第4章 Recovering from data loss with VM snapshots

Procedure

1. Boot the desired snapshot of the CA replica VM.

2. Remove replication agreements to any lost replicas.

   [root@server ~]# ipa server-del lost-server1.example.com
   [root@server ~]# ipa server-del lost-server2.example.com
   ...

3. Install a second CA replica. See Installing an IdM replica.
4. The VM CA replica is now the CA renewal server. Red Hat recommends promoting another CA replica in the environment to act as the CA renewal server. See Changing and resetting IdM CA renewal server.
5. Recreate the desired replica topology by deploying additional replicas with the desired services (CA, DNS). See Installing an IdM replica
6. Update DNS to reflect the new replica topology. If IdM DNS is used, DNS service records are updated automatically.
7. Verify that IdM clients can reach the IdM servers. See Adjusting IdM Clients during recovery.

Verification

1. Test the Kerberos server on every replica by successfully retrieving a Kerberos ticket-granting ticket as an IdM user.

   [root@server ~]# kinit admin
   Password for admin@EXAMPLE.COM:
   
   [root@server ~]# klist
   Ticket cache: KCM:0
   Default principal: admin@EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   10/31/2019 15:51:37  11/01/2019 15:51:02  HTTP/server.example.com@EXAMPLE.COM
   10/31/2019 15:51:08  11/01/2019 15:51:02  krbtgt/EXAMPLE.COM@EXAMPLE.COM

2. Test the Directory Server and SSSD configuration on every replica by retrieving user information.

   [root@server ~]# ipa user-show admin
     User login: admin
     Last name: Administrator
     Home directory: /home/admin
     Login shell: /bin/bash
     Principal alias: admin@EXAMPLE.COM
     UID: 1965200000
     GID: 1965200000
     Account disabled: False
     Password: True
     Member of groups: admins, trust admins
     Kerberos keys available: True

3. Test the CA server on every CA replica with the ipa cert-show command.

   [root@server ~]# ipa cert-show 1
     Issuing CA: ipa
     Certificate: MIIEgjCCAuqgAwIBAgIjoSIP...
     Subject: CN=Certificate Authority,O=EXAMPLE.COM
     Issuer: CN=Certificate Authority,O=EXAMPLE.COM
     Not Before: Thu Oct 31 19:43:29 2019 UTC
     Not After: Mon Oct 31 19:43:29 2039 UTC
     Serial number: 1
     Serial number (hex): 0x1
     Revoked: False