Trouble setting up OD Replica

Make sure you are using the right root password, and the right diradmin or whatever the username is for your OD

The only thing is if SSH is setup and working is to check the firewall on both systems. Other then that check the hostname and DNS for both systems. Forward and reverse looks ups. You using the FQDN or the ip when setting up the replica?

Hi

+"I'm in an AD integrated environment"+

If this is a 'classic' AD-OD Integrated environment I'm guessing this means Kerberos is stopped on the OD Master? I can't see how you can set up a Replica when it can't read the information it needs for the Realm? This is because the Realm is not with your OD it's with the AD.

You would not use the same hostnames for Replicas and Masters. That would be confusing and could potentially cause problems.

It does not matter where DNS is. As long as it's somewhere on the same network and configured and working correctly on both pointers is all that's required

It should not matter what architecture the servers are. As long as they are exactly the same version is all that's required along with ssh and a fully functioning Kerberos Realm that the OD Master is the KDC of. And of course fully working DNS. If any of these four things are not quite right things will struggle.

Tony

Hi

+"So you can't use replicas when you're in a 'golden triangle' situation? Is that true?"+

I'm not saying this. Successful Replica Promotion will stall or struggle if the the Replicated Server is not an OD Master. According to the documentation an OD Master means a fully functioning LDAP Database, Password Service and Kerberos. Just as in the other requirements (I forgot to mention time synchronization) if either of those three initial things are not happening then I can't see how successful Replica Promotion can take place?

+"I wasn't able to find any information stating that this wasn't possible in the server documentation"+

It all depends on how you look at it? I see the documentation stating what is possible. Open Directory Admin Manual 3rd Edition page 60 onwards.

+"If this is so, how do institutions that need AD integration deal with server redundancy issues?"+

Hardware redundancy can be easily achieved depending on budget. Mirrored Drives, UPS etc. I have not personally tried this but have you tried simply binding/joining the second server to the shared directories? It should be able to read both nodes OK either simultaneously or separately. If the Master fails simply promote the second server accordingly. Export Groups/Computer Lists from the LDAP node once these have been configured. These can be easily re-imported elsewhere. MCX Settings should be retained using this method.

However the above could have nothing to do with the problem you're seeing? Your initial post shows log entries for sshd. Double-check and make sure you've not changed this in any way or if you've applied a SACL for ssh.

Tony

Hi

+"So are you saying I should set up the secondary server to be "connected to a Directory System?"+

You could do this if you wanted to?

I have not tried this but you could treat the secondary server the same as the first? Yes I mean bind to AD, Promote to OD Master (no kerberos) and replicate what's on the first master manually. Just don't enable anything. If the first Master dies simply enable what you need. Join mac clients to both servers making sure the secondary server is the last in the list.

You could forget the AD completely to begin with and build the OD Master/Replica pair normally. Once you're happy you could use sso_util destroy (man sso_util) from the command line to remove Kerberos on both. Bind them both to your DC afterward. I really have no idea whether this will work as all the AD-OD integrations I've done (and I've done hundreds) have never required or needed a secondary mac server.

+". . . what is the best way to use the second server?"+

Good question. Apart from enforcing Mac-style GPOs what else is the other server doing/providing? If there are not more than a handful of services then perhaps you have a redundant server on your hands doing nothing. Unless you can think of another use for it?

I'm not telling you what to do but IMHO it really is not safe to make assumptions regarding not only Servers etc but pretty much anything else. Just some friendly advice that's all.

Tony