when I start service `named-pkcs11.service` on replica server I get these error messages:
Dez 29 17:33:28 ipa-replica.example.com named-pkcs11: Failed to get initial credentials (TGT) using principal 'DNS/ipa-replica.example.com' and keytab 'FILE:/etc/named.keytab' (Generic error (see e-text))
Dez 29 17:34:04 ipa-replica.example.com ipa-dnskeysyncd: ipa-dnskeysyncd: CRITICAL Kerberos authentication failed: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): Generic error (see e-text)
Dez 29 17:34:04 ipa-replica.example.com systemd: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE
The service is starting successfully though.
The full log is available here: http://freetexthost.com/e53jnsslf1
What's causing this error?
For some reason on one of our 3 servers, yum update didn’t run the IPA upgrade. /var/log/ipaupgrade.log was zero length. “ipactl start” noted that an upgraded was needed, and did it. So it wasn’t a big deal. But it would be nice for yum update to show some sign if there’s an issue. And perhaps output a message saying that the upgrade was done successfully.
I have completed setup of FreeIPA on 2 nodes: master + replica
Both servers are configured in network 192.168.100.0/24.
For both nodes I have defined a DNS forwarder to 192.168.1.101; this is my main DNS server running Pi-hole (Linux network-level advertisement and internet tracker blocking application).
Now I try to add a Linux client with this IP 192.168.1.47 in the WebUI and I get this error message:
The host was added but the DNS update failed with: DNS reverse zone 168.192.in-addr.arpa. for IP address 192.168.1.47 is not managed by this server
How can I solve this issue w/o shutting down Pi-hole?
Is the concept of using Pi-hole as a DNS forwarder suboptimal?