On 02/14/2012 12:31 AM, Simo Sorce wrote:
On Tue, 2012-02-14 at 00:14 +0100, Sigbjorn Lie wrote:
On 02/13/2012 09:43 PM, Simo Sorce wrote:
On Mon, 2012-02-13 at 21:37 +0100, Sigbjorn Lie wrote:
On 02/13/2012 08:55 PM, Simo Sorce wrote:
On Mon, 2012-02-13 at 20:43 +0100, Sigbjorn Lie wrote:
On 02/13/2012 08:16 PM, Rob Crittenden wrote:
Sigbjorn Lie wrote:
Hi,
What precautions need to be taken when replacing the primary/first IPA
server?
Is it enough to reinstall the server and run a ipa-replica-install from
one of the other replicas?
It depends on what type of CA installation you have. Did you install
with dogtag or with a selfsign CA?
rob
Dogtag
If you installed the CA on more than one replica, then you can remove
the first master, all the info is replicated on the other replicas that
have a clone of the CA. Note that the CA is not replicated by default
see the --setup-ca option or ipa-ca-install
Excellent. Yes, I've used --setup-ca when I created the replicas. :)
What if I have 3 IPA servers. 2 being replicated off the first master.
The master is re-installed and re-setup using ipa-replica-install from
one of the 2 other IPA servers.
Will not the 3rd server be left without a sync agreement? Does the 3rd
server need to be manually added back in with a sync agreement?
Before removing any server you should make sure it will not break the
topology.
You can use ipa-replica-manage and ipa-ca-replica-manage to create links
between the 2 other servers before you retire the hub.
You have to use both the commands as CA replication agreements are
distinct from IPA replication agreements.
1. Let's say the server has crashed. Unrecoverable. Can new replication
agreements still be set up between the remaining hosts?
Yes, you should be able to change the agreements, as all the principals
already exists so there is no need to replicate through the old hub just
to set the m up.
2. I do not see a way for displaying relationships between the IPA hosts
when viewing the replicas with ipa-replica-manage list. I see the same
output on all the IPA hosts.
ipa-replica-manage list shows all servers
ipa-replica-manage list servername shows the replication agreements that
server uses
If they all look the same it means you have a full mesh :)
3. Perhaps this was discussed earlier: Can there be configured a ring of
replicas with IPA?
If by ring you mean A<-> B<-> C<-> A then yes. In general we
recommend to not have more than 4 replication agreements per server, but
that's more of a rule of thumb than a hard limit.
Thank you. :)
For anyone else reading this thread and looking for more information,
see the link below. I see some of my questions we're already documented
there.
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/ipa-replica-manage.html
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users
