Thank you Fraser,
Why not throw warning before it start running ipa-replica-install ( I
would say put human interaction there and without that it won't let
you move forward)
something like following example:
WARNING!!!!!!! you are running singel CA Master, Do you want to
install CA Replica on this server [Yes/No]:
Not seeing any point in end if it remind you and then you have to
re-install again with --setup-ca
This is just me feeling that way because i went through this pain :(
and had lots of alcohol to wash that pain away :)
On Mon, Sep 30, 2019 at 9:09 PM Fraser Tweedale <ftweedal(a)redhat.com> wrote:
>
> On Mon, Sep 30, 2019 at 10:20:16AM -0400, Satish Patel via FreeIPA-users wrote:
> > Stuart,
> >
> > All i would say please run multiple CA servers in your ldap
> > infrastructure, otherwise you will be in very big trouble like i was
> > in, I had no idea about role of CA and was running single CA which we
> > lost and then we totally screwed and won't able to create any replica
> > or anything totally dead end.
> >
> > FreeIPA document is really huge and sometime you get lost of what
> > components are mandatory no blaming to anyone but that was i felt. I
> > wish they add this CA verification feature in " ipa-replica-install"
> > command which won't let you move forward until you have minimum two CA
> > (and force you to use --setup-ca option)
> >
>
> We now have a warning at end of ipa-replica-install if there is only
> one CA replica in the topology.
>
> The freeipa-healthcheck project will also analyse the topology and
> warn of insufficient redundancy of CA/KRA, DNS, etc.
>
> Cheers,
> Fraser
>
> > On Mon, Sep 30, 2019 at 12:35 AM Fraser Tweedale via FreeIPA-users
> > <freeipa-users(a)lists.fedorahosted.org> wrote:
> > >
> > > Hi Stuart,
> > >
> > > Adding the freeipa-users@ mailing list for visibility.
> > >
> > > I'd have to work through your scenario to work out why it fails.
> > > But it may be some time before I get around to that.
> > >
> > > I think your idea to first try creating a CA replica on F28 before
> > > moving forward to F30 is a sensible thing to try.
> > >
> > > One question though: are you on Domain Level 0 or 1?
> > > (`ipa domainlevel-get`).
> > >
> > > Cheers,
> > > Fraser
> > >
> > > On Thu, Sep 26, 2019 at 07:35:58PM +0100, Stuart McRobert wrote:
> > > > Dear Fraser,
> > > >
> > > > I've read through lots of posts but I am uncertain about the best
way
> > > > forward and wonder if I could seek your guidance? I just don't
want to break
> > > > things.
> > > >
> > > > Currently we have three freeipa servers (1-3) on Fedora 26 (clearly
need
> > > > updating) with ipa VERSION: 4.4.4, API_VERSION: 2.215 and one new
Fedora 30
> > > > server (#4) which I just started to add with VERSION: 4.8.1,
API_VERSION:
> > > > 2.233.
> > > >
> > > > The reason for adding a new server before updating the others is the
web
> > > > interface warning:
> > > >
> > > > Warning: Only One CA Server Detected
> > > > It is strongly recommended to keep the CA services installed on
more than
> > > > one server
> > > >
> > > > which I fully understand is not good, but it doesn't offer to just
fix it!
> > > >
> > > > I suspect server #4 may be too new, failing with both
> > > >
> > > > ipa-replica-install --setup-ca
> > > >
> > > > and
> > > >
> > > > ipa-ca-install
> > > >
> > > > in a very similar way, e.g.
> > > >
> > > > 2019-09-26T16:18:15Z ERROR Unable to log in as
uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca on
ldap://freeipa01.services.nsa.stats.ox.ac.uk:389
> > > > 2019-09-26T16:18:15Z DEBUG Traceback (most recent call last):
> > > > File
"/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 603, in
start_creation
> > > > run_step(full_msg, method)
> > > > File
"/usr/lib/python3.7/site-packages/ipaserver/install/service.py", line 589, in
run_step
> > > > method()
> > > > File
"/usr/lib/python3.7/site-packages/ipaserver/install/dogtaginstance.py", line
503, in setup_admin
> > > > self.admin_dn, master_conn
> > > > ipalib.errors.NotFound:
uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca did not replicate to
ldap://freeipa01.services.nsa.stats.ox.ac.uk:389
> > > >
> > > > 2019-09-26T16:18:15Z DEBUG [error] NotFound:
uid=admin-freeipa04.services.nsa.stats.ox.ac.uk,ou=people,o=ipaca did not replicate to
ldap://freeipa01.services.nsa.stats.ox.ac.uk:389
> > > >
> > > >
> > > > which I think others have also run into.
> > > >
> > > > Next thought was to confirm what we had:
> > > >
> > > > [root@freeipa01 ~]# ipa server-find
> > > > ---------------------
> > > > 4 IPA servers matched
> > > > ---------------------
> > > > Server name: freeipa01.services.nsa.stats.ox.ac.uk
F26
> > > >
> > > > Server name: freeipa02.services.nsa.stats.ox.ac.uk
F26
> > > >
> > > > Server name: freeipa03.services.nsa.stats.ox.ac.uk
F26
> > > >
> > > > Server name: freeipa04.services.nsa.stats.ox.ac.uk
F30
> > > > ----------------------------
> > > > Number of entries returned 4
> > > > ----------------------------
> > > > [root@freeipa01 ~]# ipa server-role-find --role "CA
server"
> > > > ----------------------
> > > > 4 server roles matched
> > > > ----------------------
> > > > Server name: freeipa01.services.nsa.stats.ox.ac.uk
> > > > Role name: CA server
> > > > Role status: enabled
> > > >
> > > > Server name: freeipa02.services.nsa.stats.ox.ac.uk
> > > > Role name: CA server
> > > > Role status: absent
> > > >
> > > > Server name: freeipa03.services.nsa.stats.ox.ac.uk
> > > > Role name: CA server
> > > > Role status: absent
> > > >
> > > > Server name: freeipa04.services.nsa.stats.ox.ac.uk
> > > > Role name: CA server
> > > > Role status: absent
> > > > ----------------------------
> > > > Number of entries returned 4
> > > > ----------------------------
> > > >
> > > >
> > > > and then find out how to change the "Role status:" to
enabled, starting on
> > > > freeipa02 but I am not sure how to achieve this, e.g.
> > > >
> > > >
> > > > [root@freeipa02 ~]# ipa-ca-install
> > > > CA is already installed on this host.
> > > >
> > > > true but doesn't really help. Sorry if this is very easy to do
with a
> > > > command I have totally missed.
> > > >
> > > > Currently I know if freeipa01 fails, client logins also fail, and I
assume
> > > > this is because it is the only CA server enabled.
> > > >
> > > > Work plan:
> > > >
> > > > 1. Enable more CA servers
> > > >
> > > > 2. Update Fedora 26 to 30, perhaps via 28 first if advised not to jump
too
> > > > far at once, probably updating servers #2, then #3 and finally #1.
> > > >
> > > > 3. Add more servers for resiliency
> > > >
> > > >
> > > > Any idea how to get more CA servers enabled or any other suggestions?
> > > >
> > > > Many thanks
> > > >
> > > > Best wishes
> > > >
> > > > Stuart
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...