FreeIPA-users June 2020

freeipa-users@lists.fedorahosted.org

46 participants
85 discussions

Re: Migrating or adding CA to a replica after-the-fact?
by Florence Blanc-Renaud 02 Jun '20

02 Jun '20

On 6/2/20 3:28 PM, Auerbach, Steven via FreeIPA-users wrote: > Can we add the CA mastery or CA replica to an IPA v4 server that is a > replica and later promote to CA mastery?Â We have a IPA v3 server that > has been the only CA master for several years. We have a recent IPAv4 > replica that was set up without DNS or CA or NTP at the point of > creation, so only the LDAP is in the replication agreement. We are > trying to retire the IPA v3 servers and have a new replication pair in > IPA v4 without breaking the realm and all our clients and users > records.Â We keep running into walls and roadblocks as we try to build a > procedure we can execute in an off-hours maintenance window. > Hi, you can add the CA role to an existing replica that was installed without CA, using ipa-ca-install on the replica. If you decide later on to move the master CA to this replica, you can follow the steps from https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Same thing for DNS, you can run ipa-dns-install on a non-DNS replica. HTH, flo > *Steven Auerbach* > > *Assistant Director of Information Systems* > > *Information Technology & Security*** > > ** > > State University System of Florida > > Board of Governors > > 325 W. Gaines Street > > Tallahassee, Florida 32399 > > (850) 245-9592 > > www.flbog.edu <http://www.flbog.edu/> > > Graphic for Email > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

1 0

Re: Migrating or adding CA to a replica after-the-fact?
by Rob Crittenden 02 Jun '20

02 Jun '20

Auerbach, Steven via FreeIPA-users wrote: > Can we add the CA mastery or CA replica to an IPA v4 server that is a > replica and later promote to CA mastery?Â We have a IPA v3 server that > has been the only CA master for several years. We have a recent IPAv4 > replica that was set up without DNS or CA or NTP at the point of > creation, so only the LDAP is in the replication agreement. We are > trying to retire the IPA v3 servers and have a new replication pair in > IPA v4 without breaking the realm and all our clients and users > records.Â We keep running into walls and roadblocks as we try to build a > procedure we can execute in an off-hours maintenance window. Run ipa-ca-install to add a CA to a master that does not have the role configured. rob

1 0

Migrating or adding CA to a replica after-the-fact?
by Auerbach, Steven 02 Jun '20

02 Jun '20

Can we add the CA mastery or CA replica to an IPA v4 server that is a replica and later promote to CA mastery? We have a IPA v3 server that has been the only CA master for several years. We have a recent IPAv4 replica that was set up without DNS or CA or NTP at the point of creation, so only the LDAP is in the replication agreement. We are trying to retire the IPA v3 servers and have a new replication pair in IPA v4 without breaking the realm and all our clients and users records. We keep running into walls and roadblocks as we try to build a procedure we can execute in an off-hours maintenance window. Steven Auerbach Assistant Director of Information Systems Information Technology & Security State University System of Florida Board of Governors 325 W. Gaines Street Tallahassee, Florida 32399 (850) 245-9592 www.flbog.edu<http://www.flbog.edu/> [Graphic for Email]

1 0

Re: Is the bugzilla 1035010 referenced at the link fixed or worked around?
by Rob Crittenden 01 Jun '20

01 Jun '20

Auerbach, Steven via FreeIPA-users wrote: > https://bugzilla.redhat.com/show_bug.cgi?id=1035010\ > > Â > > I need to resolved this in order to do an in-place upgrade from Linux 6 > to Linux 7 and have my IPA upgrade in place from v3 to v4. The outcome of this bug was to specifically prevent in-place upgrades on an IPA master. You need to create a RHEL-7 machine as a new master. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… rob > > Â > > *Steven Auerbach* > > *Assistant Director of Information Systems* > > *Information Technology & Security*** > > *Â * > > State University System of Florida > > Board of Governors > > 325 W. Gaines Street > > Tallahassee, Florida 32399 > > (850) 245-9592 > > www.flbog.edu <http://www.flbog.edu/> > > Graphic for Email > > Â > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

1 0

Is the bugzilla 1035010 referenced at the link fixed or worked around?
by Auerbach, Steven 01 Jun '20

01 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1035010\ I need to resolved this in order to do an in-place upgrade from Linux 6 to Linux 7 and have my IPA upgrade in place from v3 to v4. Steven Auerbach Assistant Director of Information Systems Information Technology & Security State University System of Florida Board of Governors 325 W. Gaines Street Tallahassee, Florida 32399 (850) 245-9592 www.flbog.edu<http://www.flbog.edu/> [Graphic for Email]

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2020