I had already executed the very steps you suggest in your reply. The results did not
remove ipa-r02. I provide again the steps I followed-
On the server to be removed (ipa-r02) I ran ipa-replica-install --uninstall -U
The messages from that process:
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa_memcached
ipa : ERROR Some certificates may still be tracked by certmonger.
This will cause re-installation to fail.
Start the certmonger service and list the certificates being tracked
# getcert list
These may be untracked by executing
# getcert stop-tracking -i <request_id>
for each id in: 20150127222017
I then obtained the root password, signed on, started the certmonger service, and ran
# getcert list to confirm the certificate number
Then
# getcert stop-tracking -i 20150127222017
Result:
Request "20150127222017" removed.
So I stopped the certmonger service on ipa-r02:
# service certmonger stop
On another ipa server (the new "master") ipa03, I ran:
Ipa-replica-manage list
The result
ipa01.fbog.local: master
ipa-r02.fbog.local: master
ipa03.fbog.local: master
ipa04.fbog.local: master
and I ran ipa-csreplica-manage list
the result
ipa01.fbog.local: master
ipa-r02.fbog.local: CA not configured
ipa03.fbog.local: master
ipa04.fbog.local: master
the server ipa-r02 remains on both lists even though I ran the uninstall.
Might there be a problem with these commands performing as documented across the IPA
realm? Or am I missing something?
Please explain why the IdM (ipa03 and ipa04) see ipa-r02 as a member of this service
group
-Steven Auerbach
-----Original Message-----
From: Florence Blanc-Renaud <flo(a)redhat.com>
Sent: Monday, June 22, 2020 3:40 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Auerbach, Steven <Steven.Auerbach(a)flbog.edu>
Subject: Re: [Freeipa-users] Problems Cleaning Up After Migration and Upgrade
On 6/20/20 9:59 PM, Auerbach, Steven via FreeIPA-users wrote:
I have finally been able to create an RHEL7/IPAv4 server using
ipa-replica-prepare on a RHEL6/IPA v3 server (ipa01)(added the needed
schema) and running ipa-replica-install on the RHEL7/IPAv4 server
(ipa03). I followed a number of steps to stop CA and CA Renewal on
ipa01 and make ipa03 the CA and CA Renewal master as well as the DNS
master. I then created another RHEL7 server (ipa04) and ran the
ipa-replica-prepare on ipa03 and ran ipa-replica-install in ipa04.
In the IPA Administrative GUI I am exploring the topology because I
need to ultimately get rid of ipa01 and ipa-r02 -Â both RHEL6/IPAv3 servers.
I have 2 suffixes: ca and domain.
The four servers show up in the IPA Servers pane. Only ipa03 and
ipa04 have Managed Suffixes. Both have domain and ca. Both have Min
Domain Level 0 and Max Domain Level 1. Is this as it should be?
Hi,
The domain level is explained in "Displaying and raising the domain level" [1].
Domain-level 1 was introduced in IPA 4.3 and adds:
- replica promotion
- topology management plugin
As ipa01 and ipa-r02 are IPAv3 servers, it's expected that they don't show max
domain level 1.
Server Roles pane shows that ipa01, ipa03, and ipa04 are CA servers.
Eventually I need to remove ipa01. DNS servers are only ipa03 and
ipa04. This is okay, I think.
Domain Level pane show Level 0
Topology Graph pane says “Managed topology requires minimum level 1â€.
The Add and Delete buttons are greyed out.
As 2 nodes out of 4 are IPAv3, they are at domain level 0 and prevent from moving
to domain level 1. When they are removed from the topology you will be able to raise the
domain level if you want to benefit from domain-level 1 features, using ipa
domainlevel-set 1.
IPA Locations pane has No entries.
When I tried to run ipa-server-install --uninstall -U on ipa-r02 I received a number of
errors:
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa_memcached
ipa : ERROR Some certificates may still be tracked by certmonger.
This will cause re-installation to fail.
Start the certmonger service and list the certificates being tracked
# getcert list
These may be untracked by executing
# getcert stop-tracking -i <request_id>
for each id in: 20150127222017
In the CLI on ipa03 when I ran ipa-replica-manage list and the result
is ipa01: master, ipa-r02: master, ipa03: master, ipa04: master.
In the CLI on ipa03 when I ran ipa-csreplica-manage list and the result is
ipa01: master, ipa-r02: CA not configured, ipa03: master, ipa04: master.
So ipa-r02 still shows up. How do I clean this up properly in the
system? And how do I properly remove ipa01 when the time comes?
On domain-level 0, the tool to manage replicas is ipa-replica-manage
[2]. In order to completely remove a server, you can use
ipa-replica-manage del <server> --force --cleanup
As a reminder, the supported method to remove a server in domain-level 0
is described in "Removing a replica" [3] and involves:
- (on another server) ipa-replica-manage del <server>
- (on another server) ipa-csreplica-manage del <server>
- (on the server to be removed) ipa-server-install --uninstall -U
All the documentation I find refers to replicas. It seems I do not
have
any replicas, I have all masters.
You can find more explanation in "IdM terminology" [4] but there is no
functional difference between a master and a replica.
Hope this clarifies,
flo
[1]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[2]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[3]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[4]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
There is something fundamental I continue to miss in administering this
environment.
*Steven Auerbach*
*Assistant Director of Information Systems*
*Information Technology & Security***
**
State University System of Florida
Board of Governors
325 W. Gaines Street
Tallahassee, Florida 32399
(850) 245-9592
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
<
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
Graphic for Email
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
List Guidelines:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
List Archives:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...