ipa-migrate(1)

✨ ipa-migrate(1) ✨

okay so bestie, we're reading the ipa-migrate page from the IPA Manual Pages, and it's literally about moving a whole IPA server from one machine to another. no cap, this is main character energy for sysadmins 💅

🌸 NAME 🌸

ipa-migrate — migrate an IPA server from one machine to another 🦋

🎀 SYNOPSIS 🎀

ipa-migrate [OPTIONS] prod-mode|stage-mode hostname

💖 DESCRIPTION 💖

so the whole vibe of ipa-migrate is: you take one IPA server hostname and you migrate it into an existing local IPA server installation. that's the assignment. periodt.

you're migrating the IPA schema, configuration, and database over to a local IPA server. and here's the cute part — this migration can be done online, where the tool just goes and queries the remote server, or offline, where you hand it LDIF files. and you can mix and match those two!! so like, imagine migrating the schema and configuration online, and then using an exported LDIF file just for the database migration portion. that's lowkey super useful for very large databases, because then you don't need to worry about network interruptions 💀✨

• prod-mode — in this mode, everything gets migrated, including the current user SIDs and DNA ranges. full send. 👑
• stage-mode — in this mode, SIDs & DNA ranges are not migrated, and DNA attributes are reset. it's giving "rehearsal, not the real show" 🎭

✨ OPTIONS ✨

• -v, --verbose — use verbose output while running the migration tool. she talks a lot. we love her for it 🗣️
• -D, --bind-dn=BIND_DN — the Bind DN (Distinguished Name), i.e. an LDAP entry, to bind to the remote IPA server with. typically this is "cn=directory manager", but honestly it could be any entry that has access to read the userPassword attribute. if it's ommitted, the default is "cn=directory manager" 🔑
• -w, --bind-pw=PASSWORD — the password for the Bind DN that's authenticating against the remote IPA server. if a password is not provided, then the tool will prompt for the password if needed 🫶
• -j, --bind-pw-file=FILE_PATH — path to a file containing the password for the Bind DN 📄
• -Z, --cacertfile=FILE_PATH — path to a file containing a CA Certificate that the remote server trusts 🔒
• -l, --log-file=FILE_PATH — path to a file containing the migration log. by default the tool will use /var/log/ipa-migrate.log 📝
• -x, --dryrun — go through the whole migration process but do not write any data to the new IPA server. purely a vibe check 🧚
• -o, --dryrun-record=FILE_PATH — go through the migration process but do not write any data to the new IPA server. however, write the migration operations to an LDIF file, which can be applied later or reused for multiple migrations. iconic reuse behaviour ♻️
• -r, --reset-range — reset the ID range for migrated users/groups. in "stage-mode" this is done automatically 🎯
• -F, --force — ignore any errors and continue to proceed with the migration effort. chaotic. use with care 😭
• -q, --quiet — only log errors during the migration process 🤫
• -B, --migrate-dns — migrate the DNS records 🌐
• -S, --skip-schema — do not migrate the database schema 🙈
• -C, --skip-config — do not migrate the database configuration (dse.ldif/cn=config) 🙈
• -O, --schema-overwrite — overwrite existing schema definitions. by default, duplicate schema is skipped ✨
• -s, --subtree=DN — specifies a custom database subtree that should be included in the migration. this is only needed if non-default subtrees/branches were added to the database outside of IPA 🌳
• -f, --db-ldif=FILE_PATH — LDIF file containing the entire backend. if omitted, the tool will query the remote IPA server 💾
• -m, --schema-ldif=FILE_PATH — LDIF file containing the schema. if omitted, the tool will query the remote IPA server 💾
• -g, --config-ldif=FILE_PATH — LDIF file containing the entire "cn=config" DIT. if omitted, the tool will query the remote IPA server 💾
• -n, --no-prompt — do not prompt for confirmation before starting migration. > use at your own risk! ⚠️

🌈 POST MIGRATION 🌈

okay bestie, here's what you're left with after the migration, and it's a lot, so read carefully 👇

• the server is left in migration-mode so that the migrated users can more easily reset their passwords, either by authenticating via SSSD or by using the web-based password migration page. this authentication will generate new Kerberos keys. after passwords are reset, the server should be taken out of migration mode 🔑
• all hosts are preserved, but they will need to be re-enrolled using ipa-client-install (e.g. ipa-client-install --uninstall && ipa-client-install) 🔁
• all certificates should be re-issued against the new CA 📜
• any manually created keytabs will need to be re-created using ipa-getkeytab 🎫
• Vaults are not migrated and will have to be re-created 🔐
• Sub CA's are not migrated and will have to be re-created 🏛️

⭐ EXIT STATUS ⭐

1. 0 — if the command was successful 🎉
2. 1 — if an error occurred 😭
3. 2 — if the local host or remote host is not an IPA server, the IPA server installation is faulty, or the realm can not be determined 💀

and that's the whole page, bestie!! 🫶 this one's from the IPA manual set, dated Apr 2 2024 — go forth and migrate responsibly, mwah 💅✨🎀