How to move FreeIPA to new server?

[fujisan]

Hello,

I just got a new server on which I'd like to install a FreeIPA server.
Today it is installed on the old server.

I just tried to install it with ipa-server-install but of course it
complained saying the DNS domain is handled by the old server.

What is the best way to install FreeIPA on the new server without
disturbing the users too much?

Regards,
F.

[Alexander Bokovoy]

On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> Hello,
>
> I just got a new server on which I'd like to install a FreeIPA server.
> Today it is installed on the old server.
>
> I just tried to install it with ipa-server-install but of course it
> complained saying the DNS domain is handled by the old server.
>
> What is the best way to install FreeIPA on the new server without
> disturbing the users too much? 
Add a new server as a replica.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[fujisan]

and then re-install each client with --server=new-server.my.domain?

On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
wrote:

>  On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
>  >Hello,
>  >
>  >I just got a new server on which I'd like to install a FreeIPA server.
>  >Today it is installed on the old server.
>  >
>  >I just tried to install it with ipa-server-install but of course it
>  >complained saying the DNS domain is handled by the old server.
>  >
>  >What is the best way to install FreeIPA on the new server without
>  >disturbing the users too much?
>  Add a new server as a replica.
>
>
>  --
>  / Alexander Bokovoy
>  Sr. Principal Software Engineer
>  Security / Identity Management Engineering
>  Red Hat Limited, Finland
>

[Alexander Bokovoy]

On ti, 16 huhti 2019, fujisan wrote:
> and then re-install each client with --server=new-server.my.domain?
No. You don't need to reinstall anything. Looks like you didn't install
any replica before?

Instructions are here for a replica installation:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

Instructions are here for a server removal:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

Old server name might be mentioned in three configuration files on the
clients if you deployed them with --server option to ipa-client-install
instead of using auto-discovery.

- /etc/sssd/sssd.conf might have a direct reference to IPA master
  instead of _srv_ label. If it has both, make sure you keep _srv_
  first and replace old server name by the new one there. On IPA masters
  itself there should be no _srv_ label.

- /etc/ipa/default.conf has name of the master this server was enrolled
  into. It can be updated to a new server without any trouble if old
  server will be decommissioned.

- /etc/krb5.conf can have a reference to the old server as a KDC. It can
  also be updated without any issue.



> On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy
> <abokovoy(a)redhat.com&gt;
> wrote:
>
> > On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> > >Hello,
> > >
> > >I just got a new server on which I'd like to install a FreeIPA server.
> > >Today it is installed on the old server.
> > >
> > >I just tried to install it with ipa-server-install but of course it
> > >complained saying the DNS domain is handled by the old server.
> > >
> > >What is the best way to install FreeIPA on the new server without
> > >disturbing the users too much?
> > Add a new server as a replica.
> >
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland
> > 
-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[François Cami]

On Tue, Apr 16, 2019 at 12:09 PM Alexander Bokovoy via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  On ti, 16 huhti 2019, fujisan wrote:
>  >and then re-install each client with --server=new-server.my.domain?
>  No. You don't need to reinstall anything. Looks like you didn't install
>  any replica before?
>
>  Instructions are here for a replica installation:
>
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
The documentation emphasizes it, but just in case: be sure to install
a CA on the replica if the old server has one (--setup-ca).


> Instructions are here for a server removal:
>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>
> Old server name might be mentioned in three configuration files on the
> clients if you deployed them with --server option to ipa-client-install
> instead of using auto-discovery.
>
> - /etc/sssd/sssd.conf might have a direct reference to IPA master
>   instead of _srv_ label. If it has both, make sure you keep _srv_
>   first and replace old server name by the new one there. On IPA masters
>   itself there should be no _srv_ label.
>
> - /etc/ipa/default.conf has name of the master this server was enrolled
>   into. It can be updated to a new server without any trouble if old
>   server will be decommissioned.
>
> - /etc/krb5.conf can have a reference to the old server as a KDC. It can
>   also be updated without any issue.
>
>
>
> >On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
> >wrote:
> >
> >> On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> >> >Hello,
> >> >
> >> >I just got a new server on which I'd like to install a FreeIPA
server.
> >> >Today it is installed on the old server.
> >> >
> >> >I just tried to install it with ipa-server-install but of course it
> >> >complained saying the DNS domain is handled by the old server.
> >> >
> >> >What is the best way to install FreeIPA on the new server without
> >> >disturbing the users too much?
> >> Add a new server as a replica.
> >>
> >>
> >> --
> >> / Alexander Bokovoy
> >> Sr. Principal Software Engineer
> >> Security / Identity Management Engineering
> >> Red Hat Limited, Finland
> >>
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...

[fujisan]

Thank you for your reply.

So i'm trying to install freeipa as a replica using the following command
until it says *LDAP error: Invalid credentials.*
What is missing?

# ipa-replica-install --principal=admin --admin-password=XXXX
--server=oldserver.domain.local --domain=domainlocal --realm=DOMAINLOCAL
--setup-dns --mkhomedir --ssh-trust-dns --auto-reverse --forwarder=.....
[...]
Run connection check to master
Connection check OK
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/41]: creating directory server instance
  [2/41]: enabling ldapi
  [3/41]: configure autobind for root
  [4/41]: stopping directory server
  [5/41]: updating configuration in dse.ldif
  [6/41]: starting directory server
  [7/41]: adding default schema
  [8/41]: enabling memberof plugin
  [9/41]: enabling winsync plugin
  [10/41]: configuring replication version plugin
  [11/41]: enabling IPA enrollment plugin
  [12/41]: configuring uniqueness plugin
  [13/41]: configuring uuid plugin
  [14/41]: configuring modrdn plugin
  [15/41]: configuring DNS plugin
  [16/41]: enabling entryUSN plugin
  [17/41]: configuring lockout plugin
  [18/41]: configuring topology plugin
  [19/41]: creating indices
  [20/41]: enabling referential integrity plugin
  [21/41]: configuring certmap.conf
  [22/41]: configure new location for managed entries
  [23/41]: configure dirsrv ccache
  [24/41]: enabling SASL mapping fallback
  [25/41]: restarting directory server
  [26/41]: creating DS keytab
  [27/41]: ignore time skew for initial replication
  [28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 15 seconds elapsed
[ldap://oldserever.domain.local:389] reports: Update failed! Status: [Error
(49)  - LDAP error: Invalid credentials]

  [error] RuntimeError: Failed to start replication
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Failed to start replication
The ipa-replica-install command failed. See /var/log/ipareplica-install.log
for more information


On Tue, Apr 16, 2019 at 12:32 PM François Cami <fcami(a)redhat.com&gt; wrote:

>  On Tue, Apr 16, 2019 at 12:09 PM Alexander Bokovoy via FreeIPA-users
>  <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  >
>  > On ti, 16 huhti 2019, fujisan wrote:
>  > >and then re-install each client with --server=new-server.my.domain?
>  > No. You don't need to reinstall anything. Looks like you didn't install
>  > any replica before?
>  >
>  > Instructions are here for a replica installation:
>  >
>
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>
>  The documentation emphasizes it, but just in case: be sure to install
>  a CA on the replica if the old server has one (--setup-ca).
>
>
>  > Instructions are here for a server removal:
>  >
>
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>  >
>  > Old server name might be mentioned in three configuration files on the
>  > clients if you deployed them with --server option to ipa-client-install
>  > instead of using auto-discovery.
>  >
>  > - /etc/sssd/sssd.conf might have a direct reference to IPA master
>  >   instead of _srv_ label. If it has both, make sure you keep _srv_
>  >   first and replace old server name by the new one there. On IPA masters
>  >   itself there should be no _srv_ label.
>  >
>  > - /etc/ipa/default.conf has name of the master this server was enrolled
>  >   into. It can be updated to a new server without any trouble if old
>  >   server will be decommissioned.
>  >
>  > - /etc/krb5.conf can have a reference to the old server as a KDC. It can
>  >   also be updated without any issue.
>  >
>  >
>  >
>  > >On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <abokovoy(a)redhat.com
>  >
>  > >wrote:
>  > >
>  > >> On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
>  > >> >Hello,
>  > >> >
>  > >> >I just got a new server on which I'd like to install a FreeIPA
>  server.
>  > >> >Today it is installed on the old server.
>  > >> >
>  > >> >I just tried to install it with ipa-server-install but of course it
>  > >> >complained saying the DNS domain is handled by the old server.
>  > >> >
>  > >> >What is the best way to install FreeIPA on the new server without
>  > >> >disturbing the users too much?
>  > >> Add a new server as a replica.
>  > >>
>  > >>
>  > >> --
>  > >> / Alexander Bokovoy
>  > >> Sr. Principal Software Engineer
>  > >> Security / Identity Management Engineering
>  > >> Red Hat Limited, Finland
>  > >>
>  >
>  > --
>  > / Alexander Bokovoy
>  > Sr. Principal Software Engineer
>  > Security / Identity Management Engineering
>  > Red Hat Limited, Finland
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to
>  freeipa-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[fujisan]

Never mind.
Clock was skewed. Fixed it and now it is working.


On Tue, Apr 16, 2019 at 1:53 PM fujisan <fujisan43(a)gmail.com&gt; wrote:

>  Thank you for your reply.
>
>  So i'm trying to install freeipa as a replica using the following command
>  until it says *LDAP error: Invalid credentials.*
>  What is missing?
>
>  # ipa-replica-install --principal=admin --admin-password=XXXX
>  --server=oldserver.domain.local --domain=domainlocal --realm=DOMAINLOCAL
>  --setup-dns --mkhomedir --ssh-trust-dns --auto-reverse --forwarder=.....
>  [...]
>  Run connection check to master
>  Connection check OK
>  Configuring directory server (dirsrv). Estimated time: 30 seconds
>    [1/41]: creating directory server instance
>    [2/41]: enabling ldapi
>    [3/41]: configure autobind for root
>    [4/41]: stopping directory server
>    [5/41]: updating configuration in dse.ldif
>    [6/41]: starting directory server
>    [7/41]: adding default schema
>    [8/41]: enabling memberof plugin
>    [9/41]: enabling winsync plugin
>    [10/41]: configuring replication version plugin
>    [11/41]: enabling IPA enrollment plugin
>    [12/41]: configuring uniqueness plugin
>    [13/41]: configuring uuid plugin
>    [14/41]: configuring modrdn plugin
>    [15/41]: configuring DNS plugin
>    [16/41]: enabling entryUSN plugin
>    [17/41]: configuring lockout plugin
>    [18/41]: configuring topology plugin
>    [19/41]: creating indices
>    [20/41]: enabling referential integrity plugin
>    [21/41]: configuring certmap.conf
>    [22/41]: configure new location for managed entries
>    [23/41]: configure dirsrv ccache
>    [24/41]: enabling SASL mapping fallback
>    [25/41]: restarting directory server
>    [26/41]: creating DS keytab
>    [27/41]: ignore time skew for initial replication
>    [28/41]: setting up initial replication
>  Starting replication, please wait until this has completed.
>  Update in progress, 15 seconds elapsed
>  [ldap://oldserever.domain.local:389] reports: Update failed! Status:
>  [Error (49)  - LDAP error: Invalid credentials]
>
>    [error] RuntimeError: Failed to start replication
>  Your system may be partly configured.
>  Run /usr/sbin/ipa-server-install --uninstall to clean up.
>
>  Failed to start replication
>  The ipa-replica-install command failed. See
>  /var/log/ipareplica-install.log for more information
>
>
>  On Tue, Apr 16, 2019 at 12:32 PM François Cami <fcami(a)redhat.com&gt; wrote:
>
> > On Tue, Apr 16, 2019 at 12:09 PM Alexander Bokovoy via FreeIPA-users
> > <freeipa-users(a)lists.fedorahosted.org&gt; wrote:
> > >
> > > On ti, 16 huhti 2019, fujisan wrote:
> > > >and then re-install each client with --server=new-server.my.domain?
> > > No. You don't need to reinstall anything. Looks like you didn't install
> > > any replica before?
> > >
> > > Instructions are here for a replica installation:
> > >
> >
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> >
> > The documentation emphasizes it, but just in case: be sure to install
> > a CA on the replica if the old server has one (--setup-ca).
> >
> >
> > > Instructions are here for a server removal:
> > >
> >
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
> > >
> > > Old server name might be mentioned in three configuration files on the
> > > clients if you deployed them with --server option to ipa-client-install
> > > instead of using auto-discovery.
> > >
> > > - /etc/sssd/sssd.conf might have a direct reference to IPA master
> > >   instead of _srv_ label. If it has both, make sure you keep _srv_
> > >   first and replace old server name by the new one there. On IPA masters
> > >   itself there should be no _srv_ label.
> > >
> > > - /etc/ipa/default.conf has name of the master this server was enrolled
> > >   into. It can be updated to a new server without any trouble if old
> > >   server will be decommissioned.
> > >
> > > - /etc/krb5.conf can have a reference to the old server as a KDC. It can
> > >   also be updated without any issue.
> > >
> > >
> > >
> > > >On Tue, Apr 16, 2019 at 11:42 AM Alexander Bokovoy <
> > abokovoy(a)redhat.com&gt;
> > > >wrote:
> > > >
> > > >> On ti, 16 huhti 2019, fujisan via FreeIPA-users wrote:
> > > >> >Hello,
> > > >> >
> > > >> >I just got a new server on which I'd like to install a FreeIPA
> > server.
> > > >> >Today it is installed on the old server.
> > > >> >
> > > >> >I just tried to install it with ipa-server-install but of course
> it
> > > >> >complained saying the DNS domain is handled by the old server.
> > > >> >
> > > >> >What is the best way to install FreeIPA on the new server without
> > > >> >disturbing the users too much?
> > > >> Add a new server as a replica.
> > > >>
> > > >>
> > > >> --
> > > >> / Alexander Bokovoy
> > > >> Sr. Principal Software Engineer
> > > >> Security / Identity Management Engineering
> > > >> Red Hat Limited, Finland
> > > >>
> > >
> > > --
> > > / Alexander Bokovoy
> > > Sr. Principal Software Engineer
> > > Security / Identity Management Engineering
> > > Red Hat Limited, Finland
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
>