ipa-kra-install(1) IPA Manual Pages ipa-kra-install(1)

# [NAME](#NAME)

ipa-kra-install - Install a KRA on a server

# [SYNOPSIS](#SYNOPSIS)

[ipa-kra-install \[*OPTION*\]...](#ipa)

# [DESCRIPTION](#DESCRIPTION)

Adds a KRA as an IPA-managed service. This requires that the IPA server is already installed and configured, including a CA.

The KRA (Key Recovery Authority) is a component used to securely store secrets such as passwords, symmetric keys and private asymmetric keys. It is used as the back-end repository for the IPA Password Vault.

Domain level 0 is not supported anymore.

ipa-kra-install can be used to add KRA to the existing CA, or to install the KRA service on a replica.

KRA can only be removed along with the entire server using ipa-server-install --uninstall.

# [OPTIONS](#OPTIONS)

[**-p** *DM\_PASSWORD*, **--password**=*DM\_PASSWORD*](#p)

Directory Manager (existing master) password

[**--no-host-dns**](#no_host_dns)

Do not use DNS for hostname lookup during installation

[**-U**, **--unattended**](#U)

An unattended installation that will never prompt for user input

[**-v**, **--verbose**](#v)

Enable debug output when more verbose output is needed

[**-q**, **--quiet**](#q)

Output only errors

[**--log-file**=FILE](#log_file)

Log to the given file

[**--pki-config-override**=*FILE*](#pki)

File containing overrides for KRA installation.

## [HSM OPTIONS](#HSM_OPTIONS)

The token name and library path are retrieved from the existing installation.

[**--token-password**=*TOKEN\_PASSWORD*](#token)

The PKCS#11 token password for the HSM.

[**--token-password-file**=*TOKEN\_PASSWORD\_FILE*](#token~2)

The full path to a file containing the PKCS#11 token password.

# [EXIT STATUS](#EXIT_STATUS)

0 if the command was successful

1 if an error occurred

May 10 2017 IPA

---

Document: ipa-kra-install(1) from freeipa 4.13.4-r3 (Chainguard OS)
Source: https://pagure.io/freeipa.git