exist that contain only
users, and any applications that rely on these netgroups can be converted to use UNIX
groups instead of netgroups, then we recommend doing so. If this is not possible, we still
recommend creating UNIX groups out of the netgroups. If no applications use them, we
recommend deleting these netgroups altogether. Refer to the following example:
</div><ol class="a"><li class="step"><div
class="para">
Given the following netgroup: <code class="systemitem">(host1,
user1, )(host2, user2,)(host3, user3, )...</code>, create a group consisting of the
users <code class="systemitem">user1</code>, <code
class="systemitem">user2</code>, and <code
class="systemitem">user3</code> (assuming it does not already exist).
@@ -41,12 +41,12 @@
Add users and hosts as direct members of the netgroup, or, alternatively, put
them into groups and then add those groups as members to the netgroup.
</div><div class="para">
For IPA clients, both methods result in the same thing — having the users and
hosts managed in the netgroup — but from an administrative perspective, it may be simpler
in some environments to use one option instead of the other.
- </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2. Migrating
Netgroups</h3></div></div></div><div
class="para">
+ </div></li></ol></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2. Migrating
Netgroups</h3></div></div></div><div
class="para">
There are three main approaches that can be taken to the actual migration procedure:
</div><div class="orderedlist"><ol><li
class="listitem"><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Dump the netgroups from the source into an LDIF file.
</div></li><li class="listitem"><div
class="para">
- Create a script that follows the instructions in <a class="xref"
href="migrintg-from-nis.html#proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment">Procedure 9.1,
“To prepare your environment”</a> to convert the LDIF format into an LDIF file that
contains IPA native objects.
+ Create a script that follows the instructions in <a class="xref"
href="migrintg-from-nis.html#proc-Enterprise_Identity_Management_Guide-Preparing_Your_Environment-To_prepare_your_environment">Procedure 10.1,
“To prepare your environment”</a> to convert the LDIF format into an LDIF file that
contains IPA native objects.
</div></li><li class="listitem"><div
class="para">
Run the conversion script and load the resulting LDIF file into IPA using the
<code class="command">ldapmodify</code> command.
</div><div class="para">
@@ -59,4 +59,4 @@
Refer to the IPA CLI help system for more details. Use the <code
class="command">ipa help</code> command to display a list of available
topics.
</div></li></ol></div></li><li
class="listitem"><div class="orderedlist"><ol><li
class="listitem"><div class="para">
Use the UI to manually create a new structure of netgroups.
- </div></li></ol></div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Prev</strong>9.2. Configuring
the Network Information Service ...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="authz.html"><strong>Next</strong>Chapter 10. Policy:
Configuring Authorization</a></li></ul></body></html>
+ </div></li></ol></div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Prev</strong>10.2. Configuring
the Network Information Service...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="authz.html"><strong>Next</strong>Chapter 11. Policy:
Configuring Authorization</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/nis.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/nis.html
index 61522e0..93c5c69 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/nis.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/nis.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 9. Identity: Integrating with NIS Domains and
Netgroups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 10. Identity: Integrating with NIS Domains and
Netgroups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"
title="8.7. Winsync Agreement Failures" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"
title="9.2. Configuring the Network Information Service (NIS)"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.
png" alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="nis"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 9. Identity: Integrating with NIS Domains and
Netgroups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="nis.html#about-nis">9.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_
IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2. The IPA Approach to
Netgroups</a></span></dt><dt><span
class="section"><a href="nis.html#adding-netgroups">9.1.3.
Adding Netgroups</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html">9.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="migrintg-from-nis.html">9.
3. Migrating from NIS to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">9.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">9.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></div><div
class="section" id="about-nis"><div
class="titlepage"><div><div><h2 class="title"
id="about-nis">9.1. About NIS and
IPA</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">9.1.1. What
are Netgroups?</h3></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"
title="9.7. Winsync Agreement Failures" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"
title="10.2. Configuring the Network Information Service (NIS)"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right
.png" alt="Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="nis"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 10. Identity: Integrating with NIS Domains and
Netgroups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="nis.html#about-nis">10.1. About NIS and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1.
What are Netgroups?</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-
How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2. The IPA Approach to
Netgroups</a></span></dt><dt><span
class="section"><a href="nis.html#adding-netgroups">10.1.3.
Adding Netgroups</a></span></dt><dt><span
class="section"><a
href="nis.html#sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4.
IPA Netgroup
Commands</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html">10.2.
Configuring the Network Information Service
(NIS)</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html#sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1.
Exposing Automount Maps to NIS
Clients</a></span></dt></dl></dd><dt><span
class="section"><a href="migrintg-from-nis
.html">10.3. Migrating from NIS to
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Preparing_Your_Environment">10.3.1.
Preparing Your Environment</a></span></dt><dt><span
class="section"><a
href="migrintg-from-nis.html#sect-Enterprise_Identity_Management_Guide-Migrating_Netgroups_to_IPA-Migrating_Netgroups">10.3.2.
Migrating
Netgroups</a></span></dt></dl></dd></dl></div><div
class="section" id="about-nis"><div
class="titlepage"><div><div><h2 class="title"
id="about-nis">10.1. About NIS and
IPA</h2></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-What_are_Netgroups">10.1.1. What
are Netgroups?</h3></div></div></div><div
class="para">
Netgroups are a concept introduced in the directory service NIS. They were designed
to contain users, hosts (machines) and other netgroups. A netgroup is a user-host-domain
triplet. Refer to the following for more details about netgroups and their uses:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<a
href="http://compute.cnr.berkeley.edu/cgi-bin/man-cgi?netgroup+4&quo...
@@ -19,11 +19,11 @@
Despite this difference, it is important to underline that there are two plug-ins in
IPA that make the data in the new format available via NIS or the old standard RFC2307 and
RFC2307bis LDAP schema. For details, refer to the documentation and examples at: <a
href="https://fedorahosted.org/slapi-nis/">https://fedorahos...;.
The entries stored using the new schema are converted into the standard NIS netgroup map
and served via the NIS protocol by the first plug-in described on the slapi-nis project
page and the compatibility plug-in can be used to create a virtual LDAP view that matches
the standard 2307 or 2307bis schema for netgroups using the IPA-specific schema.
</div><div class="para">
Historically, netgroups have been used to define groups of hosts or users. The
advantage of netgroups for user aggregation has been that netgroups allow nesting while
normal UNIX user groups do not. Netgroups also provide the only way to aggregate hosts.
There is no notion of host groups in NIS, although for effective centralized system
management they are definitely needed. It is important to understand that netgroups are
collections of entities, be they users, hosts, or both, but there is no relation between
particular user-host pairs defined in the netgroup triplet.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">9.1.2. The
IPA Approach to Netgroups</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-How_IPA_Uses_Netgroups-The_IPA_Approach_to_Netgroups">10.1.2. The
IPA Approach to Netgroups</h3></div></div></div><div
class="para">
IPA defines both user groups and host groups, each of which allow nesting. This is a
much cleaner way of aggregation and allows better separation of duties and access control.
In an IPA deployment, netgroups are a much less attractive approach to grouping than with
other LDAP-based systems compliant with RFC 2307 (this defines the LDAP schema for users,
groups, netgroups and other maps).
</div><div class="para">
Client-side applications, for example, SUDO, need netgroups because there is no
alternative to host grouping on the client side. Consequently, netgroups are far from
obsolete on the client side. A lot of effort is still required within SSSD and IPA to
provide clean interfaces to reliably (both online and offline) relay centrally-managed
information to applications running on a client machine. IPA therefore provides a way to
define and store netgroups, but they are viewed as secondary to user groups and host
groups.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups">9.1.2.1. How
IPA Stores Netgroups</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Approach_to_Netgroups-How_IPA_Stores_Netgroups">10.1.2.1. How
IPA Stores Netgroups</h4></div></div></div><div
class="para">
IPA stores netgroups in a different format from that specified in RFC2307 and
RFC2307bis. The netgroup entries defined by the IPA schema allow relating different
objects (users, groups, hosts, host groups) to each other. IPA also provides what is known
as a <em class="firstterm">compat (compatibility)</em> plug-in. This
plug-in creates a virtual view of the data stored in native IPA entries in the format
expected by the RFC-compliant clients. This means that even though the internal data
representation of netgroups is different from the RFC, this deviation does not affect
clients due to the presence of the <code
class="systemitem">compat</code> plug-in.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-How_IPA_Stores_Netgroups-Comparison_of_Schema"><h5
class="formalpara">Comparison of Schema</h5>
To realize the differences, we can compare the standard RFC schema for netgroups
and the schema used by IPA. IPA defines the following object class:
@@ -57,7 +57,7 @@
<a
href="http://www.freeipa.org/page/DS_Design_Summary#Netgroups"&...
</div></li></ul></div>
- </div></div></div><div class="section"
id="adding-netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="adding-netgroups">9.1.3. Adding
Netgroups</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="adding-netgroups"><div
class="titlepage"><div><div><h3 class="title"
id="adding-netgroups">10.1.3. Adding
Netgroups</h3></div></div></div><div
class="para">
NIS groups traditionally contain a so-called netgroup triple of the format: (machine,
user, domain)
</div><pre class="screen">machine - machine name, a host name
user - user name
@@ -73,7 +73,7 @@ NIS domain name: panda
Member User: admin
Member Host: icefloat.panda</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
There is no necessary relationship between the machine and the user. Only one of
those fields is usually used at a time to avoid confusion.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">9.1.4. IPA
Netgroup Commands</h3></div></div></div><div
class="para">
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Netgroups-IPA_Netgroup_Commands">10.1.4. IPA
Netgroup Commands</h3></div></div></div><div
class="para">
The IPA netgroup management plug-in conforms to the Create, Read, Update, Delete
(CRUD) command-naming conventions used in all other plug-ins that ship with the default
IPA installation. You can use the following command to display a list of the IPA commands
available for working with netgroups:
</div><div class="para">
@@ -121,7 +121,7 @@ Member Host: icefloat.panda</pre><div
class="note"><div class="admonition_header
--netgroups=NETGROUPS
]</p></div></pre><div class="para">
USERS, GROUPS, HOSTS, HOSTGROUPS, and NETGROUPS are comma-separated lists of names of
the appropriate objects.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples">9.1.4.1. Examples</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Netgroup_Commands-Examples">10.1.4.1. Examples</h4></div></div></div><div
class="para">
The following examples provide an introduction to using the <code
class="command">ipa netgroup-*</code> commands:
</div><pre class="screen">
<code class="command"># ipa netgroup-add net0 --desc="test
netgroup"</code>
@@ -158,4 +158,4 @@ Number of members removed 1
<code class="command"># ipa netgroup-show net0</code>
ipa: ERROR: no such entry
-</pre></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Prev</strong>8.7. Winsync
Agreement Failures</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Next</strong>9.2. Configuring
the Network Information Service
...</a></li></ul></body></html>
+</pre></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Prev</strong>9.7. Winsync
Agreement Failures</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html"><strong>Next</strong>10.2. Configuring
the Network Information
Service...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/policy.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/policy.html
index d32e16d..3e81d45 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/policy.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/policy.html
@@ -1,12 +1,12 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.3. Defining Policies: Authorization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Drafts');
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>1.4. Defining Policies: Authorization</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
- addID('Drafts.1');
+ addID('Fedora.15');
- addID('Drafts.1.books');
- addID('Drafts.1.Enterprise_Identity_Management_Guide');
- </script><link rel="home" href="index.html"
title="Enterprise Identity Management Guide" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to IPA"
/><link rel="prev" href="ipa-components.html"
title="1.2. Identity Management: Authentication" /><link
rel="next" href="deployment-scenarios.html" title="1.4. Planning
IPA" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-components.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="deployment-scenarios.html"><strong>Next</strong></a></li></ul><div
class="section" id="policy"><div
class="titlepage"><div><div><h2 class="title"
id="policy">1.3. Defining Policies:
Authorization</h2></div></div></div><div
class="para">
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="introduction.html" title="Chapter 1. Introduction to FreeIPA"
/><link rel="prev" href="ipa-components.html"
title="1.3. Identity Management: Authentication" /><link
rel="next" href="installing-ipa.html"
title="Chapter 2. Installing a FreeIPA Server" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-components.html"><strong>Prev</strong></a></li><
li class="next"><a accesskey="n"
href="installing-ipa.html"><strong>Next</strong></a></li></ul><div
class="section" id="policy"><div
class="titlepage"><div><div><h2 class="title"
id="policy">1.4. Defining Policies:
Authorization</h2></div></div></div><div
class="para">
XXXXXXXXXX fix me XXXXXXXX
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-components.html"><strong>Prev</strong>1.2. Identity
Management: Authentication</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="deployment-scenarios.html"><strong>Next</strong>1.4. Planning
IPA</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-components.html"><strong>Prev</strong>1.3. Identity
Management: Authentication</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="installing-ipa.html"><strong>Next</strong>Chapter 2. Installing
a FreeIPA Server</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/promoting-replica.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/promoting-replica.html
index c225148..2687b9a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/promoting-replica.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/promoting-replica.html
@@ -1,31 +1,31 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.12. Promoting a Read-Only Replica to an IPA
Server</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>13.8. Promoting a Read-Only Replica to a FreeIPA
Server</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"
title="12.11. Creating DNS Entries for FreeIPA Replicas" /><link
rel="next" href="logging.html" title="12.13. IPA Server
Logging" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><
a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="logging.html"><strong>Next</strong></a></li></ul><div
class="section" id="promoting-replica"><div
class="titlepage"><div><div><h2 class="title"
id="promoting-replica">12.12. Promoting a Read-Only Replica to an IPA
Server</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 13. Configuring the FreeIPA
Server" /><link rel="prev"
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"
title="13.7. Creating DNS Entries for FreeIPA Replicas" /><link
rel="next" href="logging.html" title="13.9. FreeIPA Server
Logging" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="Working_with_D
NS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="logging.html"><strong>Next</strong></a></li></ul><div
class="section" id="promoting-replica"><div
class="titlepage"><div><div><h2 class="title"
id="promoting-replica">13.8. Promoting a Read-Only Replica to a FreeIPA
Server</h2></div></div></div><div class="para">
The only difference between a replica and the master server is that the master owns
the self-signed CA. If you copy the appropriate files from the master to the replica,
import the CA into the replica directory server, and delete the existing replication
agreements, that replica will then appear as a master server.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
If you install with the <code class="option">--selfsign</code>
option, follow this procedure if you want to promote a replica to a master. This is
because the private key for the self-signed CA is stored in the Apache database (<code
class="filename">/etc/httpd/alias</code>). The private key for a Dogtag
Certificate System CA is stored in its own security database.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Promoting_Replicas_to_Function_as_Master_Servers-To_promote_a_replica_to_a_master_server"><h6>Procedure 12.6. To
promote a replica to a master server:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></div></div><div
class="orderedlist"><h6>To promote a replica to a master
server:</h6><ol><li class="listitem"><div
class="para">
Copy the <code
class="filename">/var/lib/ipa/ca_serialno</code> file from the master
to the replica.
- </div></li><li class="step"><div
class="para">
- Import the CA into the replica DS NSS database, as follows:
+ </div></li><li class="listitem"><div
class="para">
+ Import the CA into the replica 389 Directory Server NSS database, as follows:
<pre class="screen"># cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .
</pre>
</div><div class="para">
The password on the <code class="filename">PKCS#12</code> file
is stored as <code
class="filename">/etc/dirsrv/slapd-REALM/pwdfile.txt</code> on the
original server.
- </div></li><li class="step"><div
class="para">
+ </div></li><li class="listitem"><div
class="para">
Delete the existing replication agreements, as follows:
<pre class="screen"># ipa-replica-manage del
master.example.com
</pre>
</div></li></ol></div><div class="para">
- You now have two identical IPA servers, neither of which know about the other. You can
shut down the old master and bring up the new machine (if you are introducing a new
replica into your network). Create a replica file on the new master and install it on the
new machine.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Prev</strong>12.11. Creating
DNS Entries for FreeIPA Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="logging.html"><strong>Next</strong>12.13. IPA Server
Logging</a></li></ul></body></html>
+ You now have two identical FreeIPA servers, neither of which know about the other. You
can shut down the old master and bring up the new machine (if you are introducing a new
replica into your network). Create a replica file on the new master and install it on the
new machine.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html"><strong>Prev</strong>13.7. Creating
DNS Entries for FreeIPA Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="logging.html"><strong>Next</strong>13.9. FreeIPA Server
Logging</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/renaming-machines.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/renaming-machines.html
index 1f28307..509e330 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/renaming-machines.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/renaming-machines.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.3. Renaming Machines</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.3. Renaming Machines</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="enrolling-machines.html" title="4.2. Enrolling Machines"
/><link rel="next" href="config-virt-machines.html"
title="4.4. Reconfiguring Virtual Machines" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="enrolling-machines.html"><strong>Prev</stron
g></a></li><li class="next"><a accesskey="n"
href="config-virt-machines.html"><strong>Next</strong></a></li></ul><div
class="section" id="renaming-machines"><div
class="titlepage"><div><div><h2 class="title"
id="renaming-machines">4.3. Renaming
Machines</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="enrolling-machines.html" title="5.2. Enrolling Machines"
/><link rel="next" href="config-virt-machines.html"
title="5.4. Reconfiguring Virtual Machines" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="enrolling-machines.html"><strong>Prev</stron
g></a></li><li class="next"><a accesskey="n"
href="config-virt-machines.html"><strong>Next</strong></a></li></ul><div
class="section" id="renaming-machines"><div
class="titlepage"><div><div><h2 class="title"
id="renaming-machines">5.3. Renaming
Machines</h2></div></div></div><div class="para">
The hostname of a system is critical for the correct operation of Kerberos and SSL.
Both of these security mechanisms rely on the hostname to ensure that communication is
occurring between the specified hosts, and that no "man-in-the-middle" or other
attacks are affecting the system.
</div><div class="para">
In an environment where virtual machines are commonplace, or perhaps in a clustered
environment, copying, moving, and renaming hosts could be quite common, resulting in
frequent demands for renames of machines.
@@ -17,7 +17,7 @@
Due to the nature of service principals, renaming hosts also requires the regeneration
of service principals. Each service has a Kerberos principal in the form of <code
class="systemitem"><service
name>/<hostname>@<REALM></code>, for example,
<code class="systemitem">ldap/server.example.com(a)EXAMPLE.COM</code>.
This principal can be referred to as a "service principal". In some cases the
<code class="systemitem">@<REALM></code> is omitted,
leaving only <code class="systemitem"><service
name>/<hostname></code>. (The "/" is a
"slash" separator, not an "or" operator.)
</div><div class="para">
The following procedure renames the host <code
class="systemitem">server.example.com</code> in the Kerberos realm
<code class="systemitem">EXAMPLE.COM</code>, to the new hostname
<code class="systemitem">master.example.com</code>. This procedure
uses example file names, hostnames and domain names throughout; you need to update these
examples to suit your own environment.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine"><h6>Procedure 4.3. To
rename a FreeIPA machine:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Renaming_IPA_Machines-To_rename_an_IPA_machine"><h6>Procedure 5.3. To
rename a FreeIPA machine:</h6><ol class="1"><li
class="step"><div class="para">
Identify which services are running on the machine. These need to be re-created when
the machine is re-enrolled:
<pre class="screen"><code class="command"># ipa
service-find server.example.com</code></pre>
@@ -61,4 +61,4 @@
If you need certificates for services, use either <code
class="command">certmonger</code> or the FreeIPA administration tools.
</div></li><li class="step"><div
class="para">
Re-add the host to any applicable host groups.
- </div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="enrolling-machines.html"><strong>Prev</strong>4.2. Enrolling
Machines</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="config-virt-machines.html"><strong>Next</strong>4.4. Reconfiguring
Virtual Machines</a></li></ul></body></html>
+ </div></li></ol></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="enrolling-machines.html"><strong>Prev</strong>5.2. Enrolling
Machines</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="config-virt-machines.html"><strong>Next</strong>5.4. Reconfiguring
Virtual Machines</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/rotating-keys.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/rotating-keys.html
index 5e556e6..0468080 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/rotating-keys.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/rotating-keys.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.5. Rotating Keys</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.5. Rotating Keys</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 6. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"
title="6.4. Refreshing Kerberos Tickets" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"
title="6.6. Kerberos Errors" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="
Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Next</strong></a></li></ul><div
class="section" id="rotating-keys"><div
class="titlepage"><div><div><h2 class="title"
id="rotating-keys">6.5. Rotating
Keys</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"
title="7.4. Refreshing Kerberos Tickets" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"
title="7.6. Kerberos Errors" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="
Documentation Site" /></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Next</strong></a></li></ul><div
class="section" id="rotating-keys"><div
class="titlepage"><div><div><h2 class="title"
id="rotating-keys">7.5. Rotating
Keys</h2></div></div></div><div class="para">
Kerberos keys are similar to passwords, and in the interests of security they should
occasionally be changed. The frequency of these changes may be determined by company or
other policies. Each key has an associated version number, which are stored in the <em
class="parameter"><code>KVNO</code></em> parameter.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Rotating_Kerberos_Keys-Obtaining_a_new_service_principal_Kerberos_key"><h5
class="formalpara">Obtaining a new service principal Kerberos key</h5>
Use the <code class="command">ipa-getkeytab</code> command to
create a new Kerberos key. For example, use the following command to refresh your FreeIPA
keytab:
@@ -42,4 +42,4 @@ Valid starting Expires Service principal
</div><div class="para">
This will display service and host keytab information. It is not possible to determine
if it has a key directly, but you can infer that a keytab was issued by looking at the
last change date.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Prev</strong>6.4. Refreshing
Kerberos Tickets</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Next</strong>6.6. Kerberos
Errors</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Prev</strong>7.4. Refreshing
Kerberos Tickets</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html"><strong>Next</strong>7.6. Kerberos
Errors</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/search-limits.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/search-limits.html
index 93f2a9d..77afe52 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/search-limits.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/search-limits.html
@@ -1,18 +1,18 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.5. Setting Default Search Limits</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.6. Setting Default Search Limits</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"
title="12.4. Specifying Default User Settings" /><link
rel="next" href="disabling-anon-binds.html"
title="12.6. Disabling Anonymous Binds" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="pr
evious"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="disabling-anon-binds.html"><strong>Next</strong></a></li></ul><div
class="section" id="search-limits"><div
class="titlepage"><div><div><h2 class="title"
id="search-limits">12.5. Setting Default Search
Limits</h2></div></div></div><div class="para">
- You can set limits on the number of records returned when performing various queries,
for example when you run the <code
class="command">ipa user-find</code> command. These limits are
specified by the <em class="parameter"><code>Search size
limit</code></em> attribute in the default IPA configuration. The default
value for this attribute is 100.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"
title="6.5. Specifying Default User Settings" /><link rel="next"
href="Configuring_IPA_Users-Deleting_IPA_Users.html" title="6.7. Deleting
FreeIPA Users" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="
p"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong></a></li></ul><div
class="section" id="search-limits"><div
class="titlepage"><div><div><h2 class="title"
id="search-limits">6.6. Setting Default Search
Limits</h2></div></div></div><div class="para">
+ You can set limits on the number of records returned when performing various queries,
for example when you run the <code
class="command">ipa user-find</code> command. These limits are
specified by the <em class="parameter"><code>Search size
limit</code></em> attribute in the default FreeIPA configuration. The default
value for this attribute is 100.
</div><div class="para">
To view the current configuration, run the <code
class="command"># ipa config-show</code> command. Refer to the <code
class="command">ipa help config</code> help page for more information.
</div><div class="para">
- The following is a sample IPA configuration:
+ The following is a sample FreeIPA configuration:
</div><pre class="screen">[ming@myserver ~]$ ipa config-show
Max username length: 32
Home directory base: /home
@@ -24,18 +24,18 @@ User search fields: uid,givenname,sn,telephonenumber,ou,title
Group search fields: cn,description
Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
You can use the <code class="command">ipa config-mod</code>
command to specify a suitable value for the <em
class="parameter"><code>Search size limit</code></em>
attribute. For example, if you set this value to 10, the <code
class="command">ipa user-find</code> command will only return 10
entries, even if many more entries exist. If you set this value to 0 (zero) or −1, it
means that there are no restrictions on the number of entries that can be returned.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_Limits_for_Search_Results-Setting_search_size_limits"><h6>Procedure 12.2. Setting
search size limits</h6><ul><li class="step"><div
class="para">
+ </div><div class="orderedlist"><h6>Setting search size
limits</h6><ol><li class="listitem"><div
class="para">
To set the <em class="parameter"><code>Search size
limit</code></em> attribute to 50, run the following command:
-<pre class="programlisting"><code class="command">#
ipa config-mod --searchrecordslimit=50</code></pre>
+<pre class="programlisting"># ipa config-mod
--searchrecordslimit=50</pre>
- </div></li></ul></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
+ </div></li></ol></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
You need to be aware of the potential performance impact of setting the search size
limit too high. You need to determine a suitable balance between the benefits of always
returning all entries matched by a search, and the performance gained by implementing a
search filter.
</div><div class="para">
Note also that if the size limit is set too high or removed completely it might
affect the behavior of UI screens.
</div></div></div><div class="para">
- You can configure various aspects of the IPA search functionality to suit your
deployment. For example, you can restrict the number of fields upon which a user can base
a search, or limit the number of records returned for any particular search.
+ You can configure various aspects of the FreeIPA search functionality to suit your
deployment. For example, you can restrict the number of fields upon which a user can base
a search, or limit the number of records returned for any particular search.
</div><div class="para">
- IPA supports the following search configuration attributes:
+ FreeIPA supports the following search configuration attributes:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<em class="parameter"><code>Search Time
Limit</code></em>: The maximum time, in seconds, that a search will run before
failing.
</div></li><li class="listitem"><div
class="para">
@@ -46,10 +46,10 @@ Certificate Subject base: O=MYDOMAIN.NET</pre><div
class="para">
<em class="parameter"><code>Group Search
Fields</code></em>: For a group search, specifies the fields to search for the
values entered by a user.
</div></li></ul></div><div class="para">
Use the <code class="command">ipa config-mod</code> command to
modify the default configuration attributes. For example, to specify a search time limit
of 60 seconds, use the following command:
-<pre class="screen"><code class="command"># ipa
config-mod --searchtimelimit=60</code></pre>
+<pre class="screen"># ipa config-mod --searchtimelimit=60</pre>
Refer to the <code class="command">ipa help config</code> page
for more information.
</div><div class="para">
If you add attributes to the user or group search fields, you should also create a new
<code class="systemitem">LDAP</code> index for those attributes to
avoid performance degradation. Conversely, the existence of too many indexes can impact
write performance, so you need to balance one against the other.
</div><div class="para">
- Refer to <a
href="http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_...
Indexes</a> in the <em class="citetitle">Directory Server
Administration Guide</em> for information on creating indexes.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Prev</strong>12.4. Specifying
Default User Settings</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="disabling-anon-binds.html"><strong>Next</strong>12.6. Disabling
Anonymous Binds</a></li></ul></body></html>
+ Refer to <a
href="http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_...
Indexes</a> in the <em class="citetitle">389 Directory Server
Administration Guide</em> for information on creating indexes.
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Prev</strong>6.5. Specifying
Default User Settings</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong>6.7. Deleting
FreeIPA Users</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/searching.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/searching.html
index ffd0363..439a813 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/searching.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/searching.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.8. Searching for Users and Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.10. Searching for Users and Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev" href="user-pwdpolicy.html"
title="5.7. Setting an Individual Password Policy" /><link
rel="next" href="kerberos.html" title="Chapter 6. Identity: Using
FreeIPA for a Kerberos Domain" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="user-pwdpolicy.html"><strong
Prev</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong></a></li></ul><div
class="section" id="searching"><div
class="titlepage"><div><div><h2 class="title"
id="searching">5.8. Searching for Users and
Groups</h2></div></div></div><div class="para">
+ </script><link rel="home"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="up" href="users.html"
title="Chapter 6. Identity: Managing Users and User Groups" /><link
rel="prev" href="user-pwdpolicy.html" title="6.9. Setting an
Individual Password Policy" /><link rel="next"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="user-pwdpolicy.html"><strong
Prev</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong></a></li></ul><div
class="section" id="searching"><div
class="titlepage"><div><div><h2 class="title"
id="searching">6.10. Searching for Users and
Groups</h2></div></div></div><div class="para">
FreeIPA provides extensive search capabilities, which enable you to perform
simple and partial-match searches on a range of attributes, including:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
First Name (givenname)
@@ -41,7 +41,7 @@
Home Page
</div></li></ul></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot use wildcards to search for users or groups. The search string must
include at least one character that appears in one of the indexed search fields.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1. Searching
for Users</h3></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users-Using_the_Command_Line">5.8.1.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Searching_for_Users_and_Groups-Searching_for_Users"><div
class="titlepage"><div><div><h3 class="title"
id="Searching_for_Users_and_Groups-Searching_for_Users">6.10.1. Searching for
Users</h3></div></div></div><div class="section"
id="Searching_for_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Searching_for_Users-Using_the_Command_Line">6.10.1.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa user-find</code> command to
search for users from the command line. The basic syntax of this command is as follows:
<div class="cmdsynopsis"><p><code
class="command">ipa user-find</code> [
options
@@ -78,7 +78,7 @@ Member of groups: ipausers
Number of entries returned 2
----------------------------</pre><div class="para">
If you do not see the entry that you are looking for, you may need to adjust the
<code class="option">--searchrecordslimit</code> option in the
default FreeIPA configuration.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2. Searching
for Groups</h3></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Searching_for_Groups-Using_the_Command_Line">5.8.2.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Searching_for_Users_and_Groups-Searching_for_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2. Searching
for Groups</h3></div></div></div><div class="section"
id="Searching_for_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Searching_for_Groups-Using_the_Command_Line">6.10.2.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-find</code> command to
search for groups from the command line. The basic syntax of this command is as follows:
<div class="cmdsynopsis"><p><code
class="command">ipa group-find</code> {
string
@@ -102,4 +102,4 @@ Member users: dkim, mkang, lming, klim
Number of entries returned 1
----------------------------</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The <code class="command">ipa group-find</code> command
searches both group names and group descriptions. If your search results are too
extensive, use a more specific search string.
- </div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="user-pwdpolicy.html"><strong>Prev</strong>5.7. Setting an
Individual Password Policy</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong>Chapter 6. Identity:
Using FreeIPA for a Kerberos...</a></li></ul></body></html>
+ </div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="user-pwdpolicy.html"><strong>Prev</strong>6.9. Setting an
Individual Password Policy</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="kerberos.html"><strong>Next</strong>Chapter 7. Identity:
Using FreeIPA for a Kerberos...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html
index 7b268d5..fa64434 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.4. Refreshing Kerberos Tickets</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.4. Refreshing Kerberos Tickets</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 6. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"
title="6.3. Creating and Using Service Principals" /><link
rel="next" href="rotating-keys.html" title="6.5. Rotating
Keys" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><l
i class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="rotating-keys.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">6.4. Refreshing
Kerberos Tickets</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"
title="7.3. Creating and Using Service Principals" /><link
rel="next" href="rotating-keys.html" title="7.5. Rotating
Keys" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><l
i class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="rotating-keys.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets">7.4. Refreshing
Kerberos Tickets</h2></div></div></div><div
class="para">
Some compliance or company security policies may require that system administrators
manually refresh Kerberos tickets, perhaps annually or more frequently. The current
version of FreeIPA does not provide automatic renewal of Kerberos tickets.
</div><div class="para">
Manually refreshing Kerberos tickets is a two step process: you first need to find all
of the keytabs that are older than a certain date, and then obtain a new keytab for the
host or service in question. This process is described in detail below.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Refreshing_Kerberos_Tickets-How_to_manually_refresh_Kerberos_keytabs"><h6>Procedure 6.2. How
to manually refresh Kerberos keytabs</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Refreshing_Kerberos_Tickets-How_to_manually_refresh_Kerberos_keytabs"><h6>Procedure 7.2. How
to manually refresh Kerberos keytabs</h6><ol class="1"><li
class="step"><div class="para">
Find all keytabs, both for host services and for any other services, issued before
today. Use the following queries (update the dates as necessary):
<pre class="screen"><code class="command"># ldapsearch -x
-b "cn=computers,cn=accounts,dc=example,dc=com"</code> <code
class="command">"(&(krblastpwdchange<=20110110000000)(krblastpwdchange>=19710101000000))"
dn krbprincipalname</code></pre>
@@ -38,4 +38,4 @@
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
Some services, such as NFSv4, only support a limited set of encryption types. Ensure
that you pass the appropriate arguments to the <code
class="command">ipa-getkeytab</code> command.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Prev</strong>6.3. Creating
and Using Service Principals</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="rotating-keys.html"><strong>Next</strong>6.5. Rotating
Keys</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html"><strong>Prev</strong>7.3. Creating
and Using Service Principals</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="rotating-keys.html"><strong>Next</strong>7.5. Rotating
Keys</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html
index 343ec1f..b005b44 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html
@@ -1,23 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.8. Configuring Certificates and Certificate
Authorities</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"
title="12.7. Implementing Unique UID and GID Attributes" /><link
rel="next" href="ipa-apache.html" title="12.9. Setting an IPA
Server as an Apache Virtual Host" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class
="docnav"><li class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities">12.8. Configuring
Certificates and Certificate
Authorities</h2></div></div></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.8. Configuring Certificates and Certificate
Authorities</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"
title="14.7. Implementing Unique UID and GID Attributes" /><link
rel="next" href="ipa-apache.html" title="14.9. Setting an IPA
Server as an Apache Virtual Host" /></head><body><p id
="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities">14.8. Configuring
Certificates and Certificate
Authorities</h2></div></div></div><div
class="para">
IPA creates a self-signed Certificate Authority (<abbr
class="abbrev">CA</abbr>) during the installation process. If you have
your own or a preferred <abbr class="abbrev">CA</abbr>, however, and
want to use your own certificates, IPA provides the necessary tools to import certificates
for use by Directory Server and the <code
class="systemitem">HTTP</code> server. While not a prerequisite for the
correct operation of IPA, it is recommended that you save an <acronym
class="acronym">ASCII</acronym> copy of your <abbr
class="abbrev">CA</abbr> certificate as <code
class="filename">/usr/share/ipa/html/ca.crt</code> to ensure that users
download the correct certificate.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1. Installing
Your Own Certificate</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">14.8.1. Installing
Your Own Certificate</h3></div></div></div><div
class="para">
Use the <code class="command">ipa-server-certinstall</code>
command to install your own certificate. You can install the certificate for use by
Directory Server, <code class="systemitem">HTTP</code> Server, or
both.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Installing_Your_Own_Certificate-To_install_the_certificate_for_use_by_Directory_Server"><h5
class="formalpara">To install the certificate for use by Directory
Server:</h5>
<code class="command"> # /usr/sbin/ipa-server-certinstall -d
/path/to/pkcs12.p12 </code>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2. Using
Your Own Certificate with Firefox</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">14.8.2. Using
Your Own Certificate with Firefox</h3></div></div></div><div
class="para">
To continue using the <span
class="application"><strong>Firefox</strong></span>
auto-configuration feature, you need an object-signing certificate, and you need to
regenerate the <code
class="filename">/usr/share/ipa/html/configure.jar</code> file.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The following procedure assumes that the signing certificate is provided as a
PKCS#12 file.
- </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_Your_Own_Certificate_with_Firefox-To_use_your_own_certificate_with_Firefox"><h6>Procedure 12.3. To
use your own certificate with Firefox:</h6><ol class="1"><li
class="step"><div class="para">
+ </div></div></div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Using_Your_Own_Certificate_with_Firefox-To_use_your_own_certificate_with_Firefox"><h6>Procedure 14.3. To
use your own certificate with Firefox:</h6><ol class="1"><li
class="step"><div class="para">
Create a suitable directory and then create the new certificate database in that
directory.
<pre class="screen"><code class="command"># mkdir
/tmp/signdb</code>
<code class="command"># certutil -N -d
/tmp/signdb</code></pre>
@@ -36,12 +29,12 @@
<pre class="screen"><code class="command"># signtool -d
/tmp/signdb -k Signing_cert_nickname \</code>
<code class="command">-Z /usr/share/ipa/html/configure.jar -e
.html</code></pre>
- </div></li></ol></div></div><div
class="section" id="Using_OCSP"><div
class="titlepage"><div><div><h3 class="title"
id="Using_OCSP">12.8.3. Using
OCSP</h3></div></div></div><div class="para">
- <code class="systemitem">The Online Certificate Status Protocol
(OCSP)</code> is natively provided by the CA embedded into FreeIPA. This is so that
any client that supports it can use OCSP for certificate validity checks.
+ </div></li></ol></div></div><div
class="section" id="Using_OCSP"><div
class="titlepage"><div><div><h3 class="title"
id="Using_OCSP">14.8.3. Using
OCSP</h3></div></div></div><div class="para">
+ <code class="systemitem">The Online Certificate Status Protocol
(OCSP)</code> is natively provided by the CA embedded into IPA. This is so that any
client that supports it can use OCSP for certificate validity checks.
</div><div class="para">
- The OCSP responder URL is encoded into the certificates issued by FreeIPA. In order
for that responder to be available, port 9180 needs to be open in the firewall. The OCSP
URL uses the following format:
+ The OCSP responder URL is encoded into the certificates issued by IPA. In order for
that responder to be available, port 9180 needs to be open in the firewall. The OCSP URL
uses the following format:
<pre class="screen">http://ipa.example.com:9180/ca/ocsp</pre>
</div><div class="para">
For more information on OCSP, refer to the RFC at <a
href="http://www.ietf.org/rfc/rfc2560.txt">http://www.ietf.o...
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Prev</strong>12.7. Implementing
Unique UID and GID Attributes</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong>12.9. Setting an IPA
Server as an Apache Virtual ...</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html"><strong>Prev</strong>14.7. Implementing
Unique UID and GID Attributes</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="ipa-apache.html"><strong>Next</strong>14.9. Setting an IPA
Server as an Apache Virtual ...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
index 52dda60..0a48d23 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html
@@ -1,15 +1,8 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.4. Activating and Deactivating User Accounts</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev" href="editing-users.html"
title="5.3. Editing Users" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"
title="5.5. Deleting FreeIPA Users" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="editing-u
sers.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">5.4. Activating
and Deactivating User Accounts</h2></div></div></div><div
class="para">
- FreeIPA user accounts can be set to a status of <code
class="literal">Active</code> or <code
class="literal">Inactive</code>. If you deactivate a user account, that
user can no longer log in to FreeIPA, change their password, or perform any other tasks.
Any existing connections will remain valid until their <code
class="systemitem">Kerberos</code> TGT and other tickets expire, but
they will not be able to renew them. The account and all associated information still
exists, but is inaccessible by the user.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">5.4.1. Using
the Command Line</h3></div></div></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.4. Activating and Deactivating User Accounts</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="editing-users.html"
title="6.3. Editing Users" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"
title="6.5. Deleting IPA Users" /></head><body><p
id="title"><a class="left"
href="http://www.redhat.com"><img src="Common_Content/
images/image_left.png" alt="Product Site" /></a><a
class="right" href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="editing-users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts">6.4. Activating
and Deactivating User Accounts</h2></div></div></div><div
class="para">
+ IPA user accounts can be set to a status of <code
class="literal">Active</code> or <code
class="literal">Inactive</code>. If you deactivate a user account, that
user can no longer log in to IPA, change their password, or perform any other tasks. Any
existing connections will remain valid until their <code
class="systemitem">Kerberos</code> TGT and other tickets expire, but
they will not be able to renew them. The account and all associated information still
exists, but is inaccessible by the user.
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1. Using
the Command Line</h3></div></div></div><div
class="para">
Use the <code class="command">ipa user-enable</code> and
<code class="command">ipa user-disable</code> commands to enable and
disable user accounts, respectively. Refer to the following examples:
</div><div class="para">
To disable the <code class="systemitem">jsmith</code> user
account:
@@ -19,4 +12,4 @@
To enable the <code class="systemitem">jsmith</code> user
account:
</div><div class="para">
<code class="command"> $ ipa user-enable jsmith</code>
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="editing-users.html"><strong>Prev</strong>5.3. Editing
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong>5.5. Deleting
FreeIPA Users</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="editing-users.html"><strong>Prev</strong>6.3. Editing
Users</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Next</strong>6.5. Deleting
IPA Users</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html
index 96eb202..9445a90 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html
@@ -1,19 +1,12 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.5. Deleting FreeIPA Users</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"
title="5.4. Activating and Deactivating User Accounts" /><link
rel="next" href="user-groups.html" title="5.6. Creating User
Groups" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li cl
ass="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="user-groups.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users">5.5. Deleting
FreeIPA Users</h2></div></div></div><div
class="para">
- If you delete a FreeIPA user account, all of the information stored in the entry for
that identity is lost. This includes the user's full name, group membership, phone
numbers, and passwords. The actual user account and home directory still exist, be they on
a server, local machine, or other provider, but they are no longer accessible by FreeIPA.
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.5. Deleting IPA Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"
title="6.4. Activating and Deactivating User Accounts" /><link
rel="next" href="user-groups.html" title="6.6. Creating User
Groups" /></head><body><p id="title"><a
class="left" href="http://www.redhat.co
m"><img src="Common_Content/images/image_left.png" alt="Product
Site" /></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="user-groups.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users">6.5. Deleting
IPA Users</h2></div></div></div><div
class="para">
+ If you delete an IPA user account, all of the information stored in the entry for that
identity is lost. This includes the user's full name, group membership, phone numbers,
and passwords. The actual user account and home directory still exist, be they on a
server, local machine, or other provider, but they are no longer accessible by IPA.
</div><div class="para">
Unlike deactivation, if you delete a user account, it cannot be retrieved. If you need
this user account again, you need to recreate it and add all of the account details
manually.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- Unlike in earlier versions of FreeIPA, it is now possible to delete the <code
class="systemitem">admin</code> user. If, however, you delete all of
the <code class="systemitem">admin</code> users then you will need
to use the Directory Manager account to create a new administrative user. Alternatively,
if you have a user in the group management role, they can add a new <code
class="systemitem">admin</code> user.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1. Using
the Command Line</h3></div></div></div><div
class="para">
+ Unlike in earlier versions of IPA, it is now possible to delete the <code
class="systemitem">admin</code> user. If, however, you delete all of
the <code class="systemitem">admin</code> users then you will need
to use the Directory Manager account to create a new administrative user. Alternatively,
if you have a user in the group management role, they can add a new <code
class="systemitem">admin</code> user.
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">6.5.1. Using
the Command Line</h3></div></div></div><div
class="para">
Use the <code class="command">ipa user-del</code> command to
delete user accounts. For example:
</div><div class="para">
To delete the <code class="systemitem">jsmith</code> user
account:
@@ -24,7 +17,7 @@
</div><div class="para">
<code class="command">$ ipa user-del <code
class="option">--continue</code> <em
class="parameter"><code>user_01</code></em> <em
class="parameter"><code>user_02</code></em> <em
class="parameter"><code>user_03</code></em></code>
</div><div class="para">
- If you run this command without using the <code
class="option">--continue</code> option, FreeIPA will delete the listed
user accounts unless it encounters any errors, at which point it stops. For example, if
<em class="parameter"><code>user_02</code></em> did not
exist, the previous command would only delete <em
class="parameter"><code>user_01</code></em>; <em
class="parameter"><code>user_03</code></em> would not be
affected.
+ If you run this command without using the <code
class="option">--continue</code> option, IPA will delete the listed
user accounts unless it encounters any errors, at which point it stops. For example, if
<em class="parameter"><code>user_02</code></em> did not
exist, the previous command would only delete <em
class="parameter"><code>user_01</code></em>; <em
class="parameter"><code>user_03</code></em> would not be
affected.
</div><div class="para">
The <code class="option">--continue</code> option returns a
summary of successes and failures to <code
class="systemitem">stdout</code>.
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong>5.4. Activating
and Deactivating User Accounts</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="user-groups.html"><strong>Next</strong>5.6. Creating User
Groups</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html"><strong>Prev</strong>6.4. Activating
and Deactivating User Accounts</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="user-groups.html"><strong>Next</strong>6.6. Creating User
Groups</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html
index e5ec180..d98d309 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html
@@ -1,13 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.4. Specifying Default User Settings</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="self-service.html"
title="12.3. Defining Self-Service Settings" /><link rel="next"
href="search-limits.html" title="12.5. Setting Default Search Limits"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="self-service.html"><strong>Prev</strong></a></li><li
class
="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings">12.4. Specifying
Default User Settings</h2></div></div></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.4. Specifying Default User Settings</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev" href="self-service.html"
title="14.3. Defining Self-Service Settings" /><link rel="next"
href="search-limits.html" title="14.5. Setting Default Search Limits"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a cl
ass="right" href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="self-service.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings">14.4. Specifying
Default User Settings</h2></div></div></div><div
class="para">
You can configure the default settings for IPA users to suit your deployment. For
example, you can specify the maximum username length, the default path to the <code
class="filename">/home</code> directory, the default shell, and other
attributes.
</div><div class="para">
IPA supports the following User Settings:
@@ -39,5 +32,5 @@ Certificate Subject base: O=MYDOMAIN.NET</pre><div
class="para">
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
The default root directory for all home directories is <code
class="filename">/home</code>, but it is the responsibility of the
system administrator to ensure that whatever value is specified for this attribute is
actually available.
</div><div class="para">
- Fedora includes a <code class="systemitem">PAM</code> module
called <code class="systemitem module">pam_mkhomedir</code> that can
automatically create a home directory if one does not exist for the user authenticating
against the system. IPA does not force the use of this module because it may try to create
home directories even when the shared storage is not available. It is the responsibility
of the system administrator to activate this module on the clients if needed.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="self-service.html"><strong>Prev</strong>12.3. Defining
Self-Service Settings</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong>12.5. Setting
Default Search Limits</a></li></ul></body></html>
+ Red Hat Enterprise Linux includes a <code
class="systemitem">PAM</code> module called <code
class="systemitem module">pam_mkhomedir</code> that can automatically
create a home directory if one does not exist for the user authenticating against the
system. IPA does not force the use of this module because it may try to create home
directories even when the shared storage is not available. It is the responsibility of the
system administrator to activate this module on the clients if needed.
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="self-service.html"><strong>Prev</strong>14.3. Defining
Self-Service Settings</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="search-limits.html"><strong>Next</strong>14.5. Setting
Default Search Limits</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html
index 8fbba82..d0521ae 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.3. Creating and Using Service Principals</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.3. Creating and Using Service Principals</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 6. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="kerb-policies.html" title="6.2. Setting Kerberos Ticket
Policies" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"
title="6.4. Refreshing Kerberos Tickets" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li cla
ss="previous"><a accesskey="p"
href="kerb-policies.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">6.3. Creating
and Using Service Principals</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="kerb-policies.html" title="7.2. Setting Kerberos Ticket
Policies" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"
title="7.4. Refreshing Kerberos Tickets" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li cla
ss="previous"><a accesskey="p"
href="kerb-policies.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Creating_and_Using_Service_Principals">7.3. Creating
and Using Service Principals</h2></div></div></div><div
class="para">
You can use the web interface to create service principals and also to search for
existing service principals. For security and other reasons, however, it is not possible
to retrieve a keytab using the web interface. This has to be done either on the command
line on the system where the service is accessed, or on the FreeIPA server itself, and the
keytab then exported to the client host.
</div><div class="para">
The following example demonstrates creating a service principal and keytab on a client
host for the <code class="systemitem">HTTP</code> service. In this
example, the client host is <code
class="systemitem">ipaclient.example.com</code> and the FreeIPA server
is <code class="systemitem">ipaserver.example.com</code>:
@@ -33,7 +33,7 @@
The <code class="command">ipa-getkeytab</code> command resets
the secret for the specified principal. This means that all other keytabs for that
principal are rendered invalid.
</div></div></div><div class="para">
FreeIPA provides a range of tools and commands to facilitate the creation and
administration of services and the service principals and certificates required to use
them. Some of this can be automated, but there will always be a certain amount of manual
intervention required to create services and certificates after the initial joining of a
host to a realm. These requirements and procedures are discussed in the following
sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">6.3.1. Creating
a FreeIPA Service</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Prerequisites"><h5
class="formalpara">Prerequisites</h5>
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_Service_Principals_and_Certificates_for_New_Services-Creating_an_IPA_Service">7.3.1. Creating
a FreeIPA Service</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Prerequisites"><h5
class="formalpara">Prerequisites</h5>
Before you can create a service for a FreeIPA host, you need to ensure that the host
exists. This should be true if it has already joined the realm. Use the following command
to determine if the host exists:
<pre class="screen"><code class="command"># ipa host-show
myserver.mydomain.net</code></pre>
@@ -52,7 +52,7 @@
Added service "test/myserver.mydomain.net(a)MYDOMAIN.NET"
-------------------------------------------------------
Principal: test/myserver.mydomain.net(a)MYDOMAIN.NET
- Managed by: myserver.mydomain.net</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service">6.3.1.1. Requesting
a Certificate for a Service</h4></div></div></div><div
class="para">
+ Managed by: myserver.mydomain.net</pre><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Requesting_a_Certificate_for_a_Service">7.3.1.1. Requesting
a Certificate for a Service</h4></div></div></div><div
class="para">
Use the following command to request a certificate for the new service. The
certificate request is contained in the <code
class="filename">example.csr</code> file.
<pre class="screen"><code class="command"># ipa
cert-request --principal=test/myserver.mydomain.net example.csr </code></pre>
@@ -84,7 +84,7 @@ Email Address []:authors@mydomain.net
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
-An optional company name []:</pre></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests">6.3.1.2. Using
certmonger to Manage Certificate
Requests</h4></div></div></div><div class="para">
+An optional company name []:</pre></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_certmonger_to_Manage_Certificate_Requests">7.3.1.2. Using
certmonger to Manage Certificate
Requests</h4></div></div></div><div class="para">
You can also use <span
class="application"><strong>certmonger</strong></span> to
manage the certificate request process for you. Use the following command to request a
certificate:
<pre class="screen"><code class="command"># ipa-getcert
request -d /etc/pki/nssdb -n Server-Cert</code></pre>
@@ -100,8 +100,8 @@ An optional company name []:</pre></div><div
class="section" id="sect-Enterprise
<pre class="screen"><code class="command">$ ipa
config-show | grep -i subject</code></pre>
FreeIPA will reject requests with invalid subject base values.
</div><div class="para">
- Refer to the <code class="systemitem">certmonger</code> man
page and also to <a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">Section B.1,
“What is certmonger?”</a> for more information.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS">6.3.1.3. Using
NSS</h4></div></div></div><div class="para">
+ Refer to the <code class="systemitem">certmonger</code> man
page and also to <a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">Section C.1,
“What is certmonger?”</a> for more information.
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_an_IPA_Service-Using_NSS">7.3.1.3. Using
NSS</h4></div></div></div><div class="para">
If you need to create an NSS database in which to store your key, use the <code
class="command">certutil</code> command as follows:
<pre class="screen"><code class="command">$ certutil -N
-d /path/to/database/dir</code>
<code class="command">$ certutil -R -s "CN=myserver.mydomain.net,
O=MYDOMAIN.NET" \</code>
@@ -117,9 +117,9 @@ An optional company name []:</pre></div><div
class="section" id="sect-Enterprise
Certificate Subject base: O=MYDOMAIN.NET</pre><div class="para">
This means you need to use
MYDOMAIN.NET for the organization. FreeIPA will reject
requests whose subject base differs from this value.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">6.3.2. Configuring
an NFS Service Principal on the FreeIPA
Server</h3></div></div></div><div class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_Service_Principals-Configuring_an_NFS_Service_Principal_on_the_IPA_Server">7.3.2. Configuring
an NFS Service Principal on the FreeIPA
Server</h3></div></div></div><div class="para">
The following procedure describes how to configure <code
class="systemitem">NFS</code> on the FreeIPA server and to set up an
<code class="systemitem">NFS</code> service principal.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_an_NFS_Service_Principal_on_the_IPA_Server-Configuring_NFS_on_the_IPA_Server"><h6>Procedure 6.1. Configuring
<code class="systemitem">NFS</code> on the FreeIPA
Server</h6><ol class="1"><li class="step"><div
class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Configuring_an_NFS_Service_Principal_on_the_IPA_Server-Configuring_NFS_on_the_IPA_Server"><h6>Procedure 7.1. Configuring
<code class="systemitem">NFS</code> on the FreeIPA
Server</h6><ol class="1"><li class="step"><div
class="para">
Configure the export directory.
<pre class="screen"><code class="command"># mkdir
/export</code>
<code class="command"># chmod 777 /export</code></pre>
@@ -160,4 +160,4 @@ Certificate Subject base: O=MYDOMAIN.NET</pre><div
class="para">
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Note the use of the <code class="option">-k</code> option
when restarting <code class="systemitem">rpcgssd</code>. This is
necessary to update the NFS configuration with the path to the NFS keytab.
- </div></div></div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="kerb-policies.html"><strong>Prev</strong>6.2. Setting
Kerberos Ticket Policies</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Next</strong>6.4. Refreshing
Kerberos Tickets</a></li></ul></body></html>
+ </div></div></div></li></ol></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="kerb-policies.html"><strong>Prev</strong>7.2. Setting
Kerberos Ticket Policies</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Authentication-Refreshing_Kerberos_Tickets.html"><strong>Next</strong>7.4. Refreshing
Kerberos Tickets</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html
index b1793ac..2150508 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.2. Configuring the Network Information Service
(NIS)</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>10.2. Configuring the Network Information Service
(NIS)</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="nis.html" title="Chapter 9. Identity: Integrating with NIS Domains
and Netgroups" /><link rel="prev" href="nis.html"
title="Chapter 9. Identity: Integrating with NIS Domains and Netgroups"
/><link rel="next" href="migrintg-from-nis.html"
title="9.3. Migrating from NIS to IPA" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="nis.html"><strong>Prev</s
trong></a></li><li class="next"><a
accesskey="n"
href="migrintg-from-nis.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">9.2. Configuring
the Network Information Service
(NIS)</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="nis.html" title="Chapter 10. Identity: Integrating with NIS Domains
and Netgroups" /><link rel="prev" href="nis.html"
title="Chapter 10. Identity: Integrating with NIS Domains and Netgroups"
/><link rel="next" href="migrintg-from-nis.html"
title="10.3. Migrating from NIS to IPA" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="nis.html"><strong>Prev
</strong></a></li><li class="next"><a
accesskey="n"
href="migrintg-from-nis.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS">10.2. Configuring
the Network Information Service
(NIS)</h2></div></div></div><div class="para">
The Network Information Service (NIS) is an RPC service, used in conjunction with
<code class="systemitem">portmap</code> and other related services
to distribute maps of usernames, passwords, and other sensitive information to any
computer claiming to be within its domain.
</div><div class="para">
IPA provides a NIS server plug-in to facilitate the integration of NIS clients with an
IPA domain, including exposing any automount maps that have been configured.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">9.2.1. Exposing
Automount Maps to NIS Clients</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_the_Network_Information_Service_NIS-Exposing_Automount_Maps_to_NIS_Clients">10.2.1. Exposing
Automount Maps to NIS Clients</h3></div></div></div><div
class="para">
Currently, when the NIS service is enabled, the server is automatically configured to
serve the NIS domain with the IPA domain's name, and to serve IPA users, groups, and
netgroups (passwd, group, and netgroup maps) to the NIS domain.
</div><div class="para">
If you have defined automount maps, these maps need to be manually added to the NIS
server plug-in's configuration in the directory server in order to expose them to NIS
clients.
@@ -19,7 +19,7 @@
The NIS plug-in needs to know the name of the NIS domain, the name of the NIS map,
how to find the directory entries to use as the NIS map's contents, and which
attributes to use as the NIS map's key and value. Most of these settings will be the
same for every map.
</div><div class="para">
The IPA server stores the automount maps, grouped by automount location, in the
<em class="parameter"><code>cn=automount</code></em>
branch of the IPA domain's tree.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration">9.2.1.1. Example
Automount Map Configuration</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Exposing_Automount_Maps_to_NIS_Clients-Example_Automount_Map_Configuration">10.2.1.1. Example
Automount Map Configuration</h4></div></div></div><div
class="para">
If you have created an automount map named <code
class="filename">auto.example</code> in a location named
"default", you first need to add an entry to the configuration for the NIS
server running on a host named <code
class="systemitem">dirsrv</code>, as follows:
<pre class="screen">LOCATION=default
NISDOMAIN=example.com
@@ -46,4 +46,4 @@ EOF
This entry instructs the plug-in to create a map named <code
class="filename">auto.master</code> in the domain named <code
class="systemitem">${NISDOMAIN}</code>, and that the data for that map
should be read from the entries at and below <em
class="parameter"><code>automountmapname=${NISMAP}</code></em>,
which exists inside a container named <code
class="systemitem">cn=${LOCATION}</code>. This container is in the
automount section of the IPA data store. The keys for the entries in the automount map in
NIS are the values of the <em
class="parameter"><code>automountKey</code></em> attribute
for the directory server entries, and the corresponding values in the NIS map are the
values of the <em
class="parameter"><code>automountInformation</code></em>
attribute in those same entries.
</div><div class="para">
You then need to repeat the process for the <code
class="filename">auto.direct</code> map, and then any other maps that
you have defined.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="nis.html"><strong>Prev</strong>Chapter 9. Identity:
Integrating with NIS Domains...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="migrintg-from-nis.html"><strong>Next</strong>9.3. Migrating
from NIS to IPA</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="nis.html"><strong>Prev</strong>Chapter 10. Identity:
Integrating with NIS Domain...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="migrintg-from-nis.html"><strong>Next</strong>10.3. Migrating
from NIS to IPA</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html
index ea71ca4..59b60c2 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html
@@ -1,14 +1,7 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.6. Client Problems</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev" href="certs.html"
title="4.5. Configuring Certificate-Based Machine Authentication" /><link
rel="next" href="uninstalling-clients.html"
title="4.7. Uninstalling a FreeIPA Client" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>Prev
</strong></a></li><li class="next"><a
accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems">4.6. Client
Problems</h2></div></div></div><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.6. Client Problems</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="managing-clients.html" title="Chapter 5. Managing Clients in the IPA
Domain" /><link rel="prev" href="certs.html"
title="5.5. Configuring Certificate-Based Machine Authentication" /><link
rel="next" href="uninstalling-clients.html"
title="5.7. Uninstalling an IPA Client" /></head><body><p
id="title"><a class="left"
href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site" />
</a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems">5.6. Client
Problems</h2></div></div></div><div class="para">
If you are unable to log into a machine or the standard NSS tools fail to return user
and group information (for example, <code class="command">getent passwd
admin</code> fails), inspect the SSSD logs in <code
class="filename">/var/log/sssd/</code>. You should start with the log
file for your domain (<code
class="filename">sssd_example.com.log</code>).
</div><div class="para">
To increase the log level, set <code
class="varname">debug_level</code> = 9 in the <code
class="literal">[domain/<em
class="replaceable"><code>example.com</code></em>]</code>
section of the <code class="filename">/etc/sssd/sssd.conf</code>
file, and restart the <code class="systemitem">sssd</code> daemon
for this change to take effect. Monitor the <code
class="filename">/var/log/sssd/sssd_example.com.log</code> file for any
relevant information.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>Prev</strong>4.5. Configuring
Certificate-Based Machine Authen...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong>4.7. Uninstalling
a FreeIPA Client</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certs.html"><strong>Prev</strong>5.5. Configuring
Certificate-Based Machine Authen...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="uninstalling-clients.html"><strong>Next</strong>5.7. Uninstalling
an IPA Client</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html
index a296164..c7ed82c 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.6. Kerberos Errors</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>7.6. Kerberos Errors</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 6. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="rotating-keys.html" title="6.5. Rotating Keys" /><link
rel="next" href="automount.html" title="Chapter 7. Identity:
Using Automount" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="rotating-keys.html"><strong>Prev</strong></a></li><li
class="nex
t"><a accesskey="n"
href="automount.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">6.6. Kerberos
Errors</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="kerberos.html" title="Chapter 7. Identity: Using FreeIPA for a
Kerberos Domain" /><link rel="prev"
href="rotating-keys.html" title="7.5. Rotating Keys" /><link
rel="next" href="automount.html" title="Chapter 8. Identity:
Using Automount" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="rotating-keys.html"><strong>Prev</strong></a></li><li
class="nex
t"><a accesskey="n"
href="automount.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Kerberos_Errors">7.6. Kerberos
Errors</h2></div></div></div><div class="para">
If <code class="command">kinit</code> fails or you see an
unusual Kerberos error back in the framework, inspect the following files for possible
causes:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
On the server: <code
class="filename">/var/log/krb5kdc.log</code>
@@ -15,4 +15,4 @@
If you were using the framework also look in <code
class="filename">/var/log/httpd/error_log</code>
</div></li></ul></div>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="rotating-keys.html"><strong>Prev</strong>6.5. Rotating
Keys</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="automount.html"><strong>Next</strong>Chapter 7. Identity:
Using Automount</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="rotating-keys.html"><strong>Prev</strong>7.5. Rotating
Keys</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="automount.html"><strong>Next</strong>Chapter 8. Identity:
Using Automount</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html
index 6af68eb..cce9faf 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>10.2. HBAC Service Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>11.2. HBAC Service Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="authz.html" title="Chapter 10. Policy: Configuring
Authorization" /><link rel="prev" href="authz.html"
title="Chapter 10. Policy: Configuring Authorization" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"
title="10.3. HBAC Services" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" h
ref="authz.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">10.2. HBAC
Service Groups</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="authz.html" title="Chapter 11. Policy: Configuring
Authorization" /><link rel="prev" href="authz.html"
title="Chapter 11. Policy: Configuring Authorization" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"
title="11.3. HBAC Services" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" h
ref="authz.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups">11.2. HBAC
Service Groups</h2></div></div></div><div
class="para">
HBAC service groups can contain any number of individual services (<em
class="firstterm">members</em>), and are typically used to group
similar services to make it easier to create HBAC rules. All HBAC service groups require a
name and description. IPA provides a single default group, SUDO, used for SUDO-related
services.
</div><div class="para">
Use the <code class="command">ipa hbacsvcgroup-find</code>
command to display the existing HBAC groups:
@@ -23,4 +23,4 @@ Number of entries returned 1
</div><div class="para">
IPA provides commands for adding, removing and modifying HBAC service groups, adding
and removing members to and from those groups, and displaying group information. Refer to
the <code class="command">ipa help hbacsvcgroup</code> help page for
more information.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="authz.html"><strong>Prev</strong>Chapter 10. Policy:
Configuring Authorization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Next</strong>10.3. HBAC
Services</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="authz.html"><strong>Prev</strong>Chapter 11. Policy:
Configuring Authorization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Next</strong>11.3. HBAC
Services</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html
index c3b0e50..87a3ea2 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>10.3. HBAC Services</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>11.3. HBAC Services</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="authz.html" title="Chapter 10. Policy: Configuring
Authorization" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"
title="10.2. HBAC Service Groups" /><link rel="next"
href="sudo.html" title="Chapter 11. Policy: Using sudo"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href=
"sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sudo.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">10.3. HBAC
Services</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="authz.html" title="Chapter 11. Policy: Configuring
Authorization" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"
title="11.2. HBAC Service Groups" /><link rel="next"
href="sudo.html" title="Chapter 12. Policy: Using sudo"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href=
"sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sudo.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services">11.3. HBAC
Services</h2></div></div></div><div class="para">
HBAC services refer to the PAM services that the IPA HBAC system can control access
to. HBAC service names must exactly match the service name that PAM is evaluating. For
example, use the following command to add the <code
class="systemitem">tftp</code> service as an HBAC service:
<pre class="screen"><code class="command"># ipa
hbacsvc-add tftp</code>
-------------------------
@@ -31,4 +31,4 @@ Number of entries returned 2
</div><div class="para">
Refer to the <code class="command">ipa help hbacsvc</code> help
page for more information.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Prev</strong>10.2. HBAC
Service Groups</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sudo.html"><strong>Next</strong>Chapter 11. Policy: Using
sudo</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Service_Groups.html"><strong>Prev</strong>11.2. HBAC
Service Groups</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sudo.html"><strong>Next</strong>Chapter 12. Policy: Using
sudo</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html
index 75716f0..48bcc99 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html
@@ -1,25 +1,18 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.7. Implementing Unique UID and GID Attributes</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="disabling-anon-binds.html"
title="12.6. Disabling Anonymous Binds" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"
title="12.8. Configuring Certificates and Certificate Authorities"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="doc
nav"><li class="previous"><a accesskey="p"
href="disabling-anon-binds.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes">12.7. Implementing
Unique UID and GID Attributes</h2></div></div></div><div
class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.7. Implementing Unique UID and GID Attributes</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev" href="disabling-anon-binds.html"
title="14.6. Disabling Anonymous Binds" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"
title="14.8. Configuring Certificates and Certificate Authorities"
/></head><body><p id="title"><a cla
ss="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="disabling-anon-binds.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes">14.7. Implementing
Unique UID and GID Attributes</h2></div></div></div><div
class="para">
An IPA deployment needs to handle the dual constraints of generating random UID and
GID values, while ensuring that replicas never generate the same UID or GID value. It is
also important to minimize the chance that any two deployments of IPA have overlapping
ranges.
</div><div class="para">
The system administrator—or whoever is performing the IPA installation—can impact the
logic that deals with these constraints only once, when the system is being installed.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1. Assigning
UIDs and GIDs</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">14.7.1. Assigning
UIDs and GIDs</h3></div></div></div><div
class="para">
To assign UIDs and GIDs, IPA uses the directory server DNA plug-in. This plug-in is
configured with a range of IDs and will assign a new ID whenever an entry requiring the
uidNumber or gidNumber attributes is added to the system.
</div><div class="para">
For simplicity, and to allow configuring User Private Groups (UPGs) at any time, IPA
uses a single range of UIDs and GIDs, instead of using two separate ranges. When UPGs are
active, the private group gidNumber is numerically identical to the uidNumber of its
user.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges">12.7.1.1. Selecting
ID Ranges</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Selecting_ID_Ranges">14.7.1.1. Selecting
ID Ranges</h4></div></div></div><div
class="para">
When the first IPA server is installed, a range of 200,000 IDs is randomly selected
between the values 1MiB and 2GiB, approximately. There are 10,000 possible ranges. The
selection of a random range provides a high probability of non-conflicting IDs if, at a
later stage, a trust relationship or merge between two separate installations needs to
occur.
</div><div class="para">
IDs are assigned in order by a single master, but ID ranges can be split and
distributed between replicas. When a replica is installed it is configured with an invalid
depleted range, and a place in the shared tree where it can expose information about the
ranges it manages. The first time an allocation is needed, the replica will notice it has
no more IDs available and will contact one of the other available masters (typically the
one with the greatest available range). A special extended operation is performed to split
the range in two, so that the original master and the replica will each receive half of
the previously available range for their use. When a range comes close to depletion (by
default when less than 100 IDs are available), a new range is requested.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges">12.7.1.2. Adding
New Ranges</h4></div></div></div><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Assigning_UIDs_and_GIDs-Adding_New_Ranges">14.7.1.2. Adding
New Ranges</h4></div></div></div><div
class="para">
If the domain-wide range is close to depletion, the system administrator needs to
manually select and add a new range to one of the masters. All other replicas will manage
sharing the range among them as necessary.
</div><div class="para">
To add a new range, the Directory Manager must connect to the LDAP server and add
the new range as a dash-separated minimum/maximum value pair in the <em
class="parameter"><code>dnaNextRange</code></em> attribute
in the DNA configuration entry for the ranges in question. For example, the following
command adds a new range of 100k values:
@@ -30,4 +23,4 @@ changetype: modify
add: dnaNextRange
dnaNextRange: 123400000-123500000</pre><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
This command only adds the specified range of values; it does not check that the
values in that range are actually available. This check will be performed when an attempt
is made to allocate those values. If, for example, you added a range that contained mostly
values that were already allocated, time would be lost as the system cycled through
searching for unallocated values, and then finally failing if none were available.
- </div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="disabling-anon-binds.html"><strong>Prev</strong>12.6. Disabling
Anonymous Binds</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong>12.8. Configuring
Certificates and Certificate
Au...</a></li></ul></body></html>
+ </div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="disabling-anon-binds.html"><strong>Prev</strong>14.6. Disabling
Anonymous Binds</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html"><strong>Next</strong>14.8. Configuring
Certificates and Certificate
Au...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html
index c76ec70..17f3146 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html
@@ -1,21 +1,21 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>C.3. Performing a Client-based Migration</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>D.3. Performing a Client-based Migration</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix C. Migrating from a Directory Server to IPA" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"
title="C.2. Performing a Server-based Migration" /><link
rel="next" href="Glossary.html" title="Glossary"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Glossary.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">C.3. Performing
a Client-based Migration</h2></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_
Configuring_SSSD">C.3.1. Phase 1: Installing and Configuring
SSSD</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix D. Migrating from a Directory Server to IPA" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"
title="D.2. Performing a Server-based Migration" /><link
rel="next" href="Glossary.html" title="Glossary"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Glossary.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration">D.3. Performing
a Client-based Migration</h2></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_1_Installing_and_
Configuring_SSSD">D.3.1. Phase 1: Installing and Configuring
SSSD</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
Install SSSD first on the machines that can support it:
</div><div class="para">
<code class="command"># yum install sssd</code>
</div></li><li class="listitem"><div
class="para">
Configure SSSD with the LDAP back end and point it to the existing DS deployment.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">C.3.2. Phase
2: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
- Install IPA and migrate the existing DS data as described in <a
class="xref"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">Section C.2.1,
“Phase 1: Migrating Existing Data to IPA”</a>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">C.3.3. Phase
3: Migrate SSSD Clients from LDAP to
IPA</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_2_Migrating_Existing_Data_to_IPA">D.3.2. Phase
2: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
+ Install IPA and migrate the existing DS data as described in <a
class="xref"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">Section D.2.1,
“Phase 1: Migrating Existing Data to IPA”</a>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_3_Migrate_SSSD_Clients_from_LDAP_to_IPA">D.3.3. Phase
3: Migrate SSSD Clients from LDAP to
IPA</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
Start moving clients that have SSSD installed from the LDAP back end to the IPA
back end, and enroll them with IPA. This will download the required keys and
certificates.
</div></li><li class="listitem"><div
class="para">
Instruct users to use (that is, to log in at least once) the machines with SSSD and
IPA back end, or go to the web page and authenticate.
@@ -28,8 +28,8 @@
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
It is important to include the quotes around the filter so that it is not
interpreted by the shell.
- </div></div></div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">C.3.4. Phase
4: Reconfigure non-SSSD Clients</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></div></div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_4_Reconfigure_non_SSSD_Clients">D.3.4. Phase
4: Reconfigure non-SSSD Clients</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
As the user population is migrated (the Kerberos keys are generated), you can start
reconfiguring other (non‐SSSD) clients as required. The clients can be set up in any state
shown on the diagram above.
- </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">C.3.5. Phase
5: Decommission the Directory Server</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></li></ul></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Client_based_Migration-Phase_5_Decommission_the_Directory_Server">D.3.5. Phase
5: Decommission the Directory Server</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
When the migration of the clients is complete, decommission the DS.
- </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Prev</strong>C.2. Performing
a Server-based Migration</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Glossary.html"><strong>Next</strong>Glossary</a></li></ul></body></html>
+ </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html"><strong>Prev</strong>D.2. Performing
a Server-based Migration</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Glossary.html"><strong>Next</strong>Glossary</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html
index 6442d42..e1ae994 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html
@@ -1,21 +1,21 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>C.2. Performing a Server-based Migration</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>D.2. Performing a Server-based Migration</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix C. Migrating from a Directory Server to IPA" /><link
rel="prev" href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix C. Migrating from a Directory Server to IPA" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"
title="C.3. Performing a Client-based Migration" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src=
"Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">C.2. Performing
a Server-based Migration</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix D. Migrating from a Directory Server to IPA" /><link
rel="prev" href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix D. Migrating from a Directory Server to IPA" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"
title="D.3. Performing a Client-based Migration" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src=
"Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration">D.2. Performing
a Server-based Migration</h2></div></div></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Each phase of the migration should be performed as a single step.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">C.2.1. Phase
1: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_1_Migrating_Existing_Data_to_IPA">D.2.1. Phase
1: Migrating Existing Data to IPA</h3></div></div></div><div
class="para">
The first phase of the migration consists of setting up IPA and migrating data from
the existing DS to that used by IPA. This involves the use of the <code
class="command">ipa migrate-ds</code> command, which dumps the user
data from the original DS, converts it into a format suitable for use by IPA, and then
loads the converted data into IPA.
</div><div class="para">
The <code class="command">ipa migrate-ds</code> command
connects to the DS and binds as the <code class="systemitem">Directory
Manager</code>, and then extracts all objectClass=person objects from ou=People.
This can be changed using the <code
class="option">--user-container</code> option. It also extracts all
objects from ou=Groups. This can be changed using the <code
class="option">--group-container</code> option. It adds all object
classes and attributes required by IPA (if they are missing) and coverts DNs in attributes
to match the IPA Directory Information Tree (DIT). The command returns an error if
migration is not enabled.
</div><div class="para">
Refer to the <code class="command">ipa migrate-ds</code> help
page for more details about this command (<code class="command">ipa help
migrate-ds</code>).
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_1_Migrating_Existing_Data_to_IPA-To_migrate_existing_data_to_IPA"><h6>Procedure C.1. To
migrate existing data to IPA:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_1_Migrating_Existing_Data_to_IPA-To_migrate_existing_data_to_IPA"><h6>Procedure D.1. To
migrate existing data to IPA:</h6><ol class="1"><li
class="step"><div class="para">
Install IPA, including any custom DS schema, on a different machine from the
existing DS. Refer to
</div></li><li class="step"><div
class="para">
Use the following command to enable IPA migration mode:
@@ -39,7 +39,7 @@
The migration log file is currently not implemented. Instead, any error messages
are printed to standard output.
</div></div></div>
- </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">C.2.2. Phase
2: Updating the Client Configuration</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_2_Updating_the_Client_Configuration-To_update_the_client_configuration"><h6>Procedure C.2. To
update the client configuration:</h6><ul><li
class="step"><div class="para">
+ </div></li></ol></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_2_Updating_the_Client_Configuration">D.2.2. Phase
2: Updating the Client Configuration</h3></div></div></div><div
class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Phase_2_Updating_the_Client_Configuration-To_update_the_client_configuration"><h6>Procedure D.2. To
update the client configuration:</h6><ul><li
class="step"><div class="para">
Update the client configuration to use PAM_LDAP and NSS_LDAP to connect to IPA
instead of connecting to DS, NIS, or using local files.
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
If the intention is to automatically generate the Kerberos keys when a user
authenticates, the configuration should use startTLS and simple bind authentication. For
this to occur, the IT department needs to ensure the IPA server certificate is copied to
the client.
@@ -49,7 +49,7 @@
</div></li></ul></div><div
class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
You should not update your client configuration to use PAM_KRB5 and NSS_LDAP (that
is, the equivalent of IPA v1) at this stage unless absolutely necessary. This is because
the Kerberos keys will not yet exist in the IPA user entries, and consequently users will
not be able to log in. If such a configuration is required, users can be directed to a
specific web page on the IPA server after the data has been loaded into the IPA server.
This page will prompt the user for their password and perform an LDAP bind. The DS
password plug-in will capture these passwords and generate the Kerberos keys.
- </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">C.2.3. Phase
3: Installing and Configuring SSSD</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_3_Installing_and_Configuring_SSSD-To_install_and_configure_SSSD"><h5
class="formalpara">To install and configure SSSD:</h5>
+ </div></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">D.2.3. Phase
3: Installing and Configuring SSSD</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_3_Installing_and_Configuring_SSSD-To_install_and_configure_SSSD"><h5
class="formalpara">To install and configure SSSD:</h5>
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
Install SSSD on the machines that can support it:
</div><div class="para">
@@ -58,13 +58,13 @@
Configure SSSD to use IPA as a back end (Kerberos and LDAP). Installing SSSD and
enrolling the client with IPA will ensure delivery of the machine Kerberos key and server
certificate to the client. Refer to
</div></li></ol></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">C.2.4. Phase
4: Migrating Users</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_4_Migrating_Users-To_migrate_the_users_from_DS_to_IPA"><h5
class="formalpara">To migrate the users from DS to IPA:</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_4_Migrating_Users">D.2.4. Phase
4: Migrating Users</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Phase_4_Migrating_Users-To_migrate_the_users_from_DS_to_IPA"><h5
class="formalpara">To migrate the users from DS to IPA:</h5>
<div class="orderedlist"><ol><li
class="listitem"><div class="para">
- Instruct users to log in to IPA using either an SSSD client or a client that
supports PAM_LDAP with startTLS and simple bind. An SSSD client configured as described in
<a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">Section C.2.3,
“Phase 3: Installing and Configuring SSSD”</a> will perform a silent migration.
Clients configured with startTLS and simple bind will also trigger key generation. A
Kerberos key is created the first time a user logs in, and this key is stored in the IPA
back end.
+ Instruct users to log in to IPA using either an SSSD client or a client that
supports PAM_LDAP with startTLS and simple bind. An SSSD client configured as described in
<a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Server_based_Migration.html#sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_3_Installing_and_Configuring_SSSD">Section D.2.3,
“Phase 3: Installing and Configuring SSSD”</a> will perform a silent migration.
Clients configured with startTLS and simple bind will also trigger key generation. A
Kerberos key is created the first time a user logs in, and this key is stored in the IPA
back end.
</div></li><li class="listitem"><div
class="para">
As the migration of the user population progresses (that is, as the Kerberos keys
are generated on the IPA server), you can begin to configure other, non-SSSD clients to
suit your requirements.
</div></li></ol></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">C.2.5. Phase
5: Decommission the DS</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Performing_a_Server_based_Migration-Phase_5_Decommission_the_DS">D.2.5. Phase
5: Decommission the DS</h3></div></div></div><div
class="itemizedlist"><ul><li class="listitem"><div
class="para">
When the migration of all clients and users is complete, decommission the DS.
- </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Prev</strong>Appendix C. Migrating
from a Directory Server to ...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Next</strong>C.3. Performing
a Client-based Migration</a></li></ul></body></html>
+ </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Prev</strong>Appendix D. Migrating
from a Directory Server to ...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Migrating_from_a_Directory_Server_to_IPA-Performing_a_Client_based_Migration.html"><strong>Next</strong>D.3. Performing
a Client-based Migration</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html
index 56c4a4b..7f46955 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.2. Setting up Active Directory</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.2. Setting up Active Directory</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="next"
href="configuring-active-directory.html" title="8.3. Configuring Active
Directory Synchronization" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="
previous"><a accesskey="p"
href="active-directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-active-directory.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">8.2. Setting
up Active Directory</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="next"
href="configuring-active-directory.html" title="9.3. Configuring Active
Directory Synchronization" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li class="
previous"><a accesskey="p"
href="active-directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-active-directory.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Prerequisites-Setting_up_Active_Directory">9.2. Setting
up Active Directory</h2></div></div></div><div
class="para">
The Windows Sync utility requires TLS/SSL to synchronize password changes. Therefore,
you need to set up Active Directory as an SSL server. The easiest way to achieve this is
to install Microsoft Certificate System in Enterprise Root Mode; Active Directory will
then automatically enroll to retrieve its SSL server certificate.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You need to install both the <code
class="command">winsync</code> and <code
class="command">passsync</code> utilities to synchronize User IDs and
attributes as well as passwords.
@@ -17,7 +17,7 @@
Refer to the <a
href="http://directory.fedoraproject.org/wiki/Howto:WindowsSync"...
Project Windows Sync Howto</a> for information on setting up Active Directory as an
SSL server.
</div><div class="para">
After you have installed Microsoft Certificate System, you need to save the CA
certificate in ASCII (PEM) format. This CA Certificate is required to create the
synchronization agreement.
- </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-To_save_the_CA_certificate_in_ASCII_format"><h6>Procedure 8.1. To
save the CA certificate in ASCII format:</h6><ol class="1"><li
class="step"><div class="para">
+ </div><div class="procedure"
id="proc-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-To_save_the_CA_certificate_in_ASCII_format"><h6>Procedure 9.1. To
save the CA certificate in ASCII format:</h6><ol class="1"><li
class="step"><div class="para">
Navigate to My Network Places and drill down to the CA distribution point. On
Windows 2003 Server this is typically <code
class="filename">C:\WINDOWS\system32\certsrv\CertEnroll\</code>
</div></li><li class="step"><div
class="para">
Double-click the security certificate file (<code
class="filename">.crt</code> file) to display the <span
class="guilabel"><strong>Certificate</strong></span> dialog
box.
@@ -30,5 +30,5 @@
</div></li><li class="step"><div
class="para">
Click <span
class="guibutton"><strong>OK</strong></span> to exit the
wizard.
</div></li></ol></div><div class="para">
- Refer to <a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">Section 8.4,
“Creating Synchronization Agreements”</a> for information on how to use the CA
Certificate to create the synchronization agreement.
- </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-Select_Base_64_encoded_X.509_to_export_the_security_certificate_as_ASCII"><div
class="figure-contents"><div class="mediaobject"
align="center"><img src="images/ASCII_Cert_Export.png"
align="middle" alt="Select Base-64 encoded X.509 to export the security
certificate as ASCII" /></div></div><h6>Figure 8.1. Select
Base-64 encoded X.509 to export the security certificate as
ASCII</h6></div><br class="figure-break" /></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="active-directory.html"><strong>Prev</strong>Chapter 8. Identity:
Integrating with Microsoft A...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-active-directory.html"><strong>Next</strong>8.3. Configuring
Active Directory Synchroniz
ation</a></li></ul></body></html>
+ Refer to <a class="xref"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html">Section 9.4,
“Creating Synchronization Agreements”</a> for information on how to use the CA
Certificate to create the synchronization agreement.
+ </div><div class="figure"
id="figu-Enterprise_Identity_Management_Guide-Setting_up_Active_Directory-Select_Base_64_encoded_X.509_to_export_the_security_certificate_as_ASCII"><div
class="figure-contents"><div class="mediaobject"
align="center"><img src="images/ASCII_Cert_Export.png"
align="middle" alt="Select Base-64 encoded X.509 to export the security
certificate as ASCII" /></div></div><h6>Figure 9.1. Select
Base-64 encoded X.509 to export the security certificate as
ASCII</h6></div><br class="figure-break" /></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="active-directory.html"><strong>Prev</strong>Chapter 9. Identity:
Integrating with Microsoft A...</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-active-directory.html"><strong>Next</strong>9.3. Configuring
Active Directory Synchroniz
ation</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html
index df8f77e..f70ce4b 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.4. Creating Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.4. Creating Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="configuring-active-directory.html" title="8.3. Configuring Active
Directory Synchronization" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"
title="8.5. Modifying Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common
_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-active-directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">8.4. Creating
Synchronization Agreements</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="configuring-active-directory.html" title="9.3. Configuring Active
Directory Synchronization" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"
title="9.5. Modifying Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common
_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-active-directory.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements">9.4. Creating
Synchronization Agreements</h2></div></div></div><div
class="para">
Use the <code class="command">ipa-replica-manage connect</code>
command to create synchronization agreements. The following command-line arguments apply
to creating synchronization agreements:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<code class="option">--winsync</code> — specifies that this is
a Windows Sync agreement. Winsync replication occurs every five minutes.
@@ -23,5 +23,5 @@
<code class="option">--win-subtree</code> — the DN of the
Windows subtree containing the users you want to synchronize. The default value is <em
class="parameter"><code>cn=Users,$SUFFIX</code></em> — this
is what Windows AD typically uses as the default value.
</div></li></ul></div><div class="para">
The following example illustrates adding a new WinSync agreement:
- </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Creating_Synchronization_Agreements-Adding_a_WinSync_agreement_between_an_IPA_server_and_an_AD_server."><h6>Example 8.1. Adding
a WinSync agreement between an IPA server and an AD server.</h6><div
class="example-contents"><pre class="screen"><code
class="command">ipa-replica-manage connect --winsync --binddn
cn=administrator,cn=users,dc=example,dc=com \</code>
-<code class="command">--bindpw password --passsync password --cacert
/path/to/certfile.cer
adserver.example.com
-v</code></pre></div></div><br class="example-break"
/></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-active-directory.html"><strong>Prev</strong>8.3. Configuring
Active Directory Synchronization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Next</strong>8.5. Modifying
Synchronization Agreements</a></li></ul></body></html>
+ </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Creating_Synchronization_Agreements-Adding_a_WinSync_agreement_between_an_IPA_server_and_an_AD_server."><h6>Example 9.1. Adding
a WinSync agreement between an IPA server and an AD server.</h6><div
class="example-contents"><pre class="screen"><code
class="command">ipa-replica-manage connect --winsync --binddn
cn=administrator,cn=users,dc=example,dc=com \</code>
+<code class="command">--bindpw password --passsync password --cacert
/path/to/certfile.cer
adserver.example.com
-v</code></pre></div></div><br class="example-break"
/></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-active-directory.html"><strong>Prev</strong>9.3. Configuring
Active Directory Synchronization</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Next</strong>9.5. Modifying
Synchronization Agreements</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html
index 05b52ce..9329aaa 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.6. Deleting Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.6. Deleting Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"
title="8.5. Modifying Synchronization Agreements" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"
title="8.7. Winsync Agreement Failures" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" hre
f="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">8.6. Deleting
Synchronization Agreements</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"
title="9.5. Modifying Synchronization Agreements" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"
title="9.7. Winsync Agreement Failures" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right" hre
f="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements">9.6. Deleting
Synchronization Agreements</h2></div></div></div><div
class="para">
You can use the IPA administration tools to delete existing synchronization
agreements. For example, to delete an agreement with the AD server <code
class="systemitem">adserver.example.com</code>, run the following
command:
</div><div class="para">
<code class="command"># ipa-replica-manage disconnect
adserver.example.com</code>
@@ -15,4 +15,4 @@
This removes the replication agreement between the IPA and AD servers. To complete the
operation, you need to remove the AD certificate from the IPA server. Run the following
command to remove the AD certificate:
</div><div class="para">
<code class="command"># certutil -D -d /etc/dirsrv/slapd-$REALM/ -n
"Imported CA"</code>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Prev</strong>8.5. Modifying
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Next</strong>8.7. Winsync
Agreement Failures</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html"><strong>Prev</strong>9.5. Modifying
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html"><strong>Next</strong>9.7. Winsync
Agreement Failures</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html
index c4e3d2f..83643b0 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements.html
@@ -1,17 +1,17 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.5. Modifying Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.5. Modifying Synchronization Agreements</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"
title="8.4. Creating Synchronization Agreements" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"
title="8.6. Deleting Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.pn
g" alt="Product Site" /></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">8.5. M
odifying Synchronization Agreements</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"
title="9.4. Creating Synchronization Agreements" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"
title="9.6. Deleting Synchronization Agreements" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.pn
g" alt="Product Site" /></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Modifying_Synchronization_Agreements">9.5. M
odifying Synchronization Agreements</h2></div></div></div><div
class="para">
You can change the behavior of the synchronization agreement to suit the changing
needs of your organization. You can modify a number of attributes related to the
synchronization agreement using default tools provided with IPA.
</div><div class="para">
The following example illustrates changing the synchronization behavior of account
lock status. By default, account lock status is synchronized between IPA and AD. This
means that accounts that are locked in IPA are also locked (disabled) in AD, and vice
versa. You can change this synchronization behavior as follows:
- </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Configuring_the_IPA_WinSync_agreement_to_not_synchronize_account_lock_status_information."><h6>Example 8.2. Configuring
the IPA WinSync agreement to not synchronize account lock status
information.</h6><div class="example-contents"><pre
class="screen"><code class="command">$ ldapmodify -x -D
"cn=directory manager" -w password</code>
+ </div><div class="example"
id="exam-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Configuring_the_IPA_WinSync_agreement_to_not_synchronize_account_lock_status_information."><h6>Example 9.2. Configuring
the IPA WinSync agreement to not synchronize account lock status
information.</h6><div class="example-contents"><pre
class="screen"><code class="command">$ ldapmodify -x -D
"cn=directory manager" -w password</code>
dn: cn=ipa-winsync,cn=plugins,cn=config
changetype: modify
replace: ipaWinSyncAcctDisable
@@ -20,10 +20,10 @@ ipaWinSyncAcctDisable: none
modifying entry "cn=ipa-winsync,cn=plugins,cn=config"
</pre></div></div><br class="example-break" /><div
class="para">
The default value of the <em
class="parameter"><code>ipaWinSyncAcctDisable</code></em>
attribute is <code class="literal">both</code>. If you change this
value to <code class="literal">none</code>, as described in the
example, account lock status synchronization is completely disabled. Valid values for
<em
class="parameter"><code>ipaWinSyncAcctDisable</code></em>
are <code class="literal">both</code>, <code
class="literal">to_ad</code>, <code
class="literal">to_ds</code>, and <code
class="literal">none</code>.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">8.5.1. Changing
the Default Synchronization Subtree</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Modifying_Synchronization_Agreements-Changing_the_Default_Synchronization_Subtree">9.5.1. Changing
the Default Synchronization Subtree</h3></div></div></div><div
class="para">
When you create synchronization agreements, two default containers are used as the
source of the user accounts to synchronize between IPA and Windows Active Directory. IPA
uses the <em
class="parameter"><code>cn=users,cn=accounts,$SUFFIX</code></em>
subtree as the default container, and Windows uses the <em
class="parameter"><code>CN=Users,$SUFFIX</code></em>
subtree. You can use the <em
class="parameter"><code>--win-subtree</code></em> argument
to the <code class="command">ipa-replica-manage connect</code>
command to override the default Windows subtree.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
If you pass such arguments to the bash or other shell, ensure that you quote spaces
and other shell metacharacters. For example, the argument <em
class="parameter"><code>--win-subtree=cn=users, dc=example,
dc=com</code></em> will fail. The argument <em
class="parameter"><code>--win-subtree="cn=users, dc=example,
dc=com"</code></em> will succeed.
</div></div></div><div class="para">
IPA does not currently support modifying the default synchronization container while
you are creating the synchronization agreement. You can, however, change the container
after the agreement has been established. To do so, you can either modify the <code
class="filename">dse.ldif</code> file directly (ensure that you stop
the directory server before editing this file), or use <code
class="command">ldapmodify</code> to change <em
class="parameter"><code>nsds7WindowsReplicaSubtree</code></em>.
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Prev</strong>8.4. Creating
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Next</strong>8.6. Deleting
Synchronization Agreements</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Creating_Synchronization_Agreements.html"><strong>Prev</strong>9.4. Creating
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Next</strong>9.6. Deleting
Synchronization Agreements</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html
index 60d6d88..7412e64 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>8.7. Winsync Agreement Failures</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>9.7. Winsync Agreement Failures</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 8. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"
title="8.6. Deleting Synchronization Agreements" /><link
rel="next" href="nis.html" title="Chapter 9. Identity:
Integrating with NIS Domains and Netgroups" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_Content/ima
ges/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="nis.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">8.7. Winsync
Agreement Failures</h2></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Winsync_Agreement_Failures-Symptom"><h5
class="formalpara">Symptom</h5>
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="active-directory.html" title="Chapter 9. Identity: Integrating with
Microsoft Active Directory" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"
title="9.6. Deleting Synchronization Agreements" /><link
rel="next" href="nis.html" title="Chapter 10. Identity:
Integrating with NIS Domains and Netgroups" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_Content/im
ages/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="nis.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Troubleshooting_IPA_Servers-Winsync_Agreement_Failures">9.7. Winsync
Agreement Failures</h2></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Winsync_Agreement_Failures-Symptom"><h5
class="formalpara">Symptom</h5>
If the creation of a winsync agreement fails, you may see an error message similar to
the following:
<pre class="screen">"Update failed! Status: [81 - LDAP error:
Can't contact LDAP server]
</pre>
@@ -35,4 +35,4 @@ Imported CA
CT,,C</pre>
</div><pre class="screen">"Windows PassSync entry exists,
not resetting password"
</pre><div class="para">
This is not an error, but rather a notification that IPA is not re-adding the <code
class="systemitem">passync</code> user, and neither is it changing the
original password. The <code class="systemitem">passync</code> user
is a special user entry that can change passwords in IPA.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Prev</strong>8.6. Deleting
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="nis.html"><strong>Next</strong>Chapter 9. Identity:
Integrating with NIS Domains...</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Setting_up_Synchronization_Between_IPA_and_Active_Directory-Deleting_Synchronization_Agreements.html"><strong>Prev</strong>9.6. Deleting
Synchronization Agreements</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="nis.html"><strong>Next</strong>Chapter 10. Identity:
Integrating with NIS Domain...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
index 4d98b26..29ac15b 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html
@@ -1,14 +1,7 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.11. Creating DNS Entries for FreeIPA Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="ipa-cluster.html"
title="12.10. Using IPA in a Cluster" /><link rel="next"
href="promoting-replica.html" title="12.12. Promoting a Read-Only Replica
to an IPA Server" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</strong></a><
/li><li class="next"><a accesskey="n"
href="promoting-replica.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">12.11. Creating
DNS Entries for FreeIPA Replicas</h2></div></div></div><div
class="para">
- You can use the <code class="option">--ip-address</code> option
with the <code class="command">ipa-replica-prepare</code> command to
pre-create DNS entries for a replica. If you include this option, FreeIPA will add the A
and PTR records for the replica to the DNS. For example:
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.11. Creating DNS Entries for IPA Replicas</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev" href="ipa-cluster.html"
title="14.10. Using IPA in a Cluster" /><link rel="next"
href="promoting-replica.html" title="14.12. Promoting a Read-Only Replica
to an IPA Server" /></head><body><p id="title"><a
class="left" href="http://www.redhat.com"><img
src="Common_Content/images/image_left.png" alt="Produ
ct Site" /></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="promoting-replica.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas">14.11. Creating
DNS Entries for IPA Replicas</h2></div></div></div><div
class="para">
+ You can use the <code class="option">--ip-address</code> option
with the <code class="command">ipa-replica-prepare</code> command to
pre-create DNS entries for a replica. If you include this option, IPA will add the A and
PTR records for the replica to the DNS. For example:
<pre class="screen"><code class="command">$
ipa-replica-prepare
master2.example.com --ip-address 192.168.1.2</code></pre>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</strong>12.10. Using IPA in
a Cluster</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="promoting-replica.html"><strong>Next</strong>12.12. Promoting
a Read-Only Replica to an IPA
Se...</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="ipa-cluster.html"><strong>Prev</strong>14.10. Using IPA in
a Cluster</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="promoting-replica.html"><strong>Next</strong>14.12. Promoting
a Read-Only Replica to an IPA
Se...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html
index a5d9554..eebc7ae 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.2. Using certmonger</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>C.2. Using certmonger</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix B. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix B. Services: Working with certmonger" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"
title="B.3. Using certmonger with NSS" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="
Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">B.2. Using
certmonger</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix C. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix C. Services: Working with certmonger" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"
title="C.3. Using certmonger with NSS" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="
Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger">C.2. Using
certmonger</h2></div></div></div><div
class="para">
Probably the simplest use case is to generate a certificate which is signed by the
subject itself. These are not typically used in production, but are suitable for
demonstration and testing purposes. Consider the following command:
</div><pre class="screen"><code class="command">#
selfsign-getcert request -f /tmp/server.crt -k
/tmp/server.key</code></pre><div class="para">
This informs <code class="systemitem">certmonger</code> that we
want a key to be stored in the file <code
class="filename">/tmp/server.key</code>, to generate a corresponding
certificate, and to store that certificate in the file <code
class="filename">/tmp/server.crt</code>. Using <code
class="command">selfsign-getcert</code> also implicitly tells <code
class="systemitem">certmonger</code> to <span
class="emphasis"><em>self-sign</em></span> the CSR, which
it generates and uses internally, with the subject's own key. During this process,
certmonger:
@@ -19,4 +19,4 @@
created the CSR
</div></li><li class="listitem"><div
class="para">
used the same key to produce a signed certificate.
- </div></li></ul></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Prev</strong>Appendix B. Services:
Working with certmonger</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Next</strong>B.3. Using
certmonger with NSS</a></li></ul></body></html>
+ </div></li></ul></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"><strong>Prev</strong>Appendix C. Services:
Working with certmonger</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Next</strong>C.3. Using
certmonger with NSS</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html
index 2b3e6cd..80ae191 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.4. Using certmonger with IPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>C.4. Using certmonger with IPA</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix B. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"
title="B.3. Using certmonger with NSS" /><link rel="next"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix C. Migrating from a Directory Server to IPA"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_Content/ima
ges/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">B.4. Using
certmonger with IPA</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix C. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"
title="C.3. Using certmonger with NSS" /><link rel="next"
href="Migrating_from_a_Directory_Server_to_IPA.html"
title="Appendix D. Migrating from a Directory Server to IPA"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_Content/ima
ges/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA">C.4. Using
certmonger with IPA</h2></div></div></div><div
class="para">
The only difference between using <code
class="systemitem">certmonger</code> with the IPA CA and producing a
self-signed certificate is changing the command prefix. Instead of using <code
class="command">selfsign-getcert</code>, use the <code
class="command">ipa-getcert</code> command. For example:
<pre class="screen"><code class="command">ipa-getcert
request -r \</code>
<code class="command">-f /etc/httpd/conf/ssl.crt/server.crt
\</code>
@@ -16,4 +16,4 @@
<code class="command">-D `hostname --fqdn` \</code>
<code class="command">-U id-kp-serverAuth</code></pre>
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Prev</strong>B.3. Using
certmonger with NSS</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Next</strong>Appendix C. Migrating
from a Directory Server to ...</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html"><strong>Prev</strong>C.3. Using
certmonger with NSS</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Migrating_from_a_Directory_Server_to_IPA.html"><strong>Next</strong>Appendix D. Migrating
from a Directory Server to ...</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html
index bd8e711..997f9ea 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.3. Using certmonger with NSS</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>C.3. Using certmonger with NSS</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix B. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"
title="B.2. Using certmonger" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"
title="B.4. Using certmonger with IPA" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_C
ontent/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">B.3. Using
certmonger with NSS</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html"
title="Appendix C. Services: Working with certmonger" /><link
rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"
title="C.2. Using certmonger" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"
title="C.4. Using certmonger with IPA" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img src="Common_C
ontent/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Next</strong></a></li></ul><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS">C.3. Using
certmonger with NSS</h2></div></div></div><div
class="para">
The previous example used plain files for holding the key and the certificate, but
certmonger can also take advantage of NSS database storage. In this scenario, you need to
pass the database's location and a nickname for the certificate to certmonger.
Consider the following example:
<pre class="screen"><code class="command">#
selfsign-getcert request -d /tmp -n Test-Certificate</code></pre>
@@ -18,4 +18,4 @@
</div><div class="para">
Refer to the <code class="command">getcert</code> man page for
more information about the available command options.
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Prev</strong>B.2. Using
certmonger</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Next</strong>B.4. Using
certmonger with IPA</a></li></ul></body></html>
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Prev</strong>C.2. Using
certmonger</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html"><strong>Next</strong>C.4. Using
certmonger with IPA</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html
index 453a15b..24c05cf 100644
---
a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html
+++
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html
@@ -1,16 +1,16 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix B. Services: Working with certmonger</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix C. Services: Working with certmonger</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"
title="Appendix A. Frequently Asked Questions" /><link
rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"
title="B.2. Using certmonger" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><
li class="previous"><a accesskey="p"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Services: Working with
certmonger</h1></div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">B.1. What
is certmonger?</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="certmonger-tools.html"
title="B.4. Certmonger Scripts" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"
title="C.2. Using certmonger" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certmonger-tools.html"><s
trong>Prev</strong></a></li><li class="next"><a
accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">Services: Working with
certmonger</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger.html#sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1.
What is certmonger?</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html">C.2.
Using certmonger</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_NSS.html">C.3.
Using certmonge
r with NSS</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger_with_IPA.html">C.4.
Using certmonger with IPA</a></span></dt></dl></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger"><div
class="titlepage"><div><div><h2 class="title"
id="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-What_is_certmonger">C.1. What
is certmonger?</h2></div></div></div><div
class="para">
The <code class="systemitem">certmonger</code> daemon, together
with its command line clients, attempts to simplify the process of generating
public/private key pairs and Certificate Signing Requests (CSRs), and submitting CSRs to
Certificate Authorities (CAs) for signing.
</div><div class="para">
The <code class="systemitem">certmonger</code> daemon also
monitors certificates for imminent expiration and, with the help of a CA, can optionally
refresh certificates that are about to expire. It can also drive the entire IPA enrollment
process, from key generation through to enrollment itself and refreshing certificates.
</div><div class="para">
The set of certificates that <code
class="systemitem">certmonger</code> monitors is tracked in files
stored in a user-configurable directory. The default location is <code
class="filename">/var/lib/certmonger/requests</code>.
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Prev</strong>Appendix A. Frequently
Asked Questions</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Next</strong>B.2. Using
certmonger</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="certmonger-tools.html"><strong>Prev</strong>B.4. Certmonger
Scripts</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Working_with_certmonger-Using_certmonger.html"><strong>Next</strong>C.2. Using
certmonger</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/self-service.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/self-service.html
index 1dc1b07..db0869a 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/self-service.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/self-service.html
@@ -1,13 +1,6 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>12.3. Defining Self-Service Settings</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
- addID('Fedora');
-
- addID('Fedora.15');
-
- addID('Fedora.15.books');
- addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="server-config.html" title="Chapter 12. Configuring the IPA
Server" /><link rel="prev" href="creating-roles.html"
title="12.2. Creating Roles" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"
title="12.4. Specifying Default User Settings" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a access
key="p"
href="creating-roles.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong></a></li></ul><div
class="section" id="self-service"><div
class="titlepage"><div><div><h2 class="title"
id="self-service">12.3. Defining Self-Service
Settings</h2></div></div></div><div class="para">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>14.3. Defining Self-Service Settings</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package"
content="Drafts-Enterprise_Identity_Management_Guide-1-en-US-0.1-0.0.5"
/><link rel="home" href="index.html" title="Enterprise
Identity Management Guide" /><link rel="up"
href="server-config.html" title="Chapter 14. Configuring the IPA
Server" /><link rel="prev" href="creating-roles.html"
title="14.2. Creating Roles" /><link rel="next"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"
title="14.4. Specifying Default User Settings"
/></head><body><p id="title"><a class="left"
href="http://www.redhat.com"><img src
="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.redhat.com"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="creating-roles.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong></a></li></ul><div
class="section" id="self-service"><div
class="titlepage"><div><div><h2 class="title"
id="self-service">14.3. Defining Self-Service
Settings</h2></div></div></div><div class="para">
Self-service access control rules define the operations that an entity can perform on
itself. These rules are attribute based; that is, they define what attributes can be
modified for any particular entity. You can create self-service rules so that users can
manage their own addresses, keep their contact details current, change their passwords,
etc.
</div><div class="para">
Self-service rules are defined and managed by a number of sub-commands. Use the
<code class="command">ipa help selfservice</code> command to display
the list of available commands.
@@ -37,4 +30,4 @@ Modified selfservice "Users can manage their own name
details"
</div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
You need to include all of the required attributes when you modify a self-service
rule, including existing ones.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="creating-roles.html"><strong>Prev</strong>12.2. Creating
Roles</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong>12.4. Specifying
Default User Settings</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="creating-roles.html"><strong>Prev</strong>14.2. Creating
Roles</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html"><strong>Next</strong>14.4. Specifying
Default User Settings</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html
index d2fd40d..0e34eef 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html
@@ -1,34 +1,34 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 12. Configuring the IPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 13. Configuring the FreeIPA Server</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="configuring-sudo.html"
title="11.2. Configuring sudo" /><link rel="next"
href="creating-roles.html" title="12.2. Creating Roles"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-sudo.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="cr
eating-roles.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="server-config"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 12. Configuring the IPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="server-config.html#managing-access-to-ipa">12.1. Defining Access
Controls within
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1.
Server-side Access
Control</a></span></dt></dl></dd><dt><span
class="section"><a href="creating-roles.html">12.2. Creating
Roles</a></span></dt><dt><span
class="section"><a href="self-service.html">12.3. Defining
Self-Service Settings</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Specifying_Default_User_Settings.html">12.4.
Specifying Default User Settings</a></span></dt><dt><span cla
ss="section"><a href="search-limits.html">12.5. Setting
Default Search Limits</a></span></dt><dt><span
class="section"><a href="disabling-anon-binds.html">12.6.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html">12.7.
Implementing Unique UID and GID
Attributes</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-IPA_Concepts-Implementing_Unique_UID_and_GID_Attributes.html#sect-Enterprise_Identity_Management_Guide-Implementing_Unique_UID_and_GID_Attributes-Assigning_UIDs_and_GIDs">12.7.1.
Assigning UIDs and
GIDs</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html">12.8.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a href="sect-Enterprise_Id
entity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">12.8.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities-Using_Your_Own_Certificate_with_Firefox">12.8.2.
Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_Certificates_and_Certificate_Authorities.html#Using_OCSP">12.8.3.
Using OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-apache.html">12.9. Setting an
IPA Server as an Apache Virtual Host</a></span></dt><dt><span
class="section"><a href="ipa-cluster.html">12.10. Using IPA
in a Clu
ster</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-cluster.html#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">12.10.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="ipa-cluster.html#sect-Enterprise_Identity_Management_Guide-Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">12.10.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html">12.11.
Creating DNS Entries for FreeIPA
Replicas</a></span></dt><dt><span
class="section"><a href="promoting-replica.html">12.12.
Promoting a Read-Only Replica to an IPA
Server</a></span></dt><dt><span
class="section"><a href="logging.html">12.13. IPA Ser
ver Logging</a></span></dt></dl></div><div
class="section" id="managing-access-to-ipa"><div
class="titlepage"><div><div><h2 class="title"
id="managing-access-to-ipa">12.1. Defining Access Controls within
IPA</h2></div></div></div><div class="para">
- Access control is a mechanism which defines user access. That is, it defines the
rights that users and other objects have been granted in order to perform operations on
other users or objects. When the IPA directory server receives a request, it uses the
authentication information provided by the user in the bind operation together with <em
class="firstterm">access control instructions (ACIs)</em> defined in
the server to allow or deny access to directory information. The server can allow or deny
permissions for actions, such as read, write, search, and compare, on directory server
entries. The permission level granted to a user may depend on the authentication
information provided.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="configuring-sudo.html"
title="12.2. Configuring sudo" /><link rel="next"
href="disabling-anon-binds.html" title="13.2. Disabling Anonymous
Binds" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="configuring-sudo.html"><strong>Prev</strong></a></li><li
class="next"><a acces
skey="n"
href="disabling-anon-binds.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="server-config"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 13. Configuring the FreeIPA
Server</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="server-config.html#managing-access-to-ipa">13.1. Defining Access
Controls within
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-config.html#Server_side_Access_Control">13.1.1. Server-side
Access Control</a></span></dt><dt><span
class="section"><a
href="server-config.html#creating-roles">13.1.2. Creating
Roles</a></span></dt><dt><span
class="section"><a
href="server-config.html#self-service">13.1.3. Defining Self-Service
Settings</a></span></dt></dl></dd><dt><span
class="section"><a href="disabling-anon-binds.html">13.2.
Disabling Anonymous Binds</a></span></dt><dt><span
class="section"><a href="Managing-Unique_UID_and_GID_Attributes.h
tml">13.3. Managing Unique UID and GID Number
Assignments</a></span></dt><dd><dl><dt><span
class="section"><a
href="Managing-Unique_UID_and_GID_Attributes.html#id-ranges-at-install">13.3.1.
About ID Range Assignments During
Installation</a></span></dt><dt><span
class="section"><a
href="Managing-Unique_UID_and_GID_Attributes.html#Assigning_UIDs_and_GIDs-Adding_New_Ranges">13.3.2.
Adding New
Ranges</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html">13.4.
Configuring Certificates and Certificate
Authorities</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Configuring_Certificates_and_Certificate_Authorities-Installing_Your_Own_Certificate">13.4.1.
Installing Your Own Certificate</a></span></dt><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Configuring_Certificates_and_Certificate_Authorities-Using_Yo
ur_Own_Certificate_with_Firefox">13.4.2. Using Your Own Certificate with
Firefox</a></span></dt><dt><span
class="section"><a
href="Configuring_Certificates_and_Certificate_Authorities.html#Using_OCSP">13.4.3.
Using OCSP</a></span></dt></dl></dd><dt><span
class="section"><a href="ipa-apache.html">13.5. Setting a
FreeIPA Server as an Apache Virtual
Host</a></span></dt><dt><span
class="section"><a href="ipa-cluster.html">13.6. Using
FreeIPA in a
Cluster</a></span></dt><dd><dl><dt><span
class="section"><a
href="ipa-cluster.html#Implementing_IPA_in_a_Clustered_Environment-Configuring_Kerberos_Credentials_for_a_Clustered_Environment">13.6.1.
Configuring Kerberos Credentials for a Clustered
Environment</a></span></dt><dt><span
class="section"><a
href="ipa-cluster.html#Implementing_IPA_in_a_Clustered_Environment-Using_the_Same_Service_Principal_for_Multiple_Services">13.6.2.
Using the Same Service Principal for Multiple
Services</a></span></dt></dl></dd><dt><span
class="section"><a
href="Working_with_DNS-Creating_DNS_Entries_for_IPA_Replicas.html">13.7.
Creating DNS Entries for FreeIPA
Replicas</a></span></dt><dt><span
class="section"><a href="promoting-replica.html">13.8.
Promoting a Read-Only Replica to a FreeIPA
Server</a></span></dt><dt><span
class="section"><a href="logging.html">13.9. FreeIPA Server
Logging</a></span></dt></dl></div><div
class="section" id="managing-access-to-ipa"><div
class="titlepage"><div><div><h2 class="title"
id="managing-access-to-ipa">13.1. Defining Access Controls within
FreeIPA</h2></div></div></div><div class="para">
+ Access control is a mechanism which defines user access. That is, it defines the
rights that users and other objects have been granted in order to perform operations on
other users or objects. When the FreeIPA directory server receives a request, it uses the
authentication information provided by the user in the bind operation together with <em
class="firstterm">access control instructions (ACIs)</em> defined in
the server to allow or deny access to directory information. The server can allow or deny
permissions for actions, such as read, write, search, and compare, on directory server
entries. The permission level granted to a user may depend on the authentication
information provided.
</div><div class="para">
- IPA implements a number of different methods for controlling access to the various
objects, commands and processes that exist within an IPA domain. This includes a Kerberos
Ticket Policy, a Password Policy, Host-based Access Control and SUDO Command Policies for
controlling client access to services and commands; that is, outside of the IPA server,
and a separate Access Control Model for controlling server-side objects; that is, LDAP
entries within the IPA server.
+ FreeIPA implements a number of different methods for controlling access to the various
objects, commands and processes that exist within a FreeIPA domain. This includes a
Kerberos Ticket Policy, a Password Policy, Host-based Access Control and SUDO Command
Policies for controlling client access to services and commands; that is, outside of the
FreeIPA server, and a separate Access Control Model for controlling server-side objects;
that is, LDAP entries within the FreeIPA server.
</div><div class="para">
- IPA relies on three separate types of access control rules:
+ FreeIPA relies on three separate types of access control rules:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- Role-based rules: specify what operations an entity can perform based on its IPA
Role.
+ Role-based rules: specify what operations an entity can perform based on its FreeIPA
Role.
</div></li><li class="listitem"><div
class="para">
Self-service rules: specify what an entity can change within its own entry.
</div></li><li class="listitem"><div
class="para">
Delegation rules: specify which groups can modify members of another group.
</div></li></ul></div><div class="para">
- These three types of access control complement each other, and allow IPA
administrators to create a very flexible set of access control permissions and
restrictions.
+ These three types of access control complement each other, and allow FreeIPA
administrators to create a very flexible set of access control permissions and
restrictions.
</div><div class="para">
- Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by IPA. Users, groups, hosts, and host groups can be added to different IPA
Roles. These roles provide the necessary permissions for access. You can create as many
roles as you need to suit the requirements of your deployment.
+ Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by FreeIPA. Users, groups, hosts, and host groups can be added to different
FreeIPA Roles. These roles provide the necessary permissions for access. You can create as
many roles as you need to suit the requirements of your deployment.
</div><div class="para">
There are several aspects to working with roles. Because it is a hierarchical system,
to create a fully operational role you need to create the role itself, add privileges to
this role to establish what tasks it can and cannot perform, and finally add members to
the role, such as users, groups, etc. The reverse is also true; if you remove a role, then
any users or groups who relied on this role to perform certain tasks will no longer be
able to do so.
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
You cannot create nested roles. That is, a role cannot contain another role.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control">12.1.1. Server-side
Access Control</h3></div></div></div><div
class="para">
- The IPA Access Control Model is based on the underlying 389 Directory Server access
control model, which uses access control instructions (ACIs) to define user access within
the system. An ACI is a construct that can express a complex set of access control
information.
+ </div></div></div><div class="section"
id="Server_side_Access_Control"><div
class="titlepage"><div><div><h3 class="title"
id="Server_side_Access_Control">13.1.1. Server-side Access
Control</h3></div></div></div><div class="para">
+ The FreeIPA Access Control Model is based on the underlying 389 Directory Server
access control model, which uses access control instructions (ACIs) to define user access
within the system. An ACI is a construct that can express a complex set of access control
information.
</div><div class="para">
As explained in the directory server documentation, the three main parts of an ACI
statement are:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
@@ -40,9 +40,9 @@
</div></li></ul></div>
</div><div class="para">
- The ACI structure itself is very flexible, but can also be confusing. IPA attempts to
structure these ACIs in order to provide a formalized input and output that can be
expressed on the command line and in the WebUI, while at the same time maintaining
sufficient flexibility to create complex access control rules. In order to achieve this,
IPA implements three types of access control. These are discussed in the following
sections.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control-Types_of_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Server_side_Access_Control-Types_of_Access_Control">12.1.1.1. Types
of Access Control</h4></div></div></div><div
class="para">
- IPA relies on three separate types of access control rules:
+ The ACI structure itself is very flexible, but can also be confusing. FreeIPA
attempts to structure these ACIs in order to provide a formalized input and output that
can be expressed on the command line and in the WebUI, while at the same time maintaining
sufficient flexibility to create complex access control rules. In order to achieve this,
FreeIPA implements three types of access control. These are discussed in the following
sections.
+ </div><div class="section"
id="Server_side_Access_Control-Types_of_Access_Control"><div
class="titlepage"><div><div><h4 class="title"
id="Server_side_Access_Control-Types_of_Access_Control">13.1.1.1. Types of
Access Control</h4></div></div></div><div
class="para">
+ FreeIPA relies on three separate types of access control rules:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Role-based
</div></li><li class="listitem"><div
class="para">
@@ -50,35 +50,35 @@
</div></li><li class="listitem"><div
class="para">
Delegation
</div></li></ul></div>
- These three types of access control complement each other, allowing IPA
administrators to create a very flexible set of access control permissions and
restrictions.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Role_based_Access_Control"><h5
class="formalpara">Role-based Access Control</h5>
- Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by IPA. Different users who perform the same tasks within an organization are
typically combined into a group, and this group is made a member of an IPA <em
class="firstterm">Role</em>. This Role provides the member groups and
users the necessary permissions to perform their assigned tasks.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Self_service_Access_Control"><h5
class="formalpara">Self-service Access Control</h5>
+ These three types of access control complement each other, allowing FreeIPA
administrators to create a very flexible set of access control permissions and
restrictions.
+ </div><div class="formalpara"
id="Types_of_Access_Control-Role_based_Access_Control"><h5
class="formalpara">Role-based Access Control</h5>
+ Role-based access control (RBAC) is a hierarchical way of organizing access to the
data managed by FreeIPA. Different users who perform the same tasks within an organization
are typically combined into a group, and this group is made a member of a FreeIPA <em
class="firstterm">Role</em>. This Role provides the member groups and
users the necessary permissions to perform their assigned tasks.
+ </div><div class="formalpara"
id="Types_of_Access_Control-Self_service_Access_Control"><h5
class="formalpara">Self-service Access Control</h5>
Self-service access control defines what operations an entity can perform on
itself. This method of control is attribute based; that is, it defines what attributes can
be modified for any particular entity. The ability of a user to update their own password
is an example of self-service access control. Self-service access control applies to any
authenticated entity performing an operation, not only to users. This method of access
control should also be used with caution, to avoid the possibility that it lead to the
elevation of an entity's privileges.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Delegation_Access_Control"><h5
class="formalpara">Delegation Access Control</h5>
+ </div><div class="formalpara"
id="Types_of_Access_Control-Delegation_Access_Control"><h5
class="formalpara">Delegation Access Control</h5>
Delegation access control defines what operations one group of users or entries can
perform on another group of users or entries. In each case, the group of users or entries
may be identified by a provided filter. The core difference between delegation access
control rules and other rules is that the target—the object of the access control rule—is
not a class of entries but rather a set of specific entries that are members of a group or
retrieved by a specific filter. The delegation rules allow targeted management of specific
user entries.
</div><div class="para">
- In each case, the access control rule resolves the constituents of the IPA access
control expression: "<em class="firstterm">Who</em> can do
<em class="firstterm">What</em> to <em
class="firstterm">Whom</em>". The following section explains these
constituents in more detail.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-The_IPA_Access_Control_Expression"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-The_IPA_Access_Control_Expression">12.1.1.1.1. The
IPA Access Control Expression</h5></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_Who_of_Access_Control"><h5
class="formalpara">The "Who" of Access Control</h5>
- In simple grammatical terms, the "who" of an IPA <em
class="firstterm">access control instruction (ACI)</em>, or expression,
is the subject. It specifies the entity that interacts with the system and tries to
perform an administrative task. This task could be an administrator adding a user, a user
changing his home address, or a host requesting a certificate for a service running on the
host.
+ In each case, the access control rule resolves the constituents of the FreeIPA
access control expression: "<em class="firstterm">Who</em> can
do <em class="firstterm">What</em> to <em
class="firstterm">Whom</em>". The following section explains these
constituents in more detail.
+ </div><div class="section"
id="Types_of_Access_Control-The_IPA_Access_Control_Expression"><div
class="titlepage"><div><div><h5 class="title"
id="Types_of_Access_Control-The_IPA_Access_Control_Expression">13.1.1.1.1. The
FreeIPA Access Control Expression</h5></div></div></div><div
class="formalpara"
id="The_IPA_Access_Control_Expression-The_Who_of_Access_Control"><h5
class="formalpara">The "Who" of Access Control</h5>
+ In simple grammatical terms, the "who" of a FreeIPA <em
class="firstterm">access control instruction (ACI)</em>, or expression,
is the subject. It specifies the entity that interacts with the system and tries to
perform an administrative task. This task could be an administrator adding a user, a user
changing his home address, or a host requesting a certificate for a service running on the
host.
</div><div class="para">
- It is important to understand that the "who" is not necessarily a person;
it can be any entity that has successfully authenticated against IPA. In order to
authenticate against the IPA server, this entity, the "who", needs to have a
Kerberos principal. After the entity has authenticated, it can connect to the IPA server
and try to issue administrative commands. The system will either allow or deny the
requested operation based on this entity's permissions.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_What_of_Access_Control"><h5
class="formalpara">The "What" of Access Control</h5>
- To continue the analogy with grammatical terms, the "what" of an IPA ACI
is the verb. This specifies the actual administrative operation that the subject, the
"who", is trying to perform. Such operations can target actual entries, such as
adding or deleting users, or they can target specific attributes of entries, such as
changing phone numbers for a user entry, or changing the member attributes of a group
entry.
+ It is important to understand that the "who" is not necessarily a person;
it can be any entity that has successfully authenticated against FreeIPA. In order to
authenticate against the FreeIPA server, this entity, the "who", needs to have a
Kerberos principal. After the entity has authenticated, it can connect to the FreeIPA
server and try to issue administrative commands. The system will either allow or deny the
requested operation based on this entity's permissions.
+ </div><div class="formalpara"
id="The_IPA_Access_Control_Expression-The_What_of_Access_Control"><h5
class="formalpara">The "What" of Access Control</h5>
+ To continue the analogy with grammatical terms, the "what" of a FreeIPA
ACI is the verb. This specifies the actual administrative operation that the subject, the
"who", is trying to perform. Such operations can target actual entries, such as
adding or deleting users, or they can target specific attributes of entries, such as
changing phone numbers for a user entry, or changing the member attributes of a group
entry.
</div><div class="para">
Most entry attributes are optional, and the operations against attributes can be
any of the following:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- <code class="command">Add</code> — allows the creation of
a new attribute, or new values for multi-valued attributes.
+ Add — allows the creation of a new attribute, or new values for multi-valued
attributes.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Delete</code> — allows the removal
of an attribute.
+ Delete — allows the removal of an attribute.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Read</code> — makes attributes
accessible.
+ Read — makes attributes accessible.
</div></li><li class="listitem"><div
class="para">
- <code class="command">Write</code> — allows modification
of existing attributes.
+ Write — allows modification of existing attributes.
</div></li></ul></div>
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-The_IPA_Access_Control_Expression-The_Whom_of_Access_Control"><h5
class="formalpara">The "Whom" of Access Control</h5>
- The "whom" of an IPA ACI is the object, or <em
class="firstterm">target</em>, upon which the ACI acts. Targets can be
expressed in different ways:
+ </div><div class="formalpara"
id="The_IPA_Access_Control_Expression-The_Whom_of_Access_Control"><h5
class="formalpara">The "Whom" of Access Control</h5>
+ The "whom" of a FreeIPA ACI is the object, or <em
class="firstterm">target</em>, upon which the ACI acts. Targets can be
expressed in different ways:
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
As a class of entries, for example: <code
class="classname">user</code>; <code
class="classname">group</code>; <code
class="classname">host</code>.
</div></li><li class="listitem"><div
class="para">
@@ -91,9 +91,9 @@
As a set of entries selected by filter, for example: <em
class="parameter"><code>cn="filter"</code></em>.
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types"><div
class="titlepage"><div><div><h5 class="title"
id="sect-Enterprise_Identity_Management_Guide-Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types">12.1.1.1.2. Directory
Server ACIs and IPA Access Control
Types</h5></div></div></div><div class="para">
- The following table summarizes the relationship between the different Directory
Server ACI components and the IPA access control types.
- </div><div class="table"
id="tabl-Enterprise_Identity_Management_Guide-Directory_Server_ACIs_and_IPA_Access_Control_Types-Summary_mapping_table_of_Directory_Server_ACI_component_types_to_IPA_access_control_types."><h6>Table 12.1. Summary
mapping table of Directory Server ACI component types to IPA access control
types.</h6><div class="table-contents"><table
summary="Summary mapping table of Directory Server ACI component types to IPA access
control types." border="1"><colgroup><col
align="left" width="25%" /><col align="left"
width="25%" /><col align="left" width="25%"
/><col align="left" width="25%"
/></colgroup><thead><tr><th align="left">
+ </div></div><div class="section"
id="Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types"><div
class="titlepage"><div><div><h5 class="title"
id="Types_of_Access_Control-Directory_Server_ACIs_and_IPA_Access_Control_Types">13.1.1.1.2. 389
Directory Server ACIs and FreeIPA Access Control
Types</h5></div></div></div><div class="para">
+ The following table summarizes the relationship between the different 389 Directory
Server ACI components and the FreeIPA access control types.
+ </div><div class="table"
id="tab.aci-mapping"><h6>Table 13.1. Mapping 389 Directory Server and
FreeIPA Access Control Types</h6><div
class="table-contents"><table summary="Mapping 389 Directory Server
and FreeIPA Access Control Types" border="1"><colgroup><col
align="left" width="25%" /><col align="left"
width="25%" /><col align="left" width="25%"
/><col align="left" width="25%"
/></colgroup><thead><tr><th align="left">
Type of Access Control
</th><th align="left">
Target
@@ -112,7 +112,7 @@
Taskgroup.
</div>
<div class="para">
- (A taskgroup is a special internal entry developed as part of IPA to construct
the access control hierarchy. A taskgroup is a "container" that is granted
permission to perform specific tasks.)
+ (A taskgroup is a special internal entry developed as part of FreeIPA to
construct the access control hierarchy. A taskgroup is a "container" that is
granted permission to perform specific tasks.)
</div>
</td></tr><tr><td align="left">
@@ -131,4 +131,71 @@
Write, Add, or Delete. Read is implied.
</td><td align="left">
A group of users, usually a group of administrative users.
- </td></tr></tbody></table></div></div><br
class="table-break"
/></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="configuring-sudo.html"><strong>Prev</strong>11.2. Configuring
sudo</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="creating-roles.html"><strong>Next</strong>12.2. Creating
Roles</a></li></ul></body></html>
+ </td></tr></tbody></table></div></div><br
class="table-break" /></div></div></div><div
class="section" id="creating-roles"><div
class="titlepage"><div><div><h3 class="title"
id="creating-roles">13.1.2. Creating
Roles</h3></div></div></div><div
class="orderedlist"><h6>To set up a new
role:</h6><ol><li class="listitem"><div
class="para">
+ Add the new role:
+ </div><pre class="screen"># ipa role-add --desc="User
Administrator" useradmin
+ ------------------------
+ Added role "useradmin"
+ ------------------------
+ Role name: useradmin
+ Description: User Administrator</pre></li><li
class="listitem"><div class="para">
+ Add the required privileges to the role:
+ </div><pre class="screen"># ipa role-add-privilege
--privileges="User Administrators" useradmin
+ Role name: useradmin
+ Description: User Administrator
+ Privileges: user administrators
+ ----------------------------
+ Number of privileges added 1
+----------------------------
+</pre></li><li class="listitem"><div
class="para">
+ Add the required groups to the role. In this case, we are adding only a single
group, <code class="systemitem">useradmin</code>, which already
exists.
+ </div><pre class="screen"># ipa role-add-member
--groups=useradmins useradmin
+ Role name: useradmin
+ Description: User Administrator
+ Member groups: useradmins
+ Privileges: user administrators
+ -------------------------
+ Number of members added 1
+-------------------------
+</pre></li></ol></div><div class="para">
+ The result of this procedure is that any user in the <code
class="systemitem">useradmins</code> group can add, modify, and remove
users, change user passwords, add users to the default group, and unlock user accounts.
You can use the <code class="command">ipa privilege-show</code>
command to determine exactly which command set the user or group can access:
+<pre class="screen"># ipa privilege-show 'user administrators'
+ Privilege name: User Administrators
+ Description: User Administrators
+ Permissions: add users, change a user password, add user to default group, unlock user
accounts,
+ remove users, modify users
+ Granting privilege to roles: useradmin</pre>
+
+ </div><div class="para">
+ As the needs of your enterprise change, you may need to modify the roles that you
have established. For example, you may need to change the members of the role, or change
the privileges associated with the role. You can use the <code
class="command">ipa role-*</code> commands to perform these functions.
For example, to remove an existing privilege from a role, use the <code
class="command">ipa role-remove-privilege</code> command. To remove
members from a role, use the <code class="command">ipa
role-remove-member</code> command. Refer to the <code
class="command">ipa role help</code> pages for more information.
+ </div><div class="para">
+ You can use the <code class="command">ipa role-del</code>
command to delete FreeIPA roles from your configuration. Bear in mind, however, that any
entities that rely on this role for access to FreeIPA objects or to perform certain tasks
will no longer have that ability.
+ </div></div><div class="section"
id="self-service"><div
class="titlepage"><div><div><h3 class="title"
id="self-service">13.1.3. Defining Self-Service
Settings</h3></div></div></div><div class="para">
+ Self-service access control rules define the operations that an entity can perform on
itself. These rules are attribute based; that is, they define what attributes can be
modified for any particular entity. You can create self-service rules so that users can
manage their own addresses, keep their contact details current, change their passwords,
etc.
+ </div><div class="para">
+ Self-service rules are defined and managed by a number of sub-commands. Use the
<code class="command">ipa help selfservice</code> command to display
the list of available commands.
+ </div><div class="para">
+ The following example demonstrates how to add a new self-service rule that allows
users to maintain their own name details. Note that access control rules whose names
contain spaces or other special characters need to be quoted.
+<pre class="screen">$ ipa selfservice-add "Users can manage their
own name details" --permissions=write --attrs=givenname,displayname,title,initials
+-----------------------------------------------------------
+Added selfservice "Users can manage their own name details"
+-----------------------------------------------------------
+ Self-service name: Users can manage their own name details
+ Permissions: write
+ Attributes: givenname, displayname, title, initials</pre>
+
+ </div><div class="para">
+ You can use the <code class="command">ipa
selfservice-show</code> command to display the newly-created rule.
+ </div><div class="para">
+ You can use the <code class="command">ipa
selfservice-mod</code> command to manage your self-service rules. For example, you
can add or remove various attributes from any of the defined rules, or change the
permissions. For example, you can add telephone contact details to the rule we created in
the previous example:
+<pre class="screen">$ ipa selfservice-mod "Users can manage their
own name details"
--attrs=givenname,displayname,title,initials,homephone,mobile,telephonenumber
+--------------------------------------------------------------
+Modified selfservice "Users can manage their own name details"
+--------------------------------------------------------------
+Self-service name: Users can manage their own name details
+Permissions: write
+Attributes: givenname, displayname, title, initials, homephone, mobile,
telephonenumber</pre>
+
+ </div><div class="important"><div
class="admonition_header"><h2>Important</h2></div><div
class="admonition"><div class="para">
+ You need to include all of the required attributes when you modify a self-service
rule, including existing ones.
+ </div></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="configuring-sudo.html"><strong>Prev</strong>12.2. Configuring
sudo</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="disabling-anon-binds.html"><strong>Next</strong>13.2. Disabling
Anonymous Binds</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-tools.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-tools.html
new file mode 100644
index 0000000..308d2f7
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/server-tools.html
@@ -0,0 +1,432 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>B.2. Server Scripts</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="tools-reference.html" title="Appendix B. FreeIPA Tools
Reference" /><link rel="prev" href="tools-reference.html"
title="Appendix B. FreeIPA Tools Reference" /><link rel="next"
href="client-tools.html" title="B.3. Client Scripts"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="tools-reference.html"><strong>Prev</strong></a></li><li
class="next"><a a
ccesskey="n"
href="client-tools.html"><strong>Next</strong></a></li></ul><div
class="section" id="server-tools"><div
class="titlepage"><div><div><h2 class="title"
id="server-tools">B.2. Server
Scripts</h2></div></div></div><div class="para">
+ XXXXXXXXXXXXX
+ </div><div class="section"
id="ipa-compat-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-compat-manage">B.2.1. ipa-compat-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-compat-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-location">B.2.1.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-compat-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-syntax">B.2.1.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-compat-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compat-manage-options">B.2.1.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-compliance"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-compliance">B.2.2. ipa-compliance</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-compliance-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-location">B.2.2.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-compliance-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-syntax">B.2.2.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-compliance-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-compliance-options">B.2.2.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-dns-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-dns-install">B.2.3. ipa-dns-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-dns-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-location">B.2.3.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-dns-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-syntax">B.2.3.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-dns-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-dns-install-options">B.2.3.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-host-net-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-host-net-manage">B.2.4. ipa-host-net-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-host-net-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-location">B.2.4.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-host-net-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-syntax">B.2.4.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-host-net-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-host-net-manage-options">B.2.4.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa_kpasswd"><div
class="titlepage"><div><div><h3 class="title"
id="ipa_kpasswd">B.2.5. ipa_kpasswd</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa_kpasswd-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-location">B.2.5.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa_kpasswd-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-syntax">B.2.5.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa_kpasswd-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa_kpasswd-options">B.2.5.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-ldap-updater"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-ldap-updater">B.2.6. ipa-ldap-updater</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-ldap-updater-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-location">B.2.6.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-ldap-updater-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-syntax">B.2.6.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-ldap-updater-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-ldap-updater-options">B.2.6.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-nis-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-nis-manage">B.2.7. ipa-nis-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-nis-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-location">B.2.7.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-nis-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-syntax">B.2.7.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-nis-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-nis-manage-options">B.2.7.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-install">B.2.8. ipa-replica-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-location">B.2.8.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-syntax">B.2.8.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-install-options">B.2.8.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-manage"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-manage">B.2.9. ipa-replica-manage</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-manage-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-location">B.2.9.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-manage-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-syntax">B.2.9.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-manage-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-manage-options">B.2.9.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-replica-prepare"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-replica-prepare">B.2.10. ipa-replica-prepare</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-replica-prepare-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-location">B.2.10.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-replica-prepare-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-syntax">B.2.10.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-replica-prepare-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-replica-prepare-options">B.2.10.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-server-certinstall"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-server-certinstall">B.2.11. ipa-server-certinstall</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-server-certinstall-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-location">B.2.11.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-server-certinstall-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-syntax">B.2.11.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-server-certinstall-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-certinstall-options">B.2.11.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-server-install"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-server-install">B.2.12. ipa-server-install</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-server-install-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-location">B.2.12.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-server-install-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-syntax">B.2.12.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-server-install-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-server-install-options">B.2.12.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-ugradeconfig"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-ugradeconfig">B.2.13. ipa-upgradeconfig</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipa-upgradeconfig-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-location">B.2.13.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-upgradeconfig-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-syntax">B.2.13.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipa-upgradeconfig-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-upgradeconfig-options">B.2.13.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipactl"><div
class="titlepage"><div><div><h3 class="title"
id="ipactl">B.2.14. ipactl</h3></div></div></div><div
class="para">
+ Description
+ </div><div class="section"
id="ipactl-location"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-location">B.2.14.1. Location</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-server
+ </td></tr></tbody></table></div></div><div
class="section" id="ipactl-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-syntax">B.2.14.2. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">PKCS12Export</code>
+ -d <em
class="replaceable"><code>/path/to/cert-directory</code></em>
+ [
+ -debug
+ ]</p></div></div><div class="section"
id="ipactl-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipactl-options">B.2.14.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="tools-reference.html"><strong>Prev</strong>Appendix B. FreeIPA
Tools Reference</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="client-tools.html"><strong>Next</strong>B.3. Client
Scripts</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/setting-up-clients.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/setting-up-clients.html
index 66f8da6..8ebdc8c 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/setting-up-clients.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/setting-up-clients.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 2. Setting up Systems as FreeIPA Clients</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 3. Setting up Systems as FreeIPA Clients</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="Uninstalling_IPA_Servers.html"
title="1.5. Uninstalling FreeIPA Servers and Replicas" /><link
rel="next" href="Using_Microsoft_Windows.html"
title="2.2. Configuring a Microsoft Windows System as a FreeIPA Client"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="Uninstallin
g_IPA_Servers.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Using_Microsoft_Windows.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="setting-up-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 2. Setting up Systems as FreeIPA
Clients</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="setting-up-clients.html#fedora-client-setup">2.1. Setting up a Fedora
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="setting-up-clients.html#fedora-pkgs">2.1.1. Installing the Client
Configuration Packages and Setup
Script</a></span></dt><dt><span
class="section"><a
href="setting-up-clients.html#Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2.
Configuring Kerberos</a></span></dt><dt><span
class="section"><a
href="setting-up-clients.html#fedora-Configuring_NFS_v4_with_Kerberos">2.1.3.
Configuring NFS v4
with Kerberos</a></span></dt></dl></dd><dt><span
class="section"><a href="Using_Microsoft_Windows.html">2.2.
Configuring a Microsoft Windows System as a FreeIPA
Client</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html">2.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_10">2.3.1.
Configuring Solaris 10</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">2.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html">2.4. Configuring an HP-UX
System as a
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Cli
ent_on_HP_UX-Configuring_LDAP_Authentication">2.4.1. Configuring LDAP
Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Kerberos_and_PAM">2.4.2.
Configuring Kerberos and PAM</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">2.4.3.
Configuring SSH</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">2.4.4.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Testing_the_Configuration">2.4.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html">2.5. Configuring an AIX System
as a FreeIPA Client</a></span></dt><dd><dl><dt
<span class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Prerequisites">2.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication">2.5.2.
Configuring Client Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_SSH_Access">2.5.3.
Configuring Client SSH Access</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Testing_System_Login">2.5.4.
Testing System
Login</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html">2.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_
IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">2.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">2.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">2.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">2.6.4.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Accessing_the_IPA_Server_Using_SSH">2.6.5.
Accessing the FreeIPA Server Using SSH</a></span></dt><dt><sp
an class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Macintosh_OS_X-Configuring_System_Login">2.6.6.
Configuring System
Login</a></span></dt></dl></dd></dl></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="Uninstalling_IPA_Servers.html"
title="2.5. Uninstalling FreeIPA Servers and Replicas" /><link
rel="next" href="Configuring_Microsoft_Windows.html"
title="3.2. Configuring a Microsoft Windows System as a FreeIPA Client"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href="Unins
talling_IPA_Servers.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Microsoft_Windows.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="setting-up-clients"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 3. Setting up Systems as FreeIPA
Clients</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="setting-up-clients.html#what-happens-clients">3.1. What Happens in
Client Setup</a></span></dt><dt><span
class="section"><a
href="Configuring_Microsoft_Windows.html">3.2. Configuring a Microsoft
Windows System as a FreeIPA Client</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html">3.3. Configuring a Solaris
System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10">3.3.1.
Configuring Solaris 10</a></span></dt><dt>
<span class="section"><a
href="Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris-Configuring_an_IPA_Client_on_Solaris_9">3.3.2.
Configuring Solaris
9</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html">3.4. Configuring an HP-UX
System as a
FreeIPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_NTP">3.4.1.
Configuring NTP</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_LDAP_Authentication">3.4.2.
Configuring LDAP Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_Kerberos_and_PAM-Configuring_Kerberos">3.4.3.
Configuring Kerberos</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_Kerberos_and_PAM-Confi
guring_PAM">3.4.4. Configuring
PAM</a></span></dt><dt><span class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_SSH">3.4.5.
Configuring SSH</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#Configuring_an_IPA_Client_on_HP_UX-Configuring_Access_Control">3.4.6.
Configuring Access Control</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_HP_UX.html#hp-test">3.4.7. Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html">3.5. Configuring an AIX System
as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Prerequisites">3.5.1.
Prerequisites</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_AIX.html#Configuring_an_IPA_Client_on_AIX-Configuring_Client_Authentication"
3.5.2. Configuring the AIX
Client</a></span></dt></dl></dd><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html">3.6. Configuring a
Macintosh OS X System as a FreeIPA
Client</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_Kerberos_Authentication">3.6.1.
Configuring Kerberos Authentication</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_LDAP_Authorization">3.6.2.
Configuring LDAP Authorization</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Configuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_the_LDAP_Authorization_Options">3.6.3.
Configuring the LDAP Authorization
Options</a></span></dt><dt><span
class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#Con
figuring_an_IPA_Client_on_Macintosh_OS_X-Configuring_NTP">3.6.4. Configuring
NTP</a></span></dt><dt><span class="section"><a
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html#testing-config-on-mac">3.6.5.
Testing the
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="uninstalling-clients.html">3.7.
Uninstalling a FreeIPA
Client</a></span></dt></dl></div><div
class="para">
A <span class="emphasis"><em>client</em></span> is
any system which is a member of the FreeIPA domain. While this is frequently a Fedora
system (and FreeIPA has special tools to make configuring Fedora clients very simple),
machines with other operating systems can also be added to the FreeIPA domain.
</div><div class="para">
One important aspect of a FreeIPA client is that <span
class="emphasis"><em>only</em></span> the system
configuration determines whether the system is part of the domain. (The configuration
includes things like belonging to the Kerberos domain, DNS domain, and having the proper
authentication and certificate setup.) FreeIPA does not require any sort of agent or
daemon running on a client.
@@ -15,65 +15,15 @@
This chapter explains how to configure a system to join a FreeIPA domain.
</div><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
Clients can only be configured after at least one FreeIPA server has been installed.
- </div></div></div><div class="section"
id="fedora-client-setup"><div
class="titlepage"><div><div><h2 class="title"
id="fedora-client-setup">2.1. Setting up a Fedora System as a FreeIPA
Client</h2></div></div></div><div class="section"
id="fedora-pkgs"><div
class="titlepage"><div><div><h3 class="title"
id="fedora-pkgs">2.1.1. Installing the Client Configuration Packages and
Setup Script</h3></div></div></div><div
class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
- To Fedora systems as FreeIPA clients, you need either an enrollment Kerberos
principal (for example, admin), or the host must be pre-created on the server with a
one-time password to do the enrollment.
- </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Install the client packages. These packages are used only as a simple way to
configure the system; they do <span
class="emphasis"><em>not</em></span> install an agent or
daemon on the client machine.
- </div><div class="para">
- For a regular user system, this requires only <code
class="filename">ipa-client</code>:
- </div><pre class="programlisting"><span
class="perl_Comment"># yum install
freeipa-client</span></pre><div class="para">
- For an administrator workstation, also install the FreeIPA tools package:
- </div><pre class="programlisting"><span
class="perl_Comment"># yum install freeipa-client
freeipa-admintools</span></pre></li><li
class="listitem"><div class="para">
- If the FreeIPA server is also configured as the DNS server, and is in the same
domain as the client, add the server's IP address as the first entry in the
client's <code class="filename">/etc/resolv.conf</code> file.
- </div></li><li class="listitem"><div
class="para">
- After the packages are installed, run the client setup command to configure the
system as a client.
- </div><pre class="programlisting"><span
class="perl_Comment">#
ipa-client-install</span></pre></li></ol></div><div
class="para">
- The <code class="command">ipa-client-install</code> command
runs through a series of configuration changes on the system to set it up as a client in
the FreeIPA domain:
- <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- If DNS discovery is configured correctly, the command sets up the client domain
and realm without prompting for any further information. If DNS Discovery is not
configured, or if the FreeIPA server and client are not in the same domain, the script
will prompt you for the information it requires.
- </div></li><li class="listitem"><div
class="para">
- Retrieves the CA certificate.
- </div></li><li class="listitem"><div
class="para">
- Creates a separate Kerberos configuration in order to test the provided
credentials. This enables the <code
class="command">ipa-client-install</code> command to perform a Kerberos
connection to the FreeIPA XML-RPC server, necessary to join the FreeIPA client to the
FreeIPA domain. Irrespective of whether or not this connection is successful, this
Kerberos configuration is ultimately discarded.
- </div></li><li class="listitem"><div
class="para">
- Calls the <code class="command">ipa-join</code> command to
perform the actual join
- </div></li><li class="listitem"><div
class="para">
- Obtains a service principal for the host service and installs it into <code
class="filename">/etc/krb5.keytab</code>, for example,
(host/ipa.example.com(a)EXAMPLE.COM)
- </div></li><li class="listitem"><div
class="para">
- Enables certmonger and retrieves an SSL server certificate, and installs it into
<code class="filename">/etc/pki/nssdb</code>
- </div></li><li class="listitem"><div
class="para">
- Disables the nscd daemon
- </div></li><li class="listitem"><div
class="para">
- Configures SSSD or LDAP/KRB5, including NSS and PAM configuration files
- </div></li><li class="listitem"><div
class="para">
- Configures NTP
- </div></li></ul></div>
-
- </div><div class="para">
- At the end of this process, the command displays information about the realm, DNS
domain, FreeIPA server, and other related information, similar to the following:
- </div><pre class="screen">
-Discovery was successful!
-Realm:
EXAMPLE.COM
-DNS Domain:
example.com
-IPA Server:
ipaserver.example.com
-BaseDN: dc=example,dc=com
-
-Continue to configure the system with these values? [no]: yes
-Enrollment principal: admin
-Password for admin(a)EXAMPLE.COM:
-Enrolled in IPA realm
EXAMPLE.COM
-Created /etc/ipa/default.conf
-Configured /etc/sssd/sssd.conf
-Configured /etc/krb5.conf for IPA realm
EXAMPLE.COM
-SSSD enabled
-Kerberos 5 enabled
-NTP enabled
-Client configuration complete.
-</pre></div><div class="section"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_an_IPA_Client_on_Red_Hat_Enterprise_Linux-Configuring_Kerberos">2.1.2. Configuring
Kerberos</h3></div></div></div><div class="para">
- The <code class="command">ipa-client-install</code> command
performs the Kerberos configuration automatically. This includes specifying the realm and
domain details, and default ticket attributes. Forwardable tickets are configured by
default, which facilitates connection to the administration interface from any operating
system, and also provides for auditing of administration operations.
- </div><div class="para">
- The following is an example of a Kerberos configuration file for FreeIPA:
- </div><pre class="programlisting">[libdefaults]
+ </div></div></div><div class="section"
id="what-happens-clients"><div
class="titlepage"><div><div><h2 class="title"
id="what-happens-clients">3.1. What Happens in Client
Setup</h2></div></div></div><div class="para">
+ Whether the client configuration is performed automatically on Fedora systems using
the client setup script or manually on other systems, the general process of configuring a
machine to serve as a FreeIPA client is mostly the same, with slight variation depending
on the platform:
+ </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ Retrieve the CA certificate for the FreeIPA CA.
+ </div></li><li class="listitem"><div
class="para">
+ Create a separate Kerberos configuration to test the provided credentials. This
enables a Kerberos connection to the FreeIPA XML-RPC server, necessary to join the FreeIPA
client to the FreeIPA domain. This Kerberos configuration is ultimately discarded.
+ </div><div class="para">
+ Setting up the Kerberos configuration includes specifying the realm and domain
details, and default ticket attributes. Forwardable tickets are configured by default,
which facilitates connection to the administration interface from any operating system,
and also provides for auditing of administration operations. For example, this is the
Kerberos configuration for Fedora systems:
+ </div><pre class="programlisting">[libdefaults]
default_realm =
EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
@@ -89,41 +39,16 @@
EXAMPLE.COM = {
[domain_realm]
.example.com =
EXAMPLE.COM
example.com =
EXAMPLE.COM
-</pre><div class="para">
- Use the following tests to ensure that the configuration is working correctly:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
- On the system console, log in as a FreeIPA user. After you have logged in, open a
shell and run the following commands:
- </div><div class="para">
- <code class="command">$ id</code> (ensure that the user IDs
and group IDs are correct)
- </div><div class="para">
- <code class="command">$ getent passwd
<userid></code>
- </div><div class="para">
- <code class="command">$ getent group ipausers</code>
- </div></li></ul></div></div><div
class="section"
id="fedora-Configuring_NFS_v4_with_Kerberos"><div
class="titlepage"><div><div><h3 class="title"
id="fedora-Configuring_NFS_v4_with_Kerberos">2.1.3. Configuring NFS v4 with
Kerberos</h3></div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
- Obtain a Kerberos ticket for the admin user.
- </div><div class="para">
- <code class="command"># kinit admin</code>
- </div></li><li class="listitem"><div
class="para">
- Add an NFS service principal on the client.
- </div><div class="para">
- <code class="command"># ipa service-add
nfs/ipaclient.example.com</code>
- </div></li><li class="listitem"><div
class="para">
- Obtain a keytab for the NFS service principal.
- </div><div class="para">
- <code class="command"># ipa-getkeytab -s
ipaserver.example.com -p
nfs/ipaclient.example.com -k /etc/krb5.keytab</code>
- </div><div class="note"><div
class="admonition_header"><h2>NFS Encryption
Support</h2></div><div class="admonition"><div
class="para">
- Some versions of the Linux NFS implementation have limited encryption type
support. If your NFS server is hosted on a version older than Fedora 15, you may need to
use the <code class="option">-e des-cbc-crc</code> option to the
<code class="command">ipa-getkeytab</code> command for any
nfs/<FQDN> service keytabs you want to set up, both on the server and on all
clients. This instructs the KDC to generate only DES keys.
- </div><div class="para">
- If you use this option to generate DES keys, then all clients and servers that
rely on this encryption type need to have the <code
class="option">allow_weak_crypto</code> option enabled in the
[libdefaults] section of the <code
class="filename">/etc/krb5.conf</code> file. Without these
configuration changes, NFS clients and servers will be unable to authenticate to each
other, and attempts to mount NFS filesystems may fail. The client's rpc.gssd and the
server's rpc.svcgssd daemons may log errors indicating that DES encryption types are
not permitted.
- </div></div></div></li><li
class="listitem"><div class="para">
- Add the following line to the <code
class="filename">/etc/sysconfig/nfs</code> file:
- </div><pre class="programlisting">SECURE_NFS=yes
</pre></li><li class="listitem"><div
class="para">
- Start the rpcgssd daemon.
- </div><div class="para">
- <code class="command"># service rpcgssd start</code>
- </div></li></ol></div><div class="para">
- The FreeIPA client should now be fully configured to mount NFS shares using Kerberos
credentials. Use the following command to test the configuration:
- </div><div class="para">
- <code class="command"># mount -v -t nfs4 -o sec=krb5
ipaserver.example.com:/ /mnt</code>
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Uninstalling_IPA_Servers.html"><strong>Prev</strong>1.5. Uninstalling
FreeIPA Servers and Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Using_Microsoft_Windows.html"><strong>Next</strong>2.2. Configuring
a Microsoft Windows System as a
...</a></li></ul></body></html>
+ Run the <code class="command">ipa-join</code> command to
perform the actual join
+ </div></li><li class="listitem"><div
class="para">
+ Obtain a service principal for the host service and installs it into <code
class="filename">/etc/krb5.keytab</code>. For example, <code
class="systemitem">host/ipa.example.com(a)EXAMPLE.COM</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Enable certmonger, retrieve an SSL server certificate, and install the certificate
in <code class="filename">/etc/pki/nssdb</code>.
+ </div></li><li class="listitem"><div
class="para">
+ Disable the nscd daemon.
+ </div></li><li class="listitem"><div
class="para">
+ Configures SSSD or LDAP/KRB5, including NSS and PAM configuration files.
+ </div></li><li class="listitem"><div
class="para">
+ Configure NTP.
+ </div></li></ul></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Uninstalling_IPA_Servers.html"><strong>Prev</strong>2.5. Uninstalling
FreeIPA Servers and Replicas</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="Configuring_Microsoft_Windows.html"><strong>Next</strong>3.2. Configuring
a Microsoft Windows System as a
...</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sudo.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sudo.html
index 8d25f68..c5cbb39 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sudo.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/sudo.html
@@ -1,30 +1,30 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 11. Policy: Using sudo</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 12. Policy: Using sudo</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"
title="10.3. HBAC Services" /><link rel="next"
href="configuring-sudo.html" title="11.2. Configuring sudo"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Iden
tity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-sudo.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="sudo"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 11. Policy: Using
sudo</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="sudo.html#about-sudo">11.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alt
ernative_Schema">11.1.3. Benefits of the IPA Alternative
Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">11.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-sudo.html">11.2.
Configuring sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">11.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">11.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></div><div
class="section" id="about-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="about-sudo">11.1.
About sudo and IPA</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"
title="11.3. HBAC Services" /><link rel="next"
href="configuring-sudo.html" title="12.2. Configuring sudo"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="sect-Enterprise_Iden
tity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-sudo.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="sudo"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 12. Policy: Using
sudo</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="sudo.html#about-sudo">12.1. About sudo and
IPA</a></span></dt><dd><dl><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1.
Sudo with LDAP</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">12.1.2.
Limitations of the Existing Sudo LDAP
Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alt
ernative_Schema">12.1.3. Benefits of the IPA Alternative
Schema</a></span></dt><dt><span
class="section"><a
href="sudo.html#sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">12.1.4.
Compatibility and Managed Entry Plug-in
Configuration</a></span></dt></dl></dd><dt><span
class="section"><a href="configuring-sudo.html">12.2.
Configuring sudo</a></span></dt><dd><dl><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Server_Configuration_for_Sudo_Rules">12.2.1.
Server Configuration for Sudo Rules</a></span></dt><dt><span
class="section"><a
href="configuring-sudo.html#sect-Enterprise_Identity_Management_Guide-Setting_up_Sudo_Rules-Client_Configuration_for_Sudo_Rules">12.2.2.
Client Configuration for Sudo
Rules</a></span></dt></dl></dd></dl></div><div
class="section" id="about-sudo"><div
class="titlepage"><div><div><h2 class="title"
id="about-sudo">12.1.
About sudo and IPA</h2></div></div></div><div
class="para">
The <code class="command">sudo</code> command allows a system
administrator to delegate authority, allowing certain users (or groups of users) the
ability to run one or more commands as root or as another user, and at the same time
providing an audit trail of the commands and their arguments. For more information,
including coverage of the options available for use with <code
class="command">sudo</code>, refer to the <code
class="command">sudo</code> and <code
class="command">sudoers</code> man pages.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">11.1.1. Sudo
with LDAP</h3></div></div></div><div
class="para">
+ </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Sudo_with_LDAP">12.1.1. Sudo
with LDAP</h3></div></div></div><div
class="para">
In the past, <code class="command">sudo</code> used a single,
local, configuration file, <code
class="filename">/etc/sudoers</code>. It is possible to share the same
<code class="filename">sudoers</code> file among machines, but there
is no built-in mechanism to distribute it. Some have attempted to work around this by
synchronizing changes using CVS, RSYNC, RDIST, RCP, SCP, and even NFS. By using LDAP for
<code class="filename">sudoers</code>, IPA provides a
centrally-administered, globally-available configuration source for <code
class="command">sudo</code>.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">11.1.2. Limitations
of the Existing Sudo LDAP Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Limitations_of_the_Existing_Sudo_LDAP_Schema">12.1.2. Limitations
of the Existing Sudo LDAP Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
The current schema relies on LDAP-stored POSIX groups for its groups of users. The
limitation here is that you cannot use a group of users for <code
class="command">sudo</code> without the users inheriting potential
POSIX rights.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Hosts"><h5
class="formalpara">Groups of Hosts</h5>
The current schema does not have a concept of host groups. Instead, it relies on the
legacy LDAP nisNetgroupTriple to manage groups of hosts.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Limitations_of_the_Existing_Sudo_LDAP_Schema-Groups_of_Commands"><h5
class="formalpara">Groups of Commands</h5>
The current schema does not have a concept of command groups. This requires that
individual commands be present in each Sudo rule. It also limits the ability to reuse a
group of commands for multiple Sudo rules.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">11.1.3. Benefits
of the IPA Alternative Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Benefits_of_the_IPA_Alternative_Schema">12.1.3. Benefits
of the IPA Alternative Schema</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Users"><h5
class="formalpara">Groups of Users</h5>
Groups of users can be either POSIX or non-POSIX groups within IPA. This provides
the flexibility to group users without assigning POSIX rights or GID information to the
group.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Computers"><h5
class="formalpara">Groups of Computers</h5>
The IPA alternative schema also addresses the issue of host groups and netgroups for
the purpose of sudo. The <code class="command">sudo</code> utility
itself does not support host groups—a better and cleaner host grouping mechanism—but
instead expects netgroups. To resolve this issue, IPA automatically creates a "shadow
netgroup" with the same name as every host group that you create. This means that you
can create host groups but still use netgroups with <code
class="command">sudo</code> without encountering any problems.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Benefits_of_the_IPA_Alternative_Schema-Groups_of_Commands"><h5
class="formalpara">Groups of Commands</h5>
Command groups are a new concept introduced by IPA. These objects allow
administrators the ability to create groups of <code
class="command">sudo</code> commands that can be reused for multiple
rules without the need of assigning individual commands throughout.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">11.1.4. Compatibility
and Managed Entry Plug-in
Configuration</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Compatibility_Translation_for_Native_Sudo"><h5
class="formalpara">Compatibility Translation for Native Sudo</h5>
+ </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Introduction-Compatibility_and_Managed_Entry_Plug_in_Configuration">12.1.4. Compatibility
and Managed Entry Plug-in
Configuration</h3></div></div></div><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Compatibility_Translation_for_Native_Sudo"><h5
class="formalpara">Compatibility Translation for Native Sudo</h5>
The native <code class="command">sudo</code> binary does not
yet support SSSD or the IPA Sudo Schema. As an interim solution, IPA has implemented a
compatibility plug-in which transparently translates IPA Sudo rules into those supported
by the current <code class="command">sudo</code> binary.
</div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Compatibility_and_Managed_Entry_Plug_in_Configuration-Managed_Entries_for_NIS_Netgroups"><h5
class="formalpara">Managed Entries for NIS Netgroups</h5>
In order to seamlessly support the current implementation of sudo, IPA provides a
managed entry plug-in for NIS netgroups. Whenever an IPA host group is created, a
translated nisNetgroupTriple is also created.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Prev</strong>10.3. HBAC
Services</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-sudo.html"><strong>Next</strong>11.2. Configuring
sudo</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Host_based_Access_Control_Policies-HBAC_Services.html"><strong>Prev</strong>11.3. HBAC
Services</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="configuring-sudo.html"><strong>Next</strong>12.2. Configuring
sudo</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/switching-users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/switching-users.html
index 64dbdf4..498ad51 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/switching-users.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/switching-users.html
@@ -1,24 +1,26 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.3. Switching Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.3. Switching Users</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="basic-usage.html" title="Chapter 3. Basic Usage" /><link
rel="prev" href="logging-in.html" title="3.2. Logging into the
IPA UI" /><link rel="next" href="managing-clients.html"
title="Chapter 4. Managing Clients in the FreeIPA Domain"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="logging-in.html"><strong>Prev</strong></a></li><li
class="next"><a a
ccesskey="n"
href="managing-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="switching-users"><div
class="titlepage"><div><div><h2 class="title"
id="switching-users">3.3. Switching
Users</h2></div></div></div><div class="para">
- One of the main advantages of IPA is that it uses <code
class="systemitem">Kerberos</code> for authentication. This means that
if the machine is configured to use IPA as an authentication server and you have an IPA
account, then once you have logged in to the machine and authenticated, you can reuse your
<code class="systemitem">Kerberos</code> credentials to access other
services in the IPA domain. This avoids the need to constantly re-enter your password to
access different services.
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="basic-usage.html" title="Chapter 4. Basic UI Usage"
/><link rel="prev" href="using-the-ui.html"
title="4.2. Using the FreeIPA UI" /><link rel="next"
href="managing-clients.html" title="Chapter 5. Managing Clients in the
FreeIPA Domain" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="using-the-ui.html"><strong>Prev</strong></a></li><li
class="next">
<a accesskey="n"
href="managing-clients.html"><strong>Next</strong></a></li></ul><div
class="section" id="switching-users"><div
class="titlepage"><div><div><h2 class="title"
id="switching-users">4.3. Switching
Users</h2></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
</div><div class="para">
- For example, to connect to the IPA web interface, you can enter the server's
address in your browser and it will use your <code
class="systemitem">Kerberos</code> ticket to authenticate against IPA.
Similar functionality is available if you try to access a file share, a wiki or any other
application that is configured to be a <code
class="systemitem">Kerberos</code> service in the IPA domain.
+ One of the main advantages of FreeIPA is that it uses Kerberos for authentication.
This means that if the machine is configured to use FreeIPA as an authentication server
and you have an FreeIPA account, then once you have logged in to the machine and
authenticated, you can reuse your Kerberos credentials to access other services in the
FreeIPA domain. This avoids the need to constantly re-enter your password to access
different services.
</div><div class="para">
- If you log in to a machine using an account different from your IPA account, use the
<code class="command">kinit</code> command to establish your
<code class="systemitem">Kerberos</code> credentials. Similarly, if
you need to log in to IPA as a different user, perhaps in another user role or as the
administrator, you need to replace your existing credentials with those of the new user.
Currently you can only store one set of tickets per logged-in user, and they are the
credentials that will be used when you log in to IPA.
+ For example, to connect to the FreeIPA web interface, you can enter the server's
address in your browser and it will use your Kerberos ticket to authenticate against
FreeIPA. Similar functionality is available if you try to access a file share, a wiki or
any other application that is configured to be a Kerberos service in the FreeIPA domain.
</div><div class="para">
- For example, if your local account name is <code
class="systemitem">localUser</code> but your IPA account name is
<code class="systemitem">ipaUser</code>, run the following command,
and enter your password when prompted:
+ If you log in to a machine using an account different from your FreeIPA account, use
the <code class="command">kinit</code> command to establish your
Kerberos credentials. Similarly, if you need to log in to FreeIPA as a different user,
perhaps in another user role or as the administrator, you need to replace your existing
credentials with those of the new user. Currently you can only store one set of tickets
per logged-in user, and they are the credentials that will be used when you log in to
FreeIPA.
+ </div><div class="para">
+ For example, if your local account name is localUser but your FreeIPA account name is
ipaUser, run the following command, and enter your password when prompted:
</div><pre class="screen">$ kinit ipaUser
Password for ipaUser(a)EXAMPLE.COM:
</pre><div class="para">
- This establishes your <code class="systemitem">Kerberos</code>
credentials on the local machine. You can use the <code
class="command">klist</code> command to verify that you received a
<em class="firstterm">ticket granting ticket (TGT)</em> from the
server. This should return output similar to the following:
+ This establishes your Kerberos credentials on the local machine. You can use the
<code class="command">klist</code> command to verify that you
received a <span class="emphasis"><em>ticket granting ticket
(TGT)</em></span> from the server. This should return output similar to the
following:
</div><pre class="screen">$ klist
Ticket cache: FILE:/tmp/krb5cc_500
Default principal: ipaUser(a)EXAMPLE.COM
@@ -29,7 +31,7 @@ Valid starting Expires Service principal
Kerberos 4 ticket cache: /tmp/tkt500
klist: You have no tickets cached
</pre><div class="para">
- You should now be able to connect to the IPA web interface. If you were already
connected to the web interface as another user, refresh the browser to display the updated
details for the new user.
+ You should now be able to connect to the FreeIPA web interface. If you were already
connected to the web interface as another user, refresh the browser to display the updated
details for the new user.
</div><div class="para">
- If you configured <code class="systemitem">SSSD</code> or
<code class="systemitem">pam_krb5</code> on the machine with IPA,
then the ticket is created for you when you log in to the machine requires authentication
(for example, <code class="command">sudo</code>).
- </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="logging-in.html"><strong>Prev</strong>3.2. Logging into the
IPA UI</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="managing-clients.html"><strong>Next</strong>Chapter 4. Managing
Clients in the FreeIPA Domain</a></li></ul></body></html>
+ If you configured SSSD or <code
class="systemitem">pam_krb5</code> on the machine with FreeIPA, then
the ticket is created for you when you log in to the machine requires authentication (for
example, <code class="command">sudo</code>).
+ </div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="using-the-ui.html"><strong>Prev</strong>4.2. Using the
FreeIPA UI</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="managing-clients.html"><strong>Next</strong>Chapter 5. Managing
Clients in the FreeIPA Domain</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/tools-reference.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/tools-reference.html
new file mode 100644
index 0000000..f18b420
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/tools-reference.html
@@ -0,0 +1,114 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Appendix B. FreeIPA Tools Reference</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"
title="Appendix A. Frequently Asked Questions" /><link
rel="next" href="server-tools.html" title="B.2. Server
Scripts" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="chap-Enterprise_Identity_Mana
gement_Guide-Frequently_Asked_Questions.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="server-tools.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="appendix" id="tools-reference"
lang="en-US"><div
class="titlepage"><div><div><h1
class="title">FreeIPA Tools
Reference</h1></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="tools-reference.html#ipa">B.1.
ipa</a></span></dt><dd><dl><dt><span
class="section"><a
href="tools-reference.html#ipa-location">B.1.1.
Location</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-syntax">B.1.2.
Syntax</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-commands">B.1.3.
Commands</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-options">B.1.4.
Options</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-command-automount">B.1.5. ipa
automountlocation*</a></span></dt><dt><span cla
ss="section"><a
href="tools-reference.html#ipa-command-automountmap">B.1.6. ipa
automountmap*</a></span></dt><dt><span
class="section"><a
href="tools-reference.html#ipa-command-automountkey">B.1.7. ipa
automountkey*</a></span></dt></dl></dd><dt><span
class="section"><a href="server-tools.html">B.2. Server
Scripts</a></span></dt><dd><dl><dt><span
class="section"><a
href="server-tools.html#ipa-compat-manage">B.2.1.
ipa-compat-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-compliance">B.2.2.
ipa-compliance</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-dns-install">B.2.3.
ipa-dns-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-host-net-manage">B.2.4.
ipa-host-net-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa_kpasswd">B.2.5.
ipa_kpasswd</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-ldap-updater">B.2.6.
ipa-ldap-updater</a></span></dt
<dt><span class="section"><a
href="server-tools.html#ipa-nis-manage">B.2.7.
ipa-nis-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-install">B.2.8.
ipa-replica-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-manage">B.2.9.
ipa-replica-manage</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-replica-prepare">B.2.10.
ipa-replica-prepare</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-server-certinstall">B.2.11.
ipa-server-certinstall</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-server-install">B.2.12.
ipa-server-install</a></span></dt><dt><span
class="section"><a
href="server-tools.html#ipa-ugradeconfig">B.2.13.
ipa-upgradeconfig</a></span></dt><dt><span
class="section"><a href="server-tools.html#ipactl">B.2.14.
ipactl</a></span></dt></dl></dd><dt><span
class="section"><a href="client-tools.html">B.3. Client
Scripts</a></span>
</dt><dd><dl><dt><span
class="section"><a
href="client-tools.html#ipa-client-install">B.3.1.
ipa-client-install</a></span></dt><dt><span
class="section"><a
href="client-tools.html#ipa-getkeytab">B.3.2.
ipa-getkeytab</a></span></dt><dt><span
class="section"><a href="client-tools.html#ipa-join">B.3.3.
ipa-join</a></span></dt><dt><span
class="section"><a
href="client-tools.html#ipa-rmkeytab">B.3.4.
ipa-rmkeytab</a></span></dt></dl></dd><dt><span
class="section"><a href="certmonger-tools.html">B.4.
Certmonger Scripts</a></span></dt><dd><dl><dt><span
class="section"><a
href="certmonger-tools.html#getcert">B.4.1.
getcert</a></span></dt><dt><span
class="section"><a
href="certmonger-tools.html#ipa-getcert">B.4.2.
ipa-getcert</a></span></dt></dl></dd></dl></div><div
class="para">
+ XXXXX introXXXXXXXX
+ </div><div class="section" id="ipa"><div
class="titlepage"><div><div><h2 class="title"
id="ipa">B.1. ipa</h2></div></div></div><div
class="para">
+ IPA uses a plugin system where the same plugin is used both for the XML-RPC
server-side interface and for the command-line interface. This results in a consistent,
unified interface that is easy to maintain. From the user's perspective, plugins are
more or less interchangeable with commands. Most plugins implement commands used to manage
IPA and its data. With the exception of two build-ins (`help` and `console`) all commands
are introduced by plugins. Commands are invoked like this: ipa [global-options] COMMAND
[command-parameters-that-is-options-and-arguments] A list of global options can be
displayed using: ipa --help The plugins are organized by type of objects they manage. This
type can also be used to get an overview of the available commands. To display all
commands in a specific module, use the `help` command as follows: ipa help TOPIC
Parameters available for a specific command are displayed with: ipa COMMAND --help If a
list of parameter isn't enough, more infor
mation about specific commands is available through the `help` command: ipa help COMMAND
Description
+ </div><div class="section" id="ipa-location"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-location">B.1.1. Location</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Description
+ </th><th>
+ Location
+ </th></tr></thead><tbody><tr><td>
+ Tool directory
+ </td><td>
+ Location
+ </td></tr><tr><td>
+ Package
+ </td><td>
+ ipa-admintools
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-syntax"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-syntax">B.1.2. Syntax</h3></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-commands"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-commands">B.1.3. Commands</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an automount
key. automountkey-find Search for an automount key. automountkey-mod Modify an automount
key. automountkey-show Display an automount key. automountlocation-add Create a new
automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map. cert-remove-hold Take a revoked certificate off hold. cert-request
Submit a certificate signing request. cert-rev
oke Revoke a certificate. cert-show Retrieve an existing certificate. cert-status Check
the status of a certificate signing request. config-mod Modify configuration options.
config-show Show the current configuration. console Start the IPA interactive Python
console. delegation-add Add a new delegation. delegation-del Delete a delegation.
delegation-find Search for delegations. delegation-mod Modify a delegation.
delegation-show Display information about a delegation. dns-resolve Resolve a host name in
DNS dnsrecord-add Add new DNS resource record. dnsrecord-del Delete DNS resource record.
dnsrecord-find Search for DNS resources. dnsrecord-show Display DNS resource. dnszone-add
Create new DNS zone (SOA record). dnszone-del Delete DNS zone (SOA record).
dnszone-disable Disable DNS Zone. dnszone-enable Enable DNS Zone. dnszone-find Search for
DNS zones (SOA records). dnszone-mod Modify DNS zone (SOA record). dnszone-show Display
information about a DNS zone (SOA record). entit
le-consume Consume an entitlement entitle-find Search for entitlement accounts.
entitle-get Retrieve the entitlement certs entitle-import Import an entitlement
certificate. entitle-register Register to the entitlement system entitle-status Display
current entitlements entitle-sync Re-sync the local entitlement cache with the entitlement
server env Show environment variables group-add Create a new group. group-add-member Add
members to a group. group-del Delete group. group-detach Detach a managed group from a
user group-find Search for groups. group-mod Modify a group. group-remove-member Remove
members from a group. group-show Display information about a named group. hbacrule-add
Create a new HBAC rule. hbacrule-add-host Add target hosts and hostgroups to an HBAC rule
hbacrule-add-service Add services to an HBAC rule. hbacrule-add-sourcehost Add source
hosts and hostgroups from a HBAC rule. hbacrule-add-user Add users and groups to an HBAC
rule. hbacrule-del Delete an HBAC
rule. hbacrule-disable Disable an HBAC rule. hbacrule-enable Enable an HBAC rule.
hbacrule-find Search for HBAC rules. hbacrule-mod Modify an HBAC rule.
hbacrule-remove-host Remove target hosts and hostgroups from an HBAC rule.
hbacrule-remove-service Remove service and service groups from an HBAC rule.
hbacrule-remove-sourcehost Remove source hosts and hostgroups from an HBAC rule.
hbacrule-remove-user Remove users and groups from an HBAC rule. hbacrule-show Display the
properties of an HBAC rule. hbacsvc-add Add a new HBAC service. hbacsvc-del Delete an
existing HBAC service. hbacsvc-find Search for HBAC services. hbacsvc-mod Modify an HBAC
service. hbacsvc-show Display information about an HBAC service. hbacsvcgroup-add Add a
new HBAC service group. hbacsvcgroup-add-member Add members to an HBAC service group.
hbacsvcgroup-del Delete an HBAC service group. hbacsvcgroup-find Search for an HBAC
service group. hbacsvcgroup-mod Modify an HBAC service group. hbacsvcgroup-remov
e-member Remove members from an HBAC service group. hbacsvcgroup-show Display information
about an HBAC service group. help Display help for a command or topic. host-add Add a new
host. host-add-managedby Add hosts that can manage this host. host-del Delete a host.
host-disable Disable the Kerberos key, SSL certificate and all services of a host.
host-find Search for hosts. host-mod Modify information about a host.
host-remove-managedby Remove hosts that can manage this host. host-show Display
information about a host. hostgroup-add Add a new hostgroup. hostgroup-add-member Add
members to a hostgroup. hostgroup-del Delete a hostgroup. hostgroup-find Search for
hostgroups. hostgroup-mod Modify a hostgroup. hostgroup-remove-member Remove members from
a hostgroup. hostgroup-show Display information about a hostgroup. krbtpolicy-mod Modify
Kerberos ticket policy. krbtpolicy-reset Reset Kerberos ticket policy to the default
values. krbtpolicy-show Display the current Kerberos tic
ket policy. migrate-ds Migrate users and groups from DS to IPA. netgroup-add Add a new
netgroup. netgroup-add-member Add members to a netgroup. netgroup-del Delete a netgroup.
netgroup-find Search for a netgroup. netgroup-mod Modify a netgroup.
netgroup-remove-member Remove members from a netgroup. netgroup-show Display information
about a netgroup. passwd Set a user's password permission-add Add a new permission.
permission-del Delete a permission. permission-find Search for permissions. permission-mod
Modify a permission. permission-show Display information about a permission. ping ping a
remote server plugins Show all loaded plugins privilege-add Add a new privilege.
privilege-add-permission Add permissions to a privilege. privilege-del Delete a privilege.
privilege-find Search for privileges. privilege-mod Modify a privilege.
privilege-remove-permission Remove permissions from a privilege. privilege-show Display
information about a privilege. pwpolicy-add Add a new group
password policy. pwpolicy-del Delete a group password policy. pwpolicy-find Search for
group password policies. pwpolicy-mod Modify a group password policy. pwpolicy-show
Display information about password policy. role-add Add a new role. role-add-member Add
members to a role. role-add-privilege Add privileges to a role. role-del Delete a role.
role-find Search for roles. role-mod Modify a role. role-remove-member Remove members from
a role. role-remove-privilege Remove privileges from a role. role-show Display information
about a role. selfservice-add Add a new self-service permission. selfservice-del Delete a
self-service permission. selfservice-find Search for a self-service permission.
selfservice-mod Modify a self-service permission. selfservice-show Display information
about a self-service permission. service-add Add a new IPA new service. service-add-host
Add hosts that can manage this service. service-del Delete an IPA service. service-disable
Disable the Kerberos k
ey and SSL certificate of a service. service-find Search for IPA services. service-mod
Modify an existing IPA service. service-remove-host Remove hosts that can manage this
service. service-show Display information about an IPA service. show-mappings
ipalib.cli.show_mappings sudocmd-add Create new sudo command. sudocmd-del Delete sudo
command. sudocmd-find Search for commands. sudocmd-mod Modify command. sudocmd-show
Display sudo command. sudocmdgroup-add Create new sudo command group.
sudocmdgroup-add-member Add members to sudo command group. sudocmdgroup-del Delete sudo
command group. sudocmdgroup-find Search for sudo command groups. sudocmdgroup-mod Modify
group. sudocmdgroup-remove-member Remove members from sudo command group.
sudocmdgroup-show Display sudo command group. sudorule-add Create new Sudo Rule.
sudorule-add-allow-command Add commands and sudo command groups affected by Sudo Rule.
sudorule-add-deny-command Add commands and sudo command groups affected by Sudo
Rule. sudorule-add-host Add hosts and hostgroups affected by Sudo Rule.
sudorule-add-option Add an option to the Sudo rule. sudorule-add-runasgroup Add group for
Sudo to execute as. sudorule-add-runasuser Add user for Sudo to execute as.
sudorule-add-user Add users and groups affected by Sudo Rule. sudorule-del Delete Sudo
Rule. sudorule-disable Disable a Sudo rule. sudorule-enable Enable a Sudo rule.
sudorule-find Search for Sudo Rule. sudorule-mod Modify Sudo Rule.
sudorule-remove-allow-command Remove commands and sudo command groups affected by Sudo
Rule. sudorule-remove-deny-command Remove commands and sudo command groups affected by
Sudo Rule. sudorule-remove-host Remove hosts and hostgroups affected by Sudo Rule.
sudorule-remove-option Remove an option from Sudo rule. sudorule-remove-runasgroup Remove
group for Sudo to execute as. sudorule-remove-runasuser Remove user for Sudo to execute
as. sudorule-remove-user Remove users and groups affected by Sudo Rule. sudorule-
show Dispaly Sudo Rule. user-add Add a new user. user-del Delete a user. user-disable
Disable a user account. user-enable Enable a user account. user-find Search for users.
user-mod Modify a user. user-show Display information about a user. user-unlock Unlock a
user account
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-options"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-options">B.1.4. Options</h3></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div><div
class="para">
+ help topics: automount Automount cert IPA certificate operations config Manage the
IPA configuration delegation Group to Group Delegation dns Domain Name System (DNS)
entitle Entitlements group Groups of users hbac Host-based access control commands host
Hosts/Machines hostgroup Groups of hosts. krbtpolicy Kerberos ticket policy migration
Migration to IPA misc Misc plug-ins netgroup Netgroups passwd Set a user's password
permission Permissions ping Ping the remote IPA server privilege Privileges pwpolicy
Password policy role Roles selfservice Self-service Permissions service Services sudo
commands for controlling sudo configuration user Users
+ </div></div><div class="section"
id="ipa-command-automount"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automount">B.1.5. ipa
automountlocation*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automount-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-syntax">B.1.5.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automount-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-commands">B.1.5.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automount-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automount-options">B.1.5.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-command-automountmap"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automountmap">B.1.6. ipa
automountmap*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automountmap-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-syntax">B.1.6.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automountmap-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-commands">B.1.6.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automountmap-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountmap-options">B.1.6.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div><div
class="section" id="ipa-command-automountkey"><div
class="titlepage"><div><div><h3 class="title"
id="ipa-command-automountkey">B.1.7. ipa
automountkey*</h3></div></div></div><div
class="para">
+ info
+ </div><div class="section"
id="ipa-automountkey-syntax"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-syntax">B.1.7.1. Syntax</h4></div></div></div><div
class="cmdsynopsis"><p><code
class="command">ipa</code>
+ <em
class="replaceable"><code>commands</code></em>
+ [
+ <em
class="replaceable"><code>options</code></em>
+ ]</p></div></div><div class="section"
id="ipa-automountkey-commands"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-commands">B.1.7.2. Commands</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Command
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ automountkey-add Create a new automount key. automountkey-del Delete an
automount key. automountkey-find Search for an automount key. automountkey-mod Modify an
automount key. automountkey-show Display an automount key. automountlocation-add Create a
new automount location. automountlocation-del Delete an automount location.
automountlocation-find Search for an automount location. automountlocation-import Import
automount files for a specific location. automountlocation-show Display an automount
location. automountlocation-tofiles Generate automount files for a specific location.
automountmap-add Create a new automount map. automountmap-add-indirect Create a new
indirect mount point. automountmap-del Delete an automount map. automountmap-find Search
for an automount map. automountmap-mod Modify an automount map. automountmap-show Display
an automount map.
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div><div
class="section" id="ipa-automountkey-options"><div
class="titlepage"><div><div><h4 class="title"
id="ipa-automountkey-options">B.1.7.3. Options</h4></div></div></div><div
class="informaltable"><table
border="1"><colgroup><col width="50%" /><col
width="50%" /></colgroup><thead><tr><th>
+ Parameter
+ </th><th>
+ Description
+ </th></tr></thead><tbody><tr><td>
+ -h, --help show this help message and exit -e KEY=VAL Set environment variable
KEY to VAL -c FILE Load configuration from FILE -d, --debug Produce full debuging output
-v, --verbose Produce more verbose output. A second -v displays the XML-RPC request -a,
--prompt-all Prompt for ALL values (even if optional) -n, --no-prompt Prompt for NO values
(even if required) -f, --no-fallback Only use the server configured in
/etc/ipa/default.conf
+ </td><td>
+ Location
+ </td></tr></tbody></table></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="chap-Enterprise_Identity_Management_Guide-Frequently_Asked_Questions.html"><strong>Prev</strong>Appendix A. Frequently
Asked Questions</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="server-tools.html"><strong>Next</strong>B.2. Server
Scripts</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/uninstalling-clients.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/uninstalling-clients.html
index bb1280d..593fec6 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/uninstalling-clients.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/uninstalling-clients.html
@@ -1,14 +1,14 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.7. Uninstalling a FreeIPA Client</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>3.7. Uninstalling a FreeIPA Client</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="managing-clients.html" title="Chapter 4. Managing Clients in the
FreeIPA Domain" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"
title="4.6. Client Problems" /><link rel="next"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous">
<a accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="users.html"><strong>Next</strong></a></li></ul><div
class="section" id="uninstalling-clients"><div
class="titlepage"><div><div><h2 class="title"
id="uninstalling-clients">4.7. Uninstalling a FreeIPA
Client</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="setting-up-clients.html" title="Chapter 3. Setting up Systems as
FreeIPA Clients" /><link rel="prev"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"
title="3.6. Configuring a Macintosh OS X System as a FreeIPA Client"
/><link rel="next" href="basic-usage.html"
title="Chapter 4. Basic UI Usage" /></head><body
class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p" href=
"Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="basic-usage.html"><strong>Next</strong></a></li></ul><div
class="section" id="uninstalling-clients"><div
class="titlepage"><div><div><h2 class="title"
id="uninstalling-clients">3.7. Uninstalling a FreeIPA
Client</h2></div></div></div><div class="para">
For Fedora clients, the <code
class="command">ipa-client-install</code> utility can be used to
uninstall the client and remove it from the FreeIPA domaine. To remove the client, use the
<code class="option">--uninstall</code> option.
</div><pre class="programlisting"><span
class="perl_Comment"># ipa-client-install
--uninstall</span></pre><div class="note"><div
class="admonition_header"><h2>NOTE</h2></div><div
class="admonition"><div class="para">
There is an uninstall option with the <code
class="command">ipa-join</code> command. This is called by <code
class="command">ipa-client-install --uninstall</code> as part of the
uninstallation process. However, while the <code
class="command">ipa-join</code> option removes the client from the
domain, it does not actually uninstall the client or properly remove all of the
FreeIPA-related configuration. Do not run <code class="command">ipa-join
-u</code> to attempt to uninstall the FreeIPA client. The only way to uninstall a
client completely is to use <code class="command">ipa-client-install
--uninstall</code>.
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-General_Troubleshooting_Tips-Client_Problems.html"><strong>Prev</strong>4.6. Client
Problems</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="users.html"><strong>Next</strong>Chapter 5. Identity:
Managing Users and User Grou...</a></li></ul></body></html>
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_an_IPA_Client_on_Macintosh_OS_X.html"><strong>Prev</strong>3.6. Configuring
a Macintosh OS X System as a Fre...</a></li><li
class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="basic-usage.html"><strong>Next</strong>Chapter 4. Basic UI
Usage</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-groups.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-groups.html
index 03428b8..27eceae 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-groups.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-groups.html
@@ -1,15 +1,15 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.6. Creating User Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.8. Creating User Groups</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"
title="5.5. Deleting FreeIPA Users" /><link rel="next"
href="user-pwdpolicy.html" title="5.7. Setting an Individual Password
Policy" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a acce
sskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="user-pwdpolicy.html"><strong>Next</strong></a></li></ul><div
class="section" id="user-groups"><div
class="titlepage"><div><div><h2 class="title"
id="user-groups">5.6. Creating User
Groups</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev"
href="Configuring_IPA_Users-Deleting_IPA_Users.html" title="6.7. Deleting
FreeIPA Users" /><link rel="next"
href="user-pwdpolicy.html" title="6.9. Setting an Individual Password
Policy" /></head><body class="toc_embeded "><div
id="tocdiv" class="toc"><iframe id="tocframe"
class="toc" src="../../../../toc.html">This is an iframe, to view
it upgrade your browser or enable iframe display.</iframe></div><p
id="title"><a class="left"
href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="Configuring_IPA_Users-Dele
ting_IPA_Users.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n"
href="user-pwdpolicy.html"><strong>Next</strong></a></li></ul><div
class="section" id="user-groups"><div
class="titlepage"><div><div><h2 class="title"
id="user-groups">6.8. Creating User
Groups</h2></div></div></div><div class="para">
FreeIPA uses groups to facilitate the management and administration of all types of
objects, such as users, hosts, tasks, roles, and others. This section introduces <code
class="systemitem">User Groups</code> and how they are used within
FreeIPA. Other object groups behave and are used in similar ways; these are discussed
elsewhere.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-User_Groups"><h5
class="formalpara">User Groups</h5>
+ </div><div class="formalpara"
id="Configuring_IPA_Groups-User_Groups"><h5
class="formalpara">User Groups</h5>
Three groups are created during the installation process: <code
class="systemitem">ipausers</code>, <code
class="systemitem">admins</code>, and <code
class="systemitem">editors</code>. All of these groups are required for
FreeIPA operation.
</div><div class="para">
The FreeIPA Administrator is a member of the <code
class="systemitem">admins</code> group. All other users belong to the
global group <code class="systemitem">ipausers</code>, and you can
create as many additional groups as you require.
@@ -19,11 +19,11 @@
The <code class="systemitem">editors</code> group is a special
group used by the web interface. Members of this group have at least one delegation, which
means they can edit records apart from their own.
</div><div class="para">
You can create groups based on the departments within your organization, for example,
Development, Finance, and HR. You can also create groups based on the permissions, or
roles, required to manage your departmental or other groups.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Nested_Groups"><h5
class="formalpara">Nested Groups</h5>
+ </div><div class="formalpara"
id="Configuring_IPA_Groups-Nested_Groups"><h5
class="formalpara">Nested Groups</h5>
You can also create nested groups. For example, you can create a group called
"Documentation", and then create sub-groups such as "Writers",
"Translators", and "Editors". You can add users to each of the
sub-groups to suit the needs of your organization. Any users that you add to a sub-group
automatically become members of the parent group.
</div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
Avoid the creation of cyclic groups; that is, groups that contain groups that in turn
contain their own ancestors, and avoid creating group names that contain spaces. Either of
these conditions can lead to unexpected behavior.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1. Creating
FreeIPA Groups</h3></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-Creating_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Creating_IPA_Groups-Using_the_Command_Line">5.6.1.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Configuring_IPA_Groups-Creating_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1. Creating FreeIPA
Groups</h3></div></div></div><div class="section"
id="Creating_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Creating_IPA_Groups-Using_the_Command_Line">6.8.1.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-add</code> command to
add groups. You can include attributes on the command line or use the command
interactively. For example:
</div><div class="para">
To create a group called "Engineering" using the command line:
@@ -46,7 +46,13 @@ Added group "documentation"
Description: All authors, editors, and translators
GID: 387115845</pre><div class="para">
The group name and description are mandatory fields. If either of these are not
included on the command line, you will be prompted to include them.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Using_the_Command_Line-Adding_members_to_a_new_group"><h5
class="formalpara">Adding members to a new group</h5>
+ </div><div class="important"><div
class="admonition_header"><h2>IMPORTANT</h2></div><div
class="admonition"><div class="para">
+ When a group is created without specifying a GID number, then the group entry is
assigned the ID number that is next available in the server or replica range. (Number
ranges are described more in <a class="xref"
href="Managing-Unique_UID_and_GID_Attributes.html">Section 13.3, “Managing
Unique UID and GID Number Assignments”</a>.) This means that a group always has a
unique number for its GID number.
+ </div><div class="para">
+ If a number is <span
class="emphasis"><em>manually</em></span> assigned to a
group entry, the server does not validate that the <em
class="parameter"><code>gidNumber</code></em> is unique. It
will allow duplicate IDs; this is expected (though discouraged) behavior for Posix
entries.
+ </div><div class="para">
+ If two entries are assigned the same ID number, only the first entry is returned in
a search for that ID number. However, both entries will be returned in searches for other
attributes or with <code class="command">ipa group-find
--all</code>.
+ </div></div></div><div class="formalpara"
id="Using_the_Command_Line-Adding_members_to_a_new_group"><h5
class="formalpara">Adding members to a new group</h5>
You cannot add members to a newly-created group using the <code
class="command">ipa group-add</code> command. First you need to create
the group, and then use the <code
class="command">ipa group-add-member</code> command to add members. For
example:
</div><pre class="screen">$ ipa group-add-member
--users=user01,user02,user03 engineering
Group name: engineering
@@ -66,20 +72,20 @@ Number of members added 3
-------------------------
Number of members added 2
-------------------------
-</pre></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2. Editing
FreeIPA Groups</h3></div></div></div><div
class="para">
+</pre></div></div><div class="section"
id="Configuring_IPA_Groups-Editing_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2. Editing FreeIPA
Groups</h3></div></div></div><div class="para">
You can edit many of the attributes that define a group, as well as add or remove
members. Some attributes are read-only by default, however you can edit these attributes
if required.
</div><div class="para">
You cannot edit the group name. The group name is the primary key, so changing it is
the equivalent of deleting the group and creating a new one.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Editing_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Editing_IPA_Groups-Using_the_Command_Line">5.6.2.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Editing_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Editing_IPA_Groups-Using_the_Command_Line">6.8.2.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-mod</code> command to
modify specific attributes of FreeIPA groups. FreeIPA provides numerous commands for
working with groups, such as <code
class="command">ipa group-add-member</code> and <code
class="command">ipa group-detach</code>; run the <code
class="command">ipa help group</code> command to access the FreeIPA
group help page for more information.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3. Deleting
FreeIPA Groups</h3></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Configuring_IPA_Groups-Deleting_IPA_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3. Deleting FreeIPA
Groups</h3></div></div></div><div class="para">
When you delete a FreeIPA group, only the immediate group is removed; members of the
group are not affected.
</div><div class="para">
When you delete a FreeIPA group, any delegations that apply to that group are also
removed. For example, suppose you added an "EngineeringManager" group
specifically to set up delegations for the Engineering Manager. If you delete the
EngineeringManager group, then those delegations are also lost. These delegations cannot
be retrieved. If you need this group and delegation again, you need to recreate them.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Groups-Using_the_Command_Line">5.6.3.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Deleting_IPA_Groups-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Deleting_IPA_Groups-Using_the_Command_Line">6.8.3.1. Using the Command
Line</h4></div></div></div><div class="para">
Use the <code class="command">ipa group-del</code> command to
delete groups. For example:
</div><div class="para">
To delete the Engineering group:
</div><div class="para">
- <code class="command">$ ipa group-del Engineering</code>
- </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Prev</strong>5.5. Deleting
FreeIPA Users</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="user-pwdpolicy.html"><strong>Next</strong>5.7. Setting an
Individual Password Policy</a></li></ul></body></html>
+ $ ipa group-del Engineering
+ </div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="Configuring_IPA_Users-Deleting_IPA_Users.html"><strong>Prev</strong>6.7. Deleting
FreeIPA Users</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="user-pwdpolicy.html"><strong>Next</strong>6.9. Setting an
Individual Password Policy</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-pwdpolicy.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-pwdpolicy.html
index 3f976e7..53a83f7 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-pwdpolicy.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/user-pwdpolicy.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>5.7. Setting an Individual Password Policy</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>6.9. Setting an Individual Password Policy</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 5. Identity: Managing Users and User
Groups" /><link rel="prev" href="user-groups.html"
title="5.6. Creating User Groups" /><link rel="next"
href="searching.html" title="5.8. Searching for Users and Groups"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="user-groups.html"><strong>Prev</strong></a></li><li
class="next"><a a
ccesskey="n"
href="searching.html"><strong>Next</strong></a></li></ul><div
class="section" id="user-pwdpolicy"><div
class="titlepage"><div><div><h2 class="title"
id="user-pwdpolicy">5.7. Setting an Individual Password
Policy</h2></div></div></div><div class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="users.html" title="Chapter 6. Identity: Managing Users and User
Groups" /><link rel="prev" href="user-groups.html"
title="6.8. Creating User Groups" /><link rel="next"
href="searching.html" title="6.10. Searching for Users and Groups"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="user-groups.html"><strong>Prev</strong></a></li><li
class="next"><a
accesskey="n"
href="searching.html"><strong>Next</strong></a></li></ul><div
class="section" id="user-pwdpolicy"><div
class="titlepage"><div><div><h2 class="title"
id="user-pwdpolicy">6.9. Setting an Individual Password
Policy</h2></div></div></div><div class="para">
FreeIPA has a default policy of never exposing passwords, even hashed passwords, to
clients, in the interests of system security. This policy applies even if you still rely
on NIS server functionality to some degree, for example, as a result of a full or partial
migration from NIS to FreeIPA. FreeIPA normally expects a switch to Kerberos for
authentication, but this may not always be possible.
</div><div class="para">
The FreeIPA password policy supports the specification of various password attributes
that help to ensure the security of your system, and also that of individual user
accounts. You can specify the password lifetime, length, and the types of characters
required, all as part of the FreeIPA password policy.
@@ -17,67 +17,67 @@
Because the password policy is enforced by the <abbr
class="abbrev">KDC</abbr>, any further policy specifications that you
implement as part of the Directory Server password policy will not be visible in FreeIPA,
and neither will they be enforced.
</div></li><li class="listitem"><div
class="para">
Different rules apply to changing passwords, depending on your login credentials.
- </div></li></ul></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1. Changing
Passwords as the Directory Manager</h3></div></div></div><div
class="para">
+ </div></li></ul></div></div></div><div
class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1. Changing
Passwords as the Directory Manager</h3></div></div></div><div
class="para">
If you reset a password using <em class="parameter
entry"><code>cn=Directory Manager</code></em> credentials (only
possible if you manually perform an <code
class="systemitem">LDAP</code> password change operation) then you
override any checks and the password is set to whatever you specify. The FreeIPA password
policy is ignored.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2. Changing
Passwords as the FreeIPA
Administrator</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2. Changing
Passwords as the FreeIPA
Administrator</h3></div></div></div><div
class="para">
If you reset a password using <code
class="systemitem">admin</code> credentials (that is, as part of the
<code class="systemitem">admins</code> group), the FreeIPA password
policy is ignored, but the expiration date is set to "now". This means that the
user is forced to change the password at login time, and the password policy is then
enforced. This is also true for users who have had password changing rights delegated to
them.
</div><div class="para">
Consequently, the FreeIPA Administrator can easily create users with
"default" passwords and reset user's passwords, but will not know the
actual, final password entered by the user. Further, any password that is transmitted from
the FreeIPA Administrator to the user, even over insecure channels, is a temporary
password. Consequently, it is not critical if it is accidentally disclosed, provided that
the user promptly resets it.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3. Changing
Passwords as a Regular User</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3. Changing
Passwords as a Regular User</h3></div></div></div><div
class="para">
If you are logged in as a regular user (that is, you are not part of the <code
class="systemitem">admins</code> group, or possessed of any elevated
privileges), then you can only change your own password, and these changes are always
subject to the FreeIPA password policy.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4. Editing
the Password Policy</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Editing_the_Password_Policy"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4. Editing the
Password Policy</h3></div></div></div><div
class="para">
You can use either the web interface or the command line to edit the FreeIPA password
policy. However, you can only edit those attributes supported by FreeIPA.
- </div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Editing_the_Password_Policy-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Editing_the_Password_Policy-Using_the_Command_Line">5.7.4.1. Using
the Command Line</h4></div></div></div><div
class="para">
+ </div><div class="section"
id="Editing_the_Password_Policy-Using_the_Command_Line"><div
class="titlepage"><div><div><h4 class="title"
id="Editing_the_Password_Policy-Using_the_Command_Line">6.9.4.1. Using the
Command Line</h4></div></div></div><div
class="para">
Use the <code class="command">ipa pwpolicy-*</code> commands
to create and modify FreeIPA password policies. These commands are provided as part of the
<code class="command">ipa pwpolicy</code> plug-in functionality. The
<code class="command">ipa help pwpolicy</code> command displays the
help page and some examples of using this plug-in.
</div><div class="para">
For example, use the following command to update the minimum global password length
to 10 characters, and to specify that no history of passwords be kept:
</div><div class="para">
- <code class="command"># ipa pwpolicy-mod --minlength=10
--history=0</code>
+ # ipa pwpolicy-mod --minlength=10 --history=0
</div><div class="para">
To display the global password policy:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show</code>
+ # ipa pwpolicy-show
</div><div class="para">
- Refer to <a class="xref"
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">Section 5.7.6,
“Password Policy Attributes”</a> for information on password policy attributes.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">5.7.5. Setting
Different Password Policies for Different User
Groups</h3></div></div></div><div class="para">
+ Refer to <a class="xref"
href="user-pwdpolicy.html#The_IPA_Password_Policy-Password_Policy_Attributes">Section 6.9.6,
“Password Policy Attributes”</a> for information on password policy attributes.
+ </div></div></div><div class="section"
id="The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5. Setting
Different Password Policies for Different User
Groups</h3></div></div></div><div class="para">
The FreeIPA password policy plug-in (<code class="command">ipa
pwpolicy</code>) manages both global and per-group password policies. You can use
this plug-in to display or modify existing password policies to suit the needs of your
environment.
</div><div class="para">
The following examples demonstrate how to display and modify existing password
policies.
</div><div class="para">
To display the password policy for a specific group:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show --group=<em
class="replaceable"><code>example</code></em></code>
+ # ipa pwpolicy-show --group=<em
class="replaceable"><code>example</code></em>
</div><div class="para">
To add a new policy for a specific group:
</div><div class="para">
- <code class="command"># ipa pwpolicy-add --minlife=10 --priority=10
--group=<em
class="replaceable"><code>example</code></em></code>
+ # ipa pwpolicy-add --minlife=10 --priority=10 --group=<em
class="replaceable"><code>example</code></em>
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
When adding or modifying the password policy for a group, that group needs to
already exist but does not need to contain any members.
</div></div></div><div class="para">
To remove an attribute from a password policy, use the <code
class="command">ipa pwpolicy-mod</code> command to set an empty value
for the required attribute to delete it.
</div><div class="para">
The following example illustrates adding a password policy with three specific
attributes to an existing group:
- </div><pre class="screen"><code
class="command"># ipa pwpolicy-add --minlife=1 --maxlife=5 --priority=1
g1</code>
+ </div><pre class="screen"># ipa pwpolicy-add --minlife=1
--maxlife=5 --priority=1 g1
Group: g1
Max lifetime (days): 5
Min lifetime (hours): 1
Priority: 1
</pre><div class="para">
The following command uses the <code class="command">ipa
pwdpolicy-mod</code> command to set an empty value to the <em
class="parameter"><code>minlife</code></em> attribute:
- </div><pre class="screen"><code
class="command"># ipa pwpolicy-mod --minlife= g1</code>
+ </div><pre class="screen"># ipa pwpolicy-mod --minlife= g1
Group: g1
Max lifetime (days): 5</pre><div class="para">
To display the policy for a given user:
</div><div class="para">
- <code class="command"># ipa pwpolicy-show --user=tuser1</code>
+ # ipa pwpolicy-show --user=tuser1
</div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
Password policies are not cumulative. That is, you cannot override a single setting
in a policy and let it fall back to the global policy on all the others; it is all or
nothing.
- </div></div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies"><div
class="titlepage"><div><div><h4 class="title"
id="sect-Enterprise_Identity_Management_Guide-Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies">5.7.5.1. Setting
the Priority of Password Policies</h4></div></div></div><div
class="para">
+ </div></div></div><div class="section"
id="Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies"><div
class="titlepage"><div><div><h4 class="title"
id="Setting_Different_Password_Policies_for_Different_User_Groups-Setting_the_Priority_of_Password_Policies">6.9.5.1. Setting
the Priority of Password Policies</h4></div></div></div><div
class="para">
The following example demonstrates the use of password priority, where a user and
two groups are created, with a separate password policy for each group. Each policy has a
different priority, and the user is added to both groups.
- </div><div class="procedure"><ol
class="1"><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_a_user"><h5
class="formalpara">Adding a user</h5>
+ </div><div class="procedure"><ol
class="1"><li class="step"><div
class="formalpara"
id="Setting_the_Priority_of_Password_Policies-Adding_a_user"><h5
class="formalpara">Adding a user</h5>
Use the <code class="command">ipa user-add</code> command
to add a new user:
</div><pre class="screen">
-<code class="command"># ipa user-add --first=Tim --last=User
tuser1</code>
+# ipa user-add --first=Tim --last=User tuser1
---------
Added user "tuser1"
---------
@@ -88,10 +88,10 @@ Added user "tuser1"
GECOS field: tuser1
Login shell: /bin/sh
Kerberos principal: tuser1(a)IPANETWORK.ORG
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_the_user_groups"><h5
class="formalpara">Adding the user groups</h5>
- Use the <code class="command">ipa group-add</code> command
to add two new groups:
- </div><pre class="screen">
-<code class="command"># ipa group-add --desc=Group1 g1</code>
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa group-add</code> command
to add two new groups:
+ </div><pre class="screen">
+# ipa group-add --desc=Group1 g1
----------
Added group "g1"
----------
@@ -104,10 +104,10 @@ Added group "g2"
----------
Group name: g2
Description: Group2
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Specifying_the_password_policies"><h5
class="formalpara">Specifying the password policies</h5>
- Use the <code class="command">ipa pwpolicy-add</code>
command to specify different policies for each group:
- </div><pre class="screen">
-<code class="command"># ipa pwpolicy-add --minlife=10 --priority=10
--group=g1</code>
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa pwpolicy-add</code>
command to specify different policies for each group:
+ </div><pre class="screen">
+# ipa pwpolicy-add --minlife=10 --priority=10 --group=g1
---------------------------
Added policy for group "g1"
---------------------------
@@ -120,12 +120,12 @@ Added policy for group "g2"
---------------------------
Group: g2
Minimum lifetime (in hours): 20
-</pre></li><li class="step"><div
class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Adding_the_user_to_the_groups"><h5
class="formalpara">Adding the user to the groups</h5>
- Use the <code class="command">ipa group-add-member</code>
command to add the user that you previously created to each group. You can then use the
<code class="command">ipa pwpolicy-show</code> command to display
the policy that is in effect for the user.
- </div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
+</pre></li><li class="step"><div
class="para">
+ Use the <code class="command">ipa group-add-member</code>
command to add the user that you previously created to each group. You can then use the
<code class="command">ipa pwpolicy-show</code> command to display
the policy that is in effect for the user.
+ </div><div class="procedure"><ol
class="1"><li class="step"><div
class="para">
Add the user to the <code class="systemitem">g1</code>
group and then check the policy:
</div><pre class="screen">
-<code class="command">$ ipa group-add-member --users=tuser1
g1</code>
+$ ipa group-add-member --users=tuser1 g1
Group name: g1
Description: Group1
Member Users: tuser1
@@ -141,7 +141,7 @@ $ ipa pwpolicy-show --user=tuser1
</pre></li><li class="step"><div
class="para">
Add the user to the <code class="systemitem">g2</code>
group and recheck the policy:
</div><pre class="screen">
-<code class="command">$ ipa group-add-member --users=tuser1
g2</code>
+$ ipa group-add-member --users=tuser1 g2
Group name: g2
Description: Group2
Member Users: tuser1
@@ -151,28 +151,26 @@ $ ipa pwpolicy-show --user=tuser1
Number of members added 1
-------------------------
-<code class="command">$ ipa pwpolicy-show --user=tuser1</code>
+$ ipa pwpolicy-show --user=tuser1
Group: g1
Minimum lifetime (in hours): 10
</pre><div class="para">
Notice that the password policy that is in effect for the user <code
class="systemitem">tuser1</code> is taken from the <code
class="systemitem">g1</code> group, because it has a higher priority.
- </div></li></ol></div></li><li
class="step"><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Setting_the_Priority_of_Password_Policies-Removing_the_user_from_a_single_group"><h5
class="formalpara">Removing the user from a single group</h5>
- Finally, use the <code class="command">ipa
group-remove-member</code> command to remove the user from the <code
class="systemitem">g1</code> group to demonstrate that they still have
a custom policy.
- </div><pre class="screen">
-<code class="command">$ ipa group-remove-member --users=tuser1
g1</code>
+ </div></li></ol></div></li><li
class="step"><div class="para">
+ Finally, use the <code class="command">ipa
group-remove-member</code> command to remove the user from the <code
class="systemitem">g1</code> group to demonstrate that they still have
a custom policy.
+ </div><pre class="screen">
+$ ipa group-remove-member --users=tuser1 g1
---------------------------
Number of members removed 1
---------------------------
Users:
Groups:
-<code class="command">$ ipa pwpolicy-show --user=tuser1</code>
+$ ipa pwpolicy-show --user=tuser1
Group: g2
Minimum lifetime (in hours): 20
-</pre></li></ol></div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
- You can use the <code class="command">ipa help
<topic></code> command to display a list of the commands available for
working with various topics.
- </div></div></div></div></div><div
class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6. Password
Policy Attributes</h3></div></div></div><div
class="para">
- The password policy is enforced by the <code class="systemitem
module">pwd_extop</code> SLAPI plug-in. FreeIPA 2.0 supports the following
password policy attributes:
+</pre></li></ol></div></div></div><div
class="section"
id="The_IPA_Password_Policy-Password_Policy_Attributes"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6. Password
Policy Attributes</h3></div></div></div><div
class="para">
+ The password policy is enforced by the <code class="systemitem
module">pwd_extop</code> SLAPI plug-in. FreeIPA supports the following
password policy attributes:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
<span class="guilabel"><strong>Minimum Password
Lifetime</strong></span> (<span
class="property">krbMinPwdLife</span>): The minimum period of time, in
hours, that a user's password must be in effect before the user can change it. The
default value is one hour.
</div><div class="para">
@@ -182,9 +180,7 @@ Number of members removed 1
</div></li><li class="listitem"><div
class="para">
<span class="guilabel"><strong>Minimum Number of Character
Classes</strong></span> (<span
class="property">krbPwdMinDiffChars</span>): The minimum number of
different classes, or types, of character that must exist in a password before it is
considered valid. The default value is 0 (zero).
</div><div class="para">
- For example, setting <span
class="property">krbPwdMinDiffChars</span> = 3 requires that passwords
contain at least one character from three of the supported classes.
- </div><div class="para">
- The following character classes are supported:
+ For example, setting <span class="property">krbPwdMinDiffChars =
3</span> requires that passwords contain at least one character from three of the
supported classes. There are six supported character classes:
</div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Upper-case characters
</div></li><li class="listitem"><div
class="para">
@@ -194,10 +190,8 @@ Number of members removed 1
</div></li><li class="listitem"><div
class="para">
Special characters (for example, punctuation)
</div></li><li class="listitem"><div
class="para">
- 8-bit characters (characters whose decimal code starts at 128 or below, for
example, Â, Ã, and Ä)
- </div></li></ul></div><div class="para">
- The following special classes also exist:
- </div><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ 8-bit characters (characters whose decimal code starts at 128 or below)
+ </div></li><li class="listitem"><div
class="para">
Number of repeated characters
</div><div class="para">
This weights in the opposite direction, so that if you have too many repeated
characters you will not meet the quorum to satisfy the "level" expressed by
<span class="property">krbPwdMinDiffChars</span>.
@@ -222,23 +216,23 @@ Number of members removed 1
<span class="guilabel"><strong>Lockout
Time</strong></span> (<span
class="property">lockouttime</span>): Specifies the period (in seconds)
for which a lockout is enforced.
</div></li></ul></div><div class="para">
Refer to the <code class="command">ipa help pwpolicy-add</code>
help page for more information on configuring the FreeIPA password policy.
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7. Notifying
Users of Password Expiration</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7. Notifying
Users of Password Expiration</h3></div></div></div><div
class="para">
If it is installed and configured, SSSD can use the PAM module to send messages to
users, warning them about imminent password expiration. Fedora has a <code
class="option">pam_pwd_expiration_warning</code> option to fine tune
this feature. You can also manually search for passwords that are due to expire by a
specified date. For example, to retrieve all user entries whose passwords are due to
expire before March 1st, 2011, run the following command:
</div><div class="para">
-<pre class="screen"><code class="command">$ ldapsearch -Y
GSSAPI -b "cn=users,cn=accounts,dc=example,dc=com"</code> <code
class="command">'(krbPasswordExpiration<=20110301000000Z)'</code></pre>
+<pre class="screen">$ ldapsearch -Y GSSAPI -b
"cn=users,cn=accounts,dc=example,dc=com"
'(krbPasswordExpiration<=20110301000000Z)'</pre>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8. Using
SSH for Password Authentication</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Using_SSH_for_Password_Authentication"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8. Using
SSH for Password Authentication</h3></div></div></div><div
class="para">
If you use password authentication (no GSSAPI authentication, and no ticket on the
client) with a new user, or with a user whose password has expired, you need to enable
Challenge-Response authentication. Otherwise, the password changing dialog box will not
display.
</div><div class="para">
This is not enabled by default because some older <code
class="systemitem">SSL</code> clients may not support
Challenge-Response authentication, and it is needed only if the password has expired.
- </div><div class="formalpara"
id="form-Enterprise_Identity_Management_Guide-Using_SSH_for_Password_Authentication-To_enable_Challenge_Response_authentication"><h5
class="formalpara">To enable Challenge-Response authentication:</h5>
+ </div><div class="formalpara"
id="Using_SSH_for_Password_Authentication-To_enable_Challenge_Response_authentication"><h5
class="formalpara">To enable Challenge-Response authentication:</h5>
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
Set <em
class="parameter"><code>ChallengeResponseAuthentication</code></em>
to <code class="literal">yes</code> in the <code
class="filename">/etc/ssh/sshd_config</code> file.
</div></li></ul></div>
- </div></div><div class="section"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins"><div
class="titlepage"><div><div><h3 class="title"
id="sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9. Using
Local Logins</h3></div></div></div><div
class="para">
+ </div></div><div class="section"
id="The_IPA_Password_Policy-Using_Local_Logins"><div
class="titlepage"><div><div><h3 class="title"
id="The_IPA_Password_Policy-Using_Local_Logins">6.9.9. Using Local
Logins</h3></div></div></div><div class="para">
User identity and authentication is managed by SSSD in recent versions of Fedora. The
default settings specified by the FreeIPA installation script include timeout settings
that still allow local logins to succeed if the client cannot access the FreeIPA server.
These settings are specified in the <code
class="filename">/etc/sssd/sssd.conf</code> file, and can be tuned to
suit your particular deployment. Further, if SSSD's password caching feature is
enabled, a user can log in even if the FreeIPA server is down. A typical deployment would
normally include two or more servers for redundancy, and so this would not normally be a
problem.
</div><div class="warning"><div
class="admonition_header"><h2>Warning</h2></div><div
class="admonition"><div class="para">
These timeout settings are only set on operating systems that support the FreeIPA
installation script, meaning Fedora 15 and later. On other versions, specify these values
manually or it may be impossible to log into the host if no FreeIPA servers are
available.
- </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="user-groups.html"><strong>Prev</strong>5.6. Creating User
Groups</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="searching.html"><strong>Next</strong>5.8. Searching for
Users and Groups</a></li></ul></body></html>
+ </div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="user-groups.html"><strong>Prev</strong>6.8. Creating User
Groups</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="searching.html"><strong>Next</strong>6.10. Searching for
Users and Groups</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/users.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/users.html
index c157138..0df373e 100644
--- a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/users.html
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/users.html
@@ -1,13 +1,13 @@
<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 5. Identity: Managing Users and User
Groups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.3"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>Chapter 6. Identity: Managing Users and User
Groups</title><link rel="stylesheet"
href="Common_Content/css/default.css" type="text/css" /><link
rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
addID('Fedora');
addID('Fedora.15');
addID('Fedora.15.books');
addID('Fedora.15.FreeIPA_Guide');
- </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev" href="uninstalling-clients.html"
title="4.7. Uninstalling a FreeIPA Client" /><link rel="next"
href="adding-users.html" title="5.2. Adding Users"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="uninstalling-clients.html"><strong>Prev</strong></a></li><li
class="next"><a accessk
ey="n"
href="adding-users.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="users"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 5. Identity: Managing Users and User
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="users.html#home-directories">5.1. Managing User Home
Directories</a></span></dt><dt><span
class="section"><a href="adding-users.html">5.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="editing-users.html">5.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html">5.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html#sect-Enterprise_Identity_Management_Guide-Activating_and_D
eactivating_User_Accounts-Using_the_Command_Line">5.4.1. Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html">5.5.
Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Users-Deleting_IPA_Users.html#sect-Enterprise_Identity_Management_Guide-Deleting_IPA_Users-Using_the_Command_Line">5.5.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="user-groups.html">5.6. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Creating_IPA_Groups">5.6.1.
Creating FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Editing_IPA_Groups">5.6.2.
Editing FreeIPA
Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#sect-Enterprise_Identity_Management_Guide-Configuring_IPA_Groups-Deleting_IPA_Groups">5.6.3.
Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="user-pwdpolicy.html">5.7. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">5.7.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">5.7.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">5.7.3.
Changing Password
s as a Regular User</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Editing_the_Password_Policy">5.7.4.
Editing the Password Policy</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">5.7.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Password_Policy_Attributes">5.7.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">5.7.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a href="user-pwdpolicy.html#sect-Enterp
rise_Identity_Management_Guide-The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">5.7.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#sect-Enterprise_Identity_Management_Guide-The_IPA_Password_Policy-Using_Local_Logins">5.7.9.
Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="searching.html">5.8. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="searching.html#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Users">5.8.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="searching.html#sect-Enterprise_Identity_Management_Guide-Searching_for_Users_and_Groups-Searching_for_Groups">5.8.2.
Searching for
Groups</a></span></dt></dl></dd></dl></div><div
class="section" id="home-directories"><div
class="titlepage"><div><div><h2 class="title"
id="home-directories">5.1. Managing User Ho
me Directories</h2></div></div></div><div
class="para">
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="index.html" title="FreeIPA: Identity/Policy Management"
/><link rel="prev"
href="General_Troubleshooting_Tips-Client_Problems.html" title="5.6. Client
Problems" /><link rel="next" href="adding-users.html"
title="6.2. Adding Users" /></head><body class="toc_embeded
"><div id="tocdiv" class="toc"><iframe
id="tocframe" class="toc" src="../../../../toc.html">This
is an iframe, to view it upgrade your browser or enable iframe
display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="General_Troubleshooting_Tips-Client_Problems.html"><strong>Prev</strong></
a></li><li class="next"><a accesskey="n"
href="adding-users.html"><strong>Next</strong></a></li></ul><div
xml:lang="en-US" class="chapter" id="users"
lang="en-US"><div
class="titlepage"><div><div><h2
class="title">Chapter 6. Identity: Managing Users and User
Groups</h2></div></div></div><div
class="toc"><dl><dt><span class="section"><a
href="users.html#home-directories">6.1. Managing User Home
Directories</a></span></dt><dt><span
class="section"><a href="adding-users.html">6.2. Adding
Users</a></span></dt><dt><span
class="section"><a href="editing-users.html">6.3. Editing
Users</a></span></dt><dt><span
class="section"><a
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html">6.4.
Activating and Deactivating User
Accounts</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_IPA_Users-Activating_and_Deactivating_User_Accounts.html#Activating_and_Deactivating_User_Accounts-Using_the_Command_Line">6.4.1.
Using the Command Line</a></span></
dt></dl></dd><dt><span class="section"><a
href="Configuring_IPA_Users-Specifying_Default_User_Settings.html">6.5.
Specifying Default User Settings</a></span></dt><dt><span
class="section"><a href="search-limits.html">6.6. Setting
Default Search Limits</a></span></dt><dt><span
class="section"><a
href="Configuring_IPA_Users-Deleting_IPA_Users.html">6.7. Deleting FreeIPA
Users</a></span></dt><dd><dl><dt><span
class="section"><a
href="Configuring_IPA_Users-Deleting_IPA_Users.html#Deleting_IPA_Users-Using_the_Command_Line">6.7.1.
Using the Command
Line</a></span></dt></dl></dd><dt><span
class="section"><a href="user-groups.html">6.8. Creating User
Groups</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-groups.html#Configuring_IPA_Groups-Creating_IPA_Groups">6.8.1.
Creating FreeIPA Groups</a></span></dt><dt><span
class="section"><a
href="user-groups.html#Configuring_IPA_Groups-Editing_IPA_Groups">6.8.2.
Editing FreeIPA Groups</a></span></dt><dt><span
class="section">
<a
href="user-groups.html#Configuring_IPA_Groups-Deleting_IPA_Groups">6.8.3.
Deleting FreeIPA
Groups</a></span></dt></dl></dd><dt><span
class="section"><a href="user-pwdpolicy.html">6.9. Setting an
Individual Password
Policy</a></span></dt><dd><dl><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_the_Directory_Manager">6.9.1.
Changing Passwords as the Directory
Manager</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_the_IPA_Administrator">6.9.2.
Changing Passwords as the FreeIPA
Administrator</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Changing_Passwords_as_a_Regular_User">6.9.3.
Changing Passwords as a Regular User</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Editing_the_Password_Policy">6.9.4.
Editing the Password Policy</a></span></dt><dt><span
class="sectio
n"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Setting_Different_Password_Policies_for_Different_User_Groups">6.9.5.
Setting Different Password Policies for Different User
Groups</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Password_Policy_Attributes">6.9.6.
Password Policy Attributes</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Notifying_Users_of_Password_Expiration">6.9.7.
Notifying Users of Password Expiration</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Using_SSH_for_Password_Authentication">6.9.8.
Using SSH for Password Authentication</a></span></dt><dt><span
class="section"><a
href="user-pwdpolicy.html#The_IPA_Password_Policy-Using_Local_Logins">6.9.9.
Using Local
Logins</a></span></dt></dl></dd><dt><span
class="section"><a href="searching.html">6.10. Searching for
Users and Groups</a></span></dt><dd><dl><dt><span
c
lass="section"><a
href="searching.html#Searching_for_Users_and_Groups-Searching_for_Users">6.10.1.
Searching for Users</a></span></dt><dt><span
class="section"><a
href="searching.html#Searching_for_Users_and_Groups-Searching_for_Groups">6.10.2.
Searching for
Groups</a></span></dt></dl></dd></dl></div><div
class="section" id="home-directories"><div
class="titlepage"><div><div><h2 class="title"
id="home-directories">6.1. Managing User Home
Directories</h2></div></div></div><div
class="para">
FreeIPA, as part of managing users, can manage user home directories. However, the
FreeIPA server has expectations about
<div class="itemizedlist"><ul><li
class="listitem"><div class="para">
The default prefix for users' home directories is <code
class="filename">/home</code>.
@@ -23,4 +23,4 @@
If a suitable directory and mechanism are not available for the creation of home
directories, users may not be able to log in.
</div></li></ul></div>
- </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="uninstalling-clients.html"><strong>Prev</strong>4.7. Uninstalling
a FreeIPA Client</a></li><li class="up"><a
accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="adding-users.html"><strong>Next</strong>5.2. Adding
Users</a></li></ul></body></html>
+ </div></div></div><ul class="docnav"><li
class="previous"><a accesskey="p"
href="General_Troubleshooting_Tips-Client_Problems.html"><strong>Prev</strong>5.6. Client
Problems</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="adding-users.html"><strong>Next</strong>6.2. Adding
Users</a></li></ul></body></html>
diff --git a/public_html/en-US/Fedora/15/html/FreeIPA_Guide/using-the-ui.html
b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/using-the-ui.html
new file mode 100644
index 0000000..2fc2c3c
--- /dev/null
+++ b/public_html/en-US/Fedora/15/html/FreeIPA_Guide/using-the-ui.html
@@ -0,0 +1,144 @@
+<?xml version="1.0" encoding="UTF-8"
standalone="no"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html
xmlns="http://www.w3.org/1999/xhtml"><head><meta
http-equiv="Content-Type" content="text/html; charset=UTF-8"
/><title>4.2. Using the FreeIPA UI</title><link
rel="stylesheet" href="Common_Content/css/default.css"
type="text/css" /><link rel="stylesheet" media="print"
href="Common_Content/css/print.css" type="text/css" /><meta
name="generator" content="publican 2.5" /><meta
name="package" content="Fedora-FreeIPA_Guide-15-en-US-0.1-0.0.5"
/><script type="text/javascript"
src="../../../../../toc.js"></script><script
type="text/javascript">
+ addID('Fedora');
+
+ addID('Fedora.15');
+
+ addID('Fedora.15.books');
+ addID('Fedora.15.FreeIPA_Guide');
+ </script><link rel="home" href="index.html"
title="FreeIPA: Identity/Policy Management" /><link rel="up"
href="basic-usage.html" title="Chapter 4. Basic UI Usage"
/><link rel="prev" href="basic-usage.html"
title="Chapter 4. Basic UI Usage" /><link rel="next"
href="switching-users.html" title="4.3. Switching Users"
/></head><body class="toc_embeded "><div id="tocdiv"
class="toc"><iframe id="tocframe" class="toc"
src="../../../../toc.html">This is an iframe, to view it upgrade your browser
or enable iframe display.</iframe></div><p id="title"><a
class="left" href="http://www.fedoraproject.org"><img
src="Common_Content/images/image_left.png" alt="Product Site"
/></a><a class="right"
href="http://docs.fedoraproject.org"><img
src="Common_Content/images/image_right.png" alt="Documentation Site"
/></a></p><ul class="docnav"><li
class="previous"><a accesskey="p"
href="basic-usage.html"><strong>Prev</strong></a></li><li
class="next"><a accesskey="n" href="switching
-users.html"><strong>Next</strong></a></li></ul><div
class="section" id="using-the-ui"><div
class="titlepage"><div><div><h2 class="title"
id="using-the-ui">4.2. Using the FreeIPA
UI</h2></div></div></div><div class="section"
id="config-browser"><div
class="titlepage"><div><div><h3 class="title"
id="config-browser">4.2.1. Configuring the
Browser</h3></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div><div class="para">
+ Firefox can use your Kerberos credentials for authentication, but you need to specify
which domains to communicate with, and using which attributes.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Open Firefox, and type "about:config" in the <span
class="guilabel"><strong>Address Bar</strong></span>.
+ </div></li><li class="listitem"><div
class="para">
+ In the <span
class="guilabel"><strong>Search</strong></span> field, type
"negotiate".
+ </div></li><li class="listitem"><div
class="para">
+ Enter the domain names, including the preceding period (.):
+<pre class="programlisting">network.negotiate-auth.trusted-uris
.example.com
+network.negotiate-auth.delegation-uris .example.com
+network.negotiate-auth.using-native-gsslib true
+</pre>
+
+ </div><div class="para">
+ If you are configuring Firefox on Microsoft Windows, make the following changes
instead:
+<pre class="programlisting">network.negotiate-auth.trusted-uris
.example.com
+network.auth.use-sspi false
+network.negotiate-auth.delegation-uris .example.com
+</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ In Firefox, navigate to the FreeIPA server (use the fully-qualified domain name,
for example, <code
class="systemitem">http://ipaserver.example.com</code>). Ensure that
there are no Kerberos authentication errors, and that you can see and interact with the
Web interface.
+ </div></li></ol></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Navigate to <code
class="uri">http://ipa.example.com/ipa/config/ca.crt</cod...
+ </div></li><li class="listitem"><div
class="para">
+ Select at least the first (<span
class="guilabel"><strong>Trust this CA to identify web
sites</strong></span>) and third (<span
class="guilabel"><strong>Trust this CA to identify software
developers</strong></span>) check boxes.
+ </div></li><li class="listitem"><div
class="para">
+ Click <span
class="guibutton"><strong>OK</strong></span>.
+ </div><div class="informalfigure"><div
class="mediaobject"><img src="images/Accept_CA_No_Exception.png"
width="600"
/></div></div></li></ol></div><div
class="para">
+ Rather than permanently adding an exception, you can leave all boxes unchecked and
click <span class="guibutton"><strong>OK</strong></span>
to proceed. At this point the Kerberos authentication will fail, so you need to click the
associated link and then click <span
class="guibutton"><strong>Import the FreeIPA Certificate
Authority</strong></span>.
+ </div><div class="formalpara"
id="Using_the_Browser_Interface-Configuring_Kerberos_Authentication"><h5
class="formalpara">Configuring Kerberos Authentication</h5>
+ Use the following procedure to configure your browser for Kerberos authentication
against your newly-installed domain.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Type "about:config" in the address bar. Accept that you will be careful.
+ </div></li><li class="listitem"><div
class="para">
+ In the Search field, type "negotiate".
+ </div></li><li class="listitem"><div
class="para">
+ Ensure the following lines reflect your setup. Replace "example.com" with
your own FreeIPA server's domain, including the preceding period (.):
+ <div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ network.negotiate-auth.trusted-uris .example.com
+ </div></li><li class="listitem"><div
class="para">
+ network.negotiate-auth.delegation-uris .example.com
+ </div></li><li class="listitem"><div
class="para">
+ network.negotiate-auth.using-native-gsslib true
+ </div></li></ul></div>
+
+ </div></li></ol></div><div class="formalpara"
id="Using_the_Browser_Interface-Displaying_the_IPA_Homepage"><h5
class="formalpara">Displaying the FreeIPA Homepage</h5>
+ Your browser should now be fully configured and ready to connect to the FreeIPA
server. In the address bar, type “localhost” or the name of the host. The FreeIPA homepage
should now display. Explore this page and the links it provides, familiarize yourself with
the available options, and file a bug whenever you find something is not working.
+ </div><div class="section"
id="Configuring_Your_Local_Browser-Troubleshooting"><div
class="titlepage"><div><div><h4 class="title"
id="Configuring_Your_Local_Browser-Troubleshooting">4.2.1.1. Troubleshooting</h4></div></div></div><div
class="para">
+ If you have followed the configuration steps and Negotiate authentication is not
working, you can turn on verbose logging of the authentication process, and potentially
find the cause of the problem.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Exit the browser.
+ </div></li><li class="listitem"><div
class="para">
+ Open a shell, and run the following commands:
+<pre class="screen">export NSPR_LOG_MODULES=negotiateauth:5
+export NSPR_LOG_FILE=/tmp/moz.log
+</pre>
+
+ </div><div class="para">
+ This will enable verbose logging, and all information will be logged to <code
class="filename">/tmp/moz.log</code>, which may give a clue to the
problem. Restart your browser from that shell, and visit the website you were unable to
authenticate to earlier.
+ </div></li></ol></div><div class="formalpara"
id="Troubleshooting-Analyzing_the_Symptoms"><h5
class="formalpara">Analyzing the Symptoms</h5>
+ Refer to the following symptoms and possible solutions to help resolve issues with
Negotiate authentication.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ If you receive output similar to the following:
+<pre class="screen">-1208550944[90039d0]: entering
nsNegotiateAuth::GetNextToken()
+-1208550944[90039d0]: gss_init_sec_context() failed: Miscellaneous failure
+No credentials cache found
+</pre>
+ it means that you do not have any Kerberos tickets, and need to run <code
class="command">kinit</code>.
+ </div></li><li class="listitem"><div
class="para">
+ If you can run <code class="command">kinit</code>
successfully but you are unable to authenticate, and the log file contains output similar
to the following:
+<pre class="screen">-1208994096[8d683d8]: entering
nsAuthGSSAPI::GetNextToken()
+-1208994096[8d683d8]: gss_init_sec_context() failed: Miscellaneous failure
+Server not found in Kerberos database
+</pre>
+ it generally indicates a Kerberos configuration problem. Ensure you have the
following in the [domain_realm] section of the <code
class="filename">/etc/krb5.conf</code> file:
+<pre
class="screen">.example.com =
EXAMPLE.COM
+example.com =
EXAMPLE.COM
+</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ If nothing appears in the log file it is possible that you are behind a proxy, and
that proxy is removing the HTTP headers required for Negotiate authentication. Try to
connect to the server using HTTPS instead, which allows the request to pass through
unmodified. Then proceed to debug using the log file, as described above.
+ </div></li></ol></div></div></div><div
class="section" id="logging-in"><div
class="titlepage"><div><div><h3 class="title"
id="logging-in">4.2.2. Logging into the FreeIPA
UI</h3></div></div></div><div class="para">
+ XXXXXXXXXXX FIX ME XXXXXXXX
+ </div><div class="para">
+ To be able to perform any administrative task you need to authenticate to the server.
During the configuration step you were prompted to create two users. The first of these,
Directory Manager, is the superuser, used to perform rare, low-level tasks. The second
user, admin, is used to perform normal administrative activities.
+ </div><div class="para">
+ To authenticate as the admin user:
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Open a new terminal window. This is to ensure that all default aspects of the
environment (especially paths) are set correctly.
+ </div></li><li class="listitem"><div
class="para">
+ In this window, type <code class="command">kinit
admin</code>.
+ </div></li><li class="listitem"><div
class="para">
+ When you are prompted to enter a password, use the password that you specified
during the configuration step for the admin user.
+ </div></li></ol></div><div class="para">
+ As a result of this operation you will acquire what is known as a Kerberos <span
class="emphasis"><em>ticket</em></span>. You can use the
<code class="command">klist</code> command to inspect the details of
the ticket that you have acquired.
+ </div><div class="para">
+ You can now authenticate using the newly-created user and temporary password. Type
<code class="command">kinit</code> <em
class="replaceable"><code>userLogin</code></em> to log in
to FreeIPA. This will prompt you for a password and then immediately request a password
change.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ The Kerberos client libraries used by the <code
class="command">kinit</code> utility have some limitations. One of
these limitations is the fact that the on-disc ticket storage is overwritten with any new
invocation of <code class="command">kinit</code>. This means that if
you authenticated as admin, then added aa new user, set the password and then tried to
authenticate as that user, the administrator's ticket would be lost. To prevent this
from happening, a special environment variable, <code
class="varname">KRB5CCNAME</code>, can be used. This allows you to keep
credential caches separate in different shells. Refer to the <code
class="command">kinit</code> man page for more information.
+ </div></div></div><div class="para">
+ You can browse the FreeIPA man pages and help system to explore other FreeIPA
commands. Please take some time to become familiar with the ways other FreeIPA objects can
be created and modified.
+ </div></div><div class="section"
id="Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System"><div
class="titlepage"><div><div><h3 class="title"
id="Configuring_a_Browser_to_Work_with_IPA-Using_a_Browser_on_Another_System">4.2.3. Using
a Browser on Another System</h3></div></div></div><div
class="para">
+ If you are unable, or prefer not, to update <code
class="filename">/etc/krb5.conf</code> with the FreeIPA realm
information, you can create another copy and set an appropriate environment variable. You
can then run <code class="command">kinit</code> as before and use
your browser to connect to FreeIPA. This is especially useful if you need to manage
multiple realms, and if you have overlapping domains.
+ </div><div class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="para">
+ This procedure is not necessary if you use <code
class="command">ipa-client-install</code> to set up your client.
+ </div></div></div><div
class="orderedlist"><ol><li class="listitem"><div
class="para">
+ Copy the <code class="filename">/etc/krb5.conf</code> file
from the FreeIPA server to the client system. Do not overwrite the existing <code
class="filename">krb5.conf</code> file. Run the following command on
the FreeIPA server:
+ </div><div class="para">
+
+<pre class="screen"> # scp /etc/krb5.conf
root@ipaclient:/etc/krb5_ipa.conf</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ On the FreeIPA client, open a shell and run the following commands:
+<pre class="screen">$ export KRB5_CONFIG=/etc/krb5_ipa.conf
+$ kinit user(a)EXAMPLE.COM
+$ /usr/bin/firefox</pre>
+
+ </div></li><li class="listitem"><div
class="para">
+ Configure and test Firefox.
+ </div></li></ol></div></div><div
class="section"
id="Enabling_UsernamePassword_Authentication_in_Your_Browser"><div
class="titlepage"><div><div><h3 class="title"
id="Enabling_UsernamePassword_Authentication_in_Your_Browser">4.2.4. Enabling
Username/Password Authentication in Your
Browser</h3></div></div></div><div class="para">
+ If Kerberos authentication fails, the browser login will also fail, preventing access
to the FreeIPA web interface. You can configure FreeIPA to display a username/password
authentication dialog box if this situation occurs.
+ </div><div class="orderedlist"><ol><li
class="listitem"><div class="para">
+ Edit the <code
class="filename">/etc/httpd/conf.d/ipa.conf</code> file, and change the
<em
class="parameter"><code>KrbMethodK5Passwd</code></em>
attribute from off to on.
+ </div></li><li class="listitem"><div
class="para">
+ Restart the <code class="systemitem">httpd</code> service:
+<pre class="screen"># service httpd restart</pre>
+
+ </div></li></ol></div><div
class="note"><div
class="admonition_header"><h2>Note</h2></div><div
class="admonition"><div class="itemizedlist"><ul><li
class="listitem"><div class="para">
+ You need to perform this procedure on all of the FreeIPA servers in your
deployment.
+ </div></li><li class="listitem"><div
class="para">
+ This change may not be preserved between FreeIPA updates.
+ </div></li></ul></div></div></div></div></div><ul
class="docnav"><li class="previous"><a
accesskey="p"
href="basic-usage.html"><strong>Prev</strong>Chapter 4. Basic UI
Usage</a></li><li class="up"><a accesskey="u"
href="#"><strong>Up</strong></a></li><li
class="home"><a accesskey="h"
href="index.html"><strong>Home</strong></a></li><li
class="next"><a accesskey="n"
href="switching-users.html"><strong>Next</strong>4.3. Switching
Users</a></li></ul></body></html>
diff --git
a/public_html/en-US/Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf
b/public_html/en-US/Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf
index 172f9d4..89706d9 100644
Binary files
a/public_html/en-US/Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf and
b/public_html/en-US/Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf differ
diff --git a/public_html/en-US/opds-Fedora.xml b/public_html/en-US/opds-Fedora.xml
index 0bacbe4..12dd401 100644
--- a/public_html/en-US/opds-Fedora.xml
+++ b/public_html/en-US/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/en-US/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>en-US</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>en-US</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/en-US/opds-Fedora_Contributor_Documentation.xml
b/public_html/en-US/opds-Fedora_Contributor_Documentation.xml
index 724997d..0b41344 100644
--- a/public_html/en-US/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/en-US/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/en-US/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/en-US/opds-Fedora_Core.xml
b/public_html/en-US/opds-Fedora_Core.xml
index 55031b8..38261ca 100644
--- a/public_html/en-US/opds-Fedora_Core.xml
+++ b/public_html/en-US/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/en-US/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/en-US/opds-Fedora_Draft_Documentation.xml
b/public_html/en-US/opds-Fedora_Draft_Documentation.xml
index 82392c1..37c2eb4 100644
--- a/public_html/en-US/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/en-US/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/en-US/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/en-US/opds.xml b/public_html/en-US/opds.xml
index 82998b1..c2c77cf 100644
--- a/public_html/en-US/opds.xml
+++ b/public_html/en-US/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/en-US/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/en-US/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>en-US</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/en-US/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>en-US</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/en-US/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>en-US</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/en-US/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>en-US</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/en-US/toc.html b/public_html/en-US/toc.html
index 832bd43..d25b38a 100644
--- a/public_html/en-US/toc.html
+++ b/public_html/en-US/toc.html
@@ -101,7 +101,7 @@
<a class="type"
href="./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book
collapsed">
@@ -586,7 +586,7 @@
<a class="type"
href="./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed">
@@ -700,7 +700,7 @@
<a class="type"
href="./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book
collapsed">
@@ -771,7 +771,7 @@
<a class="type"
href="./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/es-ES/opds-Fedora.xml b/public_html/es-ES/opds-Fedora.xml
index 9d1abae..fb0464e 100644
--- a/public_html/es-ES/opds-Fedora.xml
+++ b/public_html/es-ES/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/es-ES/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>es-ES</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -80,7 +80,7 @@
<dc:language>es-ES</dc:language>
<category label="14"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Utilizando Fedora con algún tipo de discapacidad visual, auditiva o
motora
+ <summary>Utilizando Fedora con algún tipo de discapacidad visual, auditiva o
motora
</summary>
<content type="text">Este documento describe algunos de los
dispositivos de hardware, aplicaciones y herramientas existentes para que personas con
discapacidades puedan utilizar una computadora con el sistema operativo
Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/Accessibili...
@@ -118,9 +118,9 @@
<dc:language>es-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Cómo descargar imágenes ISO y crear CDs o DVDs
+ <summary>Cómo descargar imágenes ISO y crear CDs o DVDs
</summary>
- <content type="text">Cómo descargar imágenes ISO y crear CDs o
DVDs</content>
+ <content type="text">Cómo descargar imágenes ISO y crear CDs o
DVDs</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/Burning_ISO...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>es-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Cómo utilizar la imagen viva de Fedora
+ <summary>Cómo utilizar la imagen viva de Fedora
</summary>
- <content type="text">Cómo utilizar la imagen viva de
Fedora</content>
+ <content type="text">Cómo utilizar la imagen viva de
Fedora</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>es-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -213,9 +213,9 @@
<dc:language>es-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Administrando el consumo de energía en Fedora
+ <summary>Administrando el consumo de energÃa en Fedora
</summary>
- <content type="text">Este documento explica cómo administrar
adecuadamente el consumo de energía en sistemas Fedora 14. Las secciones ofrecidas a
continuación describen diferentes técnicas para poder disminuir el consumo de energía (ya
sea en servidores o en portátiles), y cómo cada una de estas técnicas influye en el
rendimiento general de su sistema. Por favor tenga en cuenta que este documento se
encuentra en desarrollo, sujeto a grandes modificaciones, y que se ofrece aquí como un
anticipo. El contenido e instrucciones no deben considerarse como completos y deben
utilizarse con cautela.</content>
+ <content type="text">Este documento explica cómo administrar
adecuadamente el consumo de energÃa en sistemas Fedora 14. Las secciones ofrecidas a
continuación describen diferentes técnicas para poder disminuir el consumo de energÃa
(ya sea en servidores o en portátiles), y cómo cada una de estas técnicas influye en el
rendimiento general de su sistema. Por favor tenga en cuenta que este documento se
encuentra en desarrollo, sujeto a grandes modificaciones, y que se ofrece aquà como un
anticipo. El contenido e instrucciones no deben considerarse como completos y deben
utilizarse con cautela.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -251,9 +251,9 @@
<dc:language>es-ES</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Una guía para la seguridad en Fedora Linux
+ <summary>Una guÃa para la seguridad en Fedora Linux
</summary>
- <content type="text">La Guía de Seguridad en Fedora está diseñada
para asistir a usuarios de Fedora en el proceso de aprendizaje y prácticas de seguridad en
estaciones de trabajo y servidores, para poder así evitar intrusiones locales y remotas,
explotaciones, y actividades maliciosas. Enfocada en Fedora Linux pero detallando
conceptos y técnicas validas para todos los sistemas Linux. La Guía de Seguridad en Fedora
detalla la planificación y describe las herramientas involucradas en la creación de un
entorno de computación seguro, para centros de datos, estaciones de trabajo, o el hogar.
Con un conocimiento administrativo apropiado, vigilancia, y herramientas, los sistemas
ejecutando Linux pueden ser funcionales y al mismo tiempo seguros, frente a los métodos de
intrusión y explotación más comunes.</content>
+ <content type="text">La GuÃa de Seguridad en Fedora está diseñada
para asistir a usuarios de Fedora en el proceso de aprendizaje y prácticas de seguridad
en estaciones de trabajo y servidores, para poder asà evitar intrusiones locales y
remotas, explotaciones, y actividades maliciosas. Enfocada en Fedora Linux pero detallando
conceptos y técnicas validas para todos los sistemas Linux. La GuÃa de Seguridad en
Fedora detalla la planificación y describe las herramientas involucradas en la creación
de un entorno de computación seguro, para centros de datos, estaciones de trabajo, o el
hogar. Con un conocimiento administrativo apropiado, vigilancia, y herramientas, los
sistemas ejecutando Linux pueden ser funcionales y al mismo tiempo seguros, frente a los
métodos de intrusión y explotación más comunes.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/Security_Gu...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -309,7 +309,7 @@
<!--dc:issued></dc:issued-->
<summary>Utilizando Fedora 14 para realizar tareas comunes en un equipo de
escritorio
</summary>
- <content type="text">La guía del usuario Fedora está pensada para que
los usuarios finales puedan realizar tareas de computación relativamente sencillas, como
por ejemplo navegar por la web, leer y enviar correos electrónicos, o utilizar el equipo
para tareas propias de ámbitos laborales, pasatiempos o estudios.</content>
+ <content type="text">La guÃa del usuario Fedora está pensada para
que los usuarios finales puedan realizar tareas de computación relativamente sencillas,
como por ejemplo navegar por la web, leer y enviar correos electrónicos, o utilizar el
equipo para tareas propias de ámbitos laborales, pasatiempos o estudios.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/14/epub/User_Guide/...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -454,7 +454,7 @@
<!--dc:issued></dc:issued-->
<summary>Respuestas a preguntas frecuentes sobre Seguridad Mejorada de Linux
</summary>
- <content type="text">Este FAQ responde a muchas preguntas acerca de
Seguridad Mejorada de Linux. La información de este FAQ es valiosa para aquellos que son
nuevos en SELinux. Este FAQ, sin embargo, no está diseñado para proporcionar una cobertura
completa de SELinux. Para guías e instrucciones detalladas sobre la comprensión y el uso
de SELinux, consulte primero la Guía del Usuario de SELinux y la Guía de Administración de
Servicios Confinados. Están disponibles en
http://docs.fedoraproject.org</content>
+ <content type="text">Este FAQ responde a muchas preguntas acerca de
Seguridad Mejorada de Linux. La información de este FAQ es valiosa para aquellos que son
nuevos en SELinux. Este FAQ, sin embargo, no está diseñado para proporcionar una
cobertura completa de SELinux. Para guÃas e instrucciones detalladas sobre la
comprensión y el uso de SELinux, consulte primero la GuÃa del Usuario de SELinux y la
GuÃa de Administración de Servicios Confinados. Están disponibles en
http://docs.fedoraproject.org</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/es-ES/Fedora/13/epub/SELinux_FAQ...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/es-ES/opds-Fedora_Contributor_Documentation.xml
b/public_html/es-ES/opds-Fedora_Contributor_Documentation.xml
index d536247..5a32141 100644
--- a/public_html/es-ES/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/es-ES/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/es-ES/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/es-ES/opds-Fedora_Core.xml
b/public_html/es-ES/opds-Fedora_Core.xml
index cfdaca0..e198b4f 100644
--- a/public_html/es-ES/opds-Fedora_Core.xml
+++ b/public_html/es-ES/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/es-ES/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/es-ES/opds-Fedora_Draft_Documentation.xml
b/public_html/es-ES/opds-Fedora_Draft_Documentation.xml
index 05ae27e..4b2ee3a 100644
--- a/public_html/es-ES/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/es-ES/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/es-ES/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/es-ES/opds.xml b/public_html/es-ES/opds.xml
index db921ab..d1c1efd 100644
--- a/public_html/es-ES/opds.xml
+++ b/public_html/es-ES/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/es-ES/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/es-ES/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>es-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/es-ES/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>es-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/es-ES/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>es-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/es-ES/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>es-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/es-ES/toc.html b/public_html/es-ES/toc.html
index e5aa09b..717e733 100644
--- a/public_html/es-ES/toc.html
+++ b/public_html/es-ES/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -215,7 +215,7 @@
<a class="type"
href="./Fedora/14/epub/Software_Management_Guide/Fedora-14-Software_Management_Guide-es-ES.epub"
>epub</a>
<a class="type"
href="./Fedora/14/html/Software_Management_Guide/index.html"
onclick="window.top.location='./Fedora/14/html/Software_Management_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/14/html-single/Software_Management_Guide/index.html"
onclick="window.top.location='./Fedora/14/html-single/Software_Management_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/14/pdf/Software_Management_Guide/Fedora-0.1-Software_Management_Guide-es-ES.pdf"
onclick="window.top.location='./Fedora/14/pdf/Software_Management_Guide/Fedora-0.1-Software_Management_Guide-es-ES.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/14/pdf/Software_Management_Guide/Fedora-14-Software_Management_Guide-es-ES.pdf"
onclick="window.top.location='./Fedora/14/pdf/Software_Management_Guide/Fedora-14-Software_Management_Guide-es-ES.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.14.User_Guide' class="book collapsed">
@@ -962,7 +962,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/fa-IR/opds-Fedora.xml b/public_html/fa-IR/opds-Fedora.xml
index e4112f7..65343dd 100644
--- a/public_html/fa-IR/opds-Fedora.xml
+++ b/public_html/fa-IR/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fa-IR/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>fa-IR</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>fa-IR</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/fa-IR/opds-Fedora_Contributor_Documentation.xml
b/public_html/fa-IR/opds-Fedora_Contributor_Documentation.xml
index 10f581e..83de709 100644
--- a/public_html/fa-IR/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/fa-IR/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fa-IR/opds-Fedora_Contributor_Documen...
<title>مستندات مشارکت کننده فدورا</title>
<subtitle>مستندات مشارکت کننده فدورا</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fa-IR/opds-Fedora_Core.xml
b/public_html/fa-IR/opds-Fedora_Core.xml
index 2a54b48..c05fcc5 100644
--- a/public_html/fa-IR/opds-Fedora_Core.xml
+++ b/public_html/fa-IR/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fa-IR/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fa-IR/opds-Fedora_Draft_Documentation.xml
b/public_html/fa-IR/opds-Fedora_Draft_Documentation.xml
index 28b8396..caef154 100644
--- a/public_html/fa-IR/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/fa-IR/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fa-IR/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fa-IR/opds.xml b/public_html/fa-IR/opds.xml
index d16e2d9..ff628d9 100644
--- a/public_html/fa-IR/opds.xml
+++ b/public_html/fa-IR/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/fa-IR/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/fa-IR/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fa-IR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>مستندات مشارکت کننده فدورا</title>
<
id>http://docs.fedoraproject.org/fa-IR/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fa-IR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/fa-IR/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fa-IR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/fa-IR/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fa-IR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/fa-IR/toc.html b/public_html/fa-IR/toc.html
index 02d8bcc..5d5731a 100644
--- a/public_html/fa-IR/toc.html
+++ b/public_html/fa-IR/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/fi-FI/opds-Fedora.xml b/public_html/fi-FI/opds-Fedora.xml
index 18c2d9f..19c06e0 100644
--- a/public_html/fi-FI/opds-Fedora.xml
+++ b/public_html/fi-FI/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fi-FI/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>fi-FI</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>fi-FI</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Kuinka Fedoran live-levykuvaa käytetään
+ <summary>Kuinka Fedoran live-levykuvaa käytetään
</summary>
- <content type="text">Kuinka Fedoran live-levykuvaa
käytetään</content>
+ <content type="text">Kuinka Fedoran live-levykuvaa
käytetään</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/fi-FI/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>fi-FI</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/fi-FI/opds-Fedora_Contributor_Documentation.xml
b/public_html/fi-FI/opds-Fedora_Contributor_Documentation.xml
index 4d191d9..ab3bc2e 100644
--- a/public_html/fi-FI/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/fi-FI/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fi-FI/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fi-FI/opds-Fedora_Core.xml
b/public_html/fi-FI/opds-Fedora_Core.xml
index c46ee46..7e4fcc4 100644
--- a/public_html/fi-FI/opds-Fedora_Core.xml
+++ b/public_html/fi-FI/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fi-FI/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fi-FI/opds-Fedora_Draft_Documentation.xml
b/public_html/fi-FI/opds-Fedora_Draft_Documentation.xml
index 90936db..7094629 100644
--- a/public_html/fi-FI/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/fi-FI/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fi-FI/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fi-FI/opds.xml b/public_html/fi-FI/opds.xml
index 45c1c5c..74ec630 100644
--- a/public_html/fi-FI/opds.xml
+++ b/public_html/fi-FI/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/fi-FI/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/fi-FI/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fi-FI</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/fi-FI/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fi-FI</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/fi-FI/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fi-FI</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/fi-FI/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fi-FI</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/fi-FI/toc.html b/public_html/fi-FI/toc.html
index 3d15631..6ba079e 100644
--- a/public_html/fi-FI/toc.html
+++ b/public_html/fi-FI/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -560,7 +560,7 @@
<a class="type"
href="./Fedora/11/epub/Fedora_Live_images/Fedora-11-Fedora_Live_images-fi-FI.epub"
>epub</a>
<a class="type"
href="./Fedora/11/html/Fedora_Live_images/index.html"
onclick="window.top.location='./Fedora/11/html/Fedora_Live_images/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/11/html-single/Fedora_Live_images/index.html"
onclick="window.top.location='./Fedora/11/html-single/Fedora_Live_images/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/11/pdf/Fedora_Live_images/Fedora-13-Fedora_Live_Images-fi-FI.pdf"
onclick="window.top.location='./Fedora/11/pdf/Fedora_Live_images/Fedora-13-Fedora_Live_Images-fi-FI.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/11/pdf/Fedora_Live_images/Fedora-11-Fedora_Live_images-fi-FI.pdf"
onclick="window.top.location='./Fedora/11/pdf/Fedora_Live_images/Fedora-11-Fedora_Live_images-fi-FI.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11' class="version collapsed untranslated"
onclick="toggle(event, 'Fedora.11.untrans_books');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -633,7 +633,7 @@
<a class="type"
href="./Fedora/10/epub/Fedora_Live_Images/Fedora-10-Fedora_Live_Images-fi-FI.epub"
>epub</a>
<a class="type"
href="./Fedora/10/html/Fedora_Live_Images/index.html"
onclick="window.top.location='./Fedora/10/html/Fedora_Live_Images/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/10/html-single/Fedora_Live_Images/index.html"
onclick="window.top.location='./Fedora/10/html-single/Fedora_Live_Images/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/10/pdf/Fedora_Live_Images/Fedora-13-Fedora_Live_Images-fi-FI.pdf"
onclick="window.top.location='./Fedora/10/pdf/Fedora_Live_Images/Fedora-13-Fedora_Live_Images-fi-FI.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/10/pdf/Fedora_Live_Images/Fedora-10-Fedora_Live_Images-fi-FI.pdf"
onclick="window.top.location='./Fedora/10/pdf/Fedora_Live_Images/Fedora-10-Fedora_Live_Images-fi-FI.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.10.Making_Fedora_Discs' class="book
collapsed">
@@ -755,7 +755,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.SELinux_FAQ' class="book collapsed"
onclick="toggle(event, 'Fedora.8.SELinux_FAQ.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/fr-FR/opds-Fedora.xml b/public_html/fr-FR/opds-Fedora.xml
index a01c200..d91b0ca 100644
--- a/public_html/fr-FR/opds-Fedora.xml
+++ b/public_html/fr-FR/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fr-FR/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>fr-FR</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>fr-FR</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/fr-FR/opds-Fedora_Contributor_Documentation.xml
b/public_html/fr-FR/opds-Fedora_Contributor_Documentation.xml
index 01ec20f..fa779b7 100644
--- a/public_html/fr-FR/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/fr-FR/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fr-FR/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fr-FR/opds-Fedora_Core.xml
b/public_html/fr-FR/opds-Fedora_Core.xml
index dcfcc6b..77fcd1f 100644
--- a/public_html/fr-FR/opds-Fedora_Core.xml
+++ b/public_html/fr-FR/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fr-FR/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fr-FR/opds-Fedora_Draft_Documentation.xml
b/public_html/fr-FR/opds-Fedora_Draft_Documentation.xml
index 9bd49aa..9082b82 100644
--- a/public_html/fr-FR/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/fr-FR/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/fr-FR/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/fr-FR/opds.xml b/public_html/fr-FR/opds.xml
index 99b2d2f..310f5d4 100644
--- a/public_html/fr-FR/opds.xml
+++ b/public_html/fr-FR/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/fr-FR/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/fr-FR/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fr-FR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/fr-FR/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fr-FR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/fr-FR/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fr-FR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/fr-FR/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fr-FR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/fr-FR/toc.html b/public_html/fr-FR/toc.html
index e663ed2..211f3fe 100644
--- a/public_html/fr-FR/toc.html
+++ b/public_html/fr-FR/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/gu-IN/opds-Fedora.xml b/public_html/gu-IN/opds-Fedora.xml
index 6a03dac..9f1381e 100644
--- a/public_html/gu-IN/opds-Fedora.xml
+++ b/public_html/gu-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/gu-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>gu-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>gu-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/gu-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/gu-IN/opds-Fedora_Contributor_Documentation.xml
index 2500b9c..241bd62 100644
--- a/public_html/gu-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/gu-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/gu-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/gu-IN/opds-Fedora_Core.xml
b/public_html/gu-IN/opds-Fedora_Core.xml
index bc1ac82..cd8ee29 100644
--- a/public_html/gu-IN/opds-Fedora_Core.xml
+++ b/public_html/gu-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/gu-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/gu-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/gu-IN/opds-Fedora_Draft_Documentation.xml
index 29f1923..53e9114 100644
--- a/public_html/gu-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/gu-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/gu-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/gu-IN/opds.xml b/public_html/gu-IN/opds.xml
index b736724..3b59399 100644
--- a/public_html/gu-IN/opds.xml
+++ b/public_html/gu-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/gu-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/gu-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>gu-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/gu-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>gu-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/gu-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>gu-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/gu-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>gu-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/gu-IN/toc.html b/public_html/gu-IN/toc.html
index 09f8f0a..97e730f 100644
--- a/public_html/gu-IN/toc.html
+++ b/public_html/gu-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/he-IL/opds-Fedora.xml b/public_html/he-IL/opds-Fedora.xml
index 30d7e12..05a0433 100644
--- a/public_html/he-IL/opds-Fedora.xml
+++ b/public_html/he-IL/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/he-IL/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>he-IL</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>he-IL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/he-IL/opds-Fedora_Contributor_Documentation.xml
b/public_html/he-IL/opds-Fedora_Contributor_Documentation.xml
index f705372..5ec4217 100644
--- a/public_html/he-IL/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/he-IL/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/he-IL/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/he-IL/opds-Fedora_Core.xml
b/public_html/he-IL/opds-Fedora_Core.xml
index 3a116d8..66578d5 100644
--- a/public_html/he-IL/opds-Fedora_Core.xml
+++ b/public_html/he-IL/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/he-IL/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/he-IL/opds-Fedora_Draft_Documentation.xml
b/public_html/he-IL/opds-Fedora_Draft_Documentation.xml
index 7c309dd..ccd6eeb 100644
--- a/public_html/he-IL/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/he-IL/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/he-IL/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/he-IL/opds.xml b/public_html/he-IL/opds.xml
index 1eda9e9..ff3f30b 100644
--- a/public_html/he-IL/opds.xml
+++ b/public_html/he-IL/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/he-IL/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/he-IL/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>he-IL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/he-IL/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>he-IL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/he-IL/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>he-IL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/he-IL/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>he-IL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/he-IL/toc.html b/public_html/he-IL/toc.html
index 8552eec..acfbc2f 100644
--- a/public_html/he-IL/toc.html
+++ b/public_html/he-IL/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/hi-IN/opds-Fedora.xml b/public_html/hi-IN/opds-Fedora.xml
index 374c2a2..00ec3c1 100644
--- a/public_html/hi-IN/opds-Fedora.xml
+++ b/public_html/hi-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hi-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>hi-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>hi-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/hi-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/hi-IN/opds-Fedora_Contributor_Documentation.xml
index f6ab639..f7df500 100644
--- a/public_html/hi-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/hi-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hi-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hi-IN/opds-Fedora_Core.xml
b/public_html/hi-IN/opds-Fedora_Core.xml
index e4de08b..7327c2c 100644
--- a/public_html/hi-IN/opds-Fedora_Core.xml
+++ b/public_html/hi-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hi-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hi-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/hi-IN/opds-Fedora_Draft_Documentation.xml
index f31c28e..c771541 100644
--- a/public_html/hi-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/hi-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hi-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hi-IN/opds.xml b/public_html/hi-IN/opds.xml
index 9136bcd..ea769b8 100644
--- a/public_html/hi-IN/opds.xml
+++ b/public_html/hi-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/hi-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/hi-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hi-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/hi-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hi-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/hi-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hi-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/hi-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hi-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/hi-IN/toc.html b/public_html/hi-IN/toc.html
index 0e03bb5..7ada038 100644
--- a/public_html/hi-IN/toc.html
+++ b/public_html/hi-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/hu-HU/opds-Fedora.xml b/public_html/hu-HU/opds-Fedora.xml
index 2d8085d..1b7dff3 100644
--- a/public_html/hu-HU/opds-Fedora.xml
+++ b/public_html/hu-HU/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hu-HU/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>hu-HU</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>hu-HU</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/hu-HU/opds-Fedora_Contributor_Documentation.xml
b/public_html/hu-HU/opds-Fedora_Contributor_Documentation.xml
index bb2287a..4bd63f1 100644
--- a/public_html/hu-HU/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/hu-HU/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hu-HU/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hu-HU/opds-Fedora_Core.xml
b/public_html/hu-HU/opds-Fedora_Core.xml
index 310b0df..64f8716 100644
--- a/public_html/hu-HU/opds-Fedora_Core.xml
+++ b/public_html/hu-HU/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hu-HU/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hu-HU/opds-Fedora_Draft_Documentation.xml
b/public_html/hu-HU/opds-Fedora_Draft_Documentation.xml
index def06ec..3209114 100644
--- a/public_html/hu-HU/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/hu-HU/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/hu-HU/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/hu-HU/opds.xml b/public_html/hu-HU/opds.xml
index 782b5b8..2697506 100644
--- a/public_html/hu-HU/opds.xml
+++ b/public_html/hu-HU/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/hu-HU/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/hu-HU/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hu-HU</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/hu-HU/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hu-HU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/hu-HU/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hu-HU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/hu-HU/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hu-HU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/hu-HU/toc.html b/public_html/hu-HU/toc.html
index df65b25..745d92b 100644
--- a/public_html/hu-HU/toc.html
+++ b/public_html/hu-HU/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/id-ID/opds-Fedora.xml b/public_html/id-ID/opds-Fedora.xml
index 177221a..6e89c90 100644
--- a/public_html/id-ID/opds-Fedora.xml
+++ b/public_html/id-ID/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/id-ID/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>id-ID</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>id-ID</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/id-ID/opds-Fedora_Contributor_Documentation.xml
b/public_html/id-ID/opds-Fedora_Contributor_Documentation.xml
index 52e348c..dfa3d23 100644
--- a/public_html/id-ID/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/id-ID/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/id-ID/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/id-ID/opds-Fedora_Core.xml
b/public_html/id-ID/opds-Fedora_Core.xml
index eef6dcd..c52d0da 100644
--- a/public_html/id-ID/opds-Fedora_Core.xml
+++ b/public_html/id-ID/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/id-ID/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/id-ID/opds-Fedora_Draft_Documentation.xml
b/public_html/id-ID/opds-Fedora_Draft_Documentation.xml
index 40753f8..394a8dd 100644
--- a/public_html/id-ID/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/id-ID/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/id-ID/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/id-ID/opds.xml b/public_html/id-ID/opds.xml
index 85f3c90..d59d153 100644
--- a/public_html/id-ID/opds.xml
+++ b/public_html/id-ID/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/id-ID/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/id-ID/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>id-ID</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/id-ID/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>id-ID</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/id-ID/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>id-ID</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/id-ID/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>id-ID</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/id-ID/toc.html b/public_html/id-ID/toc.html
index c72e16e..62d6743 100644
--- a/public_html/id-ID/toc.html
+++ b/public_html/id-ID/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/it-IT/opds-Fedora.xml b/public_html/it-IT/opds-Fedora.xml
index e838f54..58f6b3d 100644
--- a/public_html/it-IT/opds-Fedora.xml
+++ b/public_html/it-IT/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/it-IT/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>it-IT</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -80,9 +80,9 @@
<dc:language>it-IT</dc:language>
<category label="14"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Usare Fedora con una disabilità visiva, uditiva o motoria
+ <summary>Usare Fedora con una disabilità visiva, uditiva o motoria
</summary>
- <content type="text">Questo documento descrive i dispositivi
hardware, le applicazioni e gli strumenti disponibili per consentire alle persone con
disabilità di usufruire di un computer con sistema operativo Fedora.</content>
+ <content type="text">Questo documento descrive i dispositivi
hardware, le applicazioni e gli strumenti disponibili per consentire alle persone con
disabilità di usufruire di un computer con sistema operativo Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/it-IT/Fedora/14/epub/Accessibili...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>it-IT</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Gestire il Consumo Energetico in Fedora
</summary>
- <content type="text">Questo documento spiega come gestire
efficacemente, i consumi di energia in sistemi Fedora 14. Le seguenti sezioni spiegano
diverse tecniche per diminuire il consumo energetico (sia nei server che nei portatili), e
come ogni tecnica influenzi le prestazioni globali del sistema. Nota: Questo documento è
ancora in fase di sviluppo, soggetto a grosse modifiche e quì fornito in anteprima. Il
contenuto e le istruzioni indicate non dovrebbero ritenersi complete e dovrebbero usarsi
con cautela.</content>
+ <content type="text">Questo documento spiega come gestire
efficacemente, i consumi di energia in sistemi Fedora 14. Le seguenti sezioni spiegano
diverse tecniche per diminuire il consumo energetico (sia nei server che nei portatili), e
come ogni tecnica influenzi le prestazioni globali del sistema. Nota: Questo documento è
ancora in fase di sviluppo, soggetto a grosse modifiche e quì fornito in anteprima. Il
contenuto e le istruzioni indicate non dovrebbero ritenersi complete e dovrebbero usarsi
con cautela.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/it-IT/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -253,7 +253,7 @@
<!--dc:issued></dc:issued-->
<summary>Guida alla protezione di Fedora Linux
</summary>
- <content type="text">La Guida alla Sicurezza intende assistere gli
utenti Fedora ad apprendere i processi e le pratiche di messa in sicurezza di workstation
e server da attività sospette, attacchi ed intrusioni, sia locali che remoti. La Guida,
dedicata a sistemi Fedora, affronta concetti e tecniche valide su tutti i sistemi Linux,
mostrando piani e gli strumenti necessari per creare un ambiente sicuro in postazioni
domestiche, negli uffici e in centri di elaborazione dati. Con una gestione e un controllo
adeguato, i sistemi Linux possono essere sia pienamente funzionali sia sicuri dai più
comuni metodi di attacco e di intrusione.</content>
+ <content type="text">La Guida alla Sicurezza intende assistere gli
utenti Fedora ad apprendere i processi e le pratiche di messa in sicurezza di workstation
e server da attività sospette, attacchi ed intrusioni, sia locali che remoti. La Guida,
dedicata a sistemi Fedora, affronta concetti e tecniche valide su tutti i sistemi Linux,
mostrando piani e gli strumenti necessari per creare un ambiente sicuro in postazioni
domestiche, negli uffici e in centri di elaborazione dati. Con una gestione e un controllo
adeguato, i sistemi Linux possono essere sia pienamente funzionali sia sicuri dai più
comuni metodi di attacco e di intrusione.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/it-IT/Fedora/14/epub/Security_Gu...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/it-IT/opds-Fedora_Contributor_Documentation.xml
b/public_html/it-IT/opds-Fedora_Contributor_Documentation.xml
index 8ea5c56..3d8fd64 100644
--- a/public_html/it-IT/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/it-IT/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/it-IT/opds-Fedora_Contributor_Documen...
<title>Documentazione Collaboratori Fedora</title>
<subtitle>Documentazione Collaboratori Fedora</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -44,7 +44,7 @@
<!--dc:issued></dc:issued-->
<summary>Guida rapida per inviare traduzioni al Fedora Project.
</summary>
- <content type="text">Questa guida è un insieme di istruzioni passo a
passo, semplici e veloci, per tradurre il software ed i documenti del Fedora
Project.</content>
+ <content type="text">Questa guida è un insieme di istruzioni passo a
passo, semplici e veloci, per tradurre il software ed i documenti del Fedora
Project.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/it-IT/Fedora_Contributor_Documen...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/it-IT/opds-Fedora_Core.xml
b/public_html/it-IT/opds-Fedora_Core.xml
index 334964e..25151c9 100644
--- a/public_html/it-IT/opds-Fedora_Core.xml
+++ b/public_html/it-IT/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/it-IT/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/it-IT/opds-Fedora_Draft_Documentation.xml
b/public_html/it-IT/opds-Fedora_Draft_Documentation.xml
index 39311dc..1ca3ade 100644
--- a/public_html/it-IT/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/it-IT/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/it-IT/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/it-IT/opds.xml b/public_html/it-IT/opds.xml
index dd2c2c6..79409a1 100644
--- a/public_html/it-IT/opds.xml
+++ b/public_html/it-IT/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/it-IT/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/it-IT/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>it-IT</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Documentazione Collaboratori Fedora</title>
<
id>http://docs.fedoraproject.org/it-IT/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>it-IT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/it-IT/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>it-IT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/it-IT/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>it-IT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/it-IT/toc.html b/public_html/it-IT/toc.html
index 9ed0826..1f57330 100644
--- a/public_html/it-IT/toc.html
+++ b/public_html/it-IT/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -288,7 +288,7 @@
<a class="type"
href="./Fedora/13/epub/Accessibility_Guide/Fedora-13-Accessibility_Guide-it-IT.epub"
>epub</a>
<a class="type"
href="./Fedora/13/html/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html/Accessibility_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/13/html-single/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html-single/Accessibility_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-it-IT.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-it-IT.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-it-IT.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-it-IT.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.13.Fedora_Live_Images' class="book
collapsed">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -708,7 +708,7 @@
<a class="type"
href="../en-US/./Fedora/10/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/10/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/10/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.10.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.10.User_Guide.types');">
@@ -808,7 +808,7 @@
<a class="type"
href="../en-US/./Fedora/9/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/9/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/9/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/9/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/9/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/9/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/9/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/9/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/9/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.9.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.9.User_Guide.types');">
@@ -917,7 +917,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.8.User_Guide.types');">
@@ -980,7 +980,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ja-JP/opds-Fedora.xml b/public_html/ja-JP/opds-Fedora.xml
index 8ea6b6a..0244df5 100644
--- a/public_html/ja-JP/opds-Fedora.xml
+++ b/public_html/ja-JP/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ja-JP/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ja-JP</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -118,9 +118,9 @@
<dc:language>ja-JP</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>ISO イメージをダウンロードし、CD や DVD メディアへ書き込む方法
+ <summary>ISO ã¤ã¡ã¼ã¸ããã¦ã³ãã¼ãããCD ã DVD
ã¡ãã£ã¢ã¸æ¸ãè¾¼ãæ¹æ³
</summary>
- <content type="text">ISO イメージをダウンロードし、CD や DVD
メディアへ書き込む方法</content>
+ <content type="text">ISO ã¤ã¡ã¼ã¸ããã¦ã³ãã¼ãããCD
ã DVD ã¡ãã£ã¢ã¸æ¸ãè¾¼ãæ¹æ³</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ja-JP/Fedora/14/epub/Burning_ISO...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>ja-JP</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Fedora Live イメージの使い方
+ <summary>Fedora Live ã¤ã¡ã¼ã¸ã®ä½¿ãæ¹
</summary>
- <content type="text">Fedora Live イメージの使い方</content>
+ <content type="text">Fedora Live
ã¤ã¡ã¼ã¸ã®ä½¿ãæ¹</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ja-JP/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ja-JP</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -213,9 +213,9 @@
<dc:language>ja-JP</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Fedora における電力消費の管理について
+ <summary>Fedora ã«ãããé»åæ¶è²»ã®ç®¡çã«ã¤ãã¦
</summary>
- <content type="text">このドキュメントでは、Fedora 14
システムで効果的に電力消費を管理する方法を説明しています。以下のセクションでは電力消費を低減する異なる技術(サーバーとラップトップの両方)と、各技術がシステムの全体的なパフォーマンスにいかに影響するかを説明します。以下の点に注意して下さい:
このドキュメントはまだ開発中であり、大幅な変更の可能性があります。そのため現時点ではプレビューとして提供されています。本文中にある内容と指導事項はまだ完全でなく、注意して取り扱う必要があります。</content>
+ <content type="text">ãã®ããã¥ã¡ã³ãã§ã¯ãFedora 14
ã·ã¹ãã ã§å¹æçã«é»åæ¶è²»ã管çããæ¹æ³ã説æãã¦ãã¾ãã以ä¸ã®ã»ã¯ã·ã§ã³ã§ã¯é»åæ¶è²»ãä½æ¸ããç°ãªãæè¡ï¼ãµã¼ãã¼ã¨ã©ãããããã®ä¸¡æ¹ï¼ã¨ãåæè¡ãã·ã¹ãã ã®å
¨ä½çãªããã©ã¼ãã³ã¹ã«ããã«å½±é¿ãããã説æãã¾ãã以ä¸ã®ç¹ã«æ³¨æãã¦ä¸ãã:
ãã®ããã¥ã¡ã³ãã¯ã¾ã éçºä¸ã§ããã大å¹
ãªå¤æ´ã®å¯è½æ§ã�
�ãã¾ãããã®ããç¾æç¹ã§ã¯ãã¬ãã¥ã¼ã¨ãã¦æä¾ããã¦ãã¾ããæ¬æä¸ã«ããå
容ã¨æå°äºé
ã¯ã¾ã å®å
¨ã§ãªãã注æãã¦åãæ±ãå¿
è¦ãããã¾ãã</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ja-JP/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ja-JP/opds-Fedora_Contributor_Documentation.xml
b/public_html/ja-JP/opds-Fedora_Contributor_Documentation.xml
index d8a9b31..0f14709 100644
--- a/public_html/ja-JP/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ja-JP/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ja-JP/opds-Fedora_Contributor_Documen...
<title>Fedora コントリビュータ用ドキュメント</title>
<subtitle>Fedora コントリビュータ用ドキュメント</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ja-JP/opds-Fedora_Core.xml
b/public_html/ja-JP/opds-Fedora_Core.xml
index 64383ff..c91e35c 100644
--- a/public_html/ja-JP/opds-Fedora_Core.xml
+++ b/public_html/ja-JP/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ja-JP/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ja-JP/opds-Fedora_Draft_Documentation.xml
b/public_html/ja-JP/opds-Fedora_Draft_Documentation.xml
index b82847c..083acbe 100644
--- a/public_html/ja-JP/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ja-JP/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ja-JP/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ja-JP/opds.xml b/public_html/ja-JP/opds.xml
index 1ee0972..cde5062 100644
--- a/public_html/ja-JP/opds.xml
+++ b/public_html/ja-JP/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ja-JP/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ja-JP/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>ja-JP</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora コントリビュータ用ドキュメント</title>
<
id>http://docs.fedoraproject.org/ja-JP/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>ja-JP</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ja-JP/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>ja-JP</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ja-JP/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>ja-JP</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ja-JP/toc.html b/public_html/ja-JP/toc.html
index be8b1b3..f09295a 100644
--- a/public_html/ja-JP/toc.html
+++ b/public_html/ja-JP/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -755,7 +755,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.SELinux_FAQ' class="book collapsed"
onclick="toggle(event, 'Fedora.8.SELinux_FAQ.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/kn-IN/opds-Fedora.xml b/public_html/kn-IN/opds-Fedora.xml
index a72a9c6..0e95c16 100644
--- a/public_html/kn-IN/opds-Fedora.xml
+++ b/public_html/kn-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/kn-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>kn-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>kn-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/kn-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/kn-IN/opds-Fedora_Contributor_Documentation.xml
index 6d4d95e..287e6d2 100644
--- a/public_html/kn-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/kn-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/kn-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/kn-IN/opds-Fedora_Core.xml
b/public_html/kn-IN/opds-Fedora_Core.xml
index 35c7d95..a91a594 100644
--- a/public_html/kn-IN/opds-Fedora_Core.xml
+++ b/public_html/kn-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/kn-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/kn-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/kn-IN/opds-Fedora_Draft_Documentation.xml
index 32491cf..74760cd 100644
--- a/public_html/kn-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/kn-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/kn-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/kn-IN/opds.xml b/public_html/kn-IN/opds.xml
index 3d86d8e..4f617c6 100644
--- a/public_html/kn-IN/opds.xml
+++ b/public_html/kn-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/kn-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/kn-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>kn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/kn-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>kn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/kn-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>kn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/kn-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>kn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/kn-IN/toc.html b/public_html/kn-IN/toc.html
index 24d79df..18fa743 100644
--- a/public_html/kn-IN/toc.html
+++ b/public_html/kn-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ko-KR/opds-Fedora.xml b/public_html/ko-KR/opds-Fedora.xml
index e32cda8..60d3200 100644
--- a/public_html/ko-KR/opds-Fedora.xml
+++ b/public_html/ko-KR/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ko-KR/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ko-KR</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ko-KR</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ko-KR/opds-Fedora_Contributor_Documentation.xml
b/public_html/ko-KR/opds-Fedora_Contributor_Documentation.xml
index 66216e2..b64b0ed 100644
--- a/public_html/ko-KR/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ko-KR/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ko-KR/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ko-KR/opds-Fedora_Core.xml
b/public_html/ko-KR/opds-Fedora_Core.xml
index 91a7bd7..06a709e 100644
--- a/public_html/ko-KR/opds-Fedora_Core.xml
+++ b/public_html/ko-KR/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ko-KR/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ko-KR/opds-Fedora_Draft_Documentation.xml
b/public_html/ko-KR/opds-Fedora_Draft_Documentation.xml
index 25c6170..0412ef4 100644
--- a/public_html/ko-KR/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ko-KR/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ko-KR/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ko-KR/opds.xml b/public_html/ko-KR/opds.xml
index 02d589f..c0288f2 100644
--- a/public_html/ko-KR/opds.xml
+++ b/public_html/ko-KR/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ko-KR/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ko-KR/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ko-KR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/ko-KR/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ko-KR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ko-KR/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ko-KR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ko-KR/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ko-KR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ko-KR/toc.html b/public_html/ko-KR/toc.html
index 57a59e6..f3ddc6f 100644
--- a/public_html/ko-KR/toc.html
+++ b/public_html/ko-KR/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ml-IN/opds-Fedora.xml b/public_html/ml-IN/opds-Fedora.xml
index 480595a..2ac2902 100644
--- a/public_html/ml-IN/opds-Fedora.xml
+++ b/public_html/ml-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ml-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ml-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ml-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ml-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/ml-IN/opds-Fedora_Contributor_Documentation.xml
index 2bed74a..a53d030 100644
--- a/public_html/ml-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ml-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ml-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ml-IN/opds-Fedora_Core.xml
b/public_html/ml-IN/opds-Fedora_Core.xml
index e32c0fd..da4d5bc 100644
--- a/public_html/ml-IN/opds-Fedora_Core.xml
+++ b/public_html/ml-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ml-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ml-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/ml-IN/opds-Fedora_Draft_Documentation.xml
index b2be539..71fa9dc 100644
--- a/public_html/ml-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ml-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ml-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ml-IN/opds.xml b/public_html/ml-IN/opds.xml
index 96e8b83..9ea4d8b 100644
--- a/public_html/ml-IN/opds.xml
+++ b/public_html/ml-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ml-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ml-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ml-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/ml-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ml-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ml-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ml-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ml-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ml-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ml-IN/toc.html b/public_html/ml-IN/toc.html
index 2bad8f3..e2b0cf9 100644
--- a/public_html/ml-IN/toc.html
+++ b/public_html/ml-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/mr-IN/opds-Fedora.xml b/public_html/mr-IN/opds-Fedora.xml
index 424fb91..13771fe 100644
--- a/public_html/mr-IN/opds-Fedora.xml
+++ b/public_html/mr-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/mr-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>mr-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>mr-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/mr-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/mr-IN/opds-Fedora_Contributor_Documentation.xml
index 37649ef..61369f9 100644
--- a/public_html/mr-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/mr-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/mr-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/mr-IN/opds-Fedora_Core.xml
b/public_html/mr-IN/opds-Fedora_Core.xml
index 6653844..f0aaf89 100644
--- a/public_html/mr-IN/opds-Fedora_Core.xml
+++ b/public_html/mr-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/mr-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/mr-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/mr-IN/opds-Fedora_Draft_Documentation.xml
index 4f1b7f9..9c95e6e 100644
--- a/public_html/mr-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/mr-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/mr-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/mr-IN/opds.xml b/public_html/mr-IN/opds.xml
index fe2db1f..736c27c 100644
--- a/public_html/mr-IN/opds.xml
+++ b/public_html/mr-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/mr-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/mr-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>mr-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/mr-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>mr-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/mr-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>mr-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/mr-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>mr-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/mr-IN/toc.html b/public_html/mr-IN/toc.html
index 3cc05d5..46c0929 100644
--- a/public_html/mr-IN/toc.html
+++ b/public_html/mr-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/nb-NO/opds-Fedora.xml b/public_html/nb-NO/opds-Fedora.xml
index b54134e..9c0aab0 100644
--- a/public_html/nb-NO/opds-Fedora.xml
+++ b/public_html/nb-NO/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nb-NO/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>nb-NO</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>nb-NO</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/nb-NO/opds-Fedora_Contributor_Documentation.xml
b/public_html/nb-NO/opds-Fedora_Contributor_Documentation.xml
index 1814af8..3a07c08 100644
--- a/public_html/nb-NO/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/nb-NO/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nb-NO/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nb-NO/opds-Fedora_Core.xml
b/public_html/nb-NO/opds-Fedora_Core.xml
index 8440887..b6e0604 100644
--- a/public_html/nb-NO/opds-Fedora_Core.xml
+++ b/public_html/nb-NO/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nb-NO/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nb-NO/opds-Fedora_Draft_Documentation.xml
b/public_html/nb-NO/opds-Fedora_Draft_Documentation.xml
index 5410611..c98cee7 100644
--- a/public_html/nb-NO/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/nb-NO/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nb-NO/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nb-NO/opds.xml b/public_html/nb-NO/opds.xml
index 8c9f5c7..b977eea 100644
--- a/public_html/nb-NO/opds.xml
+++ b/public_html/nb-NO/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/nb-NO/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/nb-NO/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>nb-NO</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/nb-NO/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>nb-NO</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/nb-NO/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>nb-NO</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/nb-NO/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>nb-NO</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/nb-NO/toc.html b/public_html/nb-NO/toc.html
index c24bcbd..83e284a 100644
--- a/public_html/nb-NO/toc.html
+++ b/public_html/nb-NO/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -747,7 +747,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Release_Notes' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Release_Notes.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/nl-NL/opds-Fedora.xml b/public_html/nl-NL/opds-Fedora.xml
index c8fbd68..6fc15cb 100644
--- a/public_html/nl-NL/opds-Fedora.xml
+++ b/public_html/nl-NL/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nl-NL/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>nl-NL</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>nl-NL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Het installeren van Fedora 14 op x86, AMD64, and Intel 64
architecturen
+ <summary>Het installeren van Fedora 14 op x86, AMD64, and Intel 64
architecturen
</summary>
<content type="text">Verstrekt documentatie voor het installeer
proces.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/nl-NL/Fedora/14/epub/Installatio...
diff --git a/public_html/nl-NL/opds-Fedora_Contributor_Documentation.xml
b/public_html/nl-NL/opds-Fedora_Contributor_Documentation.xml
index 5e0e2f3..07562bc 100644
--- a/public_html/nl-NL/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/nl-NL/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nl-NL/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nl-NL/opds-Fedora_Core.xml
b/public_html/nl-NL/opds-Fedora_Core.xml
index aa098f0..8b84141 100644
--- a/public_html/nl-NL/opds-Fedora_Core.xml
+++ b/public_html/nl-NL/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nl-NL/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nl-NL/opds-Fedora_Draft_Documentation.xml
b/public_html/nl-NL/opds-Fedora_Draft_Documentation.xml
index 0593b23..881bac4 100644
--- a/public_html/nl-NL/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/nl-NL/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/nl-NL/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/nl-NL/opds.xml b/public_html/nl-NL/opds.xml
index 5769422..8cb737e 100644
--- a/public_html/nl-NL/opds.xml
+++ b/public_html/nl-NL/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/nl-NL/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/nl-NL/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>nl-NL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/nl-NL/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>nl-NL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/nl-NL/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>nl-NL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/nl-NL/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>nl-NL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/nl-NL/toc.html b/public_html/nl-NL/toc.html
index e2842a1..2ce6dea 100644
--- a/public_html/nl-NL/toc.html
+++ b/public_html/nl-NL/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -650,7 +650,7 @@
<a class="type"
href="./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-nl-NL.epub"
>epub</a>
<a class="type"
href="./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-nl-NL.pdf"
onclick="window.top.location='./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-nl-NL.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-nl-NL.pdf"
onclick="window.top.location='./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-nl-NL.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed">
@@ -998,7 +998,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/opds.xml b/public_html/opds.xml
index 5a3a985..1903197 100644
--- a/public_html/opds.xml
+++ b/public_html/opds.xml
@@ -7,7 +7,7 @@
<link rel="start"
href="http://docs.fedoraproject.org/opds.xml"
type="application/atom+xml;type=feed;profile=opds-catalog"/>
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<title>Fedora Documentation</title>
- <updated>2011-06-28T19:47:11</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
@@ -16,7 +16,7 @@
<entry>
<title>অসমীয়া</title>
<id>as-IN/opds.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>as-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="as-IN/opds.xml"/>
@@ -24,7 +24,7 @@
<entry>
<title>български</title>
<id>bg-BG/opds.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bg-BG</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="bg-BG/opds.xml"/>
@@ -32,7 +32,7 @@
<entry>
<title>বাংলা</title>
<id>bn-IN/opds.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="bn-IN/opds.xml"/>
@@ -40,7 +40,7 @@
<entry>
<title>Bosanski</title>
<id>bs-BA/opds.xml</id>
- <updated>2011-06-28T19:47:01</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>bs-BA</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="bs-BA/opds.xml"/>
@@ -48,7 +48,7 @@
<entry>
<title>Català</title>
<id>ca-ES/opds.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:43</updated>
<dc:language>ca-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ca-ES/opds.xml"/>
@@ -56,7 +56,7 @@
<entry>
<title>Čeština</title>
<id>cs-CZ/opds.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>cs-CZ</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="cs-CZ/opds.xml"/>
@@ -64,7 +64,7 @@
<entry>
<title>Dansk</title>
<id>da-DK/opds.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>da-DK</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="da-DK/opds.xml"/>
@@ -72,7 +72,7 @@
<entry>
<title>Deutsch</title>
<id>de-DE/opds.xml</id>
- <updated>2011-06-28T19:47:02</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>de-DE</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="de-DE/opds.xml"/>
@@ -80,7 +80,7 @@
<entry>
<title>Ελληνικά</title>
<id>el-GR/opds.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>el-GR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="el-GR/opds.xml"/>
@@ -88,7 +88,7 @@
<entry>
<title>English</title>
<id>en-US/opds.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:44</updated>
<dc:language>en-US</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="en-US/opds.xml"/>
@@ -96,7 +96,7 @@
<entry>
<title>Español</title>
<id>es-ES/opds.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>es-ES</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="es-ES/opds.xml"/>
@@ -104,7 +104,7 @@
<entry>
<title>فارسی</title>
<id>fa-IR/opds.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fa-IR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="fa-IR/opds.xml"/>
@@ -112,7 +112,7 @@
<entry>
<title>Suomi</title>
<id>fi-FI/opds.xml</id>
- <updated>2011-06-28T19:47:03</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fi-FI</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="fi-FI/opds.xml"/>
@@ -120,7 +120,7 @@
<entry>
<title>Français</title>
<id>fr-FR/opds.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>fr-FR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="fr-FR/opds.xml"/>
@@ -128,7 +128,7 @@
<entry>
<title>ગુજરાતી</title>
<id>gu-IN/opds.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:45</updated>
<dc:language>gu-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="gu-IN/opds.xml"/>
@@ -136,7 +136,7 @@
<entry>
<title>עברית</title>
<id>he-IL/opds.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>he-IL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="he-IL/opds.xml"/>
@@ -144,7 +144,7 @@
<entry>
<title>हिन्दी</title>
<id>hi-IN/opds.xml</id>
- <updated>2011-06-28T19:47:04</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hi-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="hi-IN/opds.xml"/>
@@ -152,7 +152,7 @@
<entry>
<title>Magyar</title>
<id>hu-HU/opds.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>hu-HU</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="hu-HU/opds.xml"/>
@@ -160,7 +160,7 @@
<entry>
<title>Indonesia</title>
<id>id-ID/opds.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>id-ID</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="id-ID/opds.xml"/>
@@ -168,7 +168,7 @@
<entry>
<title>Italiano</title>
<id>it-IT/opds.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:46</updated>
<dc:language>it-IT</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="it-IT/opds.xml"/>
@@ -176,7 +176,7 @@
<entry>
<title>日本語</title>
<id>ja-JP/opds.xml</id>
- <updated>2011-06-28T19:47:05</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ja-JP</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ja-JP/opds.xml"/>
@@ -184,7 +184,7 @@
<entry>
<title>ಕನ್ನಡ</title>
<id>kn-IN/opds.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>kn-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="kn-IN/opds.xml"/>
@@ -192,7 +192,7 @@
<entry>
<title>한국어</title>
<id>ko-KR/opds.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ko-KR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ko-KR/opds.xml"/>
@@ -200,7 +200,7 @@
<entry>
<title>മലയാളം</title>
<id>ml-IN/opds.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>ml-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ml-IN/opds.xml"/>
@@ -208,7 +208,7 @@
<entry>
<title>मराठी</title>
<id>mr-IN/opds.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>mr-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="mr-IN/opds.xml"/>
@@ -216,7 +216,7 @@
<entry>
<title>Norsk (bokmål)</title>
<id>nb-NO/opds.xml</id>
- <updated>2011-06-28T19:47:06</updated>
+ <updated>2011-06-28T21:51:47</updated>
<dc:language>nb-NO</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="nb-NO/opds.xml"/>
@@ -224,7 +224,7 @@
<entry>
<title>Nederlands</title>
<id>nl-NL/opds.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>nl-NL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="nl-NL/opds.xml"/>
@@ -232,7 +232,7 @@
<entry>
<title>ଓଡ଼ିଆ</title>
<id>or-IN/opds.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>or-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="or-IN/opds.xml"/>
@@ -240,7 +240,7 @@
<entry>
<title>ਪੰਜਾਬੀ</title>
<id>pa-IN/opds.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pa-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="pa-IN/opds.xml"/>
@@ -248,7 +248,7 @@
<entry>
<title>Polski</title>
<id>pl-PL/opds.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pl-PL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="pl-PL/opds.xml"/>
@@ -256,7 +256,7 @@
<entry>
<title>Português Brasileiro</title>
<id>pt-BR/opds.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pt-BR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="pt-BR/opds.xml"/>
@@ -264,7 +264,7 @@
<entry>
<title>Português</title>
<id>pt-PT/opds.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>pt-PT</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="pt-PT/opds.xml"/>
@@ -272,7 +272,7 @@
<entry>
<title>Русский</title>
<id>ru-RU/opds.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>ru-RU</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ru-RU/opds.xml"/>
@@ -280,7 +280,7 @@
<entry>
<title>Slovenščina</title>
<id>sk-SK/opds.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sk-SK</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="sk-SK/opds.xml"/>
@@ -288,7 +288,7 @@
<entry>
<title>Srpski (latinica)</title>
<id>sr-Latn-RS/opds.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-Latn-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="sr-Latn-RS/opds.xml"/>
@@ -296,7 +296,7 @@
<entry>
<title>Српски</title>
<id>sr-RS/opds.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="sr-RS/opds.xml"/>
@@ -304,7 +304,7 @@
<entry>
<title>Svenska</title>
<id>sv-SE/opds.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sv-SE</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="sv-SE/opds.xml"/>
@@ -312,7 +312,7 @@
<entry>
<title>தமிழ்</title>
<id>ta-IN/opds.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>ta-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="ta-IN/opds.xml"/>
@@ -320,7 +320,7 @@
<entry>
<title>తెలుగు</title>
<id>te-IN/opds.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>te-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="te-IN/opds.xml"/>
@@ -328,7 +328,7 @@
<entry>
<title>Українська</title>
<id>uk-UA/opds.xml</id>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>uk-UA</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="uk-UA/opds.xml"/>
@@ -336,7 +336,7 @@
<entry>
<title>简体中文</title>
<id>zh-CN/opds.xml</id>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>zh-CN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="zh-CN/opds.xml"/>
@@ -344,7 +344,7 @@
<entry>
<title>繁體中文</title>
<id>zh-TW/opds.xml</id>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<dc:language>zh-TW</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="zh-TW/opds.xml"/>
diff --git a/public_html/or-IN/opds-Fedora.xml b/public_html/or-IN/opds-Fedora.xml
index 209fd34..360a024 100644
--- a/public_html/or-IN/opds-Fedora.xml
+++ b/public_html/or-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/or-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>or-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>or-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/or-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/or-IN/opds-Fedora_Contributor_Documentation.xml
index c870654..c4a13f4 100644
--- a/public_html/or-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/or-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/or-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/or-IN/opds-Fedora_Core.xml
b/public_html/or-IN/opds-Fedora_Core.xml
index b95fc1ff..c1937d8 100644
--- a/public_html/or-IN/opds-Fedora_Core.xml
+++ b/public_html/or-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/or-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/or-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/or-IN/opds-Fedora_Draft_Documentation.xml
index 18090ef..94f02c9 100644
--- a/public_html/or-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/or-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/or-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/or-IN/opds.xml b/public_html/or-IN/opds.xml
index 40798ff..79a2be6 100644
--- a/public_html/or-IN/opds.xml
+++ b/public_html/or-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/or-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/or-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>or-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/or-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>or-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/or-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>or-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/or-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>or-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/or-IN/toc.html b/public_html/or-IN/toc.html
index 81d10fa..b363960 100644
--- a/public_html/or-IN/toc.html
+++ b/public_html/or-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/pa-IN/opds-Fedora.xml b/public_html/pa-IN/opds-Fedora.xml
index cd4de85..dbd74c2 100644
--- a/public_html/pa-IN/opds-Fedora.xml
+++ b/public_html/pa-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pa-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>pa-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>pa-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/pa-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/pa-IN/opds-Fedora_Contributor_Documentation.xml
index 5e2ea12..9daa39b 100644
--- a/public_html/pa-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/pa-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pa-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pa-IN/opds-Fedora_Core.xml
b/public_html/pa-IN/opds-Fedora_Core.xml
index 8f9fc47..cfa50f7 100644
--- a/public_html/pa-IN/opds-Fedora_Core.xml
+++ b/public_html/pa-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pa-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pa-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/pa-IN/opds-Fedora_Draft_Documentation.xml
index cc3a117..c301a64 100644
--- a/public_html/pa-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/pa-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pa-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pa-IN/opds.xml b/public_html/pa-IN/opds.xml
index eca2393..943533a 100644
--- a/public_html/pa-IN/opds.xml
+++ b/public_html/pa-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/pa-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/pa-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pa-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/pa-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pa-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/pa-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pa-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/pa-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pa-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/pa-IN/toc.html b/public_html/pa-IN/toc.html
index dd0384b..3fc5af1 100644
--- a/public_html/pa-IN/toc.html
+++ b/public_html/pa-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/pl-PL/opds-Fedora.xml b/public_html/pl-PL/opds-Fedora.xml
index 46f367e..7f762c0 100644
--- a/public_html/pl-PL/opds-Fedora.xml
+++ b/public_html/pl-PL/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pl-PL/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>pl-PL</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -80,9 +80,9 @@
<dc:language>pl-PL</dc:language>
<category label="14"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Używanie Fedory z niepełnosprawnościami wzrokowymi, słuchowymi lub
motorycznymi
+ <summary>Używanie Fedory z niepeÅnosprawnoÅciami wzrokowymi, sÅuchowymi lub
motorycznymi
</summary>
- <content type="text">Ten dokument opisuje niektóre urządzenia
sprzętowe, aplikacje i narzędzia dostępne do pomocy osobom z niepełnosprawnościami w
używaniu komputera z systemem operacyjnym Fedora.</content>
+ <content type="text">Ten dokument opisuje niektóre urzÄ
dzenia sprzÄtowe, aplikacje i narzÄdzia dostÄpne do pomocy osobom z
niepeÅnosprawnoÅciami w używaniu komputera z systemem operacyjnym
Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/pl-PL/Fedora/14/epub/Accessibili...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -118,9 +118,9 @@
<dc:language>pl-PL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Jak pobrać obrazy ISO i utworzyć nośniki CD i DVD
+ <summary>Jak pobraÄ obrazy ISO i utworzyÄ noÅniki CD i DVD
</summary>
- <content type="text">Jak pobrać obrazy ISO i utworzyć nośniki CD i
DVD</content>
+ <content type="text">Jak pobraÄ obrazy ISO i utworzyÄ noÅniki CD i
DVD</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/pl-PL/Fedora/14/epub/Burning_ISO...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>pl-PL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Jak używać obrazu Live Fedory
+ <summary>Jak używaÄ obrazu Live Fedory
</summary>
- <content type="text">Jak używać obrazu Live Fedory</content>
+ <content type="text">Jak używaÄ obrazu Live Fedory</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/pl-PL/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>pl-PL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/pl-PL/opds-Fedora_Contributor_Documentation.xml
b/public_html/pl-PL/opds-Fedora_Contributor_Documentation.xml
index 48f77af..1105cc2 100644
--- a/public_html/pl-PL/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/pl-PL/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pl-PL/opds-Fedora_Contributor_Documen...
<title>Dokumentacja dla współtwórców Fedory</title>
<subtitle>Dokumentacja dla współtwórców Fedory</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -42,9 +42,9 @@
<dc:language>pl-PL</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Krótki podręcznik dostarczania tłumaczeń dla Projektu Fedora
+ <summary>Krótki podrÄcznik dostarczania tÅumaczeÅ dla Projektu Fedora
</summary>
- <content type="text">Ten przewodnik jest krótkim, prostym zestawem
instrukcji krok po kroku dla tłumaczenia oprogramowania i dokumentów Projektu
Fedora.</content>
+ <content type="text">Ten przewodnik jest krótkim, prostym zestawem
instrukcji krok po kroku dla tÅumaczenia oprogramowania i dokumentów Projektu
Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/pl-PL/Fedora_Contributor_Documen...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/pl-PL/opds-Fedora_Core.xml
b/public_html/pl-PL/opds-Fedora_Core.xml
index 9e08e9c..7a25978 100644
--- a/public_html/pl-PL/opds-Fedora_Core.xml
+++ b/public_html/pl-PL/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pl-PL/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pl-PL/opds-Fedora_Draft_Documentation.xml
b/public_html/pl-PL/opds-Fedora_Draft_Documentation.xml
index 8113bde..2e11a01 100644
--- a/public_html/pl-PL/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/pl-PL/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pl-PL/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pl-PL/opds.xml b/public_html/pl-PL/opds.xml
index 170cdd5..5c55054 100644
--- a/public_html/pl-PL/opds.xml
+++ b/public_html/pl-PL/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/pl-PL/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/pl-PL/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pl-PL</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Dokumentacja dla współtwórców Fedory</title>
<
id>http://docs.fedoraproject.org/pl-PL/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pl-PL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/pl-PL/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pl-PL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/pl-PL/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pl-PL</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/pl-PL/toc.html b/public_html/pl-PL/toc.html
index 30a64e3..2a5a37c 100644
--- a/public_html/pl-PL/toc.html
+++ b/public_html/pl-PL/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -690,7 +690,7 @@
<a class="type"
href="../en-US/./Fedora/10/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/10/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/10/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.10.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.10.User_Guide.types');">
@@ -772,7 +772,7 @@
<a class="type"
href="../en-US/./Fedora/9/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/9/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/9/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/9/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/9/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/9/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/9/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/9/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/9/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.9.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.9.User_Guide.types');">
@@ -890,7 +890,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/pt-BR/opds-Fedora.xml b/public_html/pt-BR/opds-Fedora.xml
index 614a806..c65d8a0 100644
--- a/public_html/pt-BR/opds-Fedora.xml
+++ b/public_html/pt-BR/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-BR/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>pt-BR</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>pt-BR</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/pt-BR/opds-Fedora_Contributor_Documentation.xml
b/public_html/pt-BR/opds-Fedora_Contributor_Documentation.xml
index f4c2c10..9ed080f 100644
--- a/public_html/pt-BR/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/pt-BR/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-BR/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-BR/opds-Fedora_Core.xml
b/public_html/pt-BR/opds-Fedora_Core.xml
index 5c030cc..44d7042 100644
--- a/public_html/pt-BR/opds-Fedora_Core.xml
+++ b/public_html/pt-BR/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-BR/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-BR/opds-Fedora_Draft_Documentation.xml
b/public_html/pt-BR/opds-Fedora_Draft_Documentation.xml
index db550a9..40dce1f 100644
--- a/public_html/pt-BR/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/pt-BR/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-BR/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-BR/opds.xml b/public_html/pt-BR/opds.xml
index e2b44fc..96494d9 100644
--- a/public_html/pt-BR/opds.xml
+++ b/public_html/pt-BR/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/pt-BR/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:48</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/pt-BR/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pt-BR</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/pt-BR/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pt-BR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/pt-BR/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:07</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pt-BR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/pt-BR/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:48</updated>
<dc:language>pt-BR</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/pt-BR/toc.html b/public_html/pt-BR/toc.html
index 8ed75e7..38e79ef 100644
--- a/public_html/pt-BR/toc.html
+++ b/public_html/pt-BR/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -828,7 +828,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/pt-PT/opds-Fedora.xml b/public_html/pt-PT/opds-Fedora.xml
index dfb3dde..8bbc2c1 100644
--- a/public_html/pt-PT/opds-Fedora.xml
+++ b/public_html/pt-PT/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-PT/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>pt-PT</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>pt-PT</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/pt-PT/opds-Fedora_Contributor_Documentation.xml
b/public_html/pt-PT/opds-Fedora_Contributor_Documentation.xml
index ccbe0d3..b1796ca 100644
--- a/public_html/pt-PT/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/pt-PT/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-PT/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-PT/opds-Fedora_Core.xml
b/public_html/pt-PT/opds-Fedora_Core.xml
index 1fdb341..fc58f6f 100644
--- a/public_html/pt-PT/opds-Fedora_Core.xml
+++ b/public_html/pt-PT/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-PT/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-PT/opds-Fedora_Draft_Documentation.xml
b/public_html/pt-PT/opds-Fedora_Draft_Documentation.xml
index 9dd627a..8c34b08 100644
--- a/public_html/pt-PT/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/pt-PT/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/pt-PT/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/pt-PT/opds.xml b/public_html/pt-PT/opds.xml
index 9c1deaf..ee11eaa 100644
--- a/public_html/pt-PT/opds.xml
+++ b/public_html/pt-PT/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/pt-PT/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/pt-PT/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>pt-PT</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/pt-PT/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>pt-PT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/pt-PT/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>pt-PT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/pt-PT/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>pt-PT</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/pt-PT/toc.html b/public_html/pt-PT/toc.html
index c57b96f..35cdec0 100644
--- a/public_html/pt-PT/toc.html
+++ b/public_html/pt-PT/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -288,7 +288,7 @@
<a class="type"
href="./Fedora/13/epub/Accessibility_Guide/Fedora-13-Accessibility_Guide-pt-PT.epub"
>epub</a>
<a class="type"
href="./Fedora/13/html/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html/Accessibility_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/13/html-single/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html-single/Accessibility_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-pt-PT.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-pt-PT.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-pt-PT.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-pt-PT.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.13.Burning_ISO_images_to_disc' class="book
collapsed">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -827,7 +827,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ru-RU/opds-Fedora.xml b/public_html/ru-RU/opds-Fedora.xml
index 12f1861..bbb83af 100644
--- a/public_html/ru-RU/opds-Fedora.xml
+++ b/public_html/ru-RU/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ru-RU/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ru-RU</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>ru-RU</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Как использовать Live-образ Fedora
+ <summary>Ðак иÑполÑзоваÑÑ Live-обÑаз Fedora
</summary>
- <content type="text">Как использовать Live-образ
Fedora</content>
+ <content type="text">Ðак иÑполÑзоваÑÑ Live-обÑаз
Fedora</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ru-RU/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ru-RU</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -232,9 +232,9 @@
<dc:language>ru-RU</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Примечания к выпуску Fedora 14
+ <summary>ÐÑимеÑÐ°Ð½Ð¸Ñ Ðº вÑпÑÑÐºÑ Fedora 14
</summary>
- <content type="text">Этот документ содержит примечания к выпуску
Fedora 14.</content>
+ <content type="text">ÐÑÐ¾Ñ Ð´Ð¾ÐºÑÐ¼ÐµÐ½Ñ ÑодеÑжиÑ
пÑимеÑÐ°Ð½Ð¸Ñ Ðº вÑпÑÑÐºÑ Fedora 14.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ru-RU/Fedora/14/epub/Release_Not...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ru-RU/opds-Fedora_Contributor_Documentation.xml
b/public_html/ru-RU/opds-Fedora_Contributor_Documentation.xml
index f306b0d..737ca86 100644
--- a/public_html/ru-RU/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ru-RU/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ru-RU/opds-Fedora_Contributor_Documen...
<title>Документация участника Fedora</title>
<subtitle>Документация участника Fedora</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -42,9 +42,9 @@
<dc:language>ru-RU</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Краткое руководство для переводчиков Fedora
+ <summary>ÐÑаÑкое ÑÑководÑÑво Ð´Ð»Ñ Ð¿ÐµÑеводÑиков
Fedora
</summary>
- <content type="text">Это руководство является краткой, простой,
пошаговой инструкцией для перевода программного обеспечения и документации в проекте
Fedora.</content>
+ <content type="text">ÐÑо ÑÑководÑÑво ÑвлÑеÑÑÑ
кÑаÑкой, пÑоÑÑой, поÑаговой инÑÑÑÑкÑией длÑ
пеÑевода пÑогÑаммного обеÑпеÑÐµÐ½Ð¸Ñ Ð¸
докÑменÑаÑии в пÑоекÑе Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/ru-RU/Fedora_Contributor_Documen...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ru-RU/opds-Fedora_Core.xml
b/public_html/ru-RU/opds-Fedora_Core.xml
index e63691e..4235206 100644
--- a/public_html/ru-RU/opds-Fedora_Core.xml
+++ b/public_html/ru-RU/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ru-RU/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ru-RU/opds-Fedora_Draft_Documentation.xml
b/public_html/ru-RU/opds-Fedora_Draft_Documentation.xml
index 0a6c1e3..ba08a59 100644
--- a/public_html/ru-RU/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ru-RU/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ru-RU/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ru-RU/opds.xml b/public_html/ru-RU/opds.xml
index 5f80895..6ba00f8 100644
--- a/public_html/ru-RU/opds.xml
+++ b/public_html/ru-RU/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ru-RU/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ru-RU/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>ru-RU</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Документация участника Fedora</title>
<
id>http://docs.fedoraproject.org/ru-RU/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>ru-RU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ru-RU/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>ru-RU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ru-RU/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>ru-RU</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ru-RU/toc.html b/public_html/ru-RU/toc.html
index 543cf95..5794cdd 100644
--- a/public_html/ru-RU/toc.html
+++ b/public_html/ru-RU/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -288,7 +288,7 @@
<a class="type"
href="./Fedora/13/epub/Accessibility_Guide/Fedora-13-Accessibility_Guide-ru-RU.epub"
>epub</a>
<a class="type"
href="./Fedora/13/html/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html/Accessibility_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/13/html-single/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html-single/Accessibility_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-ru-RU.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-ru-RU.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-ru-RU.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-ru-RU.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.13.Burning_ISO_images_to_disc' class="book
collapsed">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/sk-SK/opds-Fedora.xml b/public_html/sk-SK/opds-Fedora.xml
index f8238ec..050744e 100644
--- a/public_html/sk-SK/opds-Fedora.xml
+++ b/public_html/sk-SK/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sk-SK/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>sk-SK</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>sk-SK</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/sk-SK/opds-Fedora_Contributor_Documentation.xml
b/public_html/sk-SK/opds-Fedora_Contributor_Documentation.xml
index 1dbc614..4d05038 100644
--- a/public_html/sk-SK/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/sk-SK/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sk-SK/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sk-SK/opds-Fedora_Core.xml
b/public_html/sk-SK/opds-Fedora_Core.xml
index a4c142f..6677bf9 100644
--- a/public_html/sk-SK/opds-Fedora_Core.xml
+++ b/public_html/sk-SK/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sk-SK/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sk-SK/opds-Fedora_Draft_Documentation.xml
b/public_html/sk-SK/opds-Fedora_Draft_Documentation.xml
index 4252962..a990656 100644
--- a/public_html/sk-SK/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/sk-SK/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sk-SK/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sk-SK/opds.xml b/public_html/sk-SK/opds.xml
index 1ae6d0b..5099c24 100644
--- a/public_html/sk-SK/opds.xml
+++ b/public_html/sk-SK/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/sk-SK/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/sk-SK/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sk-SK</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/sk-SK/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sk-SK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/sk-SK/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sk-SK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/sk-SK/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sk-SK</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/sk-SK/toc.html b/public_html/sk-SK/toc.html
index a8d437e..147b302 100644
--- a/public_html/sk-SK/toc.html
+++ b/public_html/sk-SK/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -747,7 +747,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/sr-Latn-RS/opds-Fedora.xml
b/public_html/sr-Latn-RS/opds-Fedora.xml
index a7f034b..58e03e4 100644
--- a/public_html/sr-Latn-RS/opds-Fedora.xml
+++ b/public_html/sr-Latn-RS/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-Latn-RS/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>sr-Latn-RS</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>sr-Latn-RS</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/sr-Latn-RS/opds-Fedora_Contributor_Documentation.xml
b/public_html/sr-Latn-RS/opds-Fedora_Contributor_Documentation.xml
index 15ac67f..39230e6 100644
--- a/public_html/sr-Latn-RS/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/sr-Latn-RS/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-Latn-RS/opds-Fedora_Contributor_Do...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-Latn-RS/opds-Fedora_Core.xml
b/public_html/sr-Latn-RS/opds-Fedora_Core.xml
index 13db10d..9b69791 100644
--- a/public_html/sr-Latn-RS/opds-Fedora_Core.xml
+++ b/public_html/sr-Latn-RS/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-Latn-RS/opds-Fedora_Core.xml</i...
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-Latn-RS/opds-Fedora_Draft_Documentation.xml
b/public_html/sr-Latn-RS/opds-Fedora_Draft_Documentation.xml
index 6d5d73d..f9b9239 100644
--- a/public_html/sr-Latn-RS/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/sr-Latn-RS/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-Latn-RS/opds-Fedora_Draft_Document...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-Latn-RS/opds.xml b/public_html/sr-Latn-RS/opds.xml
index cc9c4a5..859a69c 100644
--- a/public_html/sr-Latn-RS/opds.xml
+++ b/public_html/sr-Latn-RS/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/sr-Latn-RS/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/sr-Latn-RS/Fedora/opds-Fedora.xml<...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-Latn-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/sr-Latn-RS/Fedora_Contributor_Documen...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-Latn-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/sr-Latn-RS/Fedora_Core/opds-Fedora_Co...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-Latn-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/sr-Latn-RS/Fedora_Draft_Documentation...
- <updated>2011-06-28T19:47:08</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-Latn-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/sr-Latn-RS/toc.html b/public_html/sr-Latn-RS/toc.html
index 0cee1fe..05a0a8a 100644
--- a/public_html/sr-Latn-RS/toc.html
+++ b/public_html/sr-Latn-RS/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/sr-RS/opds-Fedora.xml b/public_html/sr-RS/opds-Fedora.xml
index d8e2239..8627469 100644
--- a/public_html/sr-RS/opds-Fedora.xml
+++ b/public_html/sr-RS/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-RS/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>sr-RS</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>sr-RS</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/sr-RS/opds-Fedora_Contributor_Documentation.xml
b/public_html/sr-RS/opds-Fedora_Contributor_Documentation.xml
index 78b28e2..da97262 100644
--- a/public_html/sr-RS/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/sr-RS/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-RS/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-RS/opds-Fedora_Core.xml
b/public_html/sr-RS/opds-Fedora_Core.xml
index 97804d3..028c924 100644
--- a/public_html/sr-RS/opds-Fedora_Core.xml
+++ b/public_html/sr-RS/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-RS/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-RS/opds-Fedora_Draft_Documentation.xml
b/public_html/sr-RS/opds-Fedora_Draft_Documentation.xml
index 8f15aff..330b6e4 100644
--- a/public_html/sr-RS/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/sr-RS/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sr-RS/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sr-RS/opds.xml b/public_html/sr-RS/opds.xml
index 0b0a261..18fa896 100644
--- a/public_html/sr-RS/opds.xml
+++ b/public_html/sr-RS/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/sr-RS/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/sr-RS/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/sr-RS/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/sr-RS/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/sr-RS/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sr-RS</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/sr-RS/toc.html b/public_html/sr-RS/toc.html
index 5cda7e5..48b1bd8 100644
--- a/public_html/sr-RS/toc.html
+++ b/public_html/sr-RS/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -828,7 +828,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/sv-SE/opds-Fedora.xml b/public_html/sv-SE/opds-Fedora.xml
index eb91ad6..3ad0315 100644
--- a/public_html/sv-SE/opds-Fedora.xml
+++ b/public_html/sv-SE/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sv-SE/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>sv-SE</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -118,9 +118,9 @@
<dc:language>sv-SE</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Hur man hämtar ISO-avbilder och skapar CD- och DVD-media
+ <summary>Hur man hämtar ISO-avbilder och skapar CD- och DVD-media
</summary>
- <content type="text">Hur man hämtar ISO-avbilder och skapar CD- och
DVD-media</content>
+ <content type="text">Hur man hämtar ISO-avbilder och skapar CD- och
DVD-media</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/sv-SE/Fedora/14/epub/Burning_ISO...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>sv-SE</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Hur man använder Fedora live-avbilden
+ <summary>Hur man använder Fedora live-avbilden
</summary>
- <content type="text">Hur man använder Fedora
live-avbilden</content>
+ <content type="text">Hur man använder Fedora
live-avbilden</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/sv-SE/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>sv-SE</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/sv-SE/opds-Fedora_Contributor_Documentation.xml
b/public_html/sv-SE/opds-Fedora_Contributor_Documentation.xml
index a421873..97f7648 100644
--- a/public_html/sv-SE/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/sv-SE/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sv-SE/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sv-SE/opds-Fedora_Core.xml
b/public_html/sv-SE/opds-Fedora_Core.xml
index 924d761..2386e05 100644
--- a/public_html/sv-SE/opds-Fedora_Core.xml
+++ b/public_html/sv-SE/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sv-SE/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sv-SE/opds-Fedora_Draft_Documentation.xml
b/public_html/sv-SE/opds-Fedora_Draft_Documentation.xml
index 32c1f6f..7324411 100644
--- a/public_html/sv-SE/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/sv-SE/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/sv-SE/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/sv-SE/opds.xml b/public_html/sv-SE/opds.xml
index c5a7db4..3ee5ebf 100644
--- a/public_html/sv-SE/opds.xml
+++ b/public_html/sv-SE/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/sv-SE/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/sv-SE/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sv-SE</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/sv-SE/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sv-SE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/sv-SE/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sv-SE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/sv-SE/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:49</updated>
<dc:language>sv-SE</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/sv-SE/toc.html b/public_html/sv-SE/toc.html
index fceae7d..2353b28 100644
--- a/public_html/sv-SE/toc.html
+++ b/public_html/sv-SE/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -737,7 +737,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/7/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/7/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/7/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/7/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/7/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/7/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/7/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/7/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/7/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.7.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.7.Making_Fedora_Discs.types');">
@@ -863,7 +863,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/ta-IN/opds-Fedora.xml b/public_html/ta-IN/opds-Fedora.xml
index 05a6357..30255f5 100644
--- a/public_html/ta-IN/opds-Fedora.xml
+++ b/public_html/ta-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ta-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>ta-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>ta-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/ta-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/ta-IN/opds-Fedora_Contributor_Documentation.xml
index c14c5a7..9a9023f 100644
--- a/public_html/ta-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/ta-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ta-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ta-IN/opds-Fedora_Core.xml
b/public_html/ta-IN/opds-Fedora_Core.xml
index cf03f7a..ee01dde 100644
--- a/public_html/ta-IN/opds-Fedora_Core.xml
+++ b/public_html/ta-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ta-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ta-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/ta-IN/opds-Fedora_Draft_Documentation.xml
index eb06bb5..53034a5 100644
--- a/public_html/ta-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/ta-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/ta-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/ta-IN/opds.xml b/public_html/ta-IN/opds.xml
index 767617b..299af3d 100644
--- a/public_html/ta-IN/opds.xml
+++ b/public_html/ta-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/ta-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/ta-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>ta-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/ta-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>ta-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/ta-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>ta-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/ta-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>ta-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/ta-IN/toc.html b/public_html/ta-IN/toc.html
index 3b2972c..c2f3219 100644
--- a/public_html/ta-IN/toc.html
+++ b/public_html/ta-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/te-IN/opds-Fedora.xml b/public_html/te-IN/opds-Fedora.xml
index e5c8291..5dfe12c 100644
--- a/public_html/te-IN/opds-Fedora.xml
+++ b/public_html/te-IN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/te-IN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>te-IN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>te-IN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/te-IN/opds-Fedora_Contributor_Documentation.xml
b/public_html/te-IN/opds-Fedora_Contributor_Documentation.xml
index 11a47d7..5841fc2 100644
--- a/public_html/te-IN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/te-IN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/te-IN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/te-IN/opds-Fedora_Core.xml
b/public_html/te-IN/opds-Fedora_Core.xml
index 2c645fe..14f55a9 100644
--- a/public_html/te-IN/opds-Fedora_Core.xml
+++ b/public_html/te-IN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/te-IN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/te-IN/opds-Fedora_Draft_Documentation.xml
b/public_html/te-IN/opds-Fedora_Draft_Documentation.xml
index 63c4c97..9895399 100644
--- a/public_html/te-IN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/te-IN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/te-IN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/te-IN/opds.xml b/public_html/te-IN/opds.xml
index 27fb1d8..0190fb0 100644
--- a/public_html/te-IN/opds.xml
+++ b/public_html/te-IN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/te-IN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/te-IN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>te-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/te-IN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>te-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/te-IN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>te-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/te-IN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>te-IN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/te-IN/toc.html b/public_html/te-IN/toc.html
index ce3ab01..b6939cb 100644
--- a/public_html/te-IN/toc.html
+++ b/public_html/te-IN/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/toc.html b/public_html/toc.html
index 3832ef7..40a75c3 100644
--- a/public_html/toc.html
+++ b/public_html/toc.html
@@ -1296,7 +1296,7 @@
<a class="type"
href="./en-US/Fedora/15/html-single/FreeIPA_Guide/index.html">html-single</a>
- <a class="type"
href="./en-US/Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf">pdf</a>
+ <a class="type"
href="./en-US/Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf">pdf</a>
</div>
</div>
@@ -2082,7 +2082,7 @@
<a class="type"
href="./en-US/Fedora/11/html-single/Security_Guide/index.html">html-single</a>
- <a class="type"
href="./en-US/Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf">pdf</a>
+ <a class="type"
href="./en-US/Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf">pdf</a>
</div>
</div>
@@ -2256,7 +2256,7 @@
<a class="type"
href="./en-US/Fedora/8/html-single/Installation_Guide/index.html">html-single</a>
- <a class="type"
href="./en-US/Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf">pdf</a>
+ <a class="type"
href="./en-US/Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf">pdf</a>
</div>
</div>
@@ -2366,7 +2366,7 @@
<a class="type"
href="./en-US/Fedora/0.1/html-single/Amateur_Radio_Guide/index.html">html-single</a>
- <a class="type"
href="./en-US/Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf">pdf</a>
+ <a class="type"
href="./en-US/Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf">pdf</a>
</div>
</div>
@@ -2930,7 +2930,7 @@
<a class="type"
href="./es-ES/Fedora/14/html-single/Software_Management_Guide/index.html">html-single</a>
- <a class="type"
href="./es-ES/Fedora/14/pdf/Software_Management_Guide/Fedora-0.1-Software_Management_Guide-es-ES.pdf">pdf</a>
+ <a class="type"
href="./es-ES/Fedora/14/pdf/Software_Management_Guide/Fedora-14-Software_Management_Guide-es-ES.pdf">pdf</a>
</div>
</div>
@@ -3907,7 +3907,7 @@
<a class="type"
href="./fi-FI/Fedora/11/html-single/Fedora_Live_images/index.html">html-single</a>
- <a class="type"
href="./fi-FI/Fedora/11/pdf/Fedora_Live_images/Fedora-13-Fedora_Live_Images-fi-FI.pdf">pdf</a>
+ <a class="type"
href="./fi-FI/Fedora/11/pdf/Fedora_Live_images/Fedora-11-Fedora_Live_images-fi-FI.pdf">pdf</a>
</div>
</div>
@@ -3925,7 +3925,7 @@
<a class="type"
href="./fi-FI/Fedora/10/html-single/Fedora_Live_Images/index.html">html-single</a>
- <a class="type"
href="./fi-FI/Fedora/10/pdf/Fedora_Live_Images/Fedora-13-Fedora_Live_Images-fi-FI.pdf">pdf</a>
+ <a class="type"
href="./fi-FI/Fedora/10/pdf/Fedora_Live_Images/Fedora-10-Fedora_Live_Images-fi-FI.pdf">pdf</a>
</div>
</div>
@@ -4845,7 +4845,7 @@
<a class="type"
href="./it-IT/Fedora/13/html-single/Accessibility_Guide/index.html">html-single</a>
- <a class="type"
href="./it-IT/Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-it-IT.pdf">pdf</a>
+ <a class="type"
href="./it-IT/Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-it-IT.pdf">pdf</a>
</div>
</div>
@@ -6711,7 +6711,7 @@
<a class="type"
href="./nl-NL/Fedora/11/html-single/Security_Guide/index.html">html-single</a>
- <a class="type"
href="./nl-NL/Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-nl-NL.pdf">pdf</a>
+ <a class="type"
href="./nl-NL/Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-nl-NL.pdf">pdf</a>
</div>
</div>
@@ -8070,7 +8070,7 @@
<a class="type"
href="./pt-PT/Fedora/13/html-single/Accessibility_Guide/index.html">html-single</a>
- <a class="type"
href="./pt-PT/Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-pt-PT.pdf">pdf</a>
+ <a class="type"
href="./pt-PT/Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-pt-PT.pdf">pdf</a>
</div>
</div>
@@ -8613,7 +8613,7 @@
<a class="type"
href="./ru-RU/Fedora/13/html-single/Accessibility_Guide/index.html">html-single</a>
- <a class="type"
href="./ru-RU/Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-ru-RU.pdf">pdf</a>
+ <a class="type"
href="./ru-RU/Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-ru-RU.pdf">pdf</a>
</div>
</div>
@@ -10309,7 +10309,7 @@
<a class="type"
href="./uk-UA/Fedora/13/html-single/Accessibility_Guide/index.html">html-single</a>
- <a class="type"
href="./uk-UA/Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-uk-UA.pdf">pdf</a>
+ <a class="type"
href="./uk-UA/Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-uk-UA.pdf">pdf</a>
</div>
</div>
@@ -10708,7 +10708,7 @@
<a class="type"
href="./zh-CN/Fedora/13/html-single/Accessibility_Guide/index.html">html-single</a>
- <a class="type"
href="./zh-CN/Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-zh-CN.pdf">pdf</a>
+ <a class="type"
href="./zh-CN/Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-zh-CN.pdf">pdf</a>
</div>
</div>
diff --git a/public_html/uk-UA/opds-Fedora.xml b/public_html/uk-UA/opds-Fedora.xml
index f64fc58..97123ef 100644
--- a/public_html/uk-UA/opds-Fedora.xml
+++ b/public_html/uk-UA/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/uk-UA/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>uk-UA</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -80,9 +80,9 @@
<dc:language>uk-UA</dc:language>
<category label="14"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Як користуватися Fedora, якщо ви маєте зорові, слухові вади або вади
опорно-рухових можливостей
+ <summary>Як коÑиÑÑÑваÑиÑÑ Fedora, ÑкÑо ви маÑÑе
зоÑовÑ, ÑлÑÑ
Ð¾Ð²Ñ Ð²Ð°Ð´Ð¸ або вади опоÑно-ÑÑÑ
овиÑ
можливоÑÑей
</summary>
- <content type="text">Цей документ присвячено опису деяких з апаратних
пристроїв, програм та модулів, які допоможуть користувачам з особливими потребами
користуватися комп’ютером під керуванням операційної системи Fedora.</content>
+ <content type="text">Цей докÑÐ¼ÐµÐ½Ñ Ð¿ÑиÑвÑÑено
опиÑÑ Ð´ÐµÑкиÑ
з апаÑаÑниÑ
пÑиÑÑÑоÑв, пÑогÑам Ñа модÑлÑв, ÑÐºÑ Ð´Ð¾Ð¿Ð¾Ð¼Ð¾Ð¶ÑÑÑ
коÑиÑÑÑваÑам з оÑобливими поÑÑебами
коÑиÑÑÑваÑиÑÑ ÐºÐ¾Ð¼Ð¿âÑÑеÑом пÑд кеÑÑваннÑм
опеÑаÑÑÐ¹Ð½Ð¾Ñ ÑиÑÑеми Fedora.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora/14/epub/Accessibili...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -118,9 +118,9 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Як завантажити образи ISO та створити CD та DVD носії
+ <summary>Як заванÑажиÑи обÑази ISO Ñа ÑÑвоÑиÑи CD
Ñа DVD ноÑÑÑ
</summary>
- <content type="text">Як завантажити образи ISO та створити CD та DVD
носії</content>
+ <content type="text">Як заванÑажиÑи обÑази ISO
Ñа ÑÑвоÑиÑи CD Ñа DVD ноÑÑÑ</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora/14/epub/Burning_ISO...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Як користуватися образами портативної системи Fedora
+ <summary>Як коÑиÑÑÑваÑиÑÑ Ð¾Ð±Ñазами
поÑÑаÑÐ¸Ð²Ð½Ð¾Ñ ÑиÑÑеми Fedora
</summary>
- <content type="text">Як користуватися образами портативної системи
Fedora</content>
+ <content type="text">Як коÑиÑÑÑваÑиÑÑ Ð¾Ð±Ñазами
поÑÑаÑÐ¸Ð²Ð½Ð¾Ñ ÑиÑÑеми Fedora</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -308,9 +308,9 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Використання Fedora 14 з метою виконання звичних завдань на
комп’ютері
+ <summary>ÐикоÑиÑÑÐ°Ð½Ð½Ñ Fedora 14 з меÑÐ¾Ñ Ð²Ð¸ÐºÐ¾Ð½Ð°Ð½Ð½Ñ
звиÑниÑ
Ð·Ð°Ð²Ð´Ð°Ð½Ñ Ð½Ð° компâÑÑеÑÑ
</summary>
- <content type="text">Інструкцію користувача Fedora зосереджено на
описі виконання типових завдань комп’ютера, зокрема перегляду сторінок інтернету, читання
і надсилання електронної пошти та виконання офісних робіт.</content>
+ <content type="text">ÐнÑÑÑÑкÑÑÑ ÐºÐ¾ÑиÑÑÑваÑа
Fedora зоÑеÑеджено на опиÑÑ Ð²Ð¸ÐºÐ¾Ð½Ð°Ð½Ð½Ñ ÑиповиÑ
Ð·Ð°Ð²Ð´Ð°Ð½Ñ ÐºÐ¾Ð¼Ð¿âÑÑеÑа, зокÑема пеÑеглÑÐ´Ñ ÑÑоÑÑнок
ÑнÑеÑнеÑÑ, ÑиÑÐ°Ð½Ð½Ñ Ñ Ð½Ð°Ð´ÑÐ¸Ð»Ð°Ð½Ð½Ñ ÐµÐ»ÐµÐºÑÑонноÑ
поÑÑи Ñа Ð²Ð¸ÐºÐ¾Ð½Ð°Ð½Ð½Ñ Ð¾ÑÑÑниÑ
ÑобÑÑ.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora/14/epub/User_Guide/...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -453,9 +453,9 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Питання, які найчастіше задають користувачі щодо Security Enhanced
Linux, та відповіді на них
+ <summary>ÐиÑаннÑ, ÑÐºÑ Ð½Ð°Ð¹ÑаÑÑÑÑе задаÑÑÑ
коÑиÑÑÑваÑÑ Ñодо Security Enhanced Linux, Ñа вÑдповÑÐ´Ñ Ð½Ð°
ниÑ
</summary>
- <content type="text">У цьому довіднику наведено відповіді на питання
щодо Security-Enhanced Linux. Відомості з нього будуть корисними всім, хто ще не досить
знайомий з SELinux. Звичайно ж, у цьому довіднику ви не знайдете повного опису SELinux.
Докладні інструкції та настанови щодо вивчення та використання SELinux, наведено у
«Інструкції користувача SELinux» та «Підручнику з керування службами обмеження доступу».
Знайти ці підручники можна за адресою
http://docs.fedoraproject.org</content>
+ <content type="text">У ÑÑÐ¾Ð¼Ñ Ð´Ð¾Ð²ÑдникÑ
наведено вÑдповÑÐ´Ñ Ð½Ð° пиÑÐ°Ð½Ð½Ñ Ñодо Security-Enhanced Linux.
ÐÑдомоÑÑÑ Ð· нÑого бÑдÑÑÑ ÐºÐ¾ÑиÑними вÑÑм, Ñ
Ñо Ñе не доÑиÑÑ Ð·Ð½Ð°Ð¹Ð¾Ð¼Ð¸Ð¹ з SELinux. ÐвиÑайно ж, Ñ
ÑÑÐ¾Ð¼Ñ Ð´Ð¾Ð²ÑÐ´Ð½Ð¸ÐºÑ Ð²Ð¸ не знайдеÑе повного опиÑÑ
SELinux. ÐÐ¾ÐºÐ»Ð°Ð´Ð½Ñ ÑнÑÑÑÑкÑÑÑ Ñа наÑÑанови Ñодо
вивÑÐµÐ½Ð½Ñ Ñа викоÑиÑÑÐ°Ð½Ð½Ñ SELinux, наведено Ñ Â«ÐнÑÑ
ÑÑкÑÑÑ ÐºÐ¾ÑиÑÑÑваÑа SELinux» Ñа «ÐÑдÑÑÑÐ½Ð¸ÐºÑ Ð·
кеÑÑÐ²Ð°Ð½Ð½Ñ ÑлÑжбами Ð¾Ð±Ð¼ÐµÐ¶ÐµÐ½Ð½Ñ Ð´Ð¾ÑÑÑпÑ». ÐнайÑи ÑÑ
пÑдÑÑÑники можна за адÑеÑоÑ
http://docs.fedoraproject.org</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora/13/epub/SELinux_FAQ...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/uk-UA/opds-Fedora_Contributor_Documentation.xml
b/public_html/uk-UA/opds-Fedora_Contributor_Documentation.xml
index eabad56..7e5d7fb 100644
--- a/public_html/uk-UA/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/uk-UA/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/uk-UA/opds-Fedora_Contributor_Documen...
<title>Документація для учасника розробки Fedora</title>
<subtitle>Документація для учасника розробки Fedora</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -42,9 +42,9 @@
<dc:language>uk-UA</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Початкові настанови щодо перекладу Fedora Project
+ <summary>ÐоÑаÑÐºÐ¾Ð²Ñ Ð½Ð°ÑÑанови Ñодо пеÑекладÑ
Fedora Project
</summary>
- <content type="text">У цьому підручнику ви знайдете простий
покроковий набір інструкцій щодо перекладу програмного забезпечення та документації до
Fedora Project.</content>
+ <content type="text">У ÑÑÐ¾Ð¼Ñ Ð¿ÑдÑÑÑÐ½Ð¸ÐºÑ Ð²Ð¸
знайдеÑе пÑоÑÑий покÑоковий набÑÑ ÑнÑÑÑÑкÑÑй
Ñодо пеÑÐµÐºÐ»Ð°Ð´Ñ Ð¿ÑогÑамного забезпеÑÐµÐ½Ð½Ñ Ñа
докÑменÑаÑÑÑ Ð´Ð¾ Fedora Project.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/uk-UA/Fedora_Contributor_Documen...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/uk-UA/opds-Fedora_Core.xml
b/public_html/uk-UA/opds-Fedora_Core.xml
index 4ef37ff..a6ee8a7 100644
--- a/public_html/uk-UA/opds-Fedora_Core.xml
+++ b/public_html/uk-UA/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/uk-UA/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/uk-UA/opds-Fedora_Draft_Documentation.xml
b/public_html/uk-UA/opds-Fedora_Draft_Documentation.xml
index 81ef87b..5015e7c 100644
--- a/public_html/uk-UA/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/uk-UA/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/uk-UA/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/uk-UA/opds.xml b/public_html/uk-UA/opds.xml
index 8ae1fdf..f030a76 100644
--- a/public_html/uk-UA/opds.xml
+++ b/public_html/uk-UA/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/uk-UA/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/uk-UA/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>uk-UA</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Документація для учасника розробки Fedora</title>
<
id>http://docs.fedoraproject.org/uk-UA/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>uk-UA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/uk-UA/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:09</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>uk-UA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/uk-UA/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>uk-UA</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/uk-UA/toc.html b/public_html/uk-UA/toc.html
index 5b2954d..da87e48 100644
--- a/public_html/uk-UA/toc.html
+++ b/public_html/uk-UA/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -288,7 +288,7 @@
<a class="type"
href="./Fedora/13/epub/Accessibility_Guide/Fedora-13-Accessibility_Guide-uk-UA.epub"
>epub</a>
<a class="type"
href="./Fedora/13/html/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html/Accessibility_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/13/html-single/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html-single/Accessibility_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-uk-UA.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-uk-UA.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-uk-UA.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-uk-UA.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.13.Burning_ISO_images_to_disc' class="book
collapsed">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -755,7 +755,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.SELinux_FAQ' class="book collapsed"
onclick="toggle(event, 'Fedora.8.SELinux_FAQ.types');">
@@ -818,7 +818,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/zh-CN/opds-Fedora.xml b/public_html/zh-CN/opds-Fedora.xml
index 890c2c4..76f5b8e 100644
--- a/public_html/zh-CN/opds-Fedora.xml
+++ b/public_html/zh-CN/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-CN/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>zh-CN</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -156,9 +156,9 @@
<dc:language>zh-CN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>如何使用 Fedora Live 镜像
+ <summary>å¦âä½â使âç¨â Fedora Live éâåâ
</summary>
- <content type="text">如何使用 Fedora Live 镜像</content>
+ <content type="text">å¦âä½â使âç¨â Fedora Live
éâåâ</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/zh-CN/Fedora/14/epub/Fedora_Live...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>zh-CN</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/zh-CN/opds-Fedora_Contributor_Documentation.xml
b/public_html/zh-CN/opds-Fedora_Contributor_Documentation.xml
index 4e419f9..5e5d187 100644
--- a/public_html/zh-CN/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/zh-CN/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-CN/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-CN/opds-Fedora_Core.xml
b/public_html/zh-CN/opds-Fedora_Core.xml
index 9c6c67c..805a527 100644
--- a/public_html/zh-CN/opds-Fedora_Core.xml
+++ b/public_html/zh-CN/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-CN/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-CN/opds-Fedora_Draft_Documentation.xml
b/public_html/zh-CN/opds-Fedora_Draft_Documentation.xml
index 5b90c6b..40fa68b 100644
--- a/public_html/zh-CN/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/zh-CN/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-CN/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-CN/opds.xml b/public_html/zh-CN/opds.xml
index e9ae164..ef0e6f8 100644
--- a/public_html/zh-CN/opds.xml
+++ b/public_html/zh-CN/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/zh-CN/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/zh-CN/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>zh-CN</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/zh-CN/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>zh-CN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/zh-CN/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>zh-CN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/zh-CN/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:50</updated>
<dc:language>zh-CN</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/zh-CN/toc.html b/public_html/zh-CN/toc.html
index 01d67b2..0d39e40 100644
--- a/public_html/zh-CN/toc.html
+++ b/public_html/zh-CN/toc.html
@@ -103,7 +103,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -288,7 +288,7 @@
<a class="type"
href="./Fedora/13/epub/Accessibility_Guide/Fedora-13-Accessibility_Guide-zh-CN.epub"
>epub</a>
<a class="type"
href="./Fedora/13/html/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html/Accessibility_Guide/index.html';return
false;">html</a>
<a class="type"
href="./Fedora/13/html-single/Accessibility_Guide/index.html"
onclick="window.top.location='./Fedora/13/html-single/Accessibility_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-zh-CN.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/fedora-13-Accessibility_Guide-zh-CN.pdf';return
false;">pdf</a>
+ <a class="type"
href="./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-zh-CN.pdf"
onclick="window.top.location='./Fedora/13/pdf/Accessibility_Guide/Fedora-13-Accessibility_Guide-zh-CN.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.13.Burning_ISO_images_to_disc' class="book
collapsed">
@@ -608,7 +608,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -726,7 +726,7 @@
<a class="type"
href="../en-US/./Fedora/10/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/10/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/10/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/10/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/10/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.10.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.10.User_Guide.types');">
@@ -827,7 +827,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.SELinux_FAQ' class="book collapsed"
onclick="toggle(event, 'Fedora.8.SELinux_FAQ.types');">
@@ -890,7 +890,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>
diff --git a/public_html/zh-TW/opds-Fedora.xml b/public_html/zh-TW/opds-Fedora.xml
index bd24ad5..ce95e8b 100644
--- a/public_html/zh-TW/opds-Fedora.xml
+++ b/public_html/zh-TW/opds-Fedora.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-TW/opds-Fedora.xml</id>
<title>Fedora</title>
<subtitle>Fedora</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
@@ -19,13 +19,13 @@
<name></name>
<uri></uri>
</author-->
- <updated>2011-06-13</updated>
+ <updated>2011-06-28</updated>
<dc:language>zh-TW</dc:language>
<category label="15"
scheme="http://lexcycle.com/stanza/header" term="free"/>
<!--dc:issued></dc:issued-->
<summary>Managing Identity and Authorization Policies for Linux-Based
Enterprise Networks
</summary>
- <content type="text">Identity and policy management — for both users
and machines — is a core function for almost any enterprise environment. IPA provides a
way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
+ <content type="text">Identity and policy management â for both
users and machines â is a core function for almost any enterprise environment. IPA
provides a way to create an identity domain that allows machines to enroll to a domain and
immediately access identity information reuqired for single sign-on and authentication
services, as well as policy settings that govern authorization and access. This manual
covers all aspects of installing, configuring, and managing IPA domains, including both
servers and clients. This guide is intended for IT and systems
administrators.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/15/epub/FreeIPA_Gui...
<dc:format>application/epub+zip</dc:format>
</link>
@@ -175,7 +175,7 @@
<dc:language>zh-TW</dc:language>
<category label=""
scheme="http://lexcycle.com/stanza/header"
term="free"/>
<!--dc:issued></dc:issued-->
- <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
+ <summary>Installing Fedora 14 on x86, AMD64, and Intel 64 architectures
</summary>
<content type="text">Provides documentation for the installation
process.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Installatio...
@@ -215,7 +215,7 @@
<!--dc:issued></dc:issued-->
<summary>Managing power consumption on Fedora
</summary>
- <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
+ <content type="text">This document explains how to manage power
consumption on Fedora 14 systems effectively. The following sections discuss different
techniques that lower power consumption (for both server and laptop), and how each
technique affects the overall performance of your system. Please note: This document is
still under development, is subject to heavy change, and is provided here as a preview.
The content and instructions contained within should not be considered complete, and
should be used with caution.</content>
<link type="application/epub+zip"
rel="http://opds-spec.org/acquisition"
href="http://docs.fedoraproject.org/en-US/Fedora/14/epub/Power_Manag...
<dc:format>application/epub+zip</dc:format>
</link>
diff --git a/public_html/zh-TW/opds-Fedora_Contributor_Documentation.xml
b/public_html/zh-TW/opds-Fedora_Contributor_Documentation.xml
index c41445d..f52d2e5 100644
--- a/public_html/zh-TW/opds-Fedora_Contributor_Documentation.xml
+++ b/public_html/zh-TW/opds-Fedora_Contributor_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-TW/opds-Fedora_Contributor_Documen...
<title>Fedora Contributor Documentation</title>
<subtitle>Fedora Contributor Documentation</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-TW/opds-Fedora_Core.xml
b/public_html/zh-TW/opds-Fedora_Core.xml
index 4e88976..075add4 100644
--- a/public_html/zh-TW/opds-Fedora_Core.xml
+++ b/public_html/zh-TW/opds-Fedora_Core.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-TW/opds-Fedora_Core.xml</id>
<title>Fedora Core</title>
<subtitle>Fedora Core</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-TW/opds-Fedora_Draft_Documentation.xml
b/public_html/zh-TW/opds-Fedora_Draft_Documentation.xml
index 2c1158f..99357f6 100644
--- a/public_html/zh-TW/opds-Fedora_Draft_Documentation.xml
+++ b/public_html/zh-TW/opds-Fedora_Draft_Documentation.xml
@@ -6,7 +6,7 @@
<
id>http://docs.fedoraproject.org/zh-TW/opds-Fedora_Draft_Documentation...
<title>Fedora Draft Documentation</title>
<subtitle>Fedora Draft Documentation</subtitle>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
diff --git a/public_html/zh-TW/opds.xml b/public_html/zh-TW/opds.xml
index 0748a95..3a90a89 100644
--- a/public_html/zh-TW/opds.xml
+++ b/public_html/zh-TW/opds.xml
@@ -6,7 +6,7 @@
<link
rel="http://opds-spec.org/crawlable"
type="application/atom+xml"
href="http://bookserver.archive.org/catalog/crawlable" title="Crawlable
feed"/>
<
id>http://docs.fedoraproject.org/zh-TW/opds.xml</id>
<title>Product List</title>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<!--author>
<name></name>
<uri></uri>
@@ -15,7 +15,7 @@
<entry>
<title>Fedora</title>
<
id>http://docs.fedoraproject.org/zh-TW/Fedora/opds-Fedora.xml</id>
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<dc:language>zh-TW</dc:language>
<content type="text"></content>
<link type="application/atom+xml" href="opds-Fedora.xml"/>
@@ -23,7 +23,7 @@
<entry>
<title>Fedora Contributor Documentation</title>
<
id>http://docs.fedoraproject.org/zh-TW/Fedora_Contributor_Documentatio...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<dc:language>zh-TW</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Contributor_Documentation.xml"/>
@@ -31,7 +31,7 @@
<entry>
<title>Fedora Core</title>
<
id>http://docs.fedoraproject.org/zh-TW/Fedora_Core/opds-Fedora_Core.xm...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<dc:language>zh-TW</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Core.xml"/>
@@ -39,7 +39,7 @@
<entry>
<title>Fedora Draft Documentation</title>
<
id>http://docs.fedoraproject.org/zh-TW/Fedora_Draft_Documentation/opds...
- <updated>2011-06-28T19:47:10</updated>
+ <updated>2011-06-28T21:51:51</updated>
<dc:language>zh-TW</dc:language>
<content type="text"></content>
<link type="application/atom+xml"
href="opds-Fedora_Draft_Documentation.xml"/>
diff --git a/public_html/zh-TW/toc.html b/public_html/zh-TW/toc.html
index 867b78f..6bbf130 100644
--- a/public_html/zh-TW/toc.html
+++ b/public_html/zh-TW/toc.html
@@ -104,7 +104,7 @@
<a class="type"
href="../en-US/./Fedora/15/epub/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/15/html/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html/FreeIPA_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/15/html-single/FreeIPA_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Fedora-15-FreeIPA_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/15/pdf/FreeIPA_Guide/Drafts-1-Enterprise_Identity_Management_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.15.Installation_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.15.Installation_Guide.types');">
@@ -609,7 +609,7 @@
<a class="type"
href="../en-US/./Fedora/11/epub/Security_Guide/Fedora-11-Security_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/11/html/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html/Security_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/11/html-single/Security_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/11/html-single/Security_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/Fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/11/pdf/Security_Guide/fedora-11-Security_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.11.User_Guide' class="book collapsed"
onclick="toggle(event, 'Fedora.11.User_Guide.types');">
@@ -738,7 +738,7 @@
<a class="type"
href="../en-US/./Fedora/8/epub/Installation_Guide/Fedora-8-Installation_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/8/html/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html/Installation_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/8/html-single/Installation_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/8/html-single/Installation_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-9-Installation_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/8/pdf/Installation_Guide/Fedora-8-Installation_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
<div id='Fedora.8.Making_Fedora_Discs' class="book collapsed"
onclick="toggle(event, 'Fedora.8.Making_Fedora_Discs.types');">
@@ -819,7 +819,7 @@
<a class="type"
href="../en-US/./Fedora/0.1/epub/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.epub"
>epub</a>
<a class="type"
href="../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html/Amateur_Radio_Guide/index.html';return
false;">html</a>
<a class="type"
href="../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html"
onclick="window.top.location='../en-US/./Fedora/0.1/html-single/Amateur_Radio_Guide/index.html';return
false;">html-single</a>
- <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora_Draft_Documentation-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
+ <a class="type"
href="../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf"
onclick="window.top.location='../en-US/./Fedora/0.1/pdf/Amateur_Radio_Guide/Fedora-0.1-Amateur_Radio_Guide-en-US.pdf';return
false;">pdf</a>
</div>
</div>
</div>