1ipa-restore(1) IPA Manual Pages ipa-restore(1)
2
6 ipa-restore - Restore an IPA master
7
9 ipa-restore [OPTION]... BACKUP
10
12 Only the name of the backup needs to be passed in, not the full path.
13 Backups are stored in a subdirectory in /var/lib/ipa/backup. If a
14 backup is in another location then the full path must be provided.
15 The naming convention for full backups is ipa-full-YEAR-MM-DD-HH-MM-SS
17 in the GMT time zone.
18 The naming convention for data backups is ipa-data-YEAR-MM-DD-HH-MM-SS
20 In the GMT time zone.
21 The type of backup is automatically detected. A data restore can be
23 done from either type.
24 WARNING: A full restore will restore files like /etc/passwd,
26 /etc/group, /etc/resolv.conf as well. Any file that IPA may have
27 touched is backed up and restored.
28 An encrypted backup is also automatically detected and the root keyring
30 is used by default. The --keyring option can be used to define the full
31 path to the private and public keys.
32 Within the subdirectory is file, header, that describes the back up
34 including the type, system, date of backup, the version of IPA, the
35 version of the backup and the services on the master.
36 A backup can not be restored on another host.
38 A backup can not be restored in a different version of IPA.
40 Restoring from backup sets the server as the new data master. All other
42 masters will need to be re-initialized. The first step in restoring a
43 backup is to disable replication on all the other masters. This is to
44 prevent the changelog from overwriting the data in the backup.
45 Use the ipa-replica-manage and ipa-csreplica-manage commands to re-ini‐
47 tialize other masters. ipa-csreplica-manage only needs to be executed
48 on masters that have a CA installed.
49
51 The restoration on other masters needs to be done carefully, to match
52 the replication topology, working outward from the restored master. For
53 example, if your topology is A <-> B <-> C and you restored master A
54 you would restore B first, then C.
55 Replication is disabled on all masters that are available when a
57 restoration is done. If a master is down at the time of the restoration
58 you will need to proceed with extreme caution. If this master is
59 brought back up after the restoration is complete it may send out
60 replication updates that apply the very changes you were trying to back
61 out. The only safe answer is to reinstall the master. This would
62 involve deleting all replication agreements to the master. This could
63 have a cascading effect if the master is a hub to other masters. They
64 would need to be connected to other masters before removing the downed
65 master.
66 If the restore point is from a period prior to a replication agreement
68 then the master will need to be re-installed. For example, you have
69 masters A and B and you create a backup. You then add master C from B.
70 Then you restore from the backup. The restored data is going to lose
71 the replication agreement to C. The master on C will have a replication
72 agreement pointing to B, but B won't have the reverse agreement. Master
73 C won't be registered as an IPA master. It may be possible to manually
74 correct these and re-connect C to B but it would be very prone to
75 error.
76 If re-initializing on an IPA master version prior to 3.2 then the
78 replication agreements will need to be manually re-enabled otherwise
79 the re-initialization will never complete. To manually enable an agree‐
80 ment use ldapsearch to find the agreement name in cn=mapping
81 tree,cn=config. The value of nsds5ReplicaEnabled needs to be on, and
82 enabled on both sides. Remember that CA replication is done through a
83 separate agreement and will need to be updated separately.
84 If you have older masters you should consider re-creating them rather
86 than trying to re-initialize them.
87
89 -p, --password=PASSWORD
90 The Directory Manager password.
91 --data Restore the data only. The default is to restore everything in
93 the backup.
94 --gpg-keyring=GPG_KEYRING
96 The full path to a GPG keyring. The keyring consists of two
97 files, a public and a private key (.sec and .pub respectively).
98 Specify the path without an extension.
99 --no-logs
101 Exclude the IPA service log files in the backup (if they were
102 backed up).
103 --online
105 Perform the restore on-line. Requires data-only backup or the
106 --data option.
107 --instance=INSTANCE
109 Restore only the databases in this 389-ds instance. The default
110 is to restore all found (at most this is the IPA REALM instance
111 and the PKI-IPA instance). Requires data-only backup or the
112 --data option.
113 --backend=BACKEND
115 The backend to restore within an instance or instances. Requires
116 data-only backup or the --data option.
117 --v, --verbose
119 Print debugging information
120 -d, --debug
122 Alias for --verbose
123 -q, --quiet
125 Output only errors
126 --log-file=FILE
128 Log to the given file
129
131 0 if the command was successful
132 1 if an error occurred
134
136 /var/lib/ipa/backup
137 The default directory for storing backup files.
138 /var/log/iparestore.log
140 The log file for restoration
141
143 ipa-backup(1).
144IPA Mar 22 2013 ipa-restore(1)