3.9. Renaming Client Machines
3.9. Renaming Client Machines This section explains how to rename an IdM client. The process involves: the section called "Identifying Current Service and Keytab Configuration" . the section called "Removing the Client Machine from the IdM Domain" . the section called "Re-enrolling the Client with a New Host Name" . Warning Renaming a client is a manual procedure. Red Hat does not recommend it unless changing the host name is absolutely required. Identifying Current Service and Keytab Configuration Before uninstalling the current client, make note of certain settings for the client. You will apply this configuration after re-enrolling the machine with a new host name. Identify which services are running on the machine: Use the ipa service-find command, and identify services with certificates in the output: In addition, each host has a default host service which does not appear in the ipa service-find output. The service principal for the host service, also called a host principal , is host/client.example.com . Identify all host groups to which the machine belongs. For all service principals displayed by ipa service-find client.example.com , determine the location of the corresponding keytabs on client.example.com . Each service on the client system has a Kerberos principal in the form service_name/hostname@REALM , such as ldap/client.example.com@EXAMPLE.COM . Removing the Client Machine from the IdM Domain Unenroll the client machine from the IdM domain. See Section 3.7, "Uninstalling a Client" . For each identified keytab other than /etc/krb5.keytab , remove the old principals: See Section 29.4, "Removing Keytabs" . On an IdM server, remove the host entry. This removes all services and revokes all certificates issued for that host: At this point, the host is completely removed from IdM. Re-enrolling the Client with a New Host Name Rename the machine as required. Re-enroll the machine as an IdM client. See Section 3.8, "Re-enrolling a Client into the IdM Domain" . On an IdM server, add a new keytab for every service identified in the section called "Identifying Current Service and Keytab Configuration" . Generate certificates for services that had a certificate assigned in the section called "Identifying Current Service and Keytab Configuration" . You can do this: Using the IdM administration tools. See Chapter 24, Managing Certificates for Users, Hosts, and Services . Using the certmonger utility. See Working with certmonger in the System-Level Authentication Guide or the certmonger (8) man page. Re-add the client to the host groups identified in the section called "Identifying Current Service and Keytab Configuration" . See Section 13.3, "Adding and Removing User or Host Group Members" .
ipa service-find client.example.com ipa hostgroup-find client.example.com ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM ipa host-del client.example.com ipa service-add service_name/new_host_name