FreeIPA -Airtight- No access to Internet - How to update/upgrade package installation.

[Marcelo Carvalho]

I have an FreeIPA host that has to be out of reach of Internet.

I can update the host OS and packages by syncing RHEL repo to my LocalRepo.  No issues there for every package installed, but I am not able to update FreeIPA.

From https://www.freeipa.org/page/Upgrade we have instruction on upgrades:
         FreeIPA 3.3.0 or newer
                       # yum update freeipa-server

I have not tried because the purpose is to bring "freeipa-server" package to the LocalRepo for host access.   I cannot find the repository for "freeipa-server."

Please advise on how to identify FreeIPA repo for RHEL-9, or how to proceed with offline FreeIPA upgrade.

Many thanks.

Marcelo Carvalho
IT Senior System Administrator
Astranis Space Technologies Corp.
[e-mail]
https://www.astranis.com/

P.S.   Will "# yum update freeipa-server" work?  I do not see it as output of the repository when the development host is available to them.
The host is running on AWS and using a Linux RHEL-9 from AWS.

[Rob Crittenden]

Marcelo Carvalho via FreeIPA-users wrote:
> I have an FreeIPA host that has to be out of reach of Internet.
>
> I can update the host OS and packages by syncing RHEL repo to my LocalRepo.  No issues there for every package installed, but I am not able to update FreeIPA.
>
> From https://www.freeipa.org/page/Upgrade we have instruction on upgrades:
>          FreeIPA 3.3.0 or newer
>                        # yum update freeipa-server
>
> I have not tried because the purpose is to bring "freeipa-server" package to the LocalRepo for host access.   I cannot find the repository for "freeipa-server."
>
> Please advise on how to identify FreeIPA repo for RHEL-9, or how to proceed with offline FreeIPA upgrade.

There is no separate repo for IPA. It's part of RHEL.

In fact, we strongly recommend to update all available packages at the
same time. This is what is tested. Updating only individual pieces has
caused issues in the past.

So you'll need most if not all of the RHEL repo, perhaps using satellite.
> P.S.   Will "# yum update freeipa-server" work?  I do not see it as output of the repository when the development host is available to them.
> The host is running on AWS and using a Linux RHEL-9 from AWS.

I'm not sure what you mean, but the packages in RHEL do not include the
"free" prefix. dnf update ipa-server in that case.

rob

[Marcelo Carvalho]

Hi Rob.

lasdjfka

Enigma resolved on FreeIPA packaging.
.
It is "called" freeipa-server but it records itself as ipa-server.
       I meant "called" because we install it as - *sudo yum install
freeipa-server.*
We have the package (ipa-server) on our LocalRepo and our host is
up-to-it-date.

I see the new 4.10.2-5.el9_3 package available and will decide to bring it
into our LocalRepo.

Issue resolved.

Many thanks.

_M

.

2:18
The fact is we are up-to-date to our last LocalRepo sync.  The is a new
ipa-server    package     x86_64  4.10.2-5.el9_3 available on Web Repo, but
this defies our purpose of being stable on one Repo Sync.
lasdkjfkjdas

On Mon, Jan 29, 2024 at 1:40 PM Rob Crittenden  wrote:
> Marcelo Carvalho via FreeIPA-users wrote:
> > I have an FreeIPA host that has to be out of reach of Internet.
> >
> > I can update the host OS and packages by syncing RHEL repo to my
>
> LocalRepo.  No issues there for every package installed, but I am not able
> to update FreeIPA.
> > From https://www.freeipa.org/page/Upgrade we have instruction on
>
> upgrades:
> >      FreeIPA 3.3.0 or newer
> >                    # yum update freeipa-server
> >
> > I have not tried because the purpose is to bring "freeipa-server"
>
> package to the LocalRepo for host access.   I cannot find the repository
> for "freeipa-server."
> > Please advise on how to identify FreeIPA repo for RHEL-9, or how to
>
> proceed with offline FreeIPA upgrade.
>
> There is no separate repo for IPA. It's part of RHEL.
>
> In fact, we strongly recommend to update all available packages at the
> same time. This is what is tested. Updating only individual pieces has
> caused issues in the past.
>
> So you'll need most if not all of the RHEL repo, perhaps using satellite.
> > P.S.   Will "# yum update freeipa-server" work?  I do not see it as
>
> output of the repository when the development host is available to them.
> > The host is running on AWS and using a Linux RHEL-9 from AWS.
>
> I'm not sure what you mean, but the packages in RHEL do not include the
> "free" prefix. dnf update ipa-server in that case.
>
> rob

[Rafael Jeffman]

Hi Marcelo,

Take care with inplace upgrade of IPA between major versions of RHEL, as it
is not supported.

For RHEL 7 to RHEL 8 upgrades take a look at:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...

For RHEL 8 to RHEL 9 upgrades look at:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...

Remember that SIDs are now enforced, and there have been a ton of recent
discussions about issues on that matter, on this list.

Rafael

On Mon, Jan 29, 2024 at 7:32 PM Marcelo Carvalho via FreeIPA-users <
[e-mail]> wrote:
> Hi Rob.
>
> lasdjfka
>
> Enigma resolved on FreeIPA packaging.
> .
> It is "called" freeipa-server but it records itself as ipa-server.
>        I meant "called" because we install it as - sudo yum install

freeipa-server.
> We have the package (ipa-server) on our LocalRepo and our host is

up-to-it-date.
> I see the new 4.10.2-5.el9_3 package available and will decide to bring

it into our LocalRepo.
> Issue resolved.
>
> Many thanks.
>
> _M
>
> .
>
> 2:18
> The fact is we are up-to-date to our last LocalRepo sync.  The is a new

ipa-server    package     x86_64  4.10.2-5.el9_3 available on Web Repo, but
this defies our purpose of being stable on one Repo Sync.
> lasdkjfkjdas
>
> On Mon, Jan 29, 2024 at 1:40 PM Rob Crittenden

wrote:
> > Marcelo Carvalho via FreeIPA-users wrote:
> > > I have an FreeIPA host that has to be out of reach of Internet.
> > >
> > > I can update the host OS and packages by syncing RHEL repo to my

LocalRepo.  No issues there for every package installed, but I am not able
to update FreeIPA.
> > > From https://www.freeipa.org/page/Upgrade we have instruction on

upgrades:
> > >      FreeIPA 3.3.0 or newer
> > >                    # yum update freeipa-server
> > >
> > > I have not tried because the purpose is to bring "freeipa-server"

package to the LocalRepo for host access.   I cannot find the repository
for "freeipa-server."
> > > Please advise on how to identify FreeIPA repo for RHEL-9, or how to

proceed with offline FreeIPA upgrade.
> > There is no separate repo for IPA. It's part of RHEL.
> >
> > In fact, we strongly recommend to update all available packages at the
> > same time. This is what is tested. Updating only individual pieces has
> > caused issues in the past.
> >
> > So you'll need most if not all of the RHEL repo, perhaps using satellite.
> > > P.S.   Will "# yum update freeipa-server" work?  I do not see it as

output of the repository when the development host is available to them.
> > > The host is running on AWS and using a Linux RHEL-9 from AWS.
> >
> > I'm not sure what you mean, but the packages in RHEL do not include the
> > "free" prefix. dnf update ipa-server in that case.
> >
> > rob
>
> This email and any attachments may contain Astranis confidential and/or

proprietary information governed by a non-disclosure agreement, and are
intended solely for the individual or entity specified by the message.
> --
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:

https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:

https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it:

https://pagure.io/fedora-infrastructure/new_issue

--
Rafael Guterres Jeffman
Senior Software Engineer
FreeIPA - Red Hat

[Marcelo Carvalho]

Thanks Rafael

I will be in touch on our next version upgrade.   Thank you so much for the insights.

We are running on RHEL-9 and probably will stay there for a while.

Many thanks.

Marcelo Carvalho
IT Senior System Administrator
Astranis Space Technologies Corp.
[e-mail]
https://www.astranis.com/