Linux websever 5.15.0-153-generic #163-Ubuntu SMP Thu Aug 7 16:37:18 UTC 2025 x86_64
Apache/2.4.52 (Ubuntu)
: 192.168.3.70 | : 192.168.1.99
Cant Read [ /etc/named.conf ]
8.1.2-1ubuntu2.23
urlab
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
realmd /
html /
[ HOME SHELL ]
Name
Size
Permission
Action
book.devhelp2
7.21
KB
-rw-r--r--
dbus-interface-raw.html
4.93
KB
-rw-r--r--
dbus-interface-reference.html
2.57
KB
-rw-r--r--
development.html
2.71
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.K...
3.77
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.K...
16.01
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.P...
8.74
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.R...
19.67
KB
-rw-r--r--
gdbus-org.freedesktop.realmd.S...
7.79
KB
-rw-r--r--
gtk-doc.css
8.64
KB
-rw-r--r--
guide-active-directory-client....
4.33
KB
-rw-r--r--
guide-active-directory-join.ht...
4.97
KB
-rw-r--r--
guide-active-directory-permit....
2.77
KB
-rw-r--r--
guide-active-directory.html
4.39
KB
-rw-r--r--
guide-integration.html
1.55
KB
-rw-r--r--
guide-ipa-client.html
1.87
KB
-rw-r--r--
guide-ipa-join.html
3.59
KB
-rw-r--r--
guide-ipa-permit.html
2.76
KB
-rw-r--r--
guide-ipa.html
3.89
KB
-rw-r--r--
guide-kerberos.html
3.41
KB
-rw-r--r--
guide.html
3.68
KB
-rw-r--r--
home.png
566
B
-rw-r--r--
index.html
4.39
KB
-rw-r--r--
left.png
362
B
-rw-r--r--
realm-manual.html
1.82
KB
-rw-r--r--
realm.html
19.56
KB
-rw-r--r--
realmd-conf.html
20.47
KB
-rw-r--r--
right.png
377
B
-rw-r--r--
style.css
1.71
KB
-rw-r--r--
up.png
287
B
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : realmd-conf.html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>realmd.conf: realmd</title> <meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"> <link rel="home" href="index.html" title="realmd"> <link rel="up" href="realm-manual.html" title="Command manual pages"> <link rel="prev" href="realm.html" title="realm"> <link rel="next" href="guide-active-directory.html" title="Using with Active Directory"> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> <table class="navigation" id="top" width="100%" summary="Navigation header" cellpadding="2" cellspacing="5"><tr valign="middle"> <td width="100%" align="left" class="shortcuts"></td> <td><a accesskey="h" href="index.html"><img src="home.png" width="16" height="16" border="0" alt="Home"></a></td> <td><a accesskey="u" href="realm-manual.html"><img src="up.png" width="16" height="16" border="0" alt="Up"></a></td> <td><a accesskey="p" href="realm.html"><img src="left.png" width="16" height="16" border="0" alt="Prev"></a></td> <td><a accesskey="n" href="guide-active-directory.html"><img src="right.png" width="16" height="16" border="0" alt="Next"></a></td> </tr></table> <div class="refentry"> <a name="realmd-conf"></a><div class="titlepage"></div> <div class="refnamediv"><table width="100%"><tr> <td valign="top"> <h2><span class="refentrytitle">realmd.conf</span></h2> <p>realmd.conf — Tweak behavior of realmd</p> </td> <td class="gallery_image" valign="top" align="right"></td> </tr></table></div> <div class="refsect1"> <a name="realmd-conf-file"></a><h2>Configuration File</h2> <p><span class="command"><strong>realmd</strong></span> can be tweaked by network administrators to act in specific ways. This is done by placing settings in a <code class="filename">/etc/realmd.conf</code>. This file does not exist by default. The syntax of this file is the same as an INI file or Desktop Entry file. If the file is changed and <span class="command"><strong>realmd</strong></span> is running <span class="command"><strong>realmd</strong></span> must be restarted to read the new values.</p> <p>In general, settings in this file only apply at the point of joining a domain or realm. Once the realm has been setup the settings have no effect. You may choose to configure <a class="ulink" href="https://fedorahosted.org/sssd/" target="_top">SSSD</a> or <a class="ulink" href="http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/winbind.html" target="_top">Winbind</a> directly.</p> <p>Only specify the settings you wish to override in the <code class="filename">/etc/realmd.conf</code> file. Settings not specified will be loaded from their packaged defaults which can be found in <code class="filename">/usr/lib/realmd/realmd-defaults.conf</code> and <code class="filename">/usr/lib/realmd/realmd-distro.conf</code>. Only override the settings below. You may find other settings if you look through the <span class="command"><strong>realmd</strong></span> source code. However these are not guaranteed to remain stable.</p> <p>There are various sections in the config file. Some sections are global topic sections, and are listed below. Other sections are specific to a given realm. These realm specific sections should always contain the domain name in lower case as their section header.</p> <p>Examples of each setting is found below, including the header of the section it should be placed in. However in the resulting file only include each section once, and combine the various section setting together as lines underneath the section. For example</p> <div class="informalexample"><pre class="programlisting"> [users] default-home = /home/%U default-shell = /bin/bash </pre></div> </div> <div class="refsect1"> <a name="realmd-conf-active-directory"></a><h2>active-directory</h2> <p>These options should go in an <code class="option">[active-directory]</code> section of the <code class="filename">/etc/realmd.conf</code> file. Only specify the settings you wish to override.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">default-client</code></span></p></td> <td> <p>Specify the <code class="option">default-client</code> setting in order to control which client software is the preferred default for use with Active Directory.</p> <div class="informalexample"><pre class="programlisting"> [active-directory] default-client = sssd # default-client = winbind </pre></div> <p>The default setting for this is <code class="option">sssd</code> which uses <a class="ulink" href="https://fedorahosted.org/sssd/" target="_top">SSSD</a> as the Active Directory client. You can also specify <code class="option">winbind</code> to use <a class="ulink" href="http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/winbind.html" target="_top">Samba Winbind</a>. </p> <p>Some callers of <span class="command"><strong>realmd</strong></span> such as the <a class="link" href="realm.html" title="realm"><span class="command"><strong>realm</strong></span></a> command line tool allow specifying which client software should be used. Others, such as GNOME Control Center, simplify choose the default.</p> <p>You can verify the preferred default client softawre by running the following command. The realm with the preferred client software will be listed first.</p> <div class="informalexample"><pre class="screen"> $ <span class="command"><strong>realm discover domain.example.com</strong></span> domain.example.com configured: no server-software: active-directory client-software: sssd type: kerberos realm-name: AD.THEWALTER.LAN domain-name: ad.thewalter.lan domain.example.com configured: no server-software: active-directory client-software: winbind type: kerberos realm-name: AD.THEWALTER.LAN domain-name: ad.thewalter.lan </pre></div> </td> </tr> <tr> <td><p><span class="term"><code class="option">use-ldaps</code></span></p></td> <td> <p>Use the ldaps port when connecting to AD where possible. In general this option is not needed because <span class="command"><strong>realmd</strong></span> itself only read public information from the Active Directory domain controller which is available anonymously. The supported membership software products will use encrypted connections protected with GSS-SPNEGO/GSSAPI which offers a comparable level of security than ldaps. This option is only needed if the standard LDAP port (389/tcp) is blocked by a firewall and only the LDAPS port (636/tcp) is available.</p> <p>If this option is set to <em class="parameter"><code>yes</code></em> <span class="command"><strong>realmd</strong></span> will use the ldaps port when reading the rootDSE and call the <span class="command"><strong>adcli</strong></span> membership software with the option <code class="option">--use-ldaps</code>. The Samba base membership currently offers only deprecated ways to enable ldaps. Support will be added in <span class="command"><strong>realmd</strong></span> when a new way is available.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">os-name</code></span></p></td> <td><p>(see below)</p></td> </tr> <tr> <td><p><span class="term"><code class="option">os-version</code></span></p></td> <td> <p>Specify the <code class="option">os-name</code> and/or <code class="option">os-version</code> settings to control the values that are placed in the computer account <code class="option">operatingSystem</code> and <code class="option">operatingSystemVersion</code> attributes.</p> <p>This is an Active Directory specific option.</p> <p>It is also possible to use the <code class="option">--os-name</code> or <code class="option">--os-version</code> argument of the <span class="command"><strong>realm</strong></span> command to override the default values.</p> <div class="informalexample"><pre class="programlisting"> [active-directory] os-name = Gentoo Linux os-version = 9.9.9.9.9 </pre></div> </td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="realmd-conf-service"></a><h2>service</h2> <p>These options should go in an <code class="option">[service]</code> section of the <code class="filename">/etc/realmd.conf</code> file. Only specify the settings you wish to override.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">automatic-install</code></span></p></td> <td> <p>Set this to <em class="parameter"><code>no</code></em> to disable automatic installation of packages via package-kit.</p> <div class="informalexample"><pre class="programlisting"> [service] automatic-install = no # automatic-install = yes </pre></div> </td> </tr> <tr> <td><p><span class="term"><code class="option">legacy-samba-config</code></span></p></td> <td> <p>Set this to <em class="parameter"><code>yes</code></em> to create a Samba configuration file with id-mapping options used by Samba-3.5 and earlier version.</p> <div class="informalexample"><pre class="programlisting"> [service] legacy-samba-config = no # legacy-samba-config = yes </pre></div> </td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="realmd-conf-users"></a><h2>users</h2> <p>These options should go in an <code class="option">[users]</code> section of the <code class="filename">/etc/realmd.conf</code> file. Only specify the settings you wish to override.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">default-home</code></span></p></td> <td> <p>Specify the <code class="option">default-home</code> setting in order to control how to set the home directory for accounts that have no home directory explicitly set.</p> <div class="informalexample"><pre class="programlisting"> [users] default-home = /home/%U@%D # default-home = /nfs/home/%D-%U # default-home = /home/%D/%U </pre></div> <p>The default setting for this is <code class="option">/home/%U@%D</code>. The <code class="option">%D</code> format is replaced by the domain name. The <code class="option">%U</code> format is replaced by the user name.</p> <p>You can verify the home directory for a user by running the following command.</p> <div class="informalexample"><pre class="screen"> $ <span class="command"><strong>getent passwd 'DOMAIN/User'</strong></span> DOMAIN\user:*:13445:13446:Name:/home/DOMAIN/user:/bin/bash </pre></div> <p>Note that in the case of IPA domains, most users already have a home directory configured in the domain. Therefore this configuration setting may rarely show through.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">default-shell</code></span></p></td> <td> <p>Specify the <code class="option">default-shell</code> setting in order to control how to set the Unix shell for accounts that have no shell explicitly set.</p> <div class="informalexample"><pre class="programlisting"> [users] default-shell = /bin/bash # default-shell = /bin/sh </pre></div> <p>The default setting for this is <code class="option">/bin/bash</code> shell. The shell should be a valid shell if you expect the domain users be able to log in. For example it should exist in the <code class="filename">/etc/shells</code> file.</p> <p>You can verify the shell for a user by running the following command.</p> <div class="informalexample"><pre class="screen"> $ <span class="command"><strong>getent passwd 'DOMAIN/User'</strong></span> DOMAIN\user:*:13445:13446:Name:/home/DOMAIN/user:/bin/bash </pre></div> <p>Note that in the case of IPA domains, most users already have a shell configured in the domain. Therefore this configuration setting may rarely show through.</p> </td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="realmd-conf-paths"></a><h2>paths</h2> <p>These options should go in an <code class="option">[paths]</code> section of the <code class="filename">/etc/realmd.conf</code> file. Only specify the settings you wish to override.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody><tr> <td><p><span class="term"><code class="option">krb5.conf</code></span></p></td> <td> <p>Path to the Kerberos configuration file, typically <code class="filename">/etc/krb5.conf</code>. It can also be the path of a file included by <code class="filename">/etc/krb5.conf</code>, e.g. <code class="filename">/etc/krb5.conf.d/realmd_settings</code>, if the file does not exist if will be created.</p> <div class="informalexample"><pre class="programlisting"> [paths] krb5.conf = /etc/krb5.conf.d/realmd_settings </pre></div> <p>When joining an Active Directory domain <span class="command"><strong>realmd</strong></span> will set the <code class="option">default_realm</code> and <code class="option">udp_preference_limit</code> options in the Kerberos configuration:</p> <div class="informalexample"><pre class="programlisting"> default_realm = DOMAIN.EXAMPLE.COM udp_preference_limit = 0 </pre></div> <p>The <code class="option">default_realm</code> option is e.g. needed when trying to resolve enterprise principals and makes it more convenient to request Kerberos tickets for users of the default realm. Instead of specifying the whole principal just <span class="command"><strong>kinit username</strong></span> can be used.</p> <p>With <code class="option">udp_preference_limit = 0</code> always TCP will be used to send Kerberos request to domain controller. This is useful in Active Directory environments because Kerberos will typically switch to TCP after initially starting with UDP because AD Kerberos tickets are often larger than UDP can handle. Using TCP by default will avoid those extra UDP round trips. Additionally it helps to avoid issues with password changes when the DC does not reply soon enough and the client will send a second UDP request. The DC might reply with a reply error to the second request although the original password change request was successful and the client will no know if the request was successful or not. When using TCP this cannot happen because the client will never send a second request but waits on the connection until the server replies.</p> <p>Please note that <span class="command"><strong>realmd</strong></span> will not remove those options while leaving the domain since they are useful in general. When joining a new domain <span class="command"><strong>realmd</strong></span> will of course overwrite <code class="option">default_realm</code>.</p> </td> </tr></tbody> </table></div> </div> <div class="refsect1"> <a name="realmd-conf-specific-settings"></a><h2>Realm specific settings</h2> <p>These options should go in an section with the same name as the realm in the <code class="filename">/etc/realmd.conf</code> file. For example for the <code class="option">domain.example.com</code> domain the section would be called <code class="option">[domain.example.com]</code>. To figure out the canonical name for a realm use the <span class="command"><strong>realm</strong></span> command:</p> <div class="informalexample"><pre class="screen"> $ <span class="command"><strong>realm discover --name-only DOMAIN.example.com</strong></span> domain.example.com ... </pre></div> <p>Only specify the settings you wish to override.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">computer-ou</code></span></p></td> <td> <p>Specify this option to create directory computer accounts in a location other than the default. This currently only works with Active Directory domains.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] computer-ou = OU=Linux Computers,DC=domain,DC=example,DC=com # computer-ou = OU=Linux Computers, </pre></div> <p>Specify the OU as an LDAP DN. It can be relative to the Root DSE, or a complete LDAP DN. Obviously the OU must exist in the directory.</p> <p>It is also possible to use the <code class="option">--computer-ou</code> argument of the <span class="command"><strong>realm</strong></span> command to create a computer account at a specific OU.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">computer-name</code></span></p></td> <td> <p>This option only applied to Active Directory realms. Specify this option to override the default name used when creating the computer account. The system's FQDN will still be saved in the dNSHostName attribute.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] computer-name = SERVER01 </pre></div> <p>Specify the name as a string of 15 or fewer characters that is a valid NetBIOS computer name.</p> <p>It is also possible to use the <code class="option">--computer-name</code> argument of the <span class="command"><strong>realm</strong></span> command to override the default computer account name.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">user-principal</code></span></p></td> <td> <p>Set the <code class="option">user-principal</code> to <code class="code">yes</code> to create <code class="option">userPrincipalName</code> attribute for the computer accounts in the realm. The exact value depends on the defaults of the used membership software. To have full control over the value please use the <code class="option">--user-principal</code> option of the <span class="command"><strong>realm</strong></span> command, see <span class="citerefentry"><span class="refentrytitle">realm</span>(8)</span> for details.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] user-principal = yes </pre></div> </td> </tr> <tr> <td><p><span class="term"><code class="option">automatic-join</code></span></p></td> <td> <p>This option only applies to Active Directory realms. This option is off by default. In Active Directory domains, a computer account can be preset with a known computer account password. This can be used for automatic joins without authentication.</p> <p>When automatic joins are used there is no mutual authentication between the machine and the domain during the join process.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] automatic-join = yes </pre></div> </td> </tr> <tr> <td><p><span class="term"><code class="option">automatic-id-mapping</code></span></p></td> <td> <p>This option is on by default for Active Directory realms. Turn it off to use UID and GID information stored in the directory (as-per RFC2307) rather than automatically generating UID and GID numbers.</p> <p>This option only makes sense for Active Directory realms.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] automatic-id-mapping = no # automatic-id-mapping = yes </pre></div> </td> </tr> <tr> <td><p><span class="term"><code class="option">manage-system</code></span></p></td> <td> <p>This option is on by default. Normally joining a realm affects many aspects of the configuration and management of the system. Turning this off limits the interaction with the realm or domain to authentication and identity.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] manage-system = no # manage-system = yes </pre></div> <p>When this option is turned on <span class="command"><strong>realmd</strong></span> defaults to using domain policy to control who can log into this machine. Further adjustments to login policy can be made with the <span class="command"><strong>realm permit</strong></span> command.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">fully-qualified-names</code></span></p></td> <td> <p>This option is on by default. If turned off then realm user and group names are not qualified their name. This may cause them to conflict with local user and group names.</p> <div class="informalexample"><pre class="programlisting"> [domain.example.com] fully-qualified-names = no # fully-qualified-names = yes </pre></div> </td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="realmd_conf_see_also"></a><h2>SEE ALSO</h2> <p><span class="citerefentry"><span class="refentrytitle">realm</span>(8)</span></p> </div> </div> <div class="footer"> <hr>Generated by GTK-Doc</div> </body> </html>
Close
