[Freeipa-users] Continuing Problems Cleaning Up After Migration and Upgrade

[Auerbach, Steven]

I had already executed the very steps you suggest in your reply.  The results did not
remove ipa-r02. I provide again the steps I followed-
On the server to be removed (ipa-r02) I ran ipa-replica-install --uninstall -U
The messages from that process:
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa_memcached
ipa         : ERROR    Some certificates may still be tracked by certmonger.
This will cause re-installation to fail.
Start the certmonger service and list the certificates being tracked
 # getcert list
These may be untracked by executing
 # getcert stop-tracking -i <request_id>
for each id in: 20150127222017

I then obtained the root password, signed on, started the certmonger service, and ran 
# getcert list to confirm the certificate number
Then
# getcert stop-tracking -i 20150127222017
Result:
Request "20150127222017" removed.
So I stopped the certmonger service on ipa-r02:
# service certmonger stop

On another ipa server (the new "master") ipa03, I ran:
Ipa-replica-manage list
The result
ipa01.fbog.local: master
ipa-r02.fbog.local: master
ipa03.fbog.local: master
ipa04.fbog.local: master

and I ran ipa-csreplica-manage list
the result
ipa01.fbog.local: master
ipa-r02.fbog.local: CA not configured
ipa03.fbog.local: master
ipa04.fbog.local: master

the server ipa-r02 remains on both lists even though I ran the uninstall.
Might there be a problem with these commands performing as documented across the IPA
realm? Or am I missing something?  

Please explain why the IdM (ipa03 and ipa04) see ipa-r02 as a member of this service
group

-Steven Auerbach

-----Original Message-----
From: Florence Blanc-Renaud <flo(a)redhat.com&gt; 
Sent: Monday, June 22, 2020 3:40 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Auerbach, Steven <Steven.Auerbach(a)flbog.edu&gt;
Subject: Re: [Freeipa-users] Problems Cleaning Up After Migration and Upgrade

On 6/20/20 9:59 PM, Auerbach, Steven via FreeIPA-users wrote:
>  I have finally been able to create an RHEL7/IPAv4 server using 
>  ipa-replica-prepare on a RHEL6/IPA v3 server (ipa01)(added the needed
>  schema) and running ipa-replica-install on the RHEL7/IPAv4 server 
>  (ipa03).  I followed a number of steps to stop CA and CA Renewal on
>  ipa01 and make ipa03 the CA and CA Renewal master as well as the DNS 
>  master.  I then created another RHEL7 server (ipa04) and ran the 
>  ipa-replica-prepare on ipa03 and ran ipa-replica-install in ipa04.
>  
>  In the IPA Administrative GUI I am exploring the topology because I 
>  need to ultimately get rid of ipa01 and ipa-r02 -Â  both RHEL6/IPAv3 servers.
>  I have 2 suffixes: ca and domain.
>  
>  The four servers show up in the IPA Servers pane.  Only ipa03 and 
>  ipa04 have Managed Suffixes.  Both have domain and ca. Both have Min 
>  Domain Level 0 and Max Domain Level 1.  Is this as it should be?
>  
>  
Hi,

The domain level is explained in "Displaying and raising the domain level" [1].
Domain-level 1 was introduced in IPA 4.3 and adds:
- replica promotion
- topology management plugin

As ipa01 and ipa-r02 are IPAv3 servers, it's expected that they don't show max
domain level 1.

>  Server Roles pane shows that ipa01, ipa03, and ipa04 are CA servers. 
>
>  Eventually I need to remove ipa01.  DNS servers are only ipa03 and 
>  ipa04. This is okay, I think.
>  Domain Level pane show Level 0
>  Topology Graph pane says “Managed topology requires minimum level 1”.  
>  The Add and Delete buttons are greyed out.
>  
As 2 nodes out of 4 are IPAv3, they are at domain level 0 and prevent from moving
to domain level 1. When they are removed from the topology you will be able to raise the
domain level if you want to benefit from domain-level 1 features, using ipa
domainlevel-set 1.

>  IPA Locations pane has No entries.
>  When I tried to run ipa-server-install --uninstall -U on ipa-r02 I received a number of
> errors:
>  Shutting down all IPA services
>  Removing IPA client configuration
>  Unconfiguring ntpd
>  Unconfiguring named
>  Unconfiguring web server
>  Unconfiguring krb5kdc
>  Unconfiguring kadmin
>  Unconfiguring directory server
>  Unconfiguring ipa_memcached
>  ipa          : ERROR      Some certificates may still be tracked by certmonger.
>  This will cause re-installation to fail.
>  Start the certmonger service and list the certificates being tracked
>  # getcert list
>  These may be untracked by executing
>  # getcert stop-tracking -i <request_id>
>  for each id in: 20150127222017
>
>  In the CLI on ipa03 when I ran ipa-replica-manage list and the result 
>  is  ipa01: master, ipa-r02: master, ipa03: master, ipa04: master.
>  
>  In the CLI on ipa03 when I ran ipa-csreplica-manage list and the result is
>  
ipa01: master, ipa-r02: CA not configured, ipa03: master, ipa04: master.
>  
>  So ipa-r02 still shows up. How do I clean this up properly in the 
>  system? And how do I properly remove ipa01 when the time comes?
>  
>  
On domain-level 0, the tool to manage replicas is ipa-replica-manage 
[2]. In order to completely remove a server, you can use
ipa-replica-manage del <server> --force --cleanup

As a reminder, the supported method to remove a server in domain-level 0 
is described in "Removing a replica" [3] and involves:
- (on another server) ipa-replica-manage del <server>
- (on another server) ipa-csreplica-manage del <server>
- (on the server to be removed) ipa-server-install --uninstall -U

>  All the documentation I find refers to replicas.  It seems I do not
> have 
>  any replicas, I have all masters.
>  
You can find more explanation in "IdM terminology" [4] but there is no 
functional difference between a master and a replica.

Hope this clarifies,
flo

[1] 
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....

[2] 
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....

[3] 
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....

[4] 
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess....
>  
>  There is something fundamental I continue to miss in administering this 
>  environment.
>  
>  *Steven Auerbach*
>  
>  *Assistant Director of Information Systems*
>  
>  *Information Technology & Security***
>  
>  **
>  
>  State University System of Florida
>  Board of Governors
>  325 W. Gaines Street
>  Tallahassee, Florida 32399
>  [phone]
>
> https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
> <https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.flbo...
>  
>  Graphic for Email
>  
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
> https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
>  List Guidelines:
> https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
>  List Archives:
> https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
>  
>