Linux websever 5.15.0-153-generic #163-Ubuntu SMP Thu Aug 7 16:37:18 UTC 2025 x86_64
Apache/2.4.52 (Ubuntu)
: 192.168.3.70 | : 192.168.1.99
Cant Read [ /etc/named.conf ]
8.1.2-1ubuntu2.23
urlab
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
realmd /
html /
[ HOME SHELL ]
Name
Size
Permission
Action
book.devhelp2
7.21
KB
-rw-r--r--
dbus-interface-raw.html
4.93
KB
-rw-r--r--
dbus-interface-reference.html
2.57
KB
-rw-r--r--
development.html
2.71
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.K...
3.77
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.K...
16.01
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.P...
8.74
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.R...
19.67
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.S...
7.79
KB
-rw-r--r--
gtk-doc.css
8.64
KB
-rw-r--r--
guide-active-directory-client....
4.33
KB
-rw-r--r--
guide-active-directory-join.ht...
4.97
KB
-rw-r--r--
guide-active-directory-permit....
2.77
KB
-rw-r--r--
guide-active-directory.html
4.39
KB
-rw-r--r--
guide-integration.html
1.55
KB
-rw-r--r--
guide-ipa-client.html
1.87
KB
-rw-r--r--
guide-ipa-join.html
3.59
KB
-rw-r--r--
guide-ipa-permit.html
2.76
KB
-rw-r--r--
guide-ipa.html
3.89
KB
-rw-r--r--
guide-kerberos.html
3.41
KB
-rw-r--r--
guide.html
3.68
KB
-rw-r--r--
home.png
566
B
-rw-r--r--
index.html
4.39
KB
-rw-r--r--
left.png
362
B
-rw-r--r--
realm-manual.html
1.82
KB
-rw-r--r--
realm.html
19.56
KB
-rw-r--r--
realmd-conf.html
20.47
KB
-rw-r--r--
right.png
377
B
-rw-r--r--
style.css
1.71
KB
-rw-r--r--
up.png
287
B
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : realm.html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>realm: realmd</title> <meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"> <link rel="home" href="index.html" title="realmd"> <link rel="up" href="realm-manual.html" title="Command manual pages"> <link rel="prev" href="realm-manual.html" title="Command manual pages"> <link rel="next" href="realmd-conf.html" title="realmd.conf"> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> <table class="navigation" id="top" width="100%" summary="Navigation header" cellpadding="2" cellspacing="5"><tr valign="middle"> <td width="100%" align="left" class="shortcuts"></td> <td><a accesskey="h" href="index.html"><img src="home.png" width="16" height="16" border="0" alt="Home"></a></td> <td><a accesskey="u" href="realm-manual.html"><img src="up.png" width="16" height="16" border="0" alt="Up"></a></td> <td><a accesskey="p" href="realm-manual.html"><img src="left.png" width="16" height="16" border="0" alt="Prev"></a></td> <td><a accesskey="n" href="realmd-conf.html"><img src="right.png" width="16" height="16" border="0" alt="Next"></a></td> </tr></table> <div class="refentry"> <a name="realm"></a><div class="titlepage"></div> <div class="refnamediv"><table width="100%"><tr> <td valign="top"> <h2><span class="refentrytitle">realm</span></h2> <p>realm — Manage enrollment in realms</p> </td> <td class="gallery_image" valign="top" align="right"></td> </tr></table></div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> <div class="cmdsynopsis"><p><code class="command">realm discover</code> [realm-name]</p></div> <div class="cmdsynopsis"><p><code class="command">realm join</code> [-U user] [realm-name]</p></div> <div class="cmdsynopsis"><p><code class="command">realm leave</code> [-U user] [realm-name]</p></div> <div class="cmdsynopsis"><p><code class="command">realm list</code> </p></div> <div class="cmdsynopsis"><p><code class="command">realm permit</code> [-ax] [-R realm] {user@domain...}</p></div> <div class="cmdsynopsis"><p><code class="command">realm deny</code> -a [-R realm]</p></div> </div> <div class="refsect1"> <a name="man-description"></a><h2>Description</h2> <p><span class="command"><strong>realm</strong></span> is a command line tool that can be used to manage enrollment in kerberos realms, like Active Directory domains or IPA domains.</p> <p>See the various sub commands below. The following global options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-i</code>, <code class="option">--install=/path</code></span></p></td> <td><p>Run in install mode. This makes realmd chroot into the directory specified by an absolute path and place files in appropriate locations for use during an installer. No packages will be installed or services will be started when running in this mode. </p></td> </tr> <tr> <td><p><span class="term"><code class="option">--unattended</code></span></p></td> <td><p>Run in unattended mode without prompting for input.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-v</code>, <code class="option">--verbose</code></span></p></td> <td><p>Display verbose diagnostics while doing running commands.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-discover"></a><h2>Discover</h2> <p>Discover a realm and its capabilities.</p> <div class="informalexample"> <pre class="programlisting"> $ realm discover </pre> <pre class="programlisting"> $ realm discover domain.example.com </pre> </div> <p>After discovering a realm, its name, type and capabilities are displayed.</p> <p>If no domain is specified, then the domain assigned through DHCP is used as a default.</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-a</code>, <code class="option">--all</code></span></p></td> <td><p>Show all discovered realms (in various configurations).</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--client-software=xxx</code></span></p></td> <td><p>Only discover realms for which we can use the given client software. Possible values include <em class="replaceable"><code>sssd</code></em> or <em class="replaceable"><code>winbind</code></em>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-n</code>, <code class="option">--name</code></span></p></td> <td><p>Only show the names of the discovered realms.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--server-software=xxx</code></span></p></td> <td><p>Only discover realms which run the given server software. Possible values include <em class="replaceable"><code>active-directory</code></em> or <em class="replaceable"><code>ipa</code></em>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--membership-software=xxx</code></span></p></td> <td><p>Only discover realms for which the given membership software can be used to subsequently perform enrollment. Possible values include <em class="replaceable"><code>samba</code></em> or <em class="replaceable"><code>adcli</code></em>. </p></td> </tr> <tr> <td><p><span class="term"><code class="option">--use-ldaps</code></span></p></td> <td><p>See option description in <a class="xref" href="realm.html#man-join" title="Join">the section called “Join”</a>.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-join"></a><h2>Join</h2> <p>Configure the local machine for use with a realm.</p> <div class="informalexample"> <pre class="programlisting"> $ realm join domain.example.com </pre> <pre class="programlisting"> $ realm join --user=admin --computer-ou=OU=Special domain.example.com </pre> </div> <p>The realm is first discovered, as we would with the <code class="option">discover</code> command. If no domain is specified, then the domain assigned through DHCP is used as a default.</p> <p>After a successful join, the computer will be in a state where it is able to resolve remote user and group names from the realm. For kerberos realms, a computer account and host keytab is created.</p> <p>Joining arbitrary kerberos realms is not supported. The realm must have a supported mechanism for joining from a client machine, such as Active Directory or IPA.</p> <p>If the domain has been preconfigured, and unless <code class="literal">--user</code> is explicitly specified, an automatic join is attempted first.</p> <p>Note that the <code class="literal">--user </code>, <code class="literal">--no-password</code>, and <code class="literal">--one-time-password </code> options are mutually exclusive. At most one of them can be specified.</p> <p>It is generally possible to use kerberos credentials to perform a join operation. Use the <span class="command"><strong>kinit</strong></span> command to acquire credentials prior to starting the join. Do not specify the <code class="option">--user</code> argument, the user will be selected automatically from the credential cache. The <span class="command"><strong>realm</strong></span> respects the <code class="literal">KRB5_CCACHE</code> environment variable, but uses the default kerberos credential cache if it's not present. Not all types of servers can be joined using kerberos credentials, some (like IPA) insist on prompting for a password.</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--automatic-id-mapping=no</code></span></p></td> <td><p>Do not perform UID/GID mapping for users and groups, but expect these identifiers to be present in the domain already.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--client-software=xxx</code></span></p></td> <td><p>Only join realms for which we can use the given client software. Possible values include <em class="replaceable"><code>sssd</code></em> or <em class="replaceable"><code>winbind</code></em>. Not all values are supported for all realms. By default the client software is automatically selected.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--computer-ou=OU=xxx</code></span></p></td> <td><p>The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on the client software and membership software. You can usually omit the root DSE portion of distinguished name. This is an Active Directory specific option.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--membership-software=xxx</code></span></p></td> <td><p>The software to use when joining to the realm. Possible values include <em class="replaceable"><code>samba</code></em> or <em class="replaceable"><code>adcli</code></em>. Not all values are supported for all realms. By default the membership software is automatically selected.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--computer-name=xxx</code></span></p></td> <td> <p>This option only applies to Active Directory realms. Specify this option to override the default name used when creating the computer account. The system's FQDN will still be saved in the dNSHostName attribute.</p> <p>Specify the name as a string of 15 or fewer characters that is a valid NetBIOS computer name.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">--no-password</code></span></p></td> <td><p>Perform the join automatically without a password.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--one-time-password=xxxx</code></span></p></td> <td><p>Perform the join using a one time password specified on the command line. This is not possible with all types of realms.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-name=xxx</code></span></p></td> <td><p>The name of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-version=xxx</code></span></p></td> <td><p>The version of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--server-software=xxx</code></span></p></td> <td><p>Only join realms for run the given server software. Possible values include <em class="replaceable"><code>active-directory</code></em> or <em class="replaceable"><code>ipa</code></em>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-U</code>, <code class="option">--user=xxx</code></span></p></td> <td><p>The user name to be used to authenticate with when joining the machine to the realm. You will be prompted for a password.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--user-principal=<em class="parameter"><code>host/name@REALM</code></em></code></span></p></td> <td> <p>Set the <code class="option">userPrincipalName</code> field of the computer account to this kerberos principal. If you omit the value for this option, then a principal will be set based on the defaults of the membership software.</p> <p>AD makes a distinction between user and service principals. Only with user principals you can request a Kerberos Ticket-Granting-Ticket (TGT), i.e. only user principals can be used with the <span class="command"><strong>kinit</strong></span> command. By default the user principal and the canonical principal name of an AD computer account is <code class="code">shortname$@AD.DOMAIN</code>, where shortname is the NetBIOS name which is limited to 15 characters.</p> <p>If there are applications which are not aware of the AD default and are using a hard-coded default principal the <code class="option">--user-principal</code> can be used to make AD aware of this principal. Please note that <code class="option">userPrincipalName</code> is a single value LDAP attribute, i.e. only one alternative user principal besides the AD default user principal can be set.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">--use-ldaps</code></span></p></td> <td> <p>Use the ldaps port when connecting to AD where possible. In general this option is not needed because <span class="command"><strong>realmd</strong></span> itself only read public information from the Active Directory domain controller which is available anonymously. The supported membership software products will use encrypted connections protected with GSS-SPNEGO/GSSAPI which offers a comparable level of security than ldaps. This option is only needed if the standard LDAP port (389/tcp) is blocked by a firewall and only the LDAPS port (636/tcp) is available. Given that and to lower the initial effort to discover a remote domain <span class="command"><strong>realmd</strong></span> does not require a strict certificate check. If the validation of the LDAP server certificate fails <span class="command"><strong>realmd</strong></span> will continue to setup the encrypted connection to the LDAP server.</p> <p>If this option is set to <em class="parameter"><code>yes</code></em> <span class="command"><strong>realmd</strong></span> will use the ldaps port when reading the rootDSE and call the <span class="command"><strong>adcli</strong></span> membership software with the option <code class="option">--use-ldaps</code>. The Samba base membership currently offers only deprecated ways to enable ldaps. Support will be added in <span class="command"><strong>realmd</strong></span> when a new way is available. </p> </td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-leave"></a><h2>Leave</h2> <p>Deconfigure the local machine for use with a realm.</p> <div class="informalexample"> <pre class="programlisting"> $ realm leave </pre> <pre class="programlisting"> $ realm leave domain.example.com </pre> </div> <p>If no realm name is specified, then the first configured realm will be used.</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--client-software=xxx</code></span></p></td> <td><p>Only leave the realm which is using the given client software. Possible values include <em class="replaceable"><code>sssd</code></em> or <em class="replaceable"><code>winbind</code></em>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--server-software=xxx</code></span></p></td> <td><p>Only leave the realm which is using the given server software. Possible values include <em class="replaceable"><code>active-directory</code></em> or <em class="replaceable"><code>ipa</code></em>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--remove</code></span></p></td> <td><p>Remove or disable computer account from the directory while leaving the realm. This will usually prompt for a pasword.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-U</code>, <code class="option">--user</code></span></p></td> <td><p>The user name to be used to authenticate with when leaving the realm. You will be prompted for a password. Implies <code class="option">--remove</code>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--use-ldaps</code></span></p></td> <td><p>See option description in <a class="xref" href="realm.html#man-join" title="Join">the section called “Join”</a>.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-list"></a><h2>List</h2> <p>List all the discovered and configured realms.</p> <div class="informalexample"><pre class="programlisting"> $ realm list </pre></div> <p>By default, realms that have been discovered, but not configured (using the <code class="option">join</code> command), are not displayed. Also, by default, the list of realm details displayed is verbose. The options below can be used to change this default behavior</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--all</code></span></p></td> <td><p>Show all discovered realms (whether or not they have been configured). </p></td> </tr> <tr> <td><p><span class="term"><code class="option">--name-only</code></span></p></td> <td><p>Display only realm names (as opposed to verbose output).</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-permit"></a><h2>Permit</h2> <p>Permit local login by users of the realm.</p> <div class="informalexample"><pre class="programlisting"> $ realm permit --all $ realm permit user@example.com $ realm permit DOMAIN\\User2 $ realm permit --withdraw user@example.com </pre></div> <p>The current login policy and format of the user names can be seen by using the <span class="command"><strong>realm list</strong></span> command.</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--all, -a</code></span></p></td> <td><p>Permit logins using realm accounts on the local machine according to the realm policy.This usually defaults to allowing any realm user to log in.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--groups, -g</code></span></p></td> <td><p>Treat the specified names as groups rather than user login names. Permit login by users in the specified groups.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--realm, -R</code></span></p></td> <td><p>Specify the of the realm to change login policy for.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--withdraw, -x</code></span></p></td> <td><p>Remove a login from the list of realm accounts permitted to log into the machine.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="man-deny"></a><h2>Deny</h2> <p>Deny local login by realm accounts.</p> <div class="informalexample"><pre class="programlisting"> $ realm deny --all </pre></div> <p>This command prevents realm accounts from logging into the local machine. Use <span class="command"><strong>realm permit</strong></span> to restrict logins to specific accounts.</p> <p>The following options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--all, -a</code></span></p></td> <td><p>This option should be specified</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--realm, -R</code></span></p></td> <td><p>Specify the name of the realm to deny users login to.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="realm_see_also"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">realmd.conf</span>(5)</span></p> </div> </div> <div class="footer"> <hr>Generated by GTK-Doc</div> </body> </html>
Close
