Auerbach, Steven via FreeIPA-users wrote:
I had already executed the very steps you suggest in your reply. The
results did not remove ipa-r02. I provide again the steps I followed-
You don't show here the running ipa-replica-manage as Flo suggested.
On the server to be removed (ipa-r02) I ran ipa-replica-install
--uninstall -U
The messages from that process:
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa_memcached
ipa : ERROR Some certificates may still be tracked by certmonger.
This will cause re-installation to fail.
Start the certmonger service and list the certificates being tracked
# getcert list
These may be untracked by executing
# getcert stop-tracking -i <request_id>
for each id in: 20150127222017
I then obtained the root password, signed on, started the certmonger service, and ran
# getcert list to confirm the certificate number
Then
# getcert stop-tracking -i 20150127222017
Result:
Request "20150127222017" removed.
So I stopped the certmonger service on ipa-r02:
# service certmonger stop
Did you look at what this cert was before you stopped tracking it? It's
probably not important if you are retiring the machine but this means
that some cert was issued (or requested) for some non-IPA-master service.
On another ipa server (the new "master") ipa03, I ran:
Ipa-replica-manage list
The result
ipa01.fbog.local: master
ipa-r02.fbog.local: master
ipa03.fbog.local: master
ipa04.fbog.local: master
and I ran ipa-csreplica-manage list
the result
ipa01.fbog.local: master
ipa-r02.fbog.local: CA not configured
ipa03.fbog.local: master
ipa04.fbog.local: master
the server ipa-r02 remains on both lists even though I ran the uninstall.
Might there be a problem with these commands performing as documented across the IPA
realm? Or am I missing something?
Try running the cleanup as suggested.
rob
Please explain why the IdM (ipa03 and ipa04) see ipa-r02 as a member of this service
group
-Steven Auerbach
-----Original Message-----
From: Florence Blanc-Renaud <flo(a)redhat.com>
Sent: Monday, June 22, 2020 3:40 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Auerbach, Steven <Steven.Auerbach(a)flbog.edu>
Subject: Re: [Freeipa-users] Problems Cleaning Up After Migration and Upgrade
On 6/20/20 9:59 PM, Auerbach, Steven via FreeIPA-users wrote:
> I have finally been able to create an RHEL7/IPAv4 server using
> ipa-replica-prepare on a RHEL6/IPA v3 server (ipa01)(added the needed
> schema) and running ipa-replica-install on the RHEL7/IPAv4 server
> (ipa03). I followed a number of steps to stop CA and CA Renewal on
> ipa01 and make ipa03 the CA and CA Renewal master as well as the DNS
> master. I then created another RHEL7 server (ipa04) and ran the
> ipa-replica-prepare on ipa03 and ran ipa-replica-install in ipa04.
>
> In the IPA Administrative GUI I am exploring the topology because I
> need to ultimately get rid of ipa01 and ipa-r02 -Â both RHEL6/IPAv3 servers.
> I have 2 suffixes: ca and domain.
>
> The four servers show up in the IPA Servers pane. Only ipa03 and
> ipa04 have Managed Suffixes. Both have domain and ca. Both have Min
> Domain Level 0 and Max Domain Level 1. Is this as it should be?
>
Hi,
The domain level is explained in "Displaying and raising the domain level" [1].
Domain-level 1 was introduced in IPA 4.3 and adds:
- replica promotion
- topology management plugin
As ipa01 and ipa-r02 are IPAv3 servers, it's expected that they don't show max
domain level 1.
> Server Roles pane shows that ipa01, ipa03, and ipa04 are CA servers.
> Eventually I need to remove ipa01. DNS servers are only ipa03 and
> ipa04. This is okay, I think.
> Domain Level pane show Level 0
> Topology Graph pane says “Managed topology requires minimum level 1â€.
> The Add and Delete buttons are greyed out.
As 2 nodes out of 4 are IPAv3, they are at domain level 0 and prevent from moving to
domain level 1. When they are removed from the topology you will be able to raise the
domain level if you want to benefit from domain-level 1 features, using ipa
domainlevel-set 1.
> IPA Locations pane has No entries.
> When I tried to run ipa-server-install --uninstall -U on ipa-r02 I received a number
of errors:
> Shutting down all IPA services
> Removing IPA client configuration
> Unconfiguring ntpd
> Unconfiguring named
> Unconfiguring web server
> Unconfiguring krb5kdc
> Unconfiguring kadmin
> Unconfiguring directory server
> Unconfiguring ipa_memcached
> ipa : ERROR Some certificates may still be tracked by certmonger.
> This will cause re-installation to fail.
> Start the certmonger service and list the certificates being tracked
> # getcert list
> These may be untracked by executing
> # getcert stop-tracking -i <request_id>
> for each id in: 20150127222017
>
> In the CLI on ipa03 when I ran ipa-replica-manage list and the result
> is ipa01: master, ipa-r02: master, ipa03: master, ipa04: master.
>
> In the CLI on ipa03 when I ran ipa-csreplica-manage list and the result is
ipa01: master, ipa-r02: CA not configured, ipa03: master, ipa04: master.
>
> So ipa-r02 still shows up. How do I clean this up properly in the
> system? And how do I properly remove ipa01 when the time comes?
>
On domain-level 0, the tool to manage replicas is ipa-replica-manage
[2]. In order to completely remove a server, you can use
ipa-replica-manage del <server> --force --cleanup
As a reminder, the supported method to remove a server in domain-level 0
is described in "Removing a replica" [3] and involves:
- (on another server) ipa-replica-manage del <server>
- (on another server) ipa-csreplica-manage del <server>
- (on the server to be removed) ipa-server-install --uninstall -U
> All the documentation I find refers to replicas. It seems I do not have
> any replicas, I have all masters.
You can find more explanation in "IdM terminology" [4] but there is no
functional difference between a master and a replica.
Hope this clarifies,
flo
[1]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[2]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[3]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
[4]
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
>
> There is something fundamental I continue to miss in administering this
> environment.
>
> *Steven Auerbach*
>
> *Assistant Director of Information Systems*
>
> *Information Technology & Security***
>
> **
>
> State University System of Florida
> Board of Governors
> 325 W. Gaines Street
> Tallahassee, Florida 32399
> (850) 245-9592
>
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
<
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
>
> Graphic for Email
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
> List Guidelines:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
> List Archives:
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...