artj...@free.fr wrote:
Hi,

I have 1 ipa master 'ipasrv' and 2 replicas 'iparpl1 iparpl2' installed with
--setup-ca option.
Since a few days I have an issue with '389 Directory Server' on the master
(ipasrv) and on the 2nd replica (iparpl2) with the following messages:

The configuration file /etc/dirsrv/slapd-MYINSTANCE/dse.ldif was not restored
from backup /etc/dirsrv/slapd-MYINSTANCE/dse.ldif.tmp, error -1
Apr 28 07:38:35 localhost ns-slapd: [28/Apr/2014:15:38:35 +0200] dse - The
configuration file /etc/dirsrv/slapd-MYINSTANCE/dse.ldif was not restored from
backup /etc/dirsrv/slapd-MYINSTANCE/dse.ldif.bak, error -1
Apr 28 07:38:35 localhost ns-slapd: [28/Apr/2014:15:38:35 +0200] config - The
given config file /etc/dirsrv/slapd-MYINSTANCE/dse.ldif could not be accessed,
Netscape Portable Runtime error -5950 (File not found.)

The files dse.ldif and dse.ldif.bak are lost.
On my 1st replica (iparpl1) everything is OK.

No Full IPA backup and LDAP backup done on ipasrv and iparpl2.

A) Can I restore those files from iparpl1 ?

Not easily. There is some instance-specific information. The 389-ds team may have some ideas.

Do you know what happened? Were the servers crashing?

Are there any other dse.ldif.* files there? There should at least be dse.ldif.startOK. That would be a place to start.

B) I am a little bit confused after reading the documentation on
http://www.freeipa.org/page/Backup_and_Restore
   - can I consider that the ipa replicas are like ipa master ?
   In this case when I want to execute the manual procedure in chapter 'One
Server Loss'
   1. Clean deployment from the lost server by removing all replication
agreements with it.
    from iparpl1 I have the following results:

[root@iparpl1 ~]# ipa-replica-manage del iparpl2.mydomain
'iparpl1.mydomain' has no replication agreement for 'iparpl2.mydomaon'

You can only delete a master from a server that has a replication agreement with it. I assume your topology was something like:

       ipa
   /         \
iparpl1  iparpl2

This will leave iparpl2 as an IPA master in some places in the tree. Depending on the version of IPA you can use the -c flag to clean up a master that is now gone.

  [root@iparpl1 ~]# ipa-replica-manage del ipasrv.mydomain
Connection to 'ipasrv.mydomain' failed:
Unable to delete replica 'ipasrv.mydomain'

The --force flag will let this continue.


   2. Choose another FreeIPA Server with CA installed to become the first master
Can I do this request from my 1st replica iparpl1 and how ?


http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master

It matters what version of IPA you have.

   3. Nominate this master to be the one in charge or renewing certs and
publishing CRLS. This is a manual procedure at the moment.

   4. Follow standard installation procedure to deploy a new master on a
hardware/VM of your choice
this request is to install a replica not a master ?

All servers are masters to IPA. The only difference is which ones have a CA and DNS server.

If iparpl1 does not have a CA installed then I'd try to get the initial IPA master back up, otherwise you will be stuck with no CA, no way to generate new replicas.

rob

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to