[Freeipa-users] Moving the master server

Rob Crittenden rcritten at redhat.com
Mon Feb 2 15:23:38 UTC 2009


Nick Gresham wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Rob Crittenden wrote:
>> Nick Gresham wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Hi,
>>>
>>> I have a couple of machines in a running freeipa-1.2.1 in a
>>> master/replica set up. However the the master server in this scenario is
>>> now out of warranty and needs to be retired.
>>>
>>> I have another machine readied to assume its role (with a different
>>> hostname and ip number, however), or preferably, I could promote the
>>> existing replica to master.
>>>
>>> There doesn't seem to be an easy way to accomplish this, short of
>>> starting again (which is not a practical option for me).
>>>
>>> Cany anyone give some advice? Thanks in advance,
>>>
>> The only difference between a replica and the initial IPA install (the
>> "master") is that the first server owns the self-signed CA.
>>
>> You should be able to do this to make your "replica" the master:
>>
>> - copy /var/lib/ipa/ca_serialno from master to replica
>> - import the CA into the replica DS NSS database with:
>> # cd /etc/dirsrv/slapd-REALM
>> # pk12util -i /path/to/cacert.p12 -d .
>>
>> The password on the PKCS#12 file is on the original server in
>> /etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you
>> backed up elsewhere too, right?)
>>
>> - Delete the existing replication agreements:
>> # ipa-replica-manage del master.example.com
>>
>> Now you should have 2 identical IPA servers, neither of which know about
>> each other. Shut down the old master and stand up the new box. Create a
>> replica file on the newly promoted master and install that on the new
>> box. You should be back in business.
>>
>> Note: I haven't actually tried this but it should do the trick. Backups
>> are always a good idea.
>>
>> rob
> 
> That worked perfectly! Many thanks

Great, glad to hear it. We'll see about integrating this into our 
documentation.

thanks for the feedback

rob




More information about the Freeipa-users mailing list