Preparing for disaster recovery with Identity Management

Procedure

1. Configure three or more replicas to provide CA services.

   1. To install a new replica with CA services, run ipa-replica-install with the --setup-ca option.

      [root@server ~]# ipa-replica-install --setup-ca

   2. To install CA services on a preexisting replica, run ipa-ca-install.

      [root@replica ~]# ipa-ca-install

2. Create CA replication agreements between your CA replicas.

   [root@careplica1 ~]# ipa topologysegment-add
   Suffix name: ca
   Left node: ca-replica1.example.com
   Right node: ca-replica2.example.com
   Segment name [ca-replica1.example.com-to-ca-replica2.example.com]: new_segment
   ---------------------------
   Added segment "new_segment"
   ---------------------------
     Segment name: new_segment
     Left node: ca-replica1.example.com
     Right node: ca-replica2.example.com
     Connectivity: both

   Warning

   If only one server provides CA services and it is damaged, the entire environment will be lost. If you use the IdM CA, Red Hat strongly recommends having three or more replicas with CA services installed, with CA replication agreements between them.

Procedure

1. Install and configure the pinentry utility.

   [root@server ~]# dnf install pinentry
   [root@server ~]# mkdir ~/.gnupg -m 700
   [root@server ~]# echo "pinentry-program /usr/bin/pinentry-curses" >> ~/.gnupg/gpg-agent.conf

2. Create a key-input file used for generating a GPG keypair with your preferred details. For example:

   [root@server ~]# cat >key-input <<EOF
   %echo Generating a standard key
   Key-Type: RSA
   Key-Length: 2048
   Name-Real: GPG User
   Name-Comment: first key
   Name-Email: root@example.com
   Expire-Date: 0
   %commit
   %echo Finished creating standard key
   EOF

3. Optional: By default, GPG2 stores its keyring in the ~/.gnupg file. To use a custom keyring location, set the GNUPGHOME environment variable to a directory that is only accessible by root.

   [root@server ~]# export GNUPGHOME=/root/backup
   
   [root@server ~]# mkdir -p $GNUPGHOME -m 700

4. Generate a new GPG2 key based on the contents of the key-input file.

   [root@server ~]# gpg2 --batch --gen-key key-input

5. Enter a passphrase to protect the GPG2 key. You use this passphrase to access the private key for decryption.

   ┌──────────────────────────────────────────────────────┐
   │ Please enter the passphrase to                       │
   │ protect your new key                                 │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

6. Confirm the correct passphrase by entering it again.

   ┌──────────────────────────────────────────────────────┐
   │ Please re-enter this passphrase                      │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

7. Verify that the new GPG2 key was created successfully.

   gpg: keybox '/root/backup/pubring.kbx' created
   gpg: Generating a standard key
   gpg: /root/backup/trustdb.gpg: trustdb created
   gpg: key BF28FFA302EF4557 marked as ultimately trusted
   gpg: directory '/root/backup/openpgp-revocs.d' created
   gpg: revocation certificate stored as '/root/backup/openpgp-revocs.d/8F6FCF10C80359D5A05AED67BF28FFA302EF4557.rev'
   gpg: Finished creating standard key

Procedure

1. Use the ipa-restore utility to restore a full-server or data-only backup.

   • If the backup directory is in the default /var/lib/ipa/backup/ location, enter only the name of the directory:

     [root@server1 ~]# ipa-restore ipa-full-2020-01-14-12-02-32

   • If the backup directory is not in the default location, enter its full path:

     [root@server1 ~]# ipa-restore /mybackups/ipa-data-2020-02-01-05-30-00

     Note

     The ipa-restore utility automatically detects the type of backup that the directory contains, and performs the same type of restore by default. To perform a data-only restore from a full-server backup, add the --data option to the ipa-restore command:

     [root@server1 ~]# ipa-restore --data ipa-full-2020-01-14-12-02-32

2. Enter the Directory Manager password.

   Directory Manager (existing master) password:

3. Enter yes to confirm overwriting current data with the backup.

   Preparing restore from /var/lib/ipa/backup/ipa-full-2020-01-14-12-02-32 on server1.example.com
   Performing FULL restore from FULL backup
   Temporary setting umask to 022
   Restoring data will overwrite existing live data. Continue to restore? [no]: yes

4. The ipa-restore utility disables replication on all servers that are available:

   Each master will individually need to be re-initialized or
   re-created from this one. The replication agreements on
   masters running IPA 3.1 or earlier will need to be manually
   re-enabled. See the man page for details.
   Disabling all replication.
   Disabling replication agreement on server1.example.com to caReplica2.example.com
   Disabling CA replication agreement on server1.example.com to caReplica2.example.com
   Disabling replication agreement on caReplica2.example.com to server1.example.com
   Disabling replication agreement on caReplica2.example.com to replica3.example.com
   Disabling CA replication agreement on caReplica2.example.com to server1.example.com
   Disabling replication agreement on replica3.example.com to caReplica2.example.com

   The utility then stops IdM services, restores the backup, and restarts the services:

   Stopping IPA services
   Systemwide CA database updated.
   Restoring files
   Systemwide CA database updated.
   Restoring from userRoot in EXAMPLE-COM
   Restoring from ipaca in EXAMPLE-COM
   Restarting GSS-proxy
   Starting IPA services
   Restarting SSSD
   Restarting oddjobd
   Restoring umask to 18
   The ipa-restore command was successful

5. Re-initialize all replicas connected to the restored server:

   1. List all replication topology segments for the domain suffix, taking note of topology segments involving the restored server.

      [root@server1 ~]# ipa topologysegment-find domain

      ------------------
      2 segments matched
      ------------------
        Segment name: server1.example.com-to-caReplica2.example.com
        Left node: server1.example.com
        Right node: caReplica2.example.com
        Connectivity: both
      
        Segment name: caReplica2.example.com-to-replica3.example.com
        Left node: caReplica2.example.com
        Right node: replica3.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 2
      ----------------------------

   2. Re-initialize the domain suffix for all topology segments with the restored server.

      In this example, perform a re-initialization of caReplica2 with data from server1.

      [root@caReplica2 ~]# ipa-replica-manage re-initialize --from=server1.example.com

      Update in progress, 2 seconds elapsed
      Update succeeded

   3. Moving on to Certificate Authority data, list all replication topology segments for the ca suffix.

      [root@server1 ~]# ipa topologysegment-find ca

      -----------------
      1 segment matched
      -----------------
        Segment name: server1.example.com-to-caReplica2.example.com
        Left node: server1.example.com
        Right node: caReplica2.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 1
      ----------------------------

   4. Re-initialize all CA replicas connected to the restored server.

      In this example, perform a csreplica re-initialization of caReplica2 with data from server1.

      [root@caReplica2 ~]# ipa-csreplica-manage re-initialize --from=server1.example.com

6. Enter the Directory Manager password.

   Directory Manager password:

   Update in progress, 3 seconds elapsed
   Update succeeded

7. Continue moving outward through the replication topology, re-initializing successive replicas, until all servers have been updated with the data from restored server server1.example.com.

   In this example, we only have to re-initialize the domain suffix on replica3 with the data from caReplica2:

   [root@replica3 ~]# ipa-replica-manage re-initialize --from=caReplica2.example.com

8. Enter the Directory Manager password.

   Directory Manager password:

   Update in progress, 3 seconds elapsed
   Update succeeded

9. Clear SSSD’s cache on every server to avoid authentication problems due to invalid data:

   1. Stop the SSSD service:

      [root@server ~]# systemctl stop sssd

   2. Remove all cached content from SSSD:

      [root@server ~]# sss_cache -E

   3. Start the SSSD service:

      [root@server ~]# systemctl start sssd

   4. Reboot the server.

Procedure

1. If you used a custom keyring location when creating the GPG2 keys, verify that the $GNUPGHOME environment variable is set to that directory. See Creating a GPG2 key.

   [root@server ~]# echo $GNUPGHOME

   /root/backup

2. Provide the ipa-restore utility with the backup directory location.

   [root@server ~]# ipa-restore ipa-full-2020-01-13-18-30-54

   1. Enter the Directory Manager password.

      Directory Manager (existing master) password:

   2. Enter the passphrase you used when creating the GPG key.

      ┌────────────────────────────────────────────────────────────────┐
      │ Please enter the passphrase to unlock the OpenPGP secret key:  │
      │ "GPG User (first key) <root@example.com>"                      │
      │ 2048-bit RSA key, ID BF28FFA302EF4557,                         │
      │ created 2020-01-13.                                            │
      │                                                                │
      │                                                                │
      │ Passphrase: <passphrase>                                       │
      │                                                                │
      │         <OK>                                    <Cancel>       │
      └────────────────────────────────────────────────────────────────┘

3. Re-initialize all replicas connected to the restored server. See Restoring an IdM server from backup.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the backup-server.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/backup-server.yml backup-my-server.yml

3. Open the backup-my-server.yml Ansible playbook file for editing.

4. Adapt the file by setting the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group:

   ---
   - name: Playbook to backup IPA server
     hosts: ipaserver
     become: true
   
     roles:
     - role: freeipa.ansible_freeipa.ipabackup
       state: present

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server.yml

Verification

1. Log into the IdM server that you have backed up.

2. Verify that the backup is in the /var/lib/ipa/backup directory.

   [root@server ~]# ls /var/lib/ipa/backup/
   ipa-full-2021-04-30-13-12-00

Procedure

1. To store the backups, create a subdirectory in your home directory on the Ansible controller.

   $ mkdir ~/ipabackups

2. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

3. Make a copy of the backup-server-to-controller.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/backup-server-to-controller.yml backup-my-server-to-my-controller.yml

4. Open the backup-my-server-to-my-controller.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Optional: To maintain a copy of the backup on the IdM server, uncomment the following line:

       # ipabackup_keep_on_server: true

6. By default, backups are stored in the present working directory of the Ansible controller. To specify the backup directory you created in Step 1, add the ipabackup_controller_path variable and set it to the /home/user/ipabackups directory.

   ---
   - name: Playbook to backup IPA server to controller
     hosts: ipaserver
     become: true
     vars:
       ipabackup_to_controller: true
       # ipabackup_keep_on_server: true
       ipabackup_controller_path: /home/user/ipabackups
   
     roles:
     - role: freeipa.ansible_freeipa.ipabackup
       state: present

7. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

8. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server-to-my-controller.yml

Procedure

1. To store the backups, create a subdirectory in your home directory on the Ansible controller.

   $ mkdir ~/ipabackups

2. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

3. Make a copy of the copy-backup-from-server.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/copy-backup-from-server.yml copy-backup-from-my-server-to-my-controller.yml

4. Open the copy-my-backup-from-my-server-to-my-controller.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.
   2. Set the ipabackup_name variable to the name of the ipabackup on your IdM server to copy to your Ansible controller.

   3. By default, backups are stored in the present working directory of the Ansible controller. To specify the directory you created in Step 1, add the ipabackup_controller_path variable and set it to the /home/user/ipabackups directory.

      ---
      - name: Playbook to copy backup from IPA server
        hosts: ipaserver
        become: true
        vars:
          ipabackup_name: ipa-full-2021-04-30-13-12-00
          ipabackup_to_controller: true
          ipabackup_controller_path: /home/user/ipabackups
      
        roles:
        - role: freeipa.ansible_freeipa.ipabackup
          state: present

6. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

7. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-server-to-my-controller.yml

   Note

   To copy all IdM backups to your controller, set the ipabackup_name variable in the Ansible playbook to all:

     vars:
       ipabackup_name: all
       ipabackup_to_controller: true

   For an example, see the copy-all-backups-from-server.yml Ansible playbook in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the copy-backup-from-controller.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/copy-backup-from-controller.yml copy-backup-from-my-controller-to-my-server.yml

3. Open the copy-my-backup-from-my-controller-to-my-server.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Set the ipabackup_name variable to the name of the ipabackup on your Ansible controller to copy to the IdM server.

      ---
      - name: Playbook to copy a backup from controller to the IPA server
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: server.idm.example.com_ipa-full-2021-04-30-13-12-00
          ipabackup_from_controller: true
      
        roles:
        - role: freeipa.ansible_freeipa.ipabackup
          state: copied

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-controller-to-my-server.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the remove-backup-from-server.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/remove-backup-from-server.yml remove-backup-from-my-server.yml

3. Open the remove-backup-from-my-server.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Set the ipabackup_name variable to the name of the ipabackup to remove from your IdM server.

      ---
      - name: Playbook to remove backup from IPA server
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: ipa-full-2021-04-30-13-12-00
      
        roles:
        - role: freeipa.ansible_freeipa.ipabackup
          state: absent

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory remove-backup-from-my-server.yml

   Note

   To remove all IdM backups from the IdM server, set the ipabackup_name variable in the Ansible playbook to all:

     vars:
       ipabackup_name: all

   For an example, see the remove-all-backups-from-server.yml Ansible playbook in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the restore-server.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/restore-server.yml restore-my-server.yml

3. Open the restore-my-server.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.
   2. Set the ipabackup_name variable to the name of the ipabackup to restore.

   3. Set the ipabackup_password variable to the LDAP Directory Manager password.

      ---
      - name: Playbook to restore an IPA server
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: ipa-full-2021-04-30-13-12-00
          ipabackup_password: <your_LDAP_DM_password>
      
        roles:
        - role: freeipa.ansible_freeipa.ipabackup
          state: restored

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

6. Run the Ansible playbook specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory restore-my-server.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the restore-server-from-controller.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/restore-server-from-controller.yml restore-my-server-from-my-controller.yml

3. Open the restore-my-server-from-my-controller.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.
   2. Set the ipabackup_name variable to the name of the ipabackup to restore.

   3. Set the ipabackup_password variable to the LDAP Directory Manager password.

      ---
      - name: Playbook to restore IPA server from controller
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: server.idm.example.com_ipa-full-2021-04-30-13-12-00
          ipabackup_password: <your_LDAP_DM_password>
          ipabackup_from_controller: true
      
        roles:
        - role: freeipa.ansible_freeipa.ipabackup
          state: restored

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/ directory on the control node.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory restore-my-server-from-my-controller.yml