Migration to GLOBAL

Title

Status

Due

Scheduled

Context

Project

View Mission PIN code - Migration to GLOBAL project

Category

Notes Saved

credentials

root
R4d1uS\_P4ss

BSC\_ASU
MySQLP@55

radius
Appl1cation\_P4ss

replusr
Sl4ve\_P4ss

mysql -u root -pR4d1uS\_P4ss -e "SELECT VERSION(); SHOW DATABASES;"

<br>
\-\-\-

Server list
telrd-p-app-01.global.un.org
telrd-p-db-01.global.un.org
telrd-r-app-01.global.un.org
telrd-r-db-01.global.un.org
telrd-r-wtns-01.global.un.org
telrd-e-app-01.global.un.org
telrd-e-db-01.global.un.org

Radius firewall rules requested through RFS-1-12997535167

<br>
* [ ] Knowledge handover and PRE installation
    * [ ] Prepare doc
    * [ ] Share with Zvonco
    * [ ] Install PRE
* [ ] Cutover prep
    * [ ] Process decission
    * [ ] Parallel
        * [ ] confirm fw rules with Carmine
        * [ ] Confirm BDR backup config with R. Zizzi
        * [ ] Create cutover doc
        * [ ] Transfer initial load
* [ ] Cutover execution
    * [ ] Open change
    * [ ] Transfer delta
    * [ ] ???
* [ ] Frontend config
    * [ ] Ask security
    * [ ] Request fw rules

# Mission PINCode Handover — Pending Tasks

*Last updated: 2026-06-23*

***

## Infrastructure / RADIUS

* **Fix `telrd-r-db-01` `clients.conf`** — apply the same `$INCLUDE missions-clients/` directive fix that was done on `telrd-p-db-01`. Verify the file is correct and test RADIUS auth from `gsctest` against this node.
* **Fix firewall rule submission** *(done)* — reversed source/destination for UDP 1812/1813 and TCP 3306 corrected and resubmitted.
* **Clean up `gsctest` client definition** — clients are currently defined inline in `missions/gsctest.conf` rather than a dedicated `missions-clients/gsctest.conf`, breaking the pattern used by all other missions. Low priority; do before final cutover.

***

## Frontend Migration ⚠️ ON HOLD — pending Fulvio's decision

* Deploy PHP 7.4 (Remi repo) on `telrd-p-app-01` and `telrd-r-app-01`
* Developer fixes for three standalone scripts using removed `mysql_*` extension
* Resolve LDAP auth: `dpko.un.org` → FreeIPA (`idm.un.org`)
* Apache log path update for RHEL 9

***

## Cutover

* **Netscaler cutover configuration** — new frontend hostnames need to be provided to the Netscaler/GSLB team.
* **Notify eBilling team** — eBilling queries `radacct` on `acctauthentic = 'RADIUS'`; team must be informed of the new server addresses before cutover.
* **Schedule maintenance window** — coordinate production cutover window with Mario Sernicola / OICT.
* **Execute cutover delta import** — on cutover day: dump only rows since the original import date (filter by `acctstarttime`), targeting a 15–30 min window. Full import already done during testing.

***

## Documentation & Handover

* **Create installation document** — comprehensive doc covering everything done during the migration (clean install guide for the new support team). *Carlos will give the go-ahead to start.*
* **Prepare handover session script for Zvonco (new RMS team)** — structured walkthrough/script for handover sessions to bring the new support team up to speed.
* **PRE installation run-through** — perform a PRE installation using the installation document once it's ready. *Blocked by: installation document.*

Supports Markdown: bold, italics, code, lists, links. Auto-saves.

AI Notes - managed by Claude

## Migration Journal Summary (v0.10 - 2026-06-09)

### Servers
| Role | New hostname | IP |
|------|-------------|-----|
| Primary | telrad-p-db-01.global.un.org | 10.130.72.21 |
| Secondary | telrad-r-db-01.global.un.org | 10.130.200.11 |

Old servers: dfs-telrad-02.dpko.un.org / dfs-telrad-52.dpko.un.org

### Completed
- Phase 1: FreeRADIUS installed on both new GLOBAL servers
- Phase 2: raddb config migrated from old servers
- Phase 3: MariaDB 10.5 installed, data dir on /data LVM volume, my.cnf configured
- Phase 4: DB dump (~14G) imported on both servers; users recreated from hash replay
- Phase 5: Master-master replication active (both directions clean)
- Phase 6: radiusd -XC passing on both servers (rlm_sql_mysql.so extracted from InkBridge RPM)
- Phase 6b: UNAMI, UNITAD, UNUKR decommissioned - DBs dropped, config files removed

### Open items
- Phase 7: Start radiusd + firewall rules (1812/udp, 1813/udp, 3306/tcp) + SELinux + radtest
- Frontend (PHP): waiting on Fulvio - PHP version incompatibility on new servers
- Confirm new frontend hostnames for Netscaler cutover
- Confirm eBilling team contact + notification process
- Schedule maintenance window + lower DNS TTL 2h before cutover
- Handover to RMS (Zvonco)

### Key learnings
- RHEL 9: /etc/my.cnf.d/mariadb-server.cnf overrides /etc/my.cnf - both must be updated
- Do NOT restore mysql system DB across major MariaDB versions (corrupts system tables)
- freeradius-mysql not in RHEL 9 repos - use rpm2cpio to extract rlm_sql_mysql.so from InkBridge RPM
- Hostname resolution broken between old/new servers and between the two new servers - always use IPs
- Custom RADIUS attributes peer-id (3118) and fac-digits (3119) must be in /etc/raddb/dictionary

📂 Activities for this Item

➕ Add Activity

Open Activities

No open activities.

Closed Activities

Service Requests / Work Orders

RFS-1-12962069407

Service Request

WO-RFS-1-12962069413

iNeed Text

Title

Description

Mission Pin Code - Migration to GLOBAL
Assign to Carlos Rodrigo - AOM DS

Asset#

Defined per context on the Taxonomy page.

Normalized time tracking

Last 30 days

Logged: 0:00 · Normalized: 0:00

No normalized entries for this item yet.

Meeting Notes (Project / Context)

Select a meeting to preview details.

Templates

Change Title

Change Description

Change Steps

Template Notes

Communications

Label

Order

Subject

Email Body

Attachments

No attachments yet.