Chapter 8. Backing up and restoring IdM

Procedure

1. Install and configure the pinentry utility.

   [root@server ~]# yum install pinentry
   [root@server ~]# mkdir ~/.gnupg -m 700
   [root@server ~]# echo "pinentry-program /usr/bin/pinentry-curses" >> ~/.gnupg/gpg-agent.conf

2. Create a key-input file used for generating a GPG keypair with your preferred details. For example:

   [root@server ~]# cat >key-input <<EOF
   %echo Generating a standard key
   Key-Type: RSA
   Key-Length: 2048
   Name-Real: GPG User
   Name-Comment: first key
   Name-Email: root@example.com
   Expire-Date: 0
   %commit
   %echo Finished creating standard key
   EOF

3. Optional: By default, GPG2 stores its keyring in the ~/.gnupg file. To use a custom keyring location, set the GNUPGHOME environment variable to a directory that is only accessible by root.

   [root@server ~]# export GNUPGHOME=/root/backup
   
   [root@server ~]# mkdir -p $GNUPGHOME -m 700

4. Generate a new GPG2 key based on the contents of the key-input file.

   [root@server ~]# gpg2 --batch --gen-key key-input

5. Enter a passphrase to protect the GPG2 key. You use this passphrase to access the private key for decryption.

   ┌──────────────────────────────────────────────────────┐
   │ Please enter the passphrase to                       │
   │ protect your new key                                 │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

6. Confirm the correct passphrase by entering it again.

   ┌──────────────────────────────────────────────────────┐
   │ Please re-enter this passphrase                      │
   │                                                      │
   │ Passphrase: <passphrase>                             │
   │                                                      │
   │	 <OK>                             <Cancel>         │
   └──────────────────────────────────────────────────────┘

7. Verify that the new GPG2 key was created successfully.

   gpg: keybox '/root/backup/pubring.kbx' created
   gpg: Generating a standard key
   gpg: /root/backup/trustdb.gpg: trustdb created
   gpg: key BF28FFA302EF4557 marked as ultimately trusted
   gpg: directory '/root/backup/openpgp-revocs.d' created
   gpg: revocation certificate stored as '/root/backup/openpgp-revocs.d/8F6FCF10C80359D5A05AED67BF28FFA302EF4557.rev'
   gpg: Finished creating standard key

Procedure

1. Use the ipa-restore utility to restore a full-server or data-only backup.

   • If the backup directory is in the default /var/lib/ipa/backup/ location, enter only the name of the directory:

     [root@server1 ~]# ipa-restore ipa-full-2020-01-14-12-02-32

   • If the backup directory is not in the default location, enter its full path:

     [root@server1 ~]# ipa-restore /mybackups/ipa-data-2020-02-01-05-30-00

     Note

     The ipa-restore utility automatically detects the type of backup that the directory contains, and performs the same type of restore by default. To perform a data-only restore from a full-server backup, add the --data option to the ipa-restore command:

     [root@server1 ~]# ipa-restore --data ipa-full-2020-01-14-12-02-32

2. Enter the Directory Manager password.

   Directory Manager (existing master) password:

3. Enter yes to confirm overwriting current data with the backup.

   Preparing restore from /var/lib/ipa/backup/ipa-full-2020-01-14-12-02-32 on server1.example.com
   Performing FULL restore from FULL backup
   Temporary setting umask to 022
   Restoring data will overwrite existing live data. Continue to restore? [no]: yes

4. The ipa-restore utility disables replication on all servers that are available:

   Each master will individually need to be re-initialized or
   re-created from this one. The replication agreements on
   masters running IPA 3.1 or earlier will need to be manually
   re-enabled. See the man page for details.
   Disabling all replication.
   Disabling replication agreement on server1.example.com to caReplica2.example.com
   Disabling CA replication agreement on server1.example.com to caReplica2.example.com
   Disabling replication agreement on caReplica2.example.com to server1.example.com
   Disabling replication agreement on caReplica2.example.com to replica3.example.com
   Disabling CA replication agreement on caReplica2.example.com to server1.example.com
   Disabling replication agreement on replica3.example.com to caReplica2.example.com

   The utility then stops IdM services, restores the backup, and restarts the services:

   Stopping IPA services
   Systemwide CA database updated.
   Restoring files
   Systemwide CA database updated.
   Restoring from userRoot in EXAMPLE-COM
   Restoring from ipaca in EXAMPLE-COM
   Restarting GSS-proxy
   Starting IPA services
   Restarting SSSD
   Restarting oddjobd
   Restoring umask to 18
   The ipa-restore command was successful

5. Re-initialize all replicas connected to the restored server:

   1. List all replication topology segments for the domain suffix, taking note of topology segments involving the restored server.

      [root@server1 ~]# ipa topologysegment-find domain
      ------------------
      2 segments matched
      ------------------
        Segment name: server1.example.com-to-caReplica2.example.com
        Left node: server1.example.com
        Right node: caReplica2.example.com
        Connectivity: both
      
        Segment name: caReplica2.example.com-to-replica3.example.com
        Left node: caReplica2.example.com
        Right node: replica3.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 2
      ----------------------------

   2. Re-initialize the domain suffix for all topology segments with the restored server.

      In this example, perform a re-initialization of caReplica2 with data from server1.

      [root@caReplica2 ~]# ipa-replica-manage re-initialize --from=server1.example.com
      Update in progress, 2 seconds elapsed
      Update succeeded

   3. Moving on to Certificate Authority data, list all replication topology segments for the ca suffix.

      [root@server1 ~]# ipa topologysegment-find ca
      -----------------
      1 segment matched
      -----------------
        Segment name: server1.example.com-to-caReplica2.example.com
        Left node: server1.example.com
        Right node: caReplica2.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 1
      ----------------------------

   4. Re-initialize all CA replicas connected to the restored server.

      In this example, perform a csreplica re-initialization of caReplica2 with data from server1.

      [root@caReplica2 ~]# ipa-csreplica-manage re-initialize --from=server1.example.com
      Directory Manager password:
      
      Update in progress, 3 seconds elapsed
      Update succeeded

6. Continue moving outward through the replication topology, re-initializing successive replicas, until all servers have been updated with the data from restored server server1.example.com.

   In this example, we only have to re-initialize the domain suffix on replica3 with the data from caReplica2:

   [root@replica3 ~]# ipa-replica-manage re-initialize --from=caReplica2.example.com
   Directory Manager password:
   
   Update in progress, 3 seconds elapsed
   Update succeeded

7. Clear SSSD’s cache on every server to avoid authentication problems due to invalid data:

   1. Stop the SSSD service:

      [root@server ~]# systemctl stop sssd

   2. Remove all cached content from SSSD:

      [root@server ~]# sss_cache -E

   3. Start the SSSD service:

      [root@server ~]# systemctl start sssd

   4. Reboot the server.

Procedure

1. If you used a custom keyring location when creating the GPG2 keys, verify that the $GNUPGHOME environment variable is set to that directory. See Creating a GPG2 key.

   [root@server ~]# echo $GNUPGHOME
   /root/backup

2. Provide the ipa-restore utility with the backup directory location.

   [root@server ~]# ipa-restore ipa-full-2020-01-13-18-30-54

   1. Enter the Directory Manager password.

      Directory Manager (existing master) password:

   2. Enter the passphrase you used when creating the GPG key.

      ┌────────────────────────────────────────────────────────────────┐
      │ Please enter the passphrase to unlock the OpenPGP secret key:  │
      │ "GPG User (first key) <root@example.com>"                      │
      │ 2048-bit RSA key, ID BF28FFA302EF4557,                         │
      │ created 2020-01-13.                                            │
      │                                                                │
      │                                                                │
      │ Passphrase: <passphrase>                                       │
      │                                                                │
      │         <OK>                                    <Cancel>       │
      └────────────────────────────────────────────────────────────────┘

3. Re-initialize all replicas connected to the restored server. See Restoring an IdM server from backup.