Disaster Recovery Architecture for IPA servers setup replicating in full mesh

[Saurabh Garg]

Hi All,

Could anyone please share a Disaster Recovery Architecture for IPA servers setup
replicating in full mesh with the details of backup and restore procedure.

Regards,
sgarg

[Florence Blanc-Renaud]

On 11/4/19 8:44 AM, Saurabh Garg via FreeIPA-users wrote:
>  Hi All,
>  
>  Could anyone please share a Disaster Recovery Architecture for IPA servers setup
> replicating in full mesh with the details of backup and restore procedure.
>  
>  Regards,
>  sgarg
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>   
Hi,

The RHEL7 and RHEL8 documentation sets contain the following topics that 
may be of interest:
- Planning the replica topology [1], in the book "Planning Identity 
Management"
This section provides examples of replica topology and recommendations 
to achieve disaster recovery.
- Backing up and restoring Identity Management [2] in the book "Linux 
Domain Identity, Authentication, and Policy Guide"
- Backup and Restore in IdM/IPA [3]

As a general rule, we recommend rebuilding from an existing replica, 
rather than using backup-restore.

HTH,
flo

[1] 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...

[2] 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

[3] https://access.redhat.com/solutions/626303

[Charles Hedrick]

On Nov 5, 2019, at 2:25 AM, Florence Blanc-Renaud via FreeIPA-users
<[e-mail]<mailto:[e-mail]>>
wrote:

As a general rule, we recommend rebuilding from an existing replica, rather than using
backup-restore.

Right. Our strategy is

* all of our systems are VMs. We take snapshots periodically. So in a failure we would
start from a snapshot rather than trying to restore in some way. You could then
reinitialize the data from another replica
* installing a replica seems to be more reliable than it used to be. I’ve been playing
with IPA on Centos 8. I’ve found that remove and recreating replicas works fine, even
after errors, though before creating a replica after deleting it, I look through the
configuration file and remove some old info before reinstalling. My experience with
replicas is documented at
https://github.com/clhedrick/kerberos/wiki/Setting-up-new-server-%28repli...
* In general you should be able take a VM snapshot and start it. however I’ve noticed a
tendency for /etc/dirsrv/slapd-NAME/dse.ldif to be missing. I now copy this file somewhere
safe every few minutes with a cron job.