<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Fri, Dec 12, 2014 at 3:13 PM, Martin Basti <span dir="ltr"><<a href="mailto:mbasti@redhat.com" target="_blank">mbasti@redhat.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">On 12/12/14 14:57, Gianluca Cecchi wrote:<br>
<br>
Hello, read inline comments.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hello,<br>
I migrated a CentOS 6.6 system with IPA 3.0 to a CentOS 7.0 system with IPA 3.3.<br>
The workflow was the one to create a replica and then decommission the old one (that now is with services stopped) with the commands:<br>
<br>
on old server:<br>
ipa-server-install --uninstall<br>
<br>
on new server:<br>
ipa-replica-manage del infra.localdomain.local --force<br>
<br>
</blockquote></span><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br></blockquote></span></blockquote><div>[snip] </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
</blockquote></span>
It is not clear for me, did you use IPA DNS before upgrade, or you just install IPA DNS after upgrade?</blockquote><div><br></div><div>I followed chapter 6 of</div><div><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html</a></div><div><br></div><div>In IPA 3.0 I preconfigured DNS and then installed IPA with</div><div># ipa-server-install<br></div><div>and at the end</div><div><br></div><div>"</div><div>....</div><div><div>Setup complete</div><div><br></div><div>Next steps:</div><div><span class="" style="white-space:pre"> </span>1. You must make sure these network ports are open:</div><div><span class="" style="white-space:pre"> </span>TCP Ports:</div><div><span class="" style="white-space:pre"> </span> * 80, 443: HTTP/HTTPS</div><div><span class="" style="white-space:pre"> </span> * 389, 636: LDAP/LDAPS</div><div><span class="" style="white-space:pre"> </span> * 88, 464: kerberos</div><div><span class="" style="white-space:pre"> </span>UDP Ports:</div><div><span class="" style="white-space:pre"> </span> * 88, 464: kerberos</div><div><span class="" style="white-space:pre"> </span> * 123: ntp</div><div><br></div><div><span class="" style="white-space:pre"> </span>2. You can now obtain a kerberos ticket using the command: 'kinit admin'</div><div><span class="" style="white-space:pre"> </span> This ticket will allow you to use the IPA tools (e.g., ipa user-add)</div><div><span class="" style="white-space:pre"> </span> and the web user interface.</div><div><br></div><div>Be sure to back up the CA certificate stored in /root/cacert.p12</div><div>This file is required to create replicas. The password for this</div><div>file is the Directory Manager password</div></div><div>"</div><div><br></div><div>When I updated to 3.3, as part of the suggested documentation I created the replica file on old server and then used this command on new server:</div><div># ipa-replica-install --setup-ca --ip-address=192.168.1.81 -p my_password -w my_password -N --setup-dns --forwarder=192.168.1.254 -U /var/lib/ipa/replica-info-c7server.localdomain.local.gpg<br></div><div><br></div><div>And this way it should automatically embed the dns part into IPA, correct? <br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
It works but the old IPA server hostname (with hostname=infra) is no more resovable<br></blockquote></span></blockquote><div><br></div><div>[snip] </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"></blockquote>
<br></span>
IMO the behavior is expected, deleting old replica 'infra', should remove the DNS record of replica as well<br></blockquote><div><br></div><div>OK. I was able to access the web gui (this time..) and in fact the infra entry was not present neither in forward nor in reverse zone, so I added it and now it is ok:</div><div><br></div><div>[root@c7server etc]# nslookup infra</div><div>Server: 192.168.1.81</div><div>Address: 192.168.1.81#53</div><div><br></div><div>Name: infra.localdomain.local</div><div>Address: 192.168.1.62</div><div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
try following command to detect if there is the infra replica record in LDAP<br>
<br>
$ ipa dnsrecord-find localdomain.local<span class=""><font color="#888888"><br><br></font></span></blockquote><div><br></div><div>It now returns 22 entries and also the added one for infra hostname</div><div><br></div><div> [root@c7server etc]# kinit admin</div><div>Password for admin@LOCALDOMAIN.LOCAL:</div><div>[root@c7server etc]# ipa dnsrecord-find localdomain.local</div><div> Record name: @</div><div> NS record: c7server.localdomain.local.</div><div><br></div><div> Record name: _kerberos</div><div> TXT record: LOCALDOMAIN.LOCAL</div><div><br></div><div>...</div><div><br></div><div><div> Record name: infra</div><div> A record: 192.168.1.62</div></div><div><br></div><div>...</div><div><br></div><div>Thanks,</div><div>I will check if web UI gives again the problem I had yesterday with the expired session message...</div><div><br></div><div>Gianluca</div><div><br></div></div></div></div>