<div dir="ltr">What passpharase would this be encrypted with? If it's something I set a year ago and never needed to know again, then we may be screwed. If it's saved somewhere, where should I look?<div class="gmail_extra">
<br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><img src="http://damascusgrp.com/item/51f7de33e4b08d2bdb8b4860?format=1500w" width="200" height="53"><br></div><div>
<a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br></div></div></div>
<br><br><div class="gmail_quote">On Thu, Aug 29, 2013 at 11:58 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Bret Wortman wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
On Thu, Aug 29, 2013 at 11:40 AM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a><br></div><div class="im">
<mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>><u></u>wrote:<br>
<br>
Bret Wortman wrote:<br>
<br>
On Thu, Aug 29, 2013 at 11:10 AM, Rob Crittenden<br>
<<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>><br></div><div><div class="h5">
<mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>>> wrote:<br>
<br>
Bret Wortman wrote:<br>
<br>
A bit of googling has led me to understand that we must<br>
have<br>
created the<br>
original server with --selfsign, and that locked us into<br>
something bad<br>
which is now causing us problems. I'm not sure how this<br>
happened, since<br>
we actually created our original instance on a<br>
different server,<br>
created<br>
ipamaster as a replica of that one, then ran<br>
ipa-ca-install on<br>
ipamaster<br>
to make it the new CA. How did it end up in this state?<br>
<br>
Anyway, is there ANY way around this? Can I simply<br>
ignore this,<br>
break<br>
the replication agreement as Simo suggested, rebuild<br>
ipamaster,<br>
replicate ipamaster2 to the new ipamaster, and then<br>
somehow make<br>
ipamaster be a CA using Dogtag? Will that screw up all<br>
the clients?<br>
<br>
<br>
I think we should pause and take a look at your installation.<br>
<br>
I'd check all your current masters, whether they are currently<br>
working or not. Look at the value of ra_plugin in<br>
/etc/ipa/default.conf. That controls what IPA thinks the CA is.<br>
<br>
on ipamaster: ra_plugin=dogtag<br>
<br>
and either that same value or the ra_plugin doesn't exist on the<br>
replicas. On ipamaster2, the one I just installed, there is no<br>
ra_plugin<br>
in the file.<br>
<br>
Then check to see if you have dogtag running on any of these<br>
systems. This will include a 2nd 389-ds instance,<br>
/etc/dirsrv/slapd-PKI-IPA and, depending on your distro, a PKI<br></div></div>
service like pki-tomcatd@pki-tomcat.____<u></u>service. You can<div class="im"><br>
optionally<br>
<br>
see if /etc/pki/pki-tomcat exists.<br>
<br>
ipamaster definitely has a /etc/dirsrv/slapd-PKI-IPA directory, with<br>
files updated fairly recently (within the past 30 minutes -<br>
lse.ldif and<br>
lse.ldif.bak, others updated yesterday). I also have a<br>
pki-tomcatd@.service file and a pki-tomcatd.target. no<br>
/etc/pki/pki-tomcat.<br>
<br>
ipamaster2 only has /etc/dirsrv/slapd-FOO-NET. It does have<br>
pki-tomcatd.target and pki-tomcatd@.service. No /etc/pki/pki-tomcat.<br>
<br>
<br>
Ok. When you created the replica file for ipamaster2, did you create<br>
it on ipamaster? Only a replica that is a CA can create a replica<br>
with a CA.<br>
<br>
Yes. So I'm not sure what went askew.<br>
</div></blockquote>
<br>
Ok. I think we need to see what's in the prepared file. It is just a gpg-encrypted tarball. Can you do something like:<br>
<br>
gpg -d replica-info-pacer.greyoak.<u></u>com.gpg |tar xf -<br>
<br>
This will create a realm_info subdirectory. The file cacert.p12 should be in there.<span class="HOEnZb"><font color="#888888"><br>
<br>
rob<br>
<br>
</font></span></blockquote></div><br></div></div>