Hi Alfredo, As Peter says, use ipa-backup. I suggest running it twice a day, but that depends on how many changes you make in FreeIPA. Then, get your backup software to backup /var/lib/ipa/backup some time after you've run ipa-backup. Or, get your backup software to run ipa-backup for you and then back up the destination folder. It's always easier to restore a system from a full backup, but it takes time and demands many full backups which are large in size, demands a lot of storage and stresses your network. I'd run a full backup of the FreeIPA server weekly and incrementals twice a day, all of them right after running ipa-backup. HTH /tony On 13/06/18 10:07, Alfredo De Luca via FreeIPA-users wrote: > thanks Peter. > I know that having only one server it's not good thats' why for now I just want to implement a backup/restore process then one/multiple replicas. > > About a retore... is it better to restore from a full backup rather than only data backup? > > > Cheers > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... > -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316 _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...

Hi Tony et all. AFAIK if I perform a full backup, and one day I need to restore it , I can but only on the same machine/FQDN... is that right? So if I destroy the IPA server then create a new one with the same FQDN and options as the first time then I restore it should be fine?

Cheers Alfredo On Wed, Jun 13, 2018 at 5:49 PM Alfredo De Luca <alfredo.deluca(a)gmail.com <mailto:alfredo.deluca@gmail.com>> wrote: Thanks Tony. Appreciated.  I will soon do that. Cheers On Wed, Jun 13, 2018 at 11:10 AM Tony Brian Albers via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> wrote: Hi Alfredo, As Peter says, use ipa-backup. I suggest running it twice a day, but that depends on how many changes you make in FreeIPA. Then, get your backup software to backup /var/lib/ipa/backup some time after you've run ipa-backup. Or, get your backup software to run ipa-backup for you and then back up the destination folder. It's always easier to restore a system from a full backup, but it takes time and demands many full backups which are large in size, demands a lot of storage and stresses your network. I'd run a full backup of the FreeIPA server weekly and incrementals twice a day, all of them right after running ipa-backup. HTH /tony On 13/06/18 10:07, Alfredo De Luca via FreeIPA-users wrote: > thanks Peter. > I know that having only one server it's not good thats' why for now I just want to implement a backup/restore  process then one/multiple replicas. > > About a retore... is it better to restore from a full backup rather than only data backup? > > > Cheers > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... > -- Tony Albers Systems administrator, IT-development Royal Danish Library, Victor Albecks Vej 1, 8000 Aarhus C, Denmark. Tel: +45 2566 2383 / +45 8946 2316 _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... -- /Alfredo/ -- /Alfredo/ _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...

On Jun 11, 2018, at 9:10 AM, Alfredo De Luca via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; wrote: Hi all. What's the best procedure/practice to periodically perform a backup on a single freeipa server with CA? Cheers -- Alfredo _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...

On Jun 23, 2018, at 11:28:37 AM, Alfredo De Luca <alfredo.deluca(a)gmail.com&gt; wrote: Thanks Charles. Out IPA is a VM too on Openstack but for some reasons they said it's not good to take snapshots and rely on that for backups... I ll investigate further tho... cause my idea was exactly that. Snapshots!!!! Thanks for sharing. On Fri, Jun 22, 2018 at 4:34 PM Charles Hedrick <hedrick(a)cs.rutgers.edu <mailto:hedrick@cs.rutgers.edu>> wrote: Our IPA servers are VMs. We do backups of snapshots, either through VMware or when the image is on a Netapp, through a Netapp snapshot. That guarantees that you have all the pieces in a consistent state. I’ve never had to restore a production server, but I have started copies of one of the backups to do experiments that I didn’t want to do on a production system. I’ve never had an issue starting from a backup, though I need to do some changes so the system thinks it has the same hostname as the original one. > On Jun 11, 2018, at 9:10 AM, Alfredo De Luca via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > > Hi all. > What's the best procedure/practice to periodically perform a backup on a single freeipa server with CA? > > Cheers > > -- > Alfredo > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html <https://getfedora.org/code-of-conduct.html> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> > List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... <https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... -- Alfredo

On Jun 25, 2018, at 11:31 AM, Alfredo De Luca <alfredo.deluca(a)gmail.com&gt; wrote: ​Hi Hedrick. Jus a quick one. If i want to restore a full backup IPA in a different host (just for test purpose) can I change the IP address but have the same hostname/FQDN? Alfredo ​ On Sat, Jun 23, 2018 at 5:54 PM <hedrick(a)rutgers.edu <mailto:hedrick@rutgers.edu>> wrote: There is actually documentation supporting my view: https://www.freeipa.org/page/Backup_and_Restore <https://www.freeipa.org/page/Backup_and_Restore> Look particularly at the section "Why snapshot and not backup and restore scripts?" The difference is that they suggest stopping a replica before making a snapshot, while we snapshot a running system. I’ve done this with a variety of databases and other applications. My claim is that a point in time snapshot should be safe for any software that is designed to survive a crash, because a point in time snapshot is no harder to recover from than a crash. We have multiple snapshots, in case we can’t use one of them. But I’ve never seen that happen. We always run complex software systems such a ipa in a VM. > On Jun 23, 2018, at 11:28:37 AM, Alfredo De Luca <alfredo.deluca(a)gmail.com <mailto:alfredo.deluca@gmail.com>> wrote: > > Thanks Charles. Out IPA is a VM too on Openstack but for some reasons they said it's not good to take snapshots and rely on that for backups... I ll investigate further tho... cause my idea was exactly that. Snapshots!!!! > > > Thanks for sharing. > > On Fri, Jun 22, 2018 at 4:34 PM Charles Hedrick <hedrick(a)cs.rutgers.edu <mailto:hedrick@cs.rutgers.edu>> wrote: > Our IPA servers are VMs. We do backups of snapshots, either through VMware or when the image is on a Netapp, through a Netapp snapshot. That guarantees that you have all the pieces in a consistent state. I’ve never had to restore a production server, but I have started copies of one of the backups to do experiments that I didn’t want to do on a production system. I’ve never had an issue starting from a backup, though I need to do some changes so the system thinks it has the same hostname as the original one. > >> On Jun 11, 2018, at 9:10 AM, Alfredo De Luca via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> wrote: >> >> Hi all. >> What's the best procedure/practice to periodically perform a backup on a single freeipa server with CA? >> >> Cheers >> >> -- >> Alfredo >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> >> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html <https://getfedora.org/code-of-conduct.html> >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >> List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... <https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... > > > > -- > Alfredo > -- Alfredo

On Jun 25, 2018, at 2:19:16 PM, Alfredo De Luca via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; wrote: ok thanks. but can I have a different IP address but same hostname? this is to check if everything works /Alfredo On Mon, 25 Jun 2018, 18:24 , <hedrick(a)rutgers.edu <mailto:hedrick@rutgers.edu>> wrote: Yes. Edit /etc/hosts and add your IP address and hostname. Edit /etc/hostname to put your hostname. That works for me. You should probably make sure that you have iptables on the production systems to reject connections from the ip address of your copy. Otherwise you run the danger of having an out of date copy giving you out of date data. > On Jun 25, 2018, at 11:31 AM, Alfredo De Luca <alfredo.deluca(a)gmail.com <mailto:alfredo.deluca@gmail.com>> wrote: > > ​Hi Hedrick. > Jus a quick one. If i want to restore a full backup IPA in a different host (just for test purpose) can I change the IP address but have the same hostname/FQDN? > > Alfredo > ​ > > On Sat, Jun 23, 2018 at 5:54 PM <hedrick(a)rutgers.edu <mailto:hedrick@rutgers.edu>> wrote: > There is actually documentation supporting my view: https://www.freeipa.org/page/Backup_and_Restore <https://www.freeipa.org/page/Backup_and_Restore> Look particularly at the section "Why snapshot and not backup and restore scripts?" > > The difference is that they suggest stopping a replica before making a snapshot, while we snapshot a running system. I’ve done this with a variety of databases and other applications. My claim is that a point in time snapshot should be safe for any software that is designed to survive a crash, because a point in time snapshot is no harder to recover from than a crash. We have multiple snapshots, in case we can’t use one of them. But I’ve never seen that happen. > > We always run complex software systems such a ipa in a VM. > >> On Jun 23, 2018, at 11:28:37 AM, Alfredo De Luca <alfredo.deluca(a)gmail.com <mailto:alfredo.deluca@gmail.com>> wrote: >> >> Thanks Charles. Out IPA is a VM too on Openstack but for some reasons they said it's not good to take snapshots and rely on that for backups... I ll investigate further tho... cause my idea was exactly that. Snapshots!!!! >> >> >> Thanks for sharing. >> >> On Fri, Jun 22, 2018 at 4:34 PM Charles Hedrick <hedrick(a)cs.rutgers.edu <mailto:hedrick@cs.rutgers.edu>> wrote: >> Our IPA servers are VMs. We do backups of snapshots, either through VMware or when the image is on a Netapp, through a Netapp snapshot. That guarantees that you have all the pieces in a consistent state. I’ve never had to restore a production server, but I have started copies of one of the backups to do experiments that I didn’t want to do on a production system. I’ve never had an issue starting from a backup, though I need to do some changes so the system thinks it has the same hostname as the original one. >> >>> On Jun 11, 2018, at 9:10 AM, Alfredo De Luca via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> wrote: >>> >>> Hi all. >>> What's the best procedure/practice to periodically perform a backup on a single freeipa server with CA? >>> >>> Cheers >>> >>> -- >>> Alfredo >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> >>> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html <https://getfedora.org/code-of-conduct.html> >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >>> List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... <https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah... >> >> >> >> -- >> Alfredo >> > > > > -- > Alfredo > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...