Hosts
What a host object is, what "Enrolled" means, how the managed-host cap is enforced, and where host groups sit in policy.
A Linux machine joined to the domain is a host object in the directory: a Kerberos principal host/<fqdn>, a keytab, and attributes. HBAC, sudo, automount and ID views all target hosts or host groups.
List columns
| Column | Meaning |
|---|---|
| Host name | FQDN; must resolve through IPA DNS or the client's DNS. The name is the key, so renaming is delete and re-add |
| Description | free text |
| Enrolled | True once the host obtained its keytab through ipa-client-install. False is a host pre-created in the directory that has not joined yet |
A pre-created (unenrolled) host can already be put in host groups and rules; policy applies the moment the machine joins.
Managed-host cap
The licence tier caps the number of managed hosts (see Licence). A server-side plugin enforces it in host-add: beyond the cap the add is refused, in the UI and in ipa host-add alike. The count is the number of host objects in the directory, unenrolled ones included; IPA servers and replicas themselves are excluded.
At the cap: remove hosts no longer in use (ipa host-disable first to revoke the keytab, then delete) or move up a tier. Current count: ipa host-find --sizelimit=0 | tail -1.
Detail page
| Block | Holds | Notes |
|---|---|---|
| Host settings | principal aliases, description, class, locality, location, platform, OS, MAC address, SSH public keys | Platform / OS are reported once by ipa-client-install and not synced afterwards |
| Enrollment | keytab state, enrolled by | Unprovision revokes the keytab; the host can no longer authenticate with Kerberos but the object stays |
| Host certificate | certificate issued by the IPA CA | Certificate issuance is in every tier |
| Allow to retrieve / create keytab | users / groups / hosts allowed to fetch or regenerate this host's keytab | For automation (Ansible, image provisioning) |
| Authentication indicators | require tickets for this host to carry a specific method (OTP, RADIUS, PKINIT…) | Once set, a password-only ticket does not get in |
| Trusted for delegation | let this host obtain tickets to other services on the user's behalf | Only for gateway-type hosts that really forward credentials |
"Is a member of" lists host groups, netgroups, roles, HBAC and sudo rules; "Is managed by" lists other hosts allowed to manage this one (managedby), used to let host A obtain certificates or keytabs for host B.
Host groups
Host groups are the unit of policy. Rules are written against groups; adding a machine changes membership only. Name them by role (webservers, dbservers, bastion), not by rack. For membership by hostname pattern use Automember.
ipaservers is maintained by the installer and holds every IPA server; leave it alone.
Boundaries
- Renaming a host: delete, re-add, then re-run
ipa-client-installon the client. - Deleting a host does not remove its A / PTR records from IPA DNS (
ipa host-del --updatednsdoes). - The UI cannot see the client's sssd state; whether a login works on the client is in
/var/log/sssd/there.
Users
The three user states, why delete means "move to Preserved", what each block of the detail page holds, and which fields depend on licence modules.
Services
How service principals are named, when one is needed, how certificates and keytabs reach it, and what the PAC type and pre-authentication options mean.