Chapter 5. Preparing for data loss with IdM backups

• By default, the ipa-backup utility runs in offline mode, which stops all IdM services. The utility automatically restarts IdM services after the backup is finished.
• A full-server backup must always run with IdM services offline, but a data-only backup can be performed with services online.
• By default, the ipa-backup utility creates backups on the file system containing the /var/lib/ipa/backup/ directory. Red Hat recommends creating backups regularly on a file system separate from the production filesystem used by IdM, and archiving the backups to a fixed medium, such as tape or optical storage.

• Consider performing backups on hidden replicas. IdM services can be shut down on hidden replicas without affecting IdM clients.

• Starting with RHEL 8.3.0, the ipa-backup utility checks if all of the services used in your IdM cluster, such as a Certificate Authority (CA), Domain Name System (DNS), and Key Recovery Agent (KRA), are installed on the server where you are running the backup. If the server does not have all these services installed, the ipa-backup utility exits with a warning, because backups taken on that host would not be sufficient for a full cluster restoration.

  For example, if your IdM deployment uses an integrated Certificate Authority (CA), a backup run on a non-CA replica will not capture CA data. Red Hat recommends verifying that the replica where you perform an ipa-backup has all of the IdM services used in the cluster installed.

  You can bypass the IdM server role check with the ipa-backup --disable-role-check command, but the resulting backup will not contain all the data necessary to restore IdM fully.

Prerequisites

• You must have root privileges to run the ipa-backup utility.

Procedure

• To create a full-server backup in offline mode, use the ipa-backup utility without additional options.

  [root@server ~]# ipa-backup
  Preparing backup on server.example.com
  Stopping IPA services
  Backing up ipaca in EXAMPLE-COM to LDIF
  Backing up userRoot in EXAMPLE-COM to LDIF
  Backing up EXAMPLE-COM
  Backing up files
  Starting IPA service
  Backed up to /var/lib/ipa/backup/ipa-full-2020-01-14-11-26-06
  The ipa-backup command was successful

  Copy to Clipboard Toggle word wrap

• To create an offline data-only backup, specify the --data option.

  [root@server ~]# ipa-backup --data

  Copy to Clipboard Toggle word wrap

• To create a full-server backup that includes IdM log files, use the --logs option.

  [root@server ~]# ipa-backup --logs

  Copy to Clipboard Toggle word wrap

• To create a data-only backup while IdM services are running, specify both --data and --online options.

  [root@server ~]# ipa-backup --data --online

  Copy to Clipboard Toggle word wrap

Verification

• Ensure the backup directory contains an archive with the backup.

  [root@server ~]# ls /var/lib/ipa/backup/ipa-full-2020-01-14-11-26-06
  header  ipa-full.tar

  Copy to Clipboard Toggle word wrap

Prerequisites

• You have created a GPG2 key. See Creating a GPG2 key.

Procedure

• Create a GPG-encrypted backup by specifying the --gpg option.

  [root@server ~]# ipa-backup --gpg
  Preparing backup on server.example.com
  Stopping IPA services
  Backing up ipaca in EXAMPLE-COM to LDIF
  Backing up userRoot in EXAMPLE-COM to LDIF
  Backing up EXAMPLE-COM
  Backing up files
  Starting IPA service
  Encrypting /var/lib/ipa/backup/ipa-full-2020-01-13-14-38-00/ipa-full.tar
  Backed up to /var/lib/ipa/backup/ipa-full-2020-01-13-14-38-00
  The ipa-backup command was successful

  Copy to Clipboard Toggle word wrap

Verification

• Ensure that the backup directory contains an encrypted archive with a .gpg file extension.

  [root@server ~]# ls /var/lib/ipa/backup/ipa-full-2020-01-13-14-38-00
  header  ipa-full.tar.gpg

  Copy to Clipboard Toggle word wrap

Prerequisites

• You need root privileges.

Verification

• List the GPG keys on the server.

  [root@server ~]# gpg2 --list-secret-keys
  gpg: checking the trustdb
  gpg: marginals needed: 3  completes needed: 1  trust model: pgp
  gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
  /root/backup/pubring.kbx
  ------------------------
  sec   rsa2048 2020-01-13 [SCEA]
        8F6FCF10C80359D5A05AED67BF28FFA302EF4557
  uid           [ultimate] GPG User (first key) <root@example.com>

  Copy to Clipboard Toggle word wrap