Skip to content

Commit

Permalink
deploy: b5be22e
Browse files Browse the repository at this point in the history
  • Loading branch information
jeffclay committed Jan 30, 2024
1 parent c4b9885 commit 746113a
Show file tree
Hide file tree
Showing 19 changed files with 58 additions and 424 deletions.
4 changes: 0 additions & 4 deletions pull/37/_sources/page/22222222222222222222.rst

This file was deleted.

7 changes: 4 additions & 3 deletions pull/37/_sources/page/DNS.rst
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,8 @@ Assumptions
- Single-master DNS is error prone, especially for inexperienced
admins.

Goals

Goals `Category:Goals`_.
----------------------------------------------------------------------------------------------

- Provide an integrated DNS server which can be used to ease FreeIPA
Expand Down Expand Up @@ -161,7 +162,7 @@ can be consulted if there are any errors logged by BIND.

If the error is more subtle, BIND configuration (*/etc/named.conf*) can
be updated to produce a more detailed log. Standard `BIND
documentation <ftp://ftp.isc.org/isc/bind/cur/9.9/doc/arm/Bv9ARM.ch06.html#id2575001>`__
documentation <https://bind9.readthedocs.io/en/v9.18.18/reference.html#configuration-file-named-conf>`__
can be consulted for help.

Most common problems are caused by mis-configuration. Please see
Expand All @@ -188,4 +189,4 @@ Additional Documentation
- `Maintainability analysis affecting the design
goals <https://fedorahosted.org/bind-dyndb-ldap/wiki/Maintainability>`__

`Category:Goals <Category:Goals>`__
:ref:`Category:Goals <Category:Goals>`__
4 changes: 2 additions & 2 deletions pull/37/_sources/page/Howto/DNSSEC.rst
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ Create signed root zone
----------------------------------------------------------------------------------------------

How to create the root zone is explained in article `DNS in isolated
networks <Howto/DNS_in_isolated_networks>`__. Please note that update of
networks <DNS_in_isolated_networks>`__. Please note that update of
root hints will be required on all recursive clients as noted in the
linked article.

Expand Down Expand Up @@ -409,4 +409,4 @@ Check if DNSSEC signing still works
here <Troubleshooting#DNS_keys_are_not_generated_by_OpenDNSSEC>`__).
- test DNSSEC signatures of current zones using ``dig +dnssec``
- try to add new test zone with enabled DNSSEC signing and test if it
works
works
5 changes: 2 additions & 3 deletions pull/37/_sources/page/Howto/DNS_in_isolated_networks.rst
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,6 @@ DNSSEC

Details how to use DNSSEC in isolated networks are described in article
`DNSSEC in isolated
networks <Howto/DNSSEC#DNSSEC_in_isolated_networks>`__.
networks <DNSSEC#DNSSEC_in_isolated_networks>`__.

`Category:How to <Category:How_to>`__ `Category:Draft
documentation <Category:Draft_documentation>`__
`Category:How to <https://www.freeipa.org/page/HowTos>`__ `Category:Draft documentation <Category:Draft_documentation>`__
2 changes: 1 addition & 1 deletion pull/37/_sources/page/Howto/Dogtag9ToDogtag10Migration.rst
Original file line number Diff line number Diff line change
Expand Up @@ -48,4 +48,4 @@ Baseline of the procedure:
#. Apply for all affected systems

Detailed instructions can be found in `article dedicated to
migration <Howto/Migration#Migrating_to_different_platform_or_OS>`__.
migration <Migration#Migrating_to_different_platform_or_OS>`__.
32 changes: 15 additions & 17 deletions pull/37/_sources/page/Howto/Migration.rst
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,8 @@ Users and groups can be migrated using the ``migrate-ds`` command, just
like with any other LDAP based identity management server. You just need
to make sure that FreeIPA Kerberos related attributes are not migrated
as they need to be generated again by the new FreeIPA server and it's
new `Kerberos <Kerberos>`__ settings or keys. The command doesn't
migrate user private groups. Following command is suggested:
new `Kerberos <https://www.freeipa.org/page/Kerberos>`__ settings or keys.
The command doesn't migrate user private groups. Following command is suggested:

::

Expand Down Expand Up @@ -77,8 +77,7 @@ General procedure
upgrade procedure goes wrong in any way, other FreeIPA server can
keep the functionality until the upgrade process is successfully
finished. If there is just one FreeIPA server, consider `preparing a
new
replica <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/Setting_up_IPA_Replicas.html>`__
new replica <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/app.replica>`__
used for the upgrade.
#. When ready, simply upgrade the underlying operating system and
FreeIPA packages on chosen replica. After the upgrade, it may be
Expand All @@ -100,11 +99,11 @@ General procedure
``$ ipa user-find``

- Web UI works
- `DNS <DNS>`__ service (if provided by the server) works
- `DNS <https://www.freeipa.org/page/DNS>`__ service (if provided by the server) works

``$ host $(hostname)``

- `CA <PKI>`__ services (if appropriate) works
- `CA <https://www.freeipa.org/page/PKI>`__ services (if appropriate) works

``$ ipa cert-find``
``$ ipa cert-request $(CSR_FILENAME)``
Expand All @@ -130,13 +129,13 @@ applied:
system (``ipa-replica-install``). It should have all the services as
the original server had, i.e.

- if original server had `CA <PKI>`__ installed (it probably did),
- if original server had `CA <https://www.freeipa.org/page/PKI>`__ installed (it probably did),
add ``--setup-ca`` option to ``ipa-replica-install``
- Note that the FreeIPA master `CA <PKI>`__ server (this is by
- Note that the FreeIPA master `CA <https://www.freeipa.org/page/PKI>`__ server (this is by
default the first installed FreeIPA server) is being migrated, you
need to `promote the new CA replica to the FreeIPA master CA
server <Howto/Promote_CA_to_Renewal_and_CRL_Master>`__
- if original server had `DNS <DNS>`__ installed , also add
server <https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master>`__
- if original server had `DNS <https://www.freeipa.org/page/DNS>`__ installed , also add
``--setup-dns`` option to ``ipa-replica-install``

The new server should now have all the capability of the migrated
Expand All @@ -157,19 +156,19 @@ applied:
``$ ipa user-find``

- Web UI works
- `DNS <DNS>`__ service (if provided by the server) works
- `DNS <https://www.freeipa.org/page/DNS>`__ service (if provided by the server) works

``$ host $(hostname)``

- `CA <PKI>`__ services (if appropriate) works
- `CA <https://www.freeipa.org/page/PKI>`__ services (if appropriate) works

``$ ipa cert-find``
``$ ipa cert-request $(CSR_FILENAME)``

#. If the FreeIPA server is configured to provide `DNS <DNS>`__ service,
#. If the FreeIPA server is configured to provide `DNS <https://www.freeipa.org/page/DNS>`__ service,
FreeIPA domain SRV records should be already updated and FreeIPA
clients will also use the migrated FreeIPA server for their function.
When other `DNS <DNS>`__ service is used, SRV records need to be
When other `DNS <https://www.freeipa.org/page/DNS>`__ service is used, SRV records need to be
either updated manually, if used. If clients are using fixed list of
servers, administrator would need to update these lists in
``/etc/sssd/sssd.conf`` and ``/etc/krb5.conf`` and other
Expand Down Expand Up @@ -204,7 +203,7 @@ applied:
``ipa-replica-manage del old.ipa.server.fqdn``

This procedure will also remove these servers from FreeIPA
`DNS <DNS>`__ SRV records, if used.
`DNS <https://www.freeipa.org/page/DNS>`__ SRV records, if used.

#. Old FreeIPA servers can be now uninstalled with
``ipa-server-install --uninstall``
Expand All @@ -217,5 +216,4 @@ Migrating Identity Management in RHEL/CentOS
If you are using FreeIPA/Identity Management in RHEL or CentOS, please
refer to downstream guide for migration process:

- `Migrating the IdM Server to Red Hat Enterprise Linux
7 <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/upgrading.html#migrating-ipa-proc>`__
- `Migrating the IdM Server to Red Hat Enterprise Linux 8 <https://access.redhat.com/documentation/es-es/red_hat_enterprise_linux/8/html/migrating_to_identity_management_on_rhel_8/migrate-7-to-8_migrating>`__
4 changes: 2 additions & 2 deletions pull/37/_sources/page/Troubleshooting/DNS.rst
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ DNSSEC signing does not work
============================

Related information how to use DNSSEC with FreeIPA can be found in
`DNSSEC howto <Howto/DNSSEC>`__.
`DNSSEC howto <DNSSEC>`__.



Expand Down Expand Up @@ -279,4 +279,4 @@ below. Please ignore other values printed by ``localhsm`` command.
zone private keys
=================
623d723...
{'ipk11label': u'623d723...', 'ipk11sign': True, 'ipk11extractable': True, ...}
{'ipk11label': u'623d723...', 'ipk11sign': True, 'ipk11extractable': True, ...}
4 changes: 2 additions & 2 deletions pull/37/_sources/page/V4/DNSSEC_Support.rst
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ All required steps are:
- verify DNSSEC chain of trust
(``drill -TD example.com. -k /etc/trusted-key.key``)

More information can be found here: `Howto/DNSSEC <Howto/DNSSEC>`__.
More information can be found here: `Howto/DNSSEC <DNSSEC>`__.

Troubleshooting: `DNSSEC signing does not
work <Troubleshooting#DNSSEC_signing_does_not_work>`__.
Expand Down Expand Up @@ -655,4 +655,4 @@ RFE Author

Martin Basti <[email protected]>

Petr Spacek <[email protected]>
Petr Spacek <[email protected]>
3 changes: 1 addition & 2 deletions pull/37/archive.html
Original file line number Diff line number Diff line change
Expand Up @@ -7197,7 +7197,6 @@ <h1>Archive<a class="headerlink" href="#archive" title="Link to this heading">#<
<li class="toctree-l2"><a class="reference internal" href="page/Web_App_Authentication/Namespace_separation.html#multiple-freeipa-servers">Multiple FreeIPA servers</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="page/22222222222222222222.html">22222222222222222222</a></li>
<li class="toctree-l1"><a class="reference internal" href="page/API.html">API</a></li>
<li class="toctree-l1"><a class="reference internal" href="page/API.html#ipa-xml-rpc-api">IPA XML-RPC API</a></li>
<li class="toctree-l1"><a class="reference internal" href="page/API_Examples.html">API_Examples</a></li>
Expand Down Expand Up @@ -8548,7 +8547,7 @@ <h1>Archive<a class="headerlink" href="#archive" title="Link to this heading">#<
<li class="toctree-l1"><a class="reference internal" href="page/DNS.html">DNS</a><ul>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#initial-considerations">Initial Considerations</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#assumptions">Assumptions</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#goals">Goals</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#goals-category-goals">Goals `Category:Goals`_.</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#benefits-of-integrated-dns">Benefits of integrated DNS</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#caveats">Caveats</a></li>
<li class="toctree-l2"><a class="reference internal" href="page/DNS.html#internal-only-domains">Internal-only domains</a></li>
Expand Down
Binary file modified pull/37/objects.inv
Binary file not shown.
Loading

0 comments on commit 746113a

Please sign in to comment.