<html><head></head><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1476873139460_15940" dir="ltr">Hi,<br></div><div dir="ltr">Martin thanks for your quick response. Based on your comments. I have further questions.<br></div><div id="yui_3_16_0_ym19_1_1476873139460_16510"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1476873139460_16815">>> equal peers and can be considered masters</div><div id="yui_3_16_0_ym19_1_1476873139460_16708"><br></div><div id="yui_3_16_0_ym19_1_1476873139460_16760">1. If there any urgency for us to recreate a "master" server to perform any "master" type functions? How do we re-attach "replicas" to this new "master"?<br id="yui_3_16_0_ym19_1_1476873139460_16478"></div><div id="yui_3_16_0_ym19_1_1476873139460_16479"><br></div><div id="yui_3_16_0_ym19_1_1476873139460_16762" dir="ltr">>> As long as the others have valid CA and server certs </div><div id="yui_3_16_0_ym19_1_1476873139460_16483">2. This is the install script we are using on the "replicas"<br id="yui_3_16_0_ym19_1_1476873139460_16484"></div><div id="yui_3_16_0_ym19_1_1476873139460_16485"><br id="yui_3_16_0_ym19_1_1476873139460_16486"></div>ipa-replica-install \<br id="yui_3_16_0_ym19_1_1476873139460_16487"> --setup-dns --ssh-trust-dns --no-dnssec-validation \<br id="yui_3_16_0_ym19_1_1476873139460_16488"> -p xxxxxxxxx \<br id="yui_3_16_0_ym19_1_1476873139460_16489"> --admin-password=xxxxxxx \<br id="yui_3_16_0_ym19_1_1476873139460_16490"> --ip-address=replica_ip \<br id="yui_3_16_0_ym19_1_1476873139460_16491"> --no-forwarders \<br id="yui_3_16_0_ym19_1_1476873139460_16492"> -U --mkhomedir --log-file=freeipa_log_file $1<br id="yui_3_16_0_ym19_1_1476873139460_16493"><div dir="ltr" id="yui_3_16_0_ym19_1_1476873139460_16494"><br id="yui_3_16_0_ym19_1_1476873139460_16495"></div>3. The $1 is the cert generated from the "master". If theres no distinction between a "master" and a "replica" in a CA-less environment, can a "replica" run the ipa-replica-prepare script once ipa-replica-install has been successfully run?<div dir="ltr" id="yui_3_16_0_ym19_1_1476873139460_16497"><br id="yui_3_16_0_ym19_1_1476873139460_16498"></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1476873139460_15941"><div id="yui_3_16_0_ym19_1_1476873139460_16858">Thank you for any help.</div><div id="yui_3_16_0_ym19_1_1476873139460_16860">Best regards,</div><div id="yui_3_16_0_ym19_1_1476873139460_16862">James Harrison<br></div><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1476873139460_15950" style="display: block;"> <div style="font-family: verdana, helvetica, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1476873139460_15949"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1476873139460_15948"> <div dir="ltr" id="yui_3_16_0_ym19_1_1476873139460_15947"> <font id="yui_3_16_0_ym19_1_1476873139460_15946" size="2" face="Arial"> <hr id="yui_3_16_0_ym19_1_1476873139460_15945" size="1"> <b><span style="font-weight:bold;">From:</span></b> Martin Babinsky <mbabinsk@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> freeipa-users@redhat.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, 19 October 2016, 11:01<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Promote CA-less replica<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1476873139460_15953"><br>On 10/19/2016 11:35 AM, James Harrison wrote:<br clear="none"><br clear="none">Hi James,<br clear="none"><br clear="none">> Hi,<br clear="none">> Were using FreeIPA on Ubuntu Xenial. We lost the Master server.<br clear="none">><br clear="none">> I have some questions:<br clear="none">> 1. Do DNS replicate among other replicas is we change/add DNS records?<br clear="none">> If not can this behaviour be changed?<br clear="none">IPA-intergrated DNS stores records in the replicated LDAP subtree so any <br clear="none">added/removed DNS record will replicate to other IPA DNS servers.<br clear="none"><br clear="none">> 2. How do we promote a replica to become a master? We have not<br clear="none">> configured our servers to become a CA. Our CA is Comodo and we have<br clear="none">> configured FreeIPA to use a certificate, key and interim certificates<br clear="none">> from Comodo. using the options:<br clear="none">><br clear="none">> --http_pkcs12=....<br clear="none">> --http_pin=....<br clear="none">> --dirsrv_pkcs12=...<br clear="none">> --dirsrv_pin=....<br clear="none">><br clear="none">> Hope someone can help. Quite urgent.<br clear="none">><br clear="none">The terms FreeIPA master/replica are quite arbitrary as all replicas are <br clear="none">equal peers and can be considered masters. The only notion of 'master' <br clear="none">is when you use a Dogtag CA (then one of the CA replicas is designated a <br clear="none">renewal master and does renew certificates in the topology and one is <br clear="none">CRL master generating certificate revocation lists) and/or DNSSec (then <br clear="none">one of DNS replica is designated a key master generating zone signing <br clear="none">keys and other DNS replicas pull these keys).<br clear="none"><br clear="none">As you are using CA-less replicas then there should be no loss in the <br clear="none">fact that the one designated 'master' is down (unless it was e.g. the <br clear="none">only DNS server). As long as the others have valid CA and server certs <br clear="none"><div id="yui_3_16_0_ym19_1_1476873139460_16410">they should be working just fine.</div><div id="yui_3_16_0_ym19_1_1476873139460_16666"><br></div><div id="yui_3_16_0_ym19_1_1476873139460_16433"><br></div><div><br></div>You can just install a new replica in place of the master by generating <br clear="none">replica file on another replicaa nd supplying the required certificates <br clear="none">through options.<div class="yqt5915859952" id="yqtfd22560"><br clear="none"><br clear="none">> Regards,<br clear="none">> James Harrison</div><br clear="none">><br clear="none">><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">Martin^3 Babinsky<br clear="none"><br clear="none">-- <br clear="none">Manage your subscription for the Freeipa-users mailing list:<br clear="none"><a shape="rect" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">Go to <a shape="rect" href="http://freeipa.org/" target="_blank">http://freeipa.org </a>for more info on the project<div class="yqt5915859952" id="yqtfd78634"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>