----- Izvirno sporočilo -----
Od: "Rob Crittenden" <rcritten(a)redhat.com>
Za: "FreeIPA users list" <freeipa-users(a)lists.fedorahosted.org>
Cc: "Jernej Jakob" <jernej.jakob(a)abak.si>
Poslano: Četrtek, 7. Februar 2019 17:05:47
Zadeva: Re: [Freeipa-users] Upgrading from V3 on Fedora to V4 on CentOS, CA promotion
steps?
There is no 8 yet.
There is the 8 beta, I was thinking I'd maybe wait for the release, but if that
isn't gonna happen till summer I'm going with 7.
You don't need to do all this. What you want to do is something
like
(mostly off the top of my head, definitely read the docs and come up
with a full plan):
- ensure you have a CA and that its certs are valid (getcert list | grep
expires)
Checks out, all are valid.
- ipa-replica-prepare <your_new_master>
- follow
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
- on the new master ipa-replica-install <prepare-file> --setup-ca
(--setup-dns if you have it)
Ensure everything is working: users are visible, clients can enroll, etc.
Create another master from this new one, preferably also with a CA
(avoid single point-of-failure).
Get the current DNA configuration from the F19 master:
$ ldapsearch -D 'cn=directory manager' -W -b "cn=Posix
IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config"
Decommission the old master.
ipa-replica-manage dnarange-set to configure the uid ranges
This is something new - not in the above migration guide. Does this need to be set the
same as it was on the old master?
THEN set the CA renewal master and CRL generator.
This all does NOT need to be done incredibly quickly. You can create the
new master and let it just run for a week. Once you are happy, then
create the second, and so forth
You probably don't want it to drag out too long, but this isn't
something that needs to be done in a day.
rob
Thanks for the info, now I know. Knowing me I would've done it all in one go :)