Preparing for disaster recovery with Identity Management

Procedure

1. Configure three or more replicas to provide CA services.

   1. To install a new replica with CA services, run ipa-replica-install with the --setup-ca option.

      [root@server ~]# ipa-replica-install --setup-ca

      Copy to Clipboard Toggle word wrap

   2. To install CA services on a preexisting replica, run ipa-ca-install.

      [root@replica ~]# ipa-ca-install

      Copy to Clipboard Toggle word wrap

2. Create CA replication agreements between your CA replicas.

   [root@careplica1 ~]# ipa topologysegment-add
   Suffix name: ca
   Left node: ca-replica1.example.com
   Right node: ca-replica2.example.com
   Segment name [ca-replica1.example.com-to-ca-replica2.example.com]: new_segment
   ---------------------------
   Added segment "new_segment"
   ---------------------------
     Segment name: new_segment
     Left node: ca-replica1.example.com
     Right node: ca-replica2.example.com
     Connectivity: both

   Copy to Clipboard Toggle word wrap

Procedure

1. Install and configure the pinentry utility.

   [root@server ~]# dnf install pinentry
   [root@server ~]# mkdir ~/.gnupg -m 700
   [root@server ~]# echo "pinentry-program /usr/bin/pinentry-curses" >> ~/.gnupg/gpg-agent.conf

   Copy to Clipboard Toggle word wrap

2. Create a key-input file used for generating a GPG keypair with your preferred details. For example:

   [root@server ~]# cat >key-input <<EOF
   %echo Generating a standard key
   Key-Type: RSA
   Key-Length: 2048
   Name-Real: GPG User
   Name-Comment: first key
   Name-Email: root@example.com
   Expire-Date: 0
   %commit
   %echo Finished creating standard key
   EOF

   Copy to Clipboard Toggle word wrap

3. Optional: By default, GPG2 stores its keyring in the ~/.gnupg file. To use a custom keyring location, set the GNUPGHOME environment variable to a directory that is only accessible by root.

   [root@server ~]# export GNUPGHOME=/root/backup
   
   [root@server ~]# mkdir -p $GNUPGHOME -m 700

   Copy to Clipboard Toggle word wrap

4. Generate a new GPG2 key based on the contents of the key-input file.

   [root@server ~]# gpg2 --batch --gen-key key-input

   Copy to Clipboard Toggle word wrap

5. Enter a passphrase to protect the GPG2 key. You use this passphrase to access the private key for decryption.

   ┌──────────────────────────────────────────────────────┐
   │ Please enter the passphrase to                       │
   │ protect your new key                                 │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

   Copy to Clipboard Toggle word wrap

6. Confirm the correct passphrase by entering it again.

   ┌──────────────────────────────────────────────────────┐
   │ Please re-enter this passphrase                      │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

   Copy to Clipboard Toggle word wrap

7. Verify that the new GPG2 key was created successfully.

   gpg: keybox '/root/backup/pubring.kbx' created
   gpg: Generating a standard key
   gpg: /root/backup/trustdb.gpg: trustdb created
   gpg: key BF28FFA302EF4557 marked as ultimately trusted
   gpg: directory '/root/backup/openpgp-revocs.d' created
   gpg: revocation certificate stored as '/root/backup/openpgp-revocs.d/8F6FCF10C80359D5A05AED67BF28FFA302EF4557.rev'
   gpg: Finished creating standard key

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a directory for your Ansible configuration and playbooks in your home directory:

   $ mkdir ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Change into the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks

   Copy to Clipboard Toggle word wrap

3. Create the ~/MyPlaybooks/ansible.cfg file with the following content:

   [defaults]
   inventory = /home/your_username/MyPlaybooks/inventory
   
   [privilege_escalation]
   become=True

   Copy to Clipboard Toggle word wrap

4. Create the ~/MyPlaybooks/inventory file with the following content:

   [ipaserver]
   server.idm.example.com
   
   [ipareplicas]
   replica1.idm.example.com
   replica2.idm.example.com
   
   [ipacluster:children]
   ipaserver
   ipareplicas
   
   [ipacluster:vars]
   ipaadmin_password=SomeADMINpassword
   
   [ipaclients]
   ipaclient1.example.com
   ipaclient2.example.com
   
   [ipaclients:vars]
   ipaadmin_password=SomeADMINpassword

   Copy to Clipboard Toggle word wrap

   This configuration defines two host groups, eu and us, for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups.

5. Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key:

   $ ssh-keygen

   Copy to Clipboard Toggle word wrap

6. Copy the SSH public key to the IdM admin account on each managed node:

   $ ssh-copy-id admin@server.idm.example.com
   $ ssh-copy-id admin@replica.idm.example.com

   Copy to Clipboard Toggle word wrap

   You must enter the IdM admin password when you enter these commands.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the backup-server.yml file located in the /usr/share/doc/ansible-freeipa/playbooks directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/backup-server.yml backup-my-server.yml

   Copy to Clipboard Toggle word wrap
3. Open the backup-my-server.yml Ansible playbook file for editing.

4. Adapt the file by setting the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group:

   ---
   - name: Playbook to backup IPA server
     hosts: ipaserver
     become: true
   
     roles:
     - role: ipabackup
       state: present

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server.yml

   Copy to Clipboard Toggle word wrap

Verification

1. Log into the IdM server that you have backed up.

2. Verify that the backup is in the /var/lib/ipa/backup directory.

   [root@server ~]# ls /var/lib/ipa/backup/
   ipa-full-2021-04-30-13-12-00

   Copy to Clipboard Toggle word wrap

Procedure

1. To store the backups, create a subdirectory in your home directory on the Ansible controller.

   $ mkdir ~/ipabackups

   Copy to Clipboard Toggle word wrap

2. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

3. Make a copy of the backup-server-to-controller.yml file located in the /usr/share/doc/ansible-freeipa/playbooks directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/backup-server-to-controller.yml backup-my-server-to-my-controller.yml

   Copy to Clipboard Toggle word wrap
4. Open the backup-my-server-to-my-controller.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Optional: To maintain a copy of the backup on the IdM server, uncomment the following line:

       # ipabackup_keep_on_server: true

      Copy to Clipboard Toggle word wrap

6. By default, backups are stored in the present working directory of the Ansible controller. To specify the backup directory you created in Step 1, add the ipabackup_controller_path variable and set it to the /home/user/ipabackups directory.

   ---
   - name: Playbook to backup IPA server to controller
     hosts: ipaserver
     become: true
     vars:
       ipabackup_to_controller: true
       # ipabackup_keep_on_server: true
       ipabackup_controller_path: /home/user/ipabackups
   
     roles:
     - role: ipabackup
       state: present

   Copy to Clipboard Toggle word wrap
7. Save the file.

8. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory backup-my-server-to-my-controller.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. To store the backups, create a subdirectory in your home directory on the Ansible controller.

   $ mkdir ~/ipabackups

   Copy to Clipboard Toggle word wrap

2. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

3. Make a copy of the copy-backup-from-server.yml file located in the /usr/share/doc/ansible-freeipa/playbooks directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/copy-backup-from-server.yml copy-backup-from-my-server-to-my-controller.yml

   Copy to Clipboard Toggle word wrap
4. Open the copy-my-backup-from-my-server-to-my-controller.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.
   2. Set the ipabackup_name variable to the name of the ipabackup on your IdM server to copy to your Ansible controller.

   3. By default, backups are stored in the present working directory of the Ansible controller. To specify the directory you created in Step 1, add the ipabackup_controller_path variable and set it to the /home/user/ipabackups directory.

      ---
      - name: Playbook to copy backup from IPA server
        hosts: ipaserver
        become: true
        vars:
          ipabackup_name: ipa-full-2021-04-30-13-12-00
          ipabackup_to_controller: true
          ipabackup_controller_path: /home/user/ipabackups
      
        roles:
        - role: ipabackup
          state: present

      Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-server-to-my-controller.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the copy-backup-from-controller.yml file located in the /usr/share/doc/ansible-freeipa/playbooks directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/copy-backup-from-controller.yml copy-backup-from-my-controller-to-my-server.yml

   Copy to Clipboard Toggle word wrap
3. Open the copy-my-backup-from-my-controller-to-my-server.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Set the ipabackup_name variable to the name of the ipabackup on your Ansible controller to copy to the IdM server.

      ---
      - name: Playbook to copy a backup from controller to the IPA server
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: server.idm.example.com_ipa-full-2021-04-30-13-12-00
          ipabackup_from_controller: true
      
        roles:
        - role: ipabackup
          state: copied

      Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory copy-backup-from-my-controller-to-my-server.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the remove-backup-from-server.yml file located in the /usr/share/doc/ansible-freeipa/playbooks directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/remove-backup-from-server.yml remove-backup-from-my-server.yml

   Copy to Clipboard Toggle word wrap
3. Open the remove-backup-from-my-server.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Set the hosts variable to a host group from your inventory file. In this example, set it to the ipaserver host group.

   2. Set the ipabackup_name variable to the name of the ipabackup to remove from your IdM server.

      ---
      - name: Playbook to remove backup from IPA server
        hosts: ipaserver
        become: true
      
        vars:
          ipabackup_name: ipa-full-2021-04-30-13-12-00
      
        roles:
        - role: ipabackup
          state: absent

      Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook, specifying the inventory file and the playbook file:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory remove-backup-from-my-server.yml

   Copy to Clipboard Toggle word wrap