Bug 486950 - Document how to move/promote a master server
Document how to move/promote a master server
Status: CLOSED DUPLICATE of bug 646238
Product: freeIPA
Classification: Community
Component: Documentation (Show other bugs)
All Linux
low Severity medium
: v2 release
: ---
Assigned To: David O'Brien
Chandrasekar Kannan
: Documentation
Depends On:
Blocks: 431020 489811 646217 646238
  Show dependency treegraph
Reported: 2009-02-23 08:24 EST by Rob Crittenden
Modified: 2015-01-04 18:36 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 646238 (view as bug list)
Last Closed: 2011-01-13 03:44:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Rob Crittenden 2009-02-23 08:24:29 EST
User poses the following problem:

I have a couple of machines in a running freeipa-1.2.1 in a master/replica set up. However the the master server in this scenario is now out of warranty and needs to be retired.

I have another machine readied to assume its role (with a different hostname and ip number, however), or preferably, I could promote the existing replica to master.

There doesn't seem to be an easy way to accomplish this, short of starting again (which is not a practical option for me).

And the answer is:

The only difference between a replica and the initial IPA install (the "master") is that the first server owns the self-signed CA.

You should be able to do this to make your "replica" the master:

- copy /var/lib/ipa/ca_serialno from master to replica
- import the CA into the replica DS NSS database with:
# cd /etc/dirsrv/slapd-REALM
# pk12util -i /path/to/cacert.p12 -d .

The password on the PKCS#12 file is on the original server in /etc/dirsrv/slapd-REALM/pwdfile.txt as is the file cacert.p12 (which you backed up elsewhere too, right?)

- Delete the existing replication agreements:
# ipa-replica-manage del master.example.com

Now you should have 2 identical IPA servers, neither of which know about each other. Shut down the old master and stand up the new box. Create a replica file on the newly promoted master and install that on the new box. You should be back in business.
Comment 2 David O'Brien 2011-01-13 03:44:53 EST

*** This bug has been marked as a duplicate of bug 646238 ***

Note You need to log in before you can comment on or make changes to this bug.