<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Petr and all,</span></div><div><span><br></span></div><div> All the chapter your have pointed out is read many times, but that doesn't help at all.</div><div><br></div><div> My problem is: the Dogtag system ran on the IPA master ONLY before the IPA Master crashes. Now I have to do the following:</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1, install and run Dogtag system on IPA replica -- the document mentioned it -- '<span class="Apple-style-span" style="font-family: monospace; white-space: pre; ">ipa-ca-install' and etc.</span></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2, promote the IPA replica into new IPA Master -- document mentioned it but not clear -- regarding the /root/cacert.p12 key file and the replica file under /var/lib/ipa.</div><div><br></div><div> 3, how to recover the dogtag systems' data (different LDAP backend) existed on the IPA master before it crashes?</div><div><br></div><div>Other close questions include:</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>what are included in the replica definition file /var/lib/ipa/replica-info-ipareplica01.example.com.gpg? where is the signing key and how to open the .gpg file?</div><div><br></div><div>Thanks.</div><div><br></div><div>--David</div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Petr Spacek <pspacek@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> freeipa-users@redhat.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, May 10, 2012 2:45 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] How to rebuild IPA master?<br> </font> </div> <br> On 05/10/2012 02:24 AM, Steven Jones wrote:<br>> Hi,<br>><br>> In case everyone else is asleep now......<br>><br>> Do you have access to RH documentation? the 6.3beta admin guide section 18.8<br>> talks about why and how to make a replicate a master.<br><br>Just for completeness:<br>Documentation is publicly available: http://docs.redhat.com/<br><br>Documentation for IPA beta:<br>http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Identity_Management_Guide/index.html<br><br>Documentation for latest stable IPA:<br>http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/index.html<br><br>><br>> eg.,<br>><br>> "NOTE<br>> All servers and replicas which host a CA are peers in the topology. They can<br>> all issue certificates<br>> and keys to IPA clients, and they all replicate information amongst themselves.<br>> The only reason to promote a replica or server to be a master server is if the<br>> master server is<br>> being taken offline. There has to be a root CA which can issue CRLs and<br>> ultimately validate<br>> certificate checks.<br>> Aside from that, replicas, servers, and the master server are all equal peers."<br>><br>> regards<br>><br>> Steven Jones<br>><br>> Technical Specialist - Linux RHCE<br>><br>> Victoria University, Wellington, NZ<br>><br>> 0064 4 463 6272<br>><br>> ------------------------------------------------------------------------------<br>> *From:* <a ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] on<br>> behalf of David Copperfield [<a ymailto="mailto:cao2dan@yahoo.com" href="mailto:cao2dan@yahoo.com">cao2dan@yahoo.com</a>]<br>> *Sent:* Thursday, 10 May 2012 11:04 a.m.<br>> *To:* Rob Crittenden; <a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>> *Subject:* [Freeipa-users] How to rebuild IPA master?<br>><br>> Hi all,<br>><br>> I've a IPA master/replica setup in our development environment. Unfortunately<br>> our IPA master crashed, the replica is working fine. Now I have the IPA master<br>> re-imaged.<br>><br>> What are the steps I have to follow to re-create the IPA master from running<br>> IPA replica? Before crash the IPA master ran dogtag certificate system, while<br>> the IPA replica didn't -- created normally without the --setup-ca option.<br>><br>> Thanks.<br>><br>> --David<br>><br>><br>> _______________________________________________<br>> Freeipa-users mailing list<br>> <a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br>_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br><br> </div> </div> </div></body></html>