Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Rob Crittenden
Bret Wortman wrote: On Thu, Aug 29, 2013 at 11:10 AM, Rob Crittenden mailto:rcrit...@redhat.com>> wrote: Bret Wortman wrote: A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into some

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
On Thu, Aug 29, 2013 at 11:10 AM, Rob Crittenden wrote: > Bret Wortman wrote: > >> A bit of googling has led me to understand that we must have created the >> original server with --selfsign, and that locked us into something bad >> which is now causing us problems. I'm not sure how this happened,

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Rob Crittenden
Bret Wortman wrote: A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into something bad which is now causing us problems. I'm not sure how this happened, since we actually created our original instance on a different serv

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into something bad which is now causing us problems. I'm not sure how this happened, since we actually created our original instance on a different server, created ipamaster

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
Agreed, but not always possible. I had a replica crash hard and it wasn't possible to remove it. In other news: [ipamaster2]# ipa-ca-install replica-info-ipamaster2.spx.net.gpg A selfsign CA can not be added Is there a way around this? How can I ensure that I can transfer the CA back to ipamaste

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Simo Sorce
On Thu, 2013-08-29 at 09:14 -0400, Bret Wortman wrote: > On Thu, Aug 29, 2013 at 9:09 AM, Simo Sorce wrote: > On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: > > Okay, I have a replica built and running. My original, > "sick" server > > is ipamaster and the n

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
On Thu, Aug 29, 2013 at 9:09 AM, Simo Sorce wrote: > On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: > > Okay, I have a replica built and running. My original, "sick" server > > is ipamaster and the new one is ipamaster2. All I've done thus far on > > ipamaster2 is run ipa-replica-install

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Simo Sorce
On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: > Okay, I have a replica built and running. My original, "sick" server > is ipamaster and the new one is ipamaster2. All I've done thus far on > ipamaster2 is run ipa-replica-install --setup-dns --no-forwarders > replica-info-ipamaster2.foo.net

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
Okay, I have a replica built and running. My original, "sick" server is ipamaster and the new one is ipamaster2. All I've done thus far on ipamaster2 is run ipa-replica-install --setup-dns --no-forwarders replica-info-ipamaster2.foo.net.gpg. What additional steps do I need to take to ensure that t

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Bret Wortman
I was actually considering something like a few hours ago. It's a VM, so making another isn't that hard. Replication is the source of all my problems, though, so I'm concerned about whether it will work. Certainly worth the attempt! I'll report back later tomorrow. On Wed, Aug

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Jatin Nansi
On 08/29/2013 12:16 AM, Bret Wortman wrote: Ugh. Well that certainly hurts, but I just don't see an alternative. I hope Puppet can at least make the re-enrollment a bit easier. I'm still hand-copying some of the configuration and user group details and crafting the load scripts so if anyone ha

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Dmitri Pal
On 08/28/2013 10:16 AM, Bret Wortman wrote: > Ugh. Well that certainly hurts, but I just don't see an alternative. I > hope Puppet can at least make the re-enrollment a bit easier. > > I'm still hand-copying some of the configuration and user group > details and crafting the load scripts so if anyo