Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-09 Thread Innes, Duncan
For sure Rob.  It's a dirty hack to get the information that we
desperately needed at one point.

We had a pretty severe issue with our IPA servers a while back which was
eventually solved by reinstalling all but the initial IPA server,
deleting the old replication agreements and building the new ones back
up.  This page was of high value at that time.  It's still useful for an
occasional check of the status.

D

-Original Message-
From: Rob Crittenden [mailto:rcrit...@redhat.com] 
Sent: 06 February 2015 14:06
To: Innes, Duncan; Baird, Josh; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] Real-time replication status (RFE)?

Innes, Duncan wrote:
 Check:
 
 https://gist.github.com/duncaninnes/c91985822be9782df581
 
 which contains 2 scripts based on:
 
 http://directory.fedoraproject.org/docs/389ds/howto/howto-replicationm
 on
 itoring.html
 
 I just expanded it to cope with a list of servers, then version 2 
 sorts by last end, last start, hostname.  This version allows me to 
 see more clearly if a certain replication is out of date.  Could have 
 done a sort by column and added a refresh button, or automatic 
 refresh, but that wasn't the immediate aim.  Since then it's just 
 stuck, so could do with some love from any suitably minded persons.  
 It also doesn't gracefully handle situations where one server in the 
 list is offline, or taking too long to respond.
 
 Both scripts are put in /var/www/cgi-bin on one of my IPA servers, and

 accessed via:
 
 https://ipa01.example.com/cgi-bin/monitor2.pl
 
 for example.  Not sure if I modified the httpd configs - it's a while 
 ago that I sorted it out.
 
 HTH
 
 Duncan

We try to avoid using Directory Manager as much as possible which is one
of the reasons we haven't done something like this already. I'd
definitely recommend using startTLS for your bind, at a minimum.

The issue starts with the fact that we don't have a hostgroup consisting
of all IPA masters maintained automatically so there is no easy way to
do delegation. You could do this manually if you wanted though,
something like:

# ipa hostgroup-add ipamasters --desc='Manual list of IPA masters'
# ipa hostgroup-add-member --hosts=ipa1.example.com ipamasters # ipa
hostgroup-add-member --hosts=ipa2.example.com ipamasters

Now create a role that with a privilege to be able to read replication
agreements (and add and delete them too, so be aware).

# ipa role-add ipamasters --desc='IPA Masters'
# ipa role-add-privilege --privileges='Replication Administrators'
ipamasters
# ipa role-add-member --hostgroup=ipamasters ipamasters

You can test this with:

# kinit -kt /etc/krb5.keytab
# ldapsearch -Y GSSAPI -b 'cn=mapping tree,cn=config'
'(objectclass=nsDS5ReplicationAgreement)'

You'd just need to the ipamasters hostgroup up-to-date, and considering
that this list probably stabilizes over time, shouldn't be a ton of
effort.

rob

 -Original Message-
 From: Baird, Josh [mailto:jba...@follett.com]
 Sent: 05 February 2015 17:08
 To: Innes, Duncan; Rob Crittenden; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?
 
 That would be great, thanks!
 
 Josh
 
 -Original Message-
 From: Innes, Duncan [mailto:duncan.in...@virginmoney.com]
 Sent: Thursday, February 05, 2015 11:34 AM
 To: Rob Crittenden; Baird, Josh; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?

 The screen mockup in that ticket is based on a Perl script that I 
 stuck in cgi-bin to pull just those stats off each IPA server I have 
 and display them.  Can share the code if you're interested.

 D

 -Original Message-
 From: freeipa-users-boun...@redhat.com 
 [mailto:freeipa-users-boun...@redhat.com] On Behalf Of Rob Crittenden
 Sent: 05 February 2015 14:19
 To: Baird, Josh; freeipa-users@redhat.com
 Subject: Re: [Freeipa-users] Real-time replication status (RFE)?

 Baird, Josh wrote:
 Hi,

 I'm looking for an easy way to validate that all replication
 agreements are functioning correctly between all of my IPA masters 
 and
 
 replicas.  I am aware that I can run 'ipa-replica-manage list -v' 
 from
 
 each IPA master, but I was looking for something more centralized 
 that
 
 could give me a replication health report for all masters/replicas.
 Ideally, this type of feature would be exposed in the UI and would 
 also include information or insight into the status of any IPA - AD

 trust relationships.

 Am I missing a feature that already exists?  If not, is there
 something like this on the IPA roadmap?

 This is being tracked in https://fedorahosted.org/freeipa/ticket/4390

 It depends on some other work being done first.

 rob

 --
 Manage your subscription for the Freeipa-users mailing list:
 https://www.redhat.com/mailman/listinfo/freeipa-users
 Go To http://freeipa.org for more info on the project

 This message has been checked for viruses and spam by the Virgin 
 Money
 
 email scanning system powered by Messagelabs

Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-06 Thread Innes, Duncan
Check:

https://gist.github.com/duncaninnes/c91985822be9782df581

which contains 2 scripts based on:

http://directory.fedoraproject.org/docs/389ds/howto/howto-replicationmon
itoring.html

I just expanded it to cope with a list of servers, then version 2 sorts
by last end, last start, hostname.  This version allows me to see more
clearly if a certain replication is out of date.  Could have done a sort
by column and added a refresh button, or automatic refresh, but that
wasn't the immediate aim.  Since then it's just stuck, so could do with
some love from any suitably minded persons.  It also doesn't gracefully
handle situations where one server in the list is offline, or taking too
long to respond.

Both scripts are put in /var/www/cgi-bin on one of my IPA servers, and
accessed via:

https://ipa01.example.com/cgi-bin/monitor2.pl

for example.  Not sure if I modified the httpd configs - it's a while
ago that I sorted it out.

HTH

Duncan

-Original Message-
From: Baird, Josh [mailto:jba...@follett.com] 
Sent: 05 February 2015 17:08
To: Innes, Duncan; Rob Crittenden; freeipa-users@redhat.com
Subject: RE: [Freeipa-users] Real-time replication status (RFE)?

That would be great, thanks!

Josh

 -Original Message-
 From: Innes, Duncan [mailto:duncan.in...@virginmoney.com]
 Sent: Thursday, February 05, 2015 11:34 AM
 To: Rob Crittenden; Baird, Josh; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?
 
 The screen mockup in that ticket is based on a Perl script that I 
 stuck in cgi-bin to pull just those stats off each IPA server I have 
 and display them.  Can share the code if you're interested.
 
 D
 
 -Original Message-
 From: freeipa-users-boun...@redhat.com 
 [mailto:freeipa-users-boun...@redhat.com] On Behalf Of Rob Crittenden
 Sent: 05 February 2015 14:19
 To: Baird, Josh; freeipa-users@redhat.com
 Subject: Re: [Freeipa-users] Real-time replication status (RFE)?
 
 Baird, Josh wrote:
  Hi,
 
  I'm looking for an easy way to validate that all replication
 agreements are functioning correctly between all of my IPA masters and

 replicas.  I am aware that I can run 'ipa-replica-manage list -v' from

 each IPA master, but I was looking for something more centralized that

 could give me a replication health report for all masters/replicas.
 Ideally, this type of feature would be exposed in the UI and would 
 also include information or insight into the status of any IPA - AD 
 trust relationships.
 
  Am I missing a feature that already exists?  If not, is there
 something like this on the IPA roadmap?
 
 This is being tracked in https://fedorahosted.org/freeipa/ticket/4390
 
 It depends on some other work being done first.
 
 rob
 
 --
 Manage your subscription for the Freeipa-users mailing list:
 https://www.redhat.com/mailman/listinfo/freeipa-users
 Go To http://freeipa.org for more info on the project
 
 This message has been checked for viruses and spam by the Virgin Money

 email scanning system powered by Messagelabs.
 
 This message has been checked for viruses and spam by the Virgin Money

 email scanning system powered by Messagelabs.
 
 This e-mail is intended to be confidential to the recipient. If you 
 receive a copy in error, please inform the sender and then delete this
message.
 
 Virgin Money plc - Registered in England and Wales (Company no.
6952311).
 Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3
4PL.
 Virgin Money plc is authorised by the Prudential Regulation Authority 
 and regulated by the Financial Conduct Authority and the Prudential 
 Regulation Authority.
 
 The following companies also trade as Virgin Money. They are both 
 authorised and regulated by the Financial Conduct Authority, are 
 registered in England and Wales and have their registered office at 
 Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL: Virgin Money 
 Personal Financial Service Limited (Company no. 3072766) and Virgin 
 Money Unit Trust Managers Limited (Company no. 3000482).
 
 For further details of Virgin Money group companies please visit our 
 website at virginmoney.com

This message has been checked for viruses and spam by the Virgin Money
email scanning system powered by Messagelabs.

This message has been checked for viruses and spam by the Virgin Money email 
scanning system powered by Messagelabs.

This e-mail is intended to be confidential to the recipient. If you receive a 
copy in error, please inform the sender and then delete this message.

Virgin Money plc - Registered in England and Wales (Company no. 6952311). 
Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL. 
Virgin Money plc is authorised by the Prudential Regulation Authority and 
regulated by the Financial Conduct Authority and the Prudential Regulation 
Authority.

The following companies also trade as Virgin Money. They are both authorised 
and regulated by the Financial Conduct Authority, are registered in England

Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-06 Thread Rob Crittenden
Innes, Duncan wrote:
 Check:
 
 https://gist.github.com/duncaninnes/c91985822be9782df581
 
 which contains 2 scripts based on:
 
 http://directory.fedoraproject.org/docs/389ds/howto/howto-replicationmon
 itoring.html
 
 I just expanded it to cope with a list of servers, then version 2 sorts
 by last end, last start, hostname.  This version allows me to see more
 clearly if a certain replication is out of date.  Could have done a sort
 by column and added a refresh button, or automatic refresh, but that
 wasn't the immediate aim.  Since then it's just stuck, so could do with
 some love from any suitably minded persons.  It also doesn't gracefully
 handle situations where one server in the list is offline, or taking too
 long to respond.
 
 Both scripts are put in /var/www/cgi-bin on one of my IPA servers, and
 accessed via:
 
 https://ipa01.example.com/cgi-bin/monitor2.pl
 
 for example.  Not sure if I modified the httpd configs - it's a while
 ago that I sorted it out.
 
 HTH
 
 Duncan

We try to avoid using Directory Manager as much as possible which is one
of the reasons we haven't done something like this already. I'd
definitely recommend using startTLS for your bind, at a minimum.

The issue starts with the fact that we don't have a hostgroup consisting
of all IPA masters maintained automatically so there is no easy way to
do delegation. You could do this manually if you wanted though,
something like:

# ipa hostgroup-add ipamasters --desc='Manual list of IPA masters'
# ipa hostgroup-add-member --hosts=ipa1.example.com ipamasters
# ipa hostgroup-add-member --hosts=ipa2.example.com ipamasters

Now create a role that with a privilege to be able to read replication
agreements (and add and delete them too, so be aware).

# ipa role-add ipamasters --desc='IPA Masters'
# ipa role-add-privilege --privileges='Replication Administrators'
ipamasters
# ipa role-add-member --hostgroup=ipamasters ipamasters

You can test this with:

# kinit -kt /etc/krb5.keytab
# ldapsearch -Y GSSAPI -b 'cn=mapping tree,cn=config'
'(objectclass=nsDS5ReplicationAgreement)'

You'd just need to the ipamasters hostgroup up-to-date, and considering
that this list probably stabilizes over time, shouldn't be a ton of effort.

rob

 -Original Message-
 From: Baird, Josh [mailto:jba...@follett.com] 
 Sent: 05 February 2015 17:08
 To: Innes, Duncan; Rob Crittenden; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?
 
 That would be great, thanks!
 
 Josh
 
 -Original Message-
 From: Innes, Duncan [mailto:duncan.in...@virginmoney.com]
 Sent: Thursday, February 05, 2015 11:34 AM
 To: Rob Crittenden; Baird, Josh; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?

 The screen mockup in that ticket is based on a Perl script that I 
 stuck in cgi-bin to pull just those stats off each IPA server I have 
 and display them.  Can share the code if you're interested.

 D

 -Original Message-
 From: freeipa-users-boun...@redhat.com 
 [mailto:freeipa-users-boun...@redhat.com] On Behalf Of Rob Crittenden
 Sent: 05 February 2015 14:19
 To: Baird, Josh; freeipa-users@redhat.com
 Subject: Re: [Freeipa-users] Real-time replication status (RFE)?

 Baird, Josh wrote:
 Hi,

 I'm looking for an easy way to validate that all replication
 agreements are functioning correctly between all of my IPA masters and
 
 replicas.  I am aware that I can run 'ipa-replica-manage list -v' from
 
 each IPA master, but I was looking for something more centralized that
 
 could give me a replication health report for all masters/replicas.
 Ideally, this type of feature would be exposed in the UI and would 
 also include information or insight into the status of any IPA - AD 
 trust relationships.

 Am I missing a feature that already exists?  If not, is there
 something like this on the IPA roadmap?

 This is being tracked in https://fedorahosted.org/freeipa/ticket/4390

 It depends on some other work being done first.

 rob

 --
 Manage your subscription for the Freeipa-users mailing list:
 https://www.redhat.com/mailman/listinfo/freeipa-users
 Go To http://freeipa.org for more info on the project

 This message has been checked for viruses and spam by the Virgin Money
 
 email scanning system powered by Messagelabs.

 This message has been checked for viruses and spam by the Virgin Money
 
 email scanning system powered by Messagelabs.

 This e-mail is intended to be confidential to the recipient. If you 
 receive a copy in error, please inform the sender and then delete this
 message.

 Virgin Money plc - Registered in England and Wales (Company no.
 6952311).
 Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3
 4PL.
 Virgin Money plc is authorised by the Prudential Regulation Authority 
 and regulated by the Financial Conduct Authority and the Prudential 
 Regulation Authority.

 The following companies also trade as Virgin Money. They are both

Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-05 Thread Rob Crittenden
Baird, Josh wrote:
 Hi,
 
 I'm looking for an easy way to validate that all replication agreements are 
 functioning correctly between all of my IPA masters and replicas.  I am aware 
 that I can run 'ipa-replica-manage list -v' from each IPA master, but I was 
 looking for something more centralized that could give me a replication 
 health report for all masters/replicas.  Ideally, this type of feature would 
 be exposed in the UI and would also include information or insight into the 
 status of any IPA - AD trust relationships.
 
 Am I missing a feature that already exists?  If not, is there something like 
 this on the IPA roadmap?

This is being tracked in https://fedorahosted.org/freeipa/ticket/4390

It depends on some other work being done first.

rob

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project


Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-05 Thread Innes, Duncan
The screen mockup in that ticket is based on a Perl script that I stuck
in cgi-bin to pull just those stats off each IPA server I have and
display them.  Can share the code if you're interested.

D

-Original Message-
From: freeipa-users-boun...@redhat.com
[mailto:freeipa-users-boun...@redhat.com] On Behalf Of Rob Crittenden
Sent: 05 February 2015 14:19
To: Baird, Josh; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] Real-time replication status (RFE)?

Baird, Josh wrote:
 Hi,
 
 I'm looking for an easy way to validate that all replication
agreements are functioning correctly between all of my IPA masters and
replicas.  I am aware that I can run 'ipa-replica-manage list -v' from
each IPA master, but I was looking for something more centralized that
could give me a replication health report for all masters/replicas.
Ideally, this type of feature would be exposed in the UI and would also
include information or insight into the status of any IPA - AD trust
relationships.
 
 Am I missing a feature that already exists?  If not, is there
something like this on the IPA roadmap?

This is being tracked in https://fedorahosted.org/freeipa/ticket/4390

It depends on some other work being done first.

rob

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project

This message has been checked for viruses and spam by the Virgin Money
email scanning system powered by Messagelabs.

This message has been checked for viruses and spam by the Virgin Money email 
scanning system powered by Messagelabs.

This e-mail is intended to be confidential to the recipient. If you receive a 
copy in error, please inform the sender and then delete this message.

Virgin Money plc - Registered in England and Wales (Company no. 6952311). 
Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL. 
Virgin Money plc is authorised by the Prudential Regulation Authority and 
regulated by the Financial Conduct Authority and the Prudential Regulation 
Authority.

The following companies also trade as Virgin Money. They are both authorised 
and regulated by the Financial Conduct Authority, are registered in England and 
Wales and have their registered office at Jubilee House, Gosforth, Newcastle 
upon Tyne NE3 4PL: Virgin Money Personal Financial Service Limited (Company no. 
3072766) and Virgin Money Unit Trust Managers Limited (Company no. 3000482).

For further details of Virgin Money group companies please visit our website at 
virginmoney.com

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project


Re: [Freeipa-users] Real-time replication status (RFE)?

2015-02-05 Thread Baird, Josh
That would be great, thanks!

Josh

 -Original Message-
 From: Innes, Duncan [mailto:duncan.in...@virginmoney.com]
 Sent: Thursday, February 05, 2015 11:34 AM
 To: Rob Crittenden; Baird, Josh; freeipa-users@redhat.com
 Subject: RE: [Freeipa-users] Real-time replication status (RFE)?
 
 The screen mockup in that ticket is based on a Perl script that I stuck in 
 cgi-bin
 to pull just those stats off each IPA server I have and display them.  Can 
 share
 the code if you're interested.
 
 D
 
 -Original Message-
 From: freeipa-users-boun...@redhat.com
 [mailto:freeipa-users-boun...@redhat.com] On Behalf Of Rob Crittenden
 Sent: 05 February 2015 14:19
 To: Baird, Josh; freeipa-users@redhat.com
 Subject: Re: [Freeipa-users] Real-time replication status (RFE)?
 
 Baird, Josh wrote:
  Hi,
 
  I'm looking for an easy way to validate that all replication
 agreements are functioning correctly between all of my IPA masters and
 replicas.  I am aware that I can run 'ipa-replica-manage list -v' from each 
 IPA
 master, but I was looking for something more centralized that could give me
 a replication health report for all masters/replicas.
 Ideally, this type of feature would be exposed in the UI and would also
 include information or insight into the status of any IPA - AD trust
 relationships.
 
  Am I missing a feature that already exists?  If not, is there
 something like this on the IPA roadmap?
 
 This is being tracked in https://fedorahosted.org/freeipa/ticket/4390
 
 It depends on some other work being done first.
 
 rob
 
 --
 Manage your subscription for the Freeipa-users mailing list:
 https://www.redhat.com/mailman/listinfo/freeipa-users
 Go To http://freeipa.org for more info on the project
 
 This message has been checked for viruses and spam by the Virgin Money
 email scanning system powered by Messagelabs.
 
 This message has been checked for viruses and spam by the Virgin Money
 email scanning system powered by Messagelabs.
 
 This e-mail is intended to be confidential to the recipient. If you receive a
 copy in error, please inform the sender and then delete this message.
 
 Virgin Money plc - Registered in England and Wales (Company no. 6952311).
 Registered office - Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL.
 Virgin Money plc is authorised by the Prudential Regulation Authority and
 regulated by the Financial Conduct Authority and the Prudential Regulation
 Authority.
 
 The following companies also trade as Virgin Money. They are both
 authorised and regulated by the Financial Conduct Authority, are registered
 in England and Wales and have their registered office at Jubilee House,
 Gosforth, Newcastle upon Tyne NE3 4PL: Virgin Money Personal Financial
 Service Limited (Company no. 3072766) and Virgin Money Unit Trust
 Managers Limited (Company no. 3000482).
 
 For further details of Virgin Money group companies please visit our website
 at virginmoney.com

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project