----- Izvirno sporočilo -----
Od: "Rob Crittenden" <rcritten(a)redhat.com>
Za: "FreeIPA users list" <freeipa-users(a)lists.fedorahosted.org>
Cc: "Jernej Jakob" <jernej.jakob(a)abak.si>
Poslano: Četrtek, 7. Februar 2019 17:05:47
Zadeva: Re: [Freeipa-users] Upgrading from V3 on Fedora to V4 on CentOS, CA promotion
steps?
> There is no 8 yet.
There is the 8 beta, I was thinking I'd maybe wait for the release, but if that
isn't gonna happen till summer I'm going with 7.
> You don't need to do all this. What you want to do is something like
> (mostly off the top of my head, definitely read the docs and come up
> with a full plan):
>
> - ensure you have a CA and that its certs are valid (getcert list | grep
> expires)
Checks out, all are valid.
> - ipa-replica-prepare <your_new_master>
> - follow
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> - on the new master ipa-replica-install <prepare-file> --setup-ca
> (--setup-dns if you have it)
>
> Ensure everything is working: users are visible, clients can enroll, etc.
>
> Create another master from this new one, preferably also with a CA
> (avoid single point-of-failure).
>
> Get the current DNA configuration from the F19 master:
>
> $ ldapsearch -D 'cn=directory manager' -W -b "cn=Posix
> IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config"
>
> Decommission the old master.
>
> ipa-replica-manage dnarange-set to configure the uid ranges
This is something new - not in the above migration guide. Does this need to be set the
same as it was on the old master?
I forget when I added DNA range recovery when a master is removed. Doing
the above will assure that you retain the original range which is
something you wanted.
It may not be absolutely necessary, I guess hopefully not.
The ipa-replica-manage man page has more details on the dna range commands.
>
> THEN set the CA renewal master and CRL generator.
>
> This all does NOT need to be done incredibly quickly. You can create the
> new master and let it just run for a week. Once you are happy, then
> create the second, and so forth
>
> You probably don't want it to drag out too long, but this isn't
> something that needs to be done in a day.
>
> rob
Thanks for the info, now I know. Knowing me I would've done it all in one go :)
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...