[Freeipa-users] Moving the master server
Nick Gresham
n.gresham at manchester.ac.uk
Mon Feb 2 13:18:45 UTC 2009
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Rob Crittenden wrote:
> Nick Gresham wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi,
>>
>> I have a couple of machines in a running freeipa-1.2.1 in a
>> master/replica set up. However the the master server in this scenario is
>> now out of warranty and needs to be retired.
>>
>> I have another machine readied to assume its role (with a different
>> hostname and ip number, however), or preferably, I could promote the
>> existing replica to master.
>>
>> There doesn't seem to be an easy way to accomplish this, short of
>> starting again (which is not a practical option for me).
>>
>> Cany anyone give some advice? Thanks in advance,
>>
>
> The only difference between a replica and the initial IPA install (the
> "master") is that the first server owns the self-signed CA.
>
> You should be able to do this to make your "replica" the master:
>
> - copy /var/lib/ipa/ca_serialno from master to replica
> - import the CA into the replica DS NSS database with:
> # cd /etc/dirsrv/slapd-REALM
> # pk12util -i /path/to/cacert.p12 -d .
>
> The password on the PKCS#12 file is on the original server in
> /etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you
> backed up elsewhere too, right?)
>
> - Delete the existing replication agreements:
> # ipa-replica-manage del master.example.com
>
> Now you should have 2 identical IPA servers, neither of which know about
> each other. Shut down the old master and stand up the new box. Create a
> replica file on the newly promoted master and install that on the new
> box. You should be back in business.
>
> Note: I haven't actually tried this but it should do the trick. Backups
> are always a good idea.
>
> rob
That worked perfectly! Many thanks
[NG]
- --
N.J. Gresham
FLS/IS AIO
Systems Administration and Support
University of Manchester
Faculty of Life Sciences
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkmG8rAACgkQoqZzfMI0Udm/jACdGzQkzwxdapORbLKgaVUSP53B
KxEAn2ehRmuJVE5PJcQ7AiS0DoOLPn6s
=To0V
-----END PGP SIGNATURE-----
More information about the Freeipa-users
mailing list