freeipa（5）文件和日志位置

98 阅读 0 评论 65 点赞

我是靠谱客的博主自信老虎，最近开发中收集的这篇文章主要介绍freeipa（5）文件和日志位置，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

Table 18.1. FreeIPA Server Configuration Files and Directories

Directory or File Description

Server Configuration

/etc/ipa The main FreeIPA configuration directory.

/etc/ipa/default.conf The primary configuration file for FreeIPA.

/etc/ipa/ca.crt The CA certificate issued by the FreeIPA server's CA.

~/.ipa/ A user-specific FreeIPA directory that is created on the local system in the system user's home directory the first time the user runs a FreeIPA command.

FreeIPA Logs

~/.ipa/log/cli.log The log file for all XML-RPC calls and responses by the FreeIPA command-line tools. This is created in the home directory for the system user who runs the tools, who may have a different name than the FreeIPA user.

/var/log/ipaclient-install.log The installation log for the client service.

/var/log/ipaserver-install.log The installation log for the FreeIPA server.

System Services

/etc/rc.d/init.d/ipa The FreeIPA server init script.

/etc/rc.d/init.d/ipa_kpasswd The init script for the FreeIPA control daemon for Kerberos passwords.

/var/run/ipa_kpasswd.pid The PID file for the Kerberos password daemon used by the FreeIPA service.

Web UI

/etc/ipa/html A symlink directory in the main configuration directory for the HTML files used by the FreeIPA web UI.

/etc/httpd/conf.d/ipa.conf

/etc/httpd/conf.d/ipa-rewrite.conf

The configuration files used by the Apache host for the web UI application.

/etc/httpd/conf/ipa.keytab The keytab file used by the web UI service.

/usr/share/ipa The main directory for all of the HTML files, scripts, and stylesheets used by the web UI.

/usr/share/ipa/ipa-rewrite.conf

/usr/share/ipa/ipa.conf

The configuration files used by the Apache host for the web UI application.

/usr/share/ipa/updates Contains any updated files, schema, and other elements for FreeIPA.

/usr/share/ipa/html Contains the HTML files, JavaScript files, and stylesheets used by the web UI.

/usr/share/ipa/ipaclient Contains the JavaScript files used to access Firefox's autoconfiguration feature and set up the Firefox browser to work in the FreeIPA Kerberos realm.

/usr/share/ipa/migration Contains HTML pages, stylesheets, and Python scripts used for running the FreeIPA server in migration mode.

/usr/share/ipa/ui Contains all of the scripts used by the UI to perform FreeIPA operations.

/var/log/httpd The log files for the Apache web server.

Kerberos

/etc/krb5.conf The Kerberos service configuration file.

SSSD

/etc/sssd/sssd.api.d/sssd-ipa.conf The configuration file used to identify the FreeIPA server, FreeIPA Directory Server, and other FreeIPA services used by SSSD.

/var/log/sssd The log files for SSSD.

389 Directory Server

/var/lib/dirsrv/slapd-REALM_NAME All of the schema, configuration, and database files associated with the Directory Server instance used by the FreeIPA server.

/var/log/dirsrv/slapd-REALM_NAME Log files associated with the Directory Server instance used by the FreeIPA server.

Dogtag Certificate System

/etc/pki-ca The main directory for the FreeIPA CA instance.

/etc/pki-ca/conf/CS.cfg The main configuration file for the FreeIPA CA instance.

/var/lib/dirsrv/slapd-PKI-IPA/ All of the schema, configuration, and database files associated with the Directory Server instance used by the FreeIPA CA.

/var/log/dirsrv/slapd-PKI-IPA/ Log files associated with the Directory Server instance used by the FreeIPA CA.

Cache Files

/var/cache/ipa Cache files for the FreeIPA server and the FreeIPA Kerberos password daemon.

System Backups

/var/lib/ipa/sysrestore Contains backups of all of the system files and scripts that were reconfigured when the FreeIPA server was installed. These include the original .conf files for NSS, Kerberos (both krb5.conf and kdc.conf), and NTP.

/var/lib/ipa-client/sysrestore Contains backups of all of the system files and scripts that were reconfigured when the FreeIPA client was installed. Commonly, this is the sssd.conf file for SSSD authentication services.

Table 18.2. FreeIPA Log Files

Service Log File Description Additional Information

FreeIPA server /var/log/ipaserver-install.log Server installation log

FreeIPA server ~/.ipa/log/cli.log Command-line tool log

FreeIPA client /var/log/ipaclient-install.log Client installation log

Apache server

/var/log/httpd/access

/var/log/httpd/error

These are standard access and error logs for Apache servers. Both the web UI and the XML-RPC command-line interface use Apache, so some FreeIPA-specific messages will be recorded in the error log along with the Apache messages.

Apache log chapter

Dogtag Certificate System /var/log/pki-ca-install.log The installation log for the FreeIPA CA.

Dogtag Certificate System

/var/log/pki-ca/debug

/var/log/pki-ca/system

/var/log/pki-ca/transactions

/var/log/pki-ca/signedAudit

These logs mainly relate to certificate operations. In FreeIPA, this is used for service principals, hosts, and other entities which use certificates.

Logging chapter

389 Directory Server

/var/log/dirsrv/slapd-REALM/access

/var/log/dirsrv/slapd-REALM/audit

/var/log/dirsrv/slapd-REALM/errors

The access and error logs both contain detailed information about attempted access and operations for the domain Directory Server instance. The error log setting can be changed to provide very detailed output.

The access log is buffered, so the server only writes to the log every 30 seconds, by default.

Monitoring servers and databases
Log entries explained

389 Directory Server

/var/log/dirsrv/slapd-REALM/access

/var/log/dirsrv/slapd-REALM/audit

/var/log/dirsrv/slapd-REALM/errors

This directory server instance is used by the FreeIPA CA to store certificate information. Most operational data here will be related to server-replica interactions.

The access log is buffered, so the server only writes to the log every 30 seconds, by default.

Monitoring servers and databases
Log entries explained

Kerberos /var/log/krb5libs.log This is the primary log file for Kerberos connections. This location is configured in the krb5.conf file, so it could be different on some systems.

Kerberos /var/log/krb5kdc.log This is the primary log file for the Kerberos KDC server. This location is configured in the krb5.conf file, so it could be different on some systems.

Kerberos /var/log/kadmind.log This is the primary log file for the Kerberos administration server. This location is configured in the krb5.conf file, so it could be different on some systems.

DNS

/var/log/messages

DNS error messages are included with other system messages.