文件操作 - adcli.html
返回文件管理
返回主菜单
删除本文件
文件: /usr/share/doc/adcli/adcli.html
编辑文件内容
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ANSI_X3.4-1968"> <title>adcli</title> <meta name="generator" content="DocBook XSL Stylesheets V1.78.1"> <link rel="home" href="index.html" title="adcli"> <link rel="up" href="guide.html" title="Part I. User Guide"> <link rel="prev" href="guide.html" title="Part I. User Guide"> <link rel="next" href="contrib.html" title="Part II. Contributor Guide"> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> <table class="navigation" id="top" width="100%" summary="Navigation header" cellpadding="2" cellspacing="2"><tr valign="middle"> <td><a accesskey="p" href="guide.html"><img src="left.png" width="24" height="24" border="0" alt="Prev"></a></td> <td><a accesskey="u" href="guide.html"><img src="up.png" width="24" height="24" border="0" alt="Up"></a></td> <td><a accesskey="h" href="index.html"><img src="home.png" width="24" height="24" border="0" alt="Home"></a></td> <th width="100%" align="center">adcli</th> <td><a accesskey="n" href="contrib.html"><img src="right.png" width="24" height="24" border="0" alt="Next"></a></td> </tr></table> <div class="refentry"> <a name="adcli"></a><div class="titlepage"></div> <div class="refnamediv"><table width="100%"><tr> <td valign="top"> <h2><span class="refentrytitle">adcli</span></h2> <p>adcli — Tool for performing actions on an Active Directory domain</p> </td> <td valign="top" align="right"></td> </tr></table></div> <div class="refsynopsisdiv"> <h2>Synopsis</h2> <div class="cmdsynopsis"><p><code class="command">adcli info</code> domain.example.com </p></div> <div class="cmdsynopsis"><p><code class="command">adcli join</code> domain.example.com </p></div> <div class="cmdsynopsis"><p><code class="command">adcli update</code> </p></div> <div class="cmdsynopsis"><p><code class="command">adcli testjoin</code> </p></div> <div class="cmdsynopsis"><p><code class="command">adcli create-user</code> [--domain=domain.example.com] user </p></div> <div class="cmdsynopsis"><p><code class="command">adcli delete-user</code> [--domain=domain.example.com] user </p></div> <div class="cmdsynopsis"><p><code class="command">adcli create-group</code> [--domain=domain.example.com] user </p></div> <div class="cmdsynopsis"><p><code class="command">adcli delete-group</code> [--domain=domain.example.com] user </p></div> <div class="cmdsynopsis"><p><code class="command">adcli add-member</code> [--domain=domain.example.com] group user... </p></div> <div class="cmdsynopsis"><p><code class="command">adcli remove-member</code> [--domain=domain.example.com] group user... </p></div> <div class="cmdsynopsis"><p><code class="command">adcli preset-computer</code> [--domain=domain.example.com] computer... </p></div> <div class="cmdsynopsis"><p><code class="command">adcli reset-computer</code> [--domain=domain.example.com] computer </p></div> <div class="cmdsynopsis"><p><code class="command">adcli delete-computer</code> [--domain=domain.example.com] computer </p></div> </div> <div class="refsect1"> <a name="general_overview"></a><h2>General Overview</h2> <p><span class="command"><strong>adcli</strong></span> is a command line tool that can perform actions in an Active Directory domain. Among other things it can be used to join a computer to a domain.</p> <p>See the various sub commands below. The following global options can be used:</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-D, --domain=<em class="parameter"><code>domain</code></em></code></span></p></td> <td><p>The domain to connect to. If a domain is not specified, then the domain part of the local computer's host name is used.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-R, --domain-realm=<em class="parameter"><code>REALM</code></em></code></span></p></td> <td><p>Kerberos realm for the domain. If not specified, then the upper cased domain name is used.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-S, --domain-controller=<em class="parameter"><code>server</code></em></code></span></p></td> <td><p>Connect to a specific domain controller. If not specified, then an appropriate domain controller is automatically discovered.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--use-ldaps</code></span></p></td> <td> <p>Connect to the domain controller with LDAPS. By default the LDAP port is used and SASL GSS-SPNEGO or GSSAPI is used for authentication and to establish encryption. This should satisfy all requirements set on the server side and LDAPS should only be used if the LDAP port is not accessible due to firewalls or other reasons.</p> <p> Please note that the place where CA certificates can be found to validate the AD DC certificates must be configured in the OpenLDAP configuration file, e.g. <code class="filename">/etc/openldap/ldap.conf</code>. As an alternative it can be specified with the help of an environment variable, e.g. </p> <pre class="programlisting"> $ LDAPTLS_CACERT=/path/to/ad_dc_ca_cert.pem adcli join --use-ldaps -D domain.example.com ... </pre> <p> Please see <span class="citerefentry"><span class="refentrytitle">ldap.conf</span>(5)</span> for details. </p> </td> </tr> <tr> <td><p><span class="term"><code class="option">-C</code></span></p></td> <td><p>Use the default Kerberos credential cache to authenticate with the domain. </p></td> </tr> <tr> <td><p><span class="term"><code class="option">--login-ccache<em class="parameter"><code>[=ccache_name]</code></em></code></span></p></td> <td> <p>Use the specified Kerberos credential cache to authenticate with the domain. If no credential cache is specified, the default Kerberos credential cache will be used. Credential caches of type FILE can be given with the path to the file. For other credential cache types, e.g. DIR, KEYRING or KCM, the type must be specified explicitly together with a suitable identifier.</p> <p>Please note that since the <em class="parameter"><code>ccache_name</code></em> is optional the =(equal) sign is mandatory. If = is missing the parameter is treated as optionless extra argument. How this is handled depends on the specific sub-command. </p> </td> </tr> <tr> <td><p><span class="term"><code class="option">-U, --login-user=<em class="parameter"><code>User</code></em></code></span></p></td> <td><p>Use the specified user account to authenticate with the domain. If not specified, then the name 'Administrator' will be used.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--no-password</code></span></p></td> <td><p>Don't show prompts for or read a password from input.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-W, --prompt-password</code></span></p></td> <td><p>Prompt for a password if necessary. This is the default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--stdin-password</code></span></p></td> <td><p>Read a password from stdin input instead of prompting for a password.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-v, --verbose</code></span></p></td> <td><p>Run in verbose mode with debug output.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="querying"></a><h2>Querying Domain Information</h2> <p><span class="command"><strong>adcli info</strong></span> displays discovered information about an Active Directory domain or an Active Directory domain controller.</p> <pre class="programlisting"> $ adcli info domain.example.com ... </pre> <pre class="programlisting"> $ adcli info --domain-controller=dc.domain.example.com ... </pre> <p><span class="command"><strong>adcli info</strong></span> will output as much information as it can about the domain. The information is designed to be both machine and human readable. The command will exit with a non-zero exit code if the domain does not exist or cannot be reached.</p> <p>To show domain info for a specific domain controller use the <code class="option">--domain-controller</code> option to specify which domain controller to query.</p> <p>Use the <code class="option">--verbose</code> option to show details of how the domain is discovered and queried. Many of the global options, in particular authentication options, are not usable with the <span class="command"><strong>adcli info</strong></span> command.</p> </div> <div class="refsect1"> <a name="joining"></a><h2>Joining the Local Machine to a Domain</h2> <p><span class="command"><strong>adcli join</strong></span> creates a computer account in the domain for the local machine, and sets up a keytab for the machine. It does not configure an authentication service (such as <span class="command"><strong>sssd</strong></span>).</p> <pre class="programlisting"> $ adcli join domain.example.com Password for Administrator: </pre> <p>In addition to the global options, you can specify the following options to control how this operation is done.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-N, --computer-name=<em class="parameter"><code>computer</code></em></code></span></p></td> <td><p>The short non-dotted name of the computer account that will be created in the domain. If not specified, then the first portion of the <code class="option">--host-fqdn</code> is used.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-O, --domain-ou=<em class="parameter"><code>OU=xxx</code></em></code></span></p></td> <td><p>The full distinguished name of the OU in which to create the computer account. If not specified, then the computer account will be created in a default location.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-H, --host-fqdn=<em class="parameter"><code>host</code></em></code></span></p></td> <td><p>Override the local machine's fully qualified domain name. If not specified, the local machine's hostname will be retrieved via <code class="function">gethostname()</code>. If <code class="function">gethostname()</code> only returns a short name <code class="function">getaddrinfo()</code> with the AI_CANONNAME hint is called to expand the name to a fully qualified domain name.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-K, --host-keytab=<em class="parameter"><code>/path/to/keytab</code></em></code></span></p></td> <td><p>Specify the path to the host keytab where host credentials will be written after a successful join operation. If not specified, the default location will be used, usually <code class="filename">/etc/krb5.keytab</code>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--login-type=<em class="parameter"><code>{computer|user}</code></em></code></span></p></td> <td><p>Specify the type of authentication that will be performed before creating the machine account in the domain. If set to 'computer', then the computer must already have a preset account in the domain. If not specified and none of the other <code class="option">--login-xxx</code> arguments have been specified, then will try both 'computer' and 'user' authentication.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-name=<em class="parameter"><code>name</code></em></code></span></p></td> <td><p>Set the operating system name on the computer account. The default depends on where adcli was built, but is usually something like 'linux-gnu'.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-service-pack=<em class="parameter"><code>pack</code></em></code></span></p></td> <td><p>Set the operating system service pack on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-version=<em class="parameter"><code>version</code></em></code></span></p></td> <td><p>Set the operating system version on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--service-name=<em class="parameter"><code>service</code></em></code></span></p></td> <td><p>Additional service name for a kerberos principal to be created on the computer account. This option may be specified multiple times.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--user-principal=<em class="parameter"><code>host/name@REALM</code></em></code></span></p></td> <td><p>Set the userPrincipalName field of the computer account to this kerberos principal. If you omit the value for this option, then a principal will be set in the form of <code class="code">host/host.example.com@REALM</code></p></td> </tr> <tr> <td><p><span class="term"><code class="option">--one-time-password</code></span></p></td> <td><p>Specify a one time password for a preset computer account. This is equivalent to using <code class="option">--login-type=computer</code> and providing a password as input.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--trusted-for-delegation=<em class="parameter"><code>yes|no|true|false</code></em></code></span></p></td> <td><p>Set or unset the TRUSTED_FOR_DELEGATION flag in the userAccountControl attribute to allow or not allow that Kerberos tickets can be forwarded to the host.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--add-service-principal=<em class="parameter"><code>service/hostname</code></em></code></span></p></td> <td><p>Add a service principal name. In contrast to the <code class="option">--service-name</code> the hostname part can be specified as well in case the service should be accessible with a different host name as well.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--show-details</code></span></p></td> <td><p>After a successful join print out information about join operation. This is output in a format that should be both human and machine readable.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--show-password</code></span></p></td> <td><p>After a successful join print out the computer machine account password. This is output in a format that should be both human and machine readable.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--add-samba-data</code></span></p></td> <td> <p>After a successful join add the domain SID and the machine account password to the Samba specific databases by calling Samba's <span class="command"><strong>net</strong></span> utility.</p> <p>Please note that Samba's <span class="command"><strong>net</strong></span> requires some settings in <code class="filename">smb.conf</code> to create the database entries correctly. Most important here is currently the <code class="option">workgroup</code> option, see <span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span> for details.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">--samba-data-tool=<em class="parameter"><code>/path/to/net</code></em></code></span></p></td> <td><p>If Samba's <span class="command"><strong>net</strong></span> cannot be found at <code class="filename">/usr/bin/net </code>, this option can be used to specific an alternative location with the help of an absolute path.</p></td> </tr> </tbody> </table></div> <p>If supported on the AD side the <code class="option">msDS-supportedEncryptionTypes</code> attribute will be set as well. Either the current value or the default list of AD's supported encryption types filtered by the permitted encryption types of the client's Kerberos configuration are written.</p> </div> <div class="refsect1"> <a name="updating"></a><h2>Updating the machine account password and other attributes</h2> <p><span class="command"><strong>adcli update</strong></span> updates the password of the computer account on the domain controller for the local machine, write the new keys to the keytab and removes older keys. It keeps the previous key on purpose because AD will need some time to replicate the new key to all DCs hence the previous key might still be used. </p> <pre class="programlisting"> $ adcli update </pre> <p>If used with a credential cache, other attributes of the computer account can be changed as well if the principal has sufficient privileges.</p> <pre class="programlisting"> $ kinit Administrator $ adcli update --login-ccache=/tmp/krbcc_123 </pre> <p>In addition to the global options, you can specify the following options to control how this operation is done.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-N, --computer-name=<em class="parameter"><code>computer</code></em></code></span></p></td> <td><p>The short non-dotted name of the computer account that will be created in the domain. If not specified, it will be retrieved from the keytab entries.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-H, --host-fqdn=<em class="parameter"><code>host</code></em></code></span></p></td> <td><p>The local machine's fully qualified domain name. If not specified, the local machine's hostname will be retrieved from the keytab entries.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-K, --host-keytab=<em class="parameter"><code>/path/to/keytab</code></em></code></span></p></td> <td><p>Specify the path to the host keytab where current host credentials are stored and the new ones will be written to. If not specified, the default location will be used, usually <code class="filename">/etc/krb5.keytab</code>.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-name=<em class="parameter"><code>name</code></em></code></span></p></td> <td><p>Set the operating system name on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-service-pack=<em class="parameter"><code>pack</code></em></code></span></p></td> <td><p>Set the operating system service pack on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-version=<em class="parameter"><code>version</code></em></code></span></p></td> <td><p>Set the operating system version on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--service-name=<em class="parameter"><code>service</code></em></code></span></p></td> <td><p>Additional service name for a Kerberos principal to be created on the computer account. This option may be specified multiple times.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--user-principal=<em class="parameter"><code>host/name@REALM</code></em></code></span></p></td> <td><p>Set the userPrincipalName field of the computer account to this Kerberos principal.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--computer-password-lifetime=<em class="parameter"><code>lifetime</code></em></code></span></p></td> <td><p>Only update the password of the computer account if it is older than the lifetime given in days. By default the password is updated if it is older than 30 days.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--trusted-for-delegation=<em class="parameter"><code>yes|no|true|false</code></em></code></span></p></td> <td><p>Set or unset the TRUSTED_FOR_DELEGATION flag in the userAccountControl attribute to allow or not allow that Kerberos tickets can be forwarded to the host.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--add-service-principal=<em class="parameter"><code>service/hostname</code></em></code></span></p></td> <td><p>Add a service principal name. In contrast to the <code class="option">--service-name</code> the hostname part can be specified as well in case the service should be accessible with a different host name as well.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--remove-service-principal=<em class="parameter"><code>service/hostname</code></em></code></span></p></td> <td><p>Remove a service principal name from the keytab and the AD host object.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--show-details</code></span></p></td> <td><p>After a successful join print out information about join operation. This is output in a format that should be both human and machine readable.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--add-samba-data</code></span></p></td> <td> <p>After a successful join add the domain SID and the machine account password to the Samba specific databases by calling Samba's <span class="command"><strong>net</strong></span> utility.</p> <p>Please note that Samba's <span class="command"><strong>net</strong></span> requires some settings in <code class="filename">smb.conf</code> to create the database entries correctly. Most important here is currently the <code class="option">workgroup</code> option, see <span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span> for details.</p> <p>Note that if the machine account password is not older than 30 days, you have to pass <code class="option">--computer-password-lifetime=0</code> to force the update.</p> </td> </tr> <tr> <td><p><span class="term"><code class="option">--samba-data-tool=<em class="parameter"><code>/path/to/net</code></em></code></span></p></td> <td><p>If Samba's <span class="command"><strong>net</strong></span> cannot be found at <code class="filename">/usr/bin/net </code>, this option can be used to specific an alternative location with the help of an absolute path.</p></td> </tr> </tbody> </table></div> <p>If supported on the AD side the <code class="option">msDS-supportedEncryptionTypes</code> attribute will be set as well. Either the current value or the default list of AD's supported encryption types filtered by the permitted encryption types of the client's Kerberos configuration are written.</p> </div> <div class="refsect1"> <a name="testjoin"></a><h2>Testing if the machine account password is valid</h2> <p><span class="command"><strong>adcli testjoin</strong></span> uses the current credentials in the keytab and tries to authenticate with the machine account to the AD domain. If this works the machine account password and the join are still valid. If it fails the machine account password or the whole machine account have to be refreshed with <span class="command"><strong>adcli join</strong></span> or <span class="command"><strong>adcli update</strong></span>. </p> <pre class="programlisting"> $ adcli testjoin </pre> <p>Only the global options not related to authentication are available, additionally you can specify the following options to control how this operation is done.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody><tr> <td><p><span class="term"><code class="option">-K, --host-keytab=<em class="parameter"><code>/path/to/keytab</code></em></code></span></p></td> <td><p>Specify the path to the host keytab where current host credentials are stored and the new ones will be written to. If not specified, the default location will be used, usually <code class="filename">/etc/krb5.keytab</code>.</p></td> </tr></tbody> </table></div> </div> <div class="refsect1"> <a name="create_user"></a><h2>Creating a User</h2> <p><span class="command"><strong>adcli create-user</strong></span> creates a new user account in the domain.</p> <pre class="programlisting"> $ adcli create-user Fry --domain=domain.example.com \ --display-name="Philip J. Fry" --mail=fry@domain.example.com </pre> <p>In addition to the global options, you can specify the following options to control how the user is created.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--display-name=<em class="parameter"><code>"Name"</code></em></code></span></p></td> <td><p>Set the <code class="code">displayName</code> attribute of the new created user account.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-O, --domain-ou=<em class="parameter"><code>OU=xxx</code></em></code></span></p></td> <td><p>The full distinguished name of the OU in which to create the user account. If not specified, then the computer account will be created in a default location.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--mail=<em class="parameter"><code>email@domain.com</code></em></code></span></p></td> <td><p>Set the <code class="code">mail</code> attribute of the new created user account. This attribute may be specified multiple times.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--unix-home=<em class="parameter"><code>/home/user</code></em></code></span></p></td> <td><p>Set the <code class="code">unixHomeDirectory</code> attribute of the new created user account, which should be an absolute path to the user's home directory.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--unix-gid=<em class="parameter"><code>111</code></em></code></span></p></td> <td><p>Set the <code class="code">gidNumber</code> attribute of the new created user account, which should be the user's numeric primary group id.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--unix-shell=<em class="parameter"><code>/bin/shell</code></em></code></span></p></td> <td><p>Set the <code class="code">loginShell</code> attribute of the new created user account, which should be a path to a valid shell.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--unix-uid=<em class="parameter"><code>111</code></em></code></span></p></td> <td><p>Set the <code class="code">uidNumber</code> attribute of the new created user account, which should be the user's numeric primary user id.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--nis-domain=<em class="parameter"><code>nis_domain</code></em></code></span></p></td> <td><p>Set the <code class="code">msSFU30NisDomain</code> attribute of the new created user account, which should be the user's NIS domain is the NIS/YP service of Active Directory's Services for Unix (SFU) are used. This is needed to let the 'UNIX attributes' tab of older Active Directoy versions show the set UNIX specific attributes. If not specified adcli will try to determine the NIS domain automatically if needed. </p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="delete_user"></a><h2>Deleting a User</h2> <p><span class="command"><strong>adcli delete-user</strong></span> deletes a user account from the domain.</p> <pre class="programlisting"> $ adcli delete-user Fry --domain=domain.example.com </pre> <p>The various global options can be used.</p> </div> <div class="refsect1"> <a name="create_group"></a><h2>Creating a Group</h2> <p><span class="command"><strong>adcli create-group</strong></span> creates a new group in the domain.</p> <pre class="programlisting"> $ adcli create-group Pilots --domain=domain.example.com \ --description="Group for all pilots" </pre> <p>In addition to the global options, you can specify the following options to control how the group is created.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">--description=<em class="parameter"><code>"text"</code></em></code></span></p></td> <td><p>Set the <code class="code">description</code> attribute of the new created group.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">-O, --domain-ou=<em class="parameter"><code>OU=xxx</code></em></code></span></p></td> <td><p>The full distinguished name of the OU in which to create the group. If not specified, then the group will be created in a default location.</p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="delete_group"></a><h2>Deleting a Group</h2> <p><span class="command"><strong>adcli delete-group</strong></span> deletes a group from the domain.</p> <pre class="programlisting"> $ adcli delete-group Pilots --domain=domain.example.com </pre> <p>The various global options can be used.</p> </div> <div class="refsect1"> <a name="add_group_member"></a><h2>Adding a Member to a Group</h2> <p><span class="command"><strong>adcli add-member</strong></span> adds one or more users to a group in the domain. The group is specified first, and then the various users to be added.</p> <pre class="programlisting"> $ adcli add-member --domain=domain.example.com Pilots Leela Scruffy </pre> <p>The various global options can be used.</p> <p></p> </div> <div class="refsect1"> <a name="remove_group_member"></a><h2>Removing a Member from a Group</h2> <p><span class="command"><strong>adcli remove-member</strong></span> removes a user from a group in the domain. The group is specified first, and then the various users to be removed.</p> <pre class="programlisting"> $ adcli remove-member --domain=domain.example.com Pilots Scruffy </pre> <p>The various global options can be used.</p> </div> <div class="refsect1"> <a name="preset_computer_account"></a><h2>Preset Computer Accounts</h2> <p><span class="command"><strong>adcli preset-computer</strong></span> pre-creates one or more computer accounts in the domain for machines to later use when joining the domain. By doing this machines can join using a one time password or automatically without a password.</p> <pre class="programlisting"> $ adcli preset-computer --domain=domain.example.com \ host1.example.com host2 Password for Administrator: </pre> <p>If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names. The computer accounts must not already exist.</p> <p>In addition to the global options, you can specify the following options to control how this operation is done.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody> <tr> <td><p><span class="term"><code class="option">-O, --domain-ou=<em class="parameter"><code>OU=xxx</code></em></code></span></p></td> <td><p>The full distinguished name of the OU in which to create the computer accounts. If not specified, then the computer account will be created in a default location.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--one-time-password</code></span></p></td> <td><p>Specify a one time password to use when presetting the computer accounts. If not specified, then a default password will be used, which allows for later automatic joins.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-name=<em class="parameter"><code>name</code></em></code></span></p></td> <td><p>Set the operating system name on the computer account. The default depends on where adcli was built, but is usually something like 'linux-gnu'.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-service-pack=<em class="parameter"><code>pack</code></em></code></span></p></td> <td><p>Set the operating system service pack on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--os-version=<em class="parameter"><code>version</code></em></code></span></p></td> <td><p>Set the operating system version on the computer account. Not set by default.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--service-name=<em class="parameter"><code>service</code></em></code></span></p></td> <td><p>Additional service name for a kerberos principal to be created on the computer account. This option may be specified multiple times.</p></td> </tr> <tr> <td><p><span class="term"><code class="option">--user-principal</code></span></p></td> <td><p>Set the userPrincipalName field of the computer account to this kerberos principal in the form of <code class="code">host/host.example.com@REALM</code></p></td> </tr> </tbody> </table></div> </div> <div class="refsect1"> <a name="reset_computer_account"></a><h2>Reset Computer Account</h2> <p><span class="command"><strong>adcli reset-computer</strong></span> resets a computer account in the domain. If the appropriate machine is currently joined to the domain, then its membership will be broken. The account must already exist.</p> <pre class="programlisting"> $ adcli reset-computer --domain=domain.example.com host2 </pre> <p>If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names.</p> <p>In addition to the global options, you can specify the following options to control how this operation is done.</p> <div class="variablelist"><table border="0" class="variablelist"> <colgroup> <col align="left" valign="top"> <col> </colgroup> <tbody><tr> <td><p><span class="term"><code class="option">--login-type=<em class="parameter"><code>{computer|user}</code></em></code></span></p></td> <td><p>Specify the type of authentication that will be performed before creating the machine account in the domain. If set to 'computer', then the computer must already have a preset account in the domain. If not specified and none of the other <code class="option">--login-xxx</code> arguments have been specified, then will try both 'computer' and 'user' authentication.</p></td> </tr></tbody> </table></div> </div> <div class="refsect1"> <a name="delete_computer_account"></a><h2>Delete Computer Account</h2> <p><span class="command"><strong>adcli delete-computer</strong></span> deletes a computer account in the domain. The account must already exist.</p> <pre class="programlisting"> $ adcli delete-computer --domain=domain.example.com host2 Password for Administrator: </pre> <p>If the computer name contains a dot, then it is treated as fully qualified host name, otherwise it is treated as short computer name.</p> <p>If no computer name is specified, then the host name of the computer adcli is running on is used, as returned by <code class="literal">gethostname()</code>.</p> <p>The various global options can be used.</p> </div> <div class="refsect1"> <a name="bugs"></a><h2>Bugs</h2> <p> Please send bug reports to either the distribution bug tracker or the upstream bug tracker at <a class="ulink" href="https://bugs.freedesktop.org/enter_bug.cgi?product=realmd&component=adcli" target="_top">https://bugs.freedesktop.org/enter_bug.cgi?product=realmd&component=adcli</a> </p> </div> <div class="refsect1"> <a name="see_also"></a><h2>See also</h2> <span class="simplelist"><span class="citerefentry"><span class="refentrytitle">realmd</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">net</span>(8)</span>, <span class="citerefentry"><span class="refentrytitle">sssd</span>(8)</span></span><p> Further details available in the realmd online documentation at <a class="ulink" href="http://www.freedesktop.org/software/realmd/" target="_top">http://www.freedesktop.org/software/realmd/</a> </p> </div> </div> <div class="footer"> <hr> Generated by GTK-Doc </div> </body> </html>
修改文件时间
将文件时间修改为当前时间的前一年
删除文件