Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
Okay, I have a replica built and running. My original, sick server is ipamaster and the new one is ipamaster2. All I've done thus far on ipamaster2 is run ipa-replica-install --setup-dns --no-forwarders replica-info-ipamaster2.foo.net.gpg. What additional steps do I need to take to ensure that

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Simo Sorce
On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: Okay, I have a replica built and running. My original, sick server is ipamaster and the new one is ipamaster2. All I've done thus far on ipamaster2 is run ipa-replica-install --setup-dns --no-forwarders replica-info-ipamaster2.foo.net.gpg.

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
On Thu, Aug 29, 2013 at 9:09 AM, Simo Sorce s...@redhat.com wrote: On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: Okay, I have a replica built and running. My original, sick server is ipamaster and the new one is ipamaster2. All I've done thus far on ipamaster2 is run

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Simo Sorce
On Thu, 2013-08-29 at 09:14 -0400, Bret Wortman wrote: On Thu, Aug 29, 2013 at 9:09 AM, Simo Sorce s...@redhat.com wrote: On Thu, 2013-08-29 at 08:07 -0400, Bret Wortman wrote: Okay, I have a replica built and running. My original, sick server is ipamaster

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
Agreed, but not always possible. I had a replica crash hard and it wasn't possible to remove it. In other news: [ipamaster2]# ipa-ca-install replica-info-ipamaster2.spx.net.gpg A selfsign CA can not be added Is there a way around this? How can I ensure that I can transfer the CA back to

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into something bad which is now causing us problems. I'm not sure how this happened, since we actually created our original instance on a different server, created ipamaster

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Rob Crittenden
Bret Wortman wrote: A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into something bad which is now causing us problems. I'm not sure how this happened, since we actually created our original instance on a different

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Bret Wortman
On Thu, Aug 29, 2013 at 11:10 AM, Rob Crittenden rcrit...@redhat.comwrote: Bret Wortman wrote: A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked us into something bad which is now causing us problems. I'm not sure how

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-29 Thread Rob Crittenden
Bret Wortman wrote: On Thu, Aug 29, 2013 at 11:10 AM, Rob Crittenden rcrit...@redhat.com mailto:rcrit...@redhat.com wrote: Bret Wortman wrote: A bit of googling has led me to understand that we must have created the original server with --selfsign, and that locked

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Dmitri Pal
On 08/28/2013 10:16 AM, Bret Wortman wrote: Ugh. Well that certainly hurts, but I just don't see an alternative. I hope Puppet can at least make the re-enrollment a bit easier. I'm still hand-copying some of the configuration and user group details and crafting the load scripts so if anyone

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Jatin Nansi
On 08/29/2013 12:16 AM, Bret Wortman wrote: Ugh. Well that certainly hurts, but I just don't see an alternative. I hope Puppet can at least make the re-enrollment a bit easier. I'm still hand-copying some of the configuration and user group details and crafting the load scripts so if anyone

Re: [Freeipa-users] Fwd: Scorched earth

2013-08-28 Thread Bret Wortman
I was actually considering something like a few hours ago. It's a VM, so making another isn't that hard. Replication is the source of all my problems, though, so I'm concerned about whether it will work. Certainly worth the attempt! I'll report back later tomorrow. On Wed,