5.7. Manually Unconfiguring Client Machines
--updatednsoption, as when installing a client, to update the domain DNS configuration automatically.
[root@server ~]# ipa-client-install --uninstall --updatedns
- On the client, remove the old hostname from the main keytab. This can be done by removing every principal in the realm or by removing specific principals. For example, to remove all principals:
[jsmith@client ~]$ ipa-rmkeytab -k /etc/krb5.keytab -r EXAMPLE.COMTo remove specific principals:
[jsmith@client ~]$ ipa-rmkeytab -k /etc/krb5.keytab -p host/server.example.com@EXAMPLE.COM
- On the client system, disable tracking in
certmongerfor every certificate. Each certificate must be removed from tracking individually.First, list every certificate being tracked, and extract the database and nickname for each certificate. The number of certificates depends on the configured services for the host.
[jsmith@client ~]$ ipa-getcert listThen, disable tracking for each. For example:
[jsmith@client ~]$ ipa-getcert stop-tracking -n "Server-Cert" -d /etc/httpd/alias
- On the IdM server, remove the old host from the IdM DNS domain. While this is optional, it cleans up the old IdM entries associated with the system and allows it to be re-enrolled cleanly at a later time.
[jsmith@server ~]$ kinit admin [jsmith@server ~]$ ipa host-del server.example.com
- If the system should be re-added to a new IdM domain — such as a virtual machine which was moved from one location to another — then the system can be rejoined to IdM using the
ipa-joincommand on the client system.
[jsmith@client ~]$ ipa-join