table of contents
REALMD.CONF(5) | File Formats | REALMD.CONF(5) |
NAME¶
realmd.conf - Tweak behavior of realmd
CONFIGURATION FILE¶
realmd can be tweaked by network administrators to act in specific ways. This is done by placing settings in a /etc/realmd.conf. This file does not exist by default. The syntax of this file is the same as an INI file or Desktop Entry file. If the file is changed and realmd is running realmd must be restarted to read the new values.
In general, settings in this file only apply at the point of joining a domain or realm. Once the realm has been setup the settings have no effect. You may choose to configure SSSD[1] or Winbind[2] directly.
Only specify the settings you wish to override in the /etc/realmd.conf file. Settings not specified will be loaded from their packaged defaults which can be found in /usr/lib/realmd/realmd-defaults.conf and /usr/lib/realmd/realmd-distro.conf. Only override the settings below. You may find other settings if you look through the realmd source code. However these are not guaranteed to remain stable.
There are various sections in the config file. Some sections are global topic sections, and are listed below. Other sections are specific to a given realm. These realm specific sections should always contain the domain name in lower case as their section header.
Examples of each setting is found below, including the header of the section it should be placed in. However in the resulting file only include each section once, and combine the various section setting together as lines underneath the section. For example
[users] default-home = /home/%U default-shell = /bin/bash
ACTIVE-DIRECTORY¶
These options should go in an [active-directory] section of the /etc/realmd.conf file. Only specify the settings you wish to override.
default-client
[active-directory] default-client = sssd # default-client = winbind
Some callers of realmd such as the realm(8) command line tool allow specifying which client software should be used. Others, such as GNOME Control Center, simplify choose the default.
You can verify the preferred default client softawre by running the following command. The realm with the preferred client software will be listed first.
$ realm discover domain.example.com domain.example.com
configured: no
server-software: active-directory
client-software: sssd
type: kerberos
realm-name: AD.THEWALTER.LAN
domain-name: ad.thewalter.lan domain.example.com
configured: no
server-software: active-directory
client-software: winbind
type: kerberos
realm-name: AD.THEWALTER.LAN
domain-name: ad.thewalter.lan
use-ldaps
If this option is set to yes realmd will use the ldaps port when reading the rootDSE and call the adcli membership software with the option --use-ldaps. The Samba base membership currently offers only deprecated ways to enable ldaps. Support will be added in realmd when a new way is available.
os-name
os-version
This is an Active Directory specific option.
It is also possible to use the --os-name or --os-version argument of the realm command to override the default values.
[active-directory] os-name = Gentoo Linux os-version = 9.9.9.9.9
SERVICE¶
These options should go in an [service] section of the /etc/realmd.conf file. Only specify the settings you wish to override.
automatic-install
[service] automatic-install = no # automatic-install = yes
legacy-samba-config
[service] legacy-samba-config = no # legacy-samba-config = yes
USERS¶
These options should go in an [users] section of the /etc/realmd.conf file. Only specify the settings you wish to override.
default-home
[users] default-home = /home/%U@%D # default-home = /nfs/home/%D-%U # default-home = /home/%D/%U
You can verify the home directory for a user by running the following command.
$ getent passwd 'DOMAIN/User' DOMAIN\user:*:13445:13446:Name:/home/DOMAIN/user:/bin/bash
default-shell
[users] default-shell = /bin/bash # default-shell = /bin/sh
You can verify the shell for a user by running the following command.
$ getent passwd 'DOMAIN/User' DOMAIN\user:*:13445:13446:Name:/home/DOMAIN/user:/bin/bash
PATHS¶
These options should go in an [paths] section of the /etc/realmd.conf file. Only specify the settings you wish to override.
krb5.conf
[paths] krb5.conf = /etc/krb5.conf.d/realmd_settings
default_realm = DOMAIN.EXAMPLE.COM udp_preference_limit = 0
With udp_preference_limit = 0 always TCP will be used to send Kerberos request to domain controller. This is useful in Active Directory environments because Kerberos will typically switch to TCP after initially starting with UDP because AD Kerberos tickets are often larger than UDP can handle. Using TCP by default will avoid those extra UDP round trips. Additionally it helps to avoid issues with password changes when the DC does not reply soon enough and the client will send a second UDP request. The DC might reply with a reply error to the second request although the original password change request was successful and the client will no know if the request was successful or not. When using TCP this cannot happen because the client will never send a second request but waits on the connection until the server replies.
Please note that realmd will not remove those options while leaving the domain since they are useful in general. When joining a new domain realmd will of course overwrite default_realm.
REALM SPECIFIC SETTINGS¶
These options should go in an section with the same name as the realm in the /etc/realmd.conf file. For example for the domain.example.com domain the section would be called [domain.example.com]. To figure out the canonical name for a realm use the realm command:
$ realm discover --name-only DOMAIN.example.com domain.example.com ...
Only specify the settings you wish to override.
computer-ou
[domain.example.com] computer-ou = OU=Linux Computers,DC=domain,DC=example,DC=com # computer-ou = OU=Linux Computers,
It is also possible to use the --computer-ou argument of the realm command to create a computer account at a specific OU.
computer-name
[domain.example.com] computer-name = SERVER01
It is also possible to use the --computer-name argument of the realm command to override the default computer account name.
user-principal
[domain.example.com] user-principal = yes
automatic-join
When automatic joins are used there is no mutual authentication between the machine and the domain during the join process.
[domain.example.com] automatic-join = yes
automatic-id-mapping
This option only makes sense for Active Directory realms.
[domain.example.com] automatic-id-mapping = no # automatic-id-mapping = yes
manage-system
[domain.example.com] manage-system = no # manage-system = yes
fully-qualified-names
[domain.example.com] fully-qualified-names = no # fully-qualified-names = yes
SEE ALSO¶
AUTHOR¶
Stef Walter <stef@thewalter.net>
NOTES¶
- 1.
- SSSD
- 2.
- Winbind
04/19/2024 | realmd |