Hosts
What a host object consists of, what Enrolled means, how the managed-host cap is enforced, and where host groups sit in policy.
This page covers the Hosts and Host groups pages under Identity. A Linux machine joined to the domain is a host object in the directory: a Kerberos principal host/<fqdn>, a keytab and attributes. HBAC, sudo, automount and ID views all target hosts or host groups.
List columns
| Column | Meaning |
|---|---|
| Host name | FQDN; must resolve through IPA DNS or the client's DNS. The name is the key, so renaming is delete and re-add |
| Description | Free text |
| Enrolled | True once the host obtained its keytab through ipa-client-install. False is a host pre-created in the directory that has not joined yet |
A pre-created (unenrolled) host can already be placed in host groups and rules; policy applies the moment the machine joins.
Managed-host cap
The licence tier caps the number of managed hosts (see Licence). A server-side plugin enforces the cap in host-add: beyond it the add is refused, in the UI and in ipa host-add alike. The count is the number of host objects in the directory, unenrolled ones included; IPA servers and replicas themselves are excluded.
At the cap, remove hosts no longer in use (ipa host-disable first to revoke the keytab, then delete) or move up a tier. The current count is ipa host-find --sizelimit=0 | tail -1.
Detail page
| Block | Holds | Notes |
|---|---|---|
| Host settings | Principal aliases, description, class, locality, location, platform, OS, MAC address, SSH public keys | Platform and OS are reported once by ipa-client-install and not synced afterwards |
| Enrollment | Keytab state, enrolled by | Unprovision revokes the keytab; the host can no longer authenticate with Kerberos but the object stays |
| Host certificate | Certificate issued by the IPA CA | Certificate issuance is in every tier |
| Allow to retrieve keytab, Allow to create keytab | Users, groups and hosts allowed to fetch or regenerate this host's keytab | For automation (Ansible, image provisioning) |
| Authentication indicators | Require tickets for this host to carry a specific method (OTP, RADIUS, PKINIT and so on) | Once set, a password-only ticket is refused |
| Trusted for delegation | Let this host obtain tickets to other services on the user's behalf | Only for gateway-type hosts that forward credentials |
Is a member of lists host groups, netgroups, roles, HBAC and sudo rules. Is managed by lists other hosts allowed to manage this one (managedby), used to let host A obtain certificates or keytabs for host B.
Host groups
Host groups are the unit of policy. Rules are written against groups; adding a machine changes membership only. Name them by role (webservers, dbservers, bastion), not by rack. For membership by hostname pattern see Automember.
ipaservers is maintained by the installer and holds every IPA server. Do not edit it by hand.
Boundaries
| Topic | Notes |
|---|---|
| Renaming a host | Delete, re-add, then rerun ipa-client-install on the client |
| DNS records after deletion | Deleting a host does not remove its A and PTR records from IPA DNS; ipa host-del --updatedns does |
| Client login state | The UI cannot see the client's sssd state. Whether a login works on the client is recorded in /var/log/sssd/ there |
Users
The three user states, why delete means move to Preserved, what each block of the detail page holds, and which fields depend on licence modules.
Services
How service principals are named, when one is needed, how certificates and keytabs reach it, and what the PAC type and pre-authentication options mean.