On 7/24/19 11:59 AM, Jo Domsic via FreeIPA-users wrote:

Hi to the good people of FreeIPA!

I'm in the process of removing old servers from my datacentar, and I was wondering if I can delete/remove (first created) freeipa server? I have 4 masters: [root@server] ipa-replica-manage list freeipa03.lan: master freeipa04.lan: master freeipa01.lan: master <--- I want to delete this one freeipa02.lan: master

Hi, before removing this server, please make sure that all its roles are replicated into at least another master. For instance, if freeipa01 provides CA, KRA or DNS, check that the role is also configured somewhere else. You can use ipa server-role-find.

You will also need to transfer the CA renewal and CRL generation responsibilities to another master (please see [1] for instructions).

What will happen to servers that have: [root@server2] cat /etc/ipa/default.conf #File modified by ipa-client-install

[global] basedn = dc=lan realm = LAN domain = lan server = freeipa01.lan host = server2.lan xmlrpc_uri = https://freeipa01.lan/ipa/xml enable_ra = True

If the client is properly configured and relies on DNS discovery, the failover will apply silently. Check on the client that: - /etc/sssd/sssd.conf defines ipa_server = _srv_,<name of master> The _srv_ keyword means that service discovery is used to find an available master. Please see sssd-ipa man page, specifically the FAILOVER section. - /etc/krb5.conf defines dns_lookup_kdc = true in [libdefaults] and there is no kdc= in the realm section for IdM.

This way, kerberos and sssd clients will use DNS discovery. Of course, the DNS needs to be properly setup: - if using IdM embedded DNS, this is automatic - if using an external DNS, the proper DNS records are required, please see [2]. You can also use ipa dns-update-system-records --dry-run to get a list of the required records in nsupdate format. Please see [3].

HTH, flo

[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm... [2] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm... [3] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...

---

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...