[Freeipa-users] IPA to IPA migration

[Ian Harding]

On 01/05/2017 07:17 AM, Rob Crittenden wrote:
> Timothy Geier wrote:
>> This is something I’ve looked at lately and a manual proof of concept I
>> just did (using ideas from
>> https://www.freeipa.org/page/Howto/Migration#Migrating_from_other_FreeIPA_to_FreeIPA)
>> makes it seem theoretically possible (though it looks like, barring the
>> migration of the kerberos master key, all enrolled hosts would need to
>> use ipa-getkeytab to get a replacement keytab from the new server and
>> copy it to /etc/krb5.keytab so that sssd will work properly..the
>> alternative is re-enrollment.  All other keytabs in use by other
>> applications would have to be similarly replaced).  
> 
> Why migrate at all?

It is possible to get a FreeIPA installation so boogered up that it's
just not salvageable.  I'm pretty close to that right now.  The
replication model is really great but it replicates all my mistakes.

Maybe I'm just not smart enough, but I suspect others have wished they
could just throw in the towel and start over.  I would if it were
relatively easy, that is, if I could export and reimport users (ideally
with passwords), hosts, groups, hbac rules, etc.  I woudln't even mind
having to re-enroll them.



-- 
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com