[Freeipa-users] Moving the master server

[Nick Gresham]

Hi,

I have a couple of machines in a running freeipa-1.2.1 in a
master/replica set up. However the the master server in this scenario is
now out of warranty and needs to be retired.

I have another machine readied to assume its role (with a different
hostname and ip number, however), or preferably, I could promote the
existing replica to master.

There doesn't seem to be an easy way to accomplish this, short of
starting again (which is not a practical option for me).

Cany anyone give some advice? Thanks in advance,

Regards

[NG]

- --
N.J. Gresham
FLS/IS AIO
Systems Administration and Support

University of Manchester
Faculty of Life Sciences

int: 7759349
ext: 0790-989-3684

[Rob Crittenden]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I have a couple of machines in a running freeipa-1.2.1 in a
master/replica set up. However the the master server in this scenario is
now out of warranty and needs to be retired.
I have another machine readied to assume its role (with a different
hostname and ip number, however), or preferably, I could promote the
existing replica to master.
There doesn't seem to be an easy way to accomplish this, short of
starting again (which is not a practical option for me).
Cany anyone give some advice? Thanks in advance,

The only difference between a replica and the initial IPA install (the
"master") is that the first server owns the self-signed CA.

You should be able to do this to make your "replica" the master:

- copy /var/lib/ipa/ca_serialno from master to replica
- import the CA into the replica DS NSS database with:
# cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .

The password on the PKCS#12 file is on the original server in
/etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you
backed up elsewhere too, right?)

- Delete the existing replication agreements:
# ipa-replica-manage del master.example.com

Now you should have 2 identical IPA servers, neither of which know about
each other. Shut down the old master and stand up the new box. Create a
replica file on the newly promoted master and install that on the new
box. You should be back in business.

Note: I haven't actually tried this but it should do the trick. Backups
are always a good idea.

rob

[Nick Gresham]

Post by Rob Crittenden

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I have a couple of machines in a running freeipa-1.2.1 in a
master/replica set up. However the the master server in this scenario is
now out of warranty and needs to be retired.
I have another machine readied to assume its role (with a different
hostname and ip number, however), or preferably, I could promote the
existing replica to master.
There doesn't seem to be an easy way to accomplish this, short of
starting again (which is not a practical option for me).
Cany anyone give some advice? Thanks in advance,

The only difference between a replica and the initial IPA install (the
"master") is that the first server owns the self-signed CA.
- copy /var/lib/ipa/ca_serialno from master to replica
# cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .
The password on the PKCS#12 file is on the original server in
/etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you
backed up elsewhere too, right?)
# ipa-replica-manage del master.example.com
Now you should have 2 identical IPA servers, neither of which know about
each other. Shut down the old master and stand up the new box. Create a
replica file on the newly promoted master and install that on the new
box. You should be back in business.
Note: I haven't actually tried this but it should do the trick. Backups
are always a good idea.
rob

That worked perfectly! Many thanks

[NG]

- --
N.J. Gresham
FLS/IS AIO
Systems Administration and Support

University of Manchester
Faculty of Life Sciences

[Rob Crittenden]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Post by Rob Crittenden

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I have a couple of machines in a running freeipa-1.2.1 in a
master/replica set up. However the the master server in this scenario is
now out of warranty and needs to be retired.
I have another machine readied to assume its role (with a different
hostname and ip number, however), or preferably, I could promote the
existing replica to master.
There doesn't seem to be an easy way to accomplish this, short of
starting again (which is not a practical option for me).
Cany anyone give some advice? Thanks in advance,

The only difference between a replica and the initial IPA install (the
"master") is that the first server owns the self-signed CA.
- copy /var/lib/ipa/ca_serialno from master to replica
# cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .
The password on the PKCS#12 file is on the original server in
/etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you
backed up elsewhere too, right?)
# ipa-replica-manage del master.example.com
Now you should have 2 identical IPA servers, neither of which know about
each other. Shut down the old master and stand up the new box. Create a
replica file on the newly promoted master and install that on the new
box. You should be back in business.
Note: I haven't actually tried this but it should do the trick. Backups
are always a good idea.
rob

That worked perfectly! Many thanks

Great, glad to hear it. We'll see about integrating this into our
documentation.

thanks for the feedback

rob