ipa-idrange-fix(1)

💖 ipa-idrange-fix — bestie edition 💖

okay so you're looking at ipa-idrange-fix from the IPA Manual Pages, and honestly? she's a whole vibe. she analyses your IPA ID ranges, finds users and groups living outside them (the strays 😭), and then proposes fixes so everybody gets tucked into an IPA-managed range where they belong. ✨

---

🦋 NAME 🦋

ipa-idrange-fix — analyse and fix IPA ID ranges. that's the whole job description, no notes. 💅

---

🌸 SYNOPSIS 🌸

ipa-idrange-fix [options]

---

✨ DESCRIPTION ✨

so like, ipa-idrange-fix is a tool for analysis of existing IPA ranges, users and groups outside of those ranges, and it has functionality to propose and apply remediations to make sure as many users and groups as possible end up in the IPA-managed ranges. it's giving fixer, it's giving group project leader.

BIG WARNING BESTIE: Before any changes are applied, a full backup of the system is STRONGLY RECOMMENDED. like, do the backup. do NOT skip the backup. this is not a drill. 😭

Do not use this program in unattended mode unless you are absolutely sure you are consenting to the tool's proposals. no cap, read before you yeet. 🫶

You can apply the proposals manually via ipa idrange(1) commands — very DIY, very hands-on, love that for you.

This tool requires it to be run as root and does not require a kerberos ticket. The directory server needs to be running. (yes, actually running. she will notice. 👀)

Here's the plot of the whole thing: ipa-idrange-fix will read current ranges from LDAP, then check their basic constraints, RID bases, etc. If it finds critical issues with ranges, manual adjustment will be required. like, she can't fix everything, she's a tool not a miracle worker. 🙈

After analyzing existing ranges, the tool will search for users and groups that are outside of ipa-local ranges. Then it will attempt to propose new ipa-local ranges in order to cover users and groups found. it's literally matchmaking but for IDs. 💖

Finally, the tool will summarize the analysis, and, if there are proposed changes, will ask if the user wants to apply those. Please read the proposals carefully before proceeding with changes! like actually read them. not skim. READ. 👑

Important note: By default, ipa-idrange-fix will not cover the users and groups that have IDs under 1000 as these IDs are reserved for system and service users and groups. We don't recommend using IDs under 1000 for IPA users and groups as they can possibly overlap with local ones. Please consider moving those users out of the range 1..1000, unless they are absolutely needed. (they're not. they're never needed. be so serious. 💀)

---

🎀 OPTIONS 🎀

• --version — Show the program's version and exit. quick lil flex and she's out. ✌️
• -h, --help — Show the help for this program. the classic "help me help you" moment. 💅
• --ridoffset INT — An offset for newly proposed base RIDs for ranges. We introduce offset in order to have an ability to increase ranges in the future, increase to more than offset will result in RID bases overlapping, and will be denied. If set to 0, there will be no offset, proposed RID ranges will start directly one after another. it's literally leaving room on the dance floor for later. 🕺

Default — 100000, allowed values — from 0 to 2^31.

• --rangegap INT — A number of IDs between out of ranges IDs to be considered too big to be inside a proposed range. If the gap is bigger than this attribute, a new range will be started. If set to 0, every entity will get its own range, if allowed by --minrange. so basically: how much empty space before she goes "nah, separate range bestie". 📏

Default — 200000, allowed values — from 0 to 2^31.

• --minrange INT — A minimal amount of IDs the tool considers to be a valid range. All IDs that would form a range with less than this number will be considered outliers, not worth creating an IDrange for, and will be listed explicitly to be moved manually. If set to 1, a range will be proposed for every entity, even if the entity is single in the middle of an empty space. (main character energy for one whole ID. iconic. 👑)

Default — 10, allowed values — from 1 to 2^31.

• --allowunder1000 — A flag to allow proposing ranges that start with IDs lower than 1000. Remember, this is not recommended — IDs under 1000 are reserved for system and service users and groups. IDranges with these low IDs may result with overlapping of IPA and system local users and groups, which can be a serious security issue and generally produce a lot of issues around these entities' resolution. ⚠️ so like, you can, but why would you. 😭
• --norounding — A flag to turn off idrange starting id and size rounding — e.g. if we find ID 1234, and the size 567, it will stay that way, the proposed range will start at ID 1234, and have a 567 size. If not specified, basic rounding to outer margins will be applied. Rounding will be 10^size of the proposed range. raw and unrounded, she's staying exactly as she is. ✨
• --unattended — Run the tool in unattended mode, if any changes would be proposed, they will be applied automatically. danger danger — see the warning above, do not use this unless you are absolutely sure you are consenting to the tool's proposals. fr fr. 🚨
• -v, --verbose — Print debugging information. she's telling you EVERYTHING. every little thought. 🗣️
• -q, --quiet — Output only errors (output from child processes may still be shown). the silent treatment, but make it useful. 🤫
• --log-file=FILE — Log to the given file. receipts, bestie. always keep the receipts. 🧾

---

🌈 EXIT STATUS 🌈

• 0 — if the command was successful. ate and left no crumbs. 💅
• 1 — if an error occurred. it's giving not the vibe. 😭

---

🫶 SEE ALSO 🫶

• ipa idrange-mod(1)
• ipa idrange-add(1)

---

and that's the whole page, bestie!! this one's from the IPA manual, dated May 26 2024 — go forth, back up your system first, and slay those ID ranges. 💖✨🎀🦋