IdM with trust relationship with Samba AD DC - User accounts with passwords expired
by Mateo Duffour
Hi,
We currently have an IdM installation with a trust relationship with a Samba AD DC. Our user accounts reside on Samba AD DC, we dont have user accounts on IdM.
We are having a problem with Samba user acounts that have its passwords expired.
When we try to login with an ubuntu IdM client with one of those accounts, it fails and asks again for password.
The behaviour we are expecting is that Ubuntu should ask for a password change.
Thanks, best regards.
Lic. Mateo Duffour
Unidad Informática
2901.40.91
[ http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
[ http://www.fnr.gub.uy/ | ]
No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede contener información confidencial, privilegiada o de uso restringido, protegida por las normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
1 week
Broken ipa replica
by Giulio Casella
Hi everyone,
I'm stuck with a broken replica. I had a setup with two ipa server in
replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02".
Due to heavy load idc01 crashed many times, and was not working anymore.
So I tried to redo the replica again. At first I tried to
"ipa-replica-manage re-initialize", with no success.
Now I'm trying to redo from scratch the replica setup: on idc02 I
removed the segments (ipa topologysegment-del, for both ca and domain
suffix), on idc01 I removed everything (ipa-server-install --uninstall),
then I joined domain (ipa-client-install), and everything is working so far.
When doing "ipa-replica-install" on idc01 I get:
[...]
[28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 22 seconds elapsed
[ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error
(-11) connection error: Unknown connection error (-11) - Total update
aborted]
And on idc02 (the working server), in
/var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating:
[20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin -
repl5_tot_run - Beginning total update of replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)".
[20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin -
perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed
to send extended operation: LDAP error -1 (Can't contact LDAP server)
[20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain"
(idc01:389): Received error -1 (Can't contact LDAP server): for total
update operation
[20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin -
release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to
send endReplication extended operation (Can't contact LDAP server)
[20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_run - Total update failed for replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11)
[20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389):
Replication bind with GSSAPI auth resumed
[20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin -
repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote
replica has a different database generation ID than the local database.
You may have to reinitialize the remote replica, or the local replica.
It seems that idc02 remembers something about the old replica.
Any hint?
Thank you in advance,
Giulio
2 weeks, 2 days
IPA CA allow CSR SAN names in external domains
by Steve Dainard
Hello
I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be
able to add SAN's for a different dns domain than exists in the IPA realm.
The dns for 'otherdomain.com' is handled by active directory which my IPA
server has a cross-forest trust with.
ie:
host: client1.ipadomain.com
certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com,
servicename.otherdomain.com
When I try to submit this CSR with 'ipa-getcert request' the IPA server
denies with: "The service principal for subject alt name
servicename.otherdomain.com in certificate request does not exist"
It seems that the default CAACL enforces a profile named
'caIPAserviceCert', but I'm having some trouble determining what can be
modified (or cloned and changed in a new profile) that would allow the CA
to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the
SAN.
This is the only section in the profile that contains SAN:
policyset.serverCertSet.12.constraint.class_id=noConstraintImpl
policyset.serverCertSet.12.constraint.name=No Constraint
policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl
policyset.serverCertSet.12.default.name=Copy Common Name to Subject
Alternative Name
Thanks,
Steve
2 months, 1 week
Unable to add a new replica - "adding fallback group" fails
by Ricardo Mendes
Hi there,
I'm unable to add a new replica to the cluster as it fails:
Configuring SID generation
[1/8]: creating samba domain object
Samba domain object already exists
[2/8]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
[3/8]: adding RID bases
RID bases already set, nothing to do
[4/8]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[5/8]: activating sidgen task
[6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[7/8]: adding fallback group
Failed to load default-smb-group.ldif: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
Failed to add fallback group.
[error] CalledProcessError: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
====================
From ipareplica-install.log
====================
adding new entry "cn=Default SMB Group,cn=groups,cn=accounts,dc=dom0,dc=io"
2022-02-04T16:41:54Z DEBUG stderr=ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_add: Operations error (1)
additional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.
2022-02-04T16:41:54Z CRITICAL Failed to load default-smb-group.ldif: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL au
thentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
2022-02-04T16:41:54Z DEBUG Failed to add fallback group.
2022-02-04T16:41:54Z DEBUG Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1087, in error_handler
yield
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1587, in find_entries
raise e
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1547, in find_entries
result = self.conn.result3(id, 0)
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 767, in result3
resp_ctrl_classes=resp_ctrl_classes
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 774, in result4
ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 340, in _ldap_call
reraise(exc_type, exc_value, exc_traceback)
File "/usr/lib64/python3.6/site-packages/ldap/compat.py", line 46, in reraise
raise exc_value
File "/usr/lib64/python3.6/site-packages/ldap/ldapobject.py", line 324, in _ldap_call
result = func(*args,**kwargs)
ldap.NO_SUCH_OBJECT: {'msgtype': 101, 'msgid': 4, 'result': 32, 'desc': 'No such object', 'ctrls': [], 'matched': 'cn=groups,cn=accounts,dc=dom0,dc=io'}
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 327, in __add_fallback_group
api.Backend.ldap2.get_entry(fb_group_dn)
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1941, in get_entry
dn, attrs_list, time_limit, size_limit, get_effective_rights
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1644, in get_entry
size_limit=size_limit, get_effective_rights=get_effective_rights,
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1456, in get_entries
**kwargs)
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1594, in find_entries
break
File "/usr/lib64/python3.6/contextlib.py", line 99, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python3.6/site-packages/ipapython/ipaldap.py", line 1097, in error_handler
raise errors.NotFound(reason=arg_desc or 'no such entry')
ipalib.errors.NotFound: no such entry
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step
method()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 333, in __add_fallback_group
raise e
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 330, in __add_fallback_group
self._ldap_mod('default-smb-group.ldif', self.sub_dict)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 399, in _ldap_mod
ipautil.run(args, nolog=nologlist)
File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 599, in run
p.returncode, arg_string, output_log, error_log
ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
2022-02-04T16:41:54Z DEBUG [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
2022-02-04T16:41:54Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run
return cfgr.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run
return self.execute()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute
for rval in self._executor():
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure
next(executor)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 603, in main
replica_install(self)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated
func(installer)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1371, in install
adtrust.install(False, options, fstore, api)
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrust.py", line 483, in install
smb.create_instance()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 895, in create_instance
self.start_creation(show_service_name=False)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step
method()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 333, in __add_fallback_group
raise e
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 330, in __add_fallback_group
self._ldap_mod('default-smb-group.ldif', self.sub_dict)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 399, in _ldap_mod
ipautil.run(args, nolog=nologlist)
File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 599, in run
p.returncode, arg_string, output_log, error_log
2022-02-04T16:41:54Z DEBUG The ipa-replica-install command failed, exception: CalledProcessError: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
2022-02-04T16:41:54Z ERROR CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpnwzpa12h', '-H', 'ldapi://%2Frun%2Fslapd-DOM0-IO.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-DOM0-IO.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
2022-02-04T16:41:54Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
Before this failed entry, other entries have been added successfully.
Best regards.
Ricardo M.
2 months, 2 weeks
Strange CA error during FreeIPA connection
by Alessandro Minonzio
Hi,
I report this issue about FreeIPA server:
------------------------------------------------------------------------------------------------------------------
Request for enhancement
A strange error is occurring when I try to access my FreeIPA.
Issue
The problem occurs when I try to access the FreeIPA portal.
"The message occurs saying IPA Error 4301: CertificateOperationError"
"Certificate operation cannot be completed: Unable to communicate with CMS
(500)"
in Certificate Authority appear:
"cannot connect to 'https://xyz.xxxxxhq.it:443/ca/rest/account/login':
<https://xyz.xxxxxhq.it/ca/rest/account/login':> [SSL:
SSL_HANDSHAKE_FAILURE] ssl handshake failure (_ssl.c:1826)"
and if I try to connect with KINIT ADMIN command on the console appear this
error:
"kinit: Cannot contact any KDC for realm 'SUBITOHQ.IT' while getting
initial credentials"
Actual behavior
Serverweb and console with kinit admin doesn't work. LDAPADMIN tool too.
Version/Release/Distribution
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.5-11.el7.centos.3.x86_64
ipa-client-4.6.5-11.el7.centos.3.x86_64
389-ds-base-1.3.9.1-12.el7_7.x86_64
pki-ca-10.5.16-5.el7_7.noarch
krb5-server-1.15.1-37.el7_7.2.x86_64
Additional info:
maybe it's a problem with CA but how is the process to solve that issue?
The fact is that this behavior it's on a replica FreeIPA server with CA and
DOMAIN. There is a resolution or a command to solve that?
------------------------------------------------------------------------------------------------------------------
could you help me please?
Best regards,
AM
2 months, 2 weeks
IPA users accessing AD machines
by Cyrus
Hello!,
I'm in a interop puzzle dilemma, hope you can help me out.
Currently all our user accounts are hosted in an Active Directory
environment we don't own (another team handles that for us), acme.tld for
this discussion.
We're in the need to implement:
- FreeIPA to handle our linux machine accounts and process/app users with
ipa.domain.tld
- FreeIPA (same as above or different cluster?) to handle external provider
accounts with ext.domain.tld
- Own AD Controllers to handle our Windows machines with ad.domain.tld
The aim is:
1. Allow acme.tld users to access ipa.domain.tld machines.
2. Allow acme.tld users to access ad.domain.tld machines
3. Allow ext.domain.tld users to access ipa.domain.tld machines
4. Allow ext.domain.tld users to access ad.domain.tld machines
1 seems to be solved trusting acme.tld on FreeIPA side
2 seems to be solved trusting acme.tld on AD side
Not sure how to solve 3 and 4, can you provide any recommendation?.
Regards,
CI.-
2 months, 2 weeks
Problem with "Login failed due to an unknown reason" / PKINIT OpenSSL error
by Ville Teronen
Hello,
We are currently experiencing strange behavior on FreeIPA system related to PKINIT OpenSSL error when trying to log in through FreeIPA web gui. This started happening as we upgraded our second replica with "dnf ugprade". Freeipa packages in themself haven't been updated.
Our setup is basically as follows.
ipa.tre-1.web1.fi
ipa.tku-2.web1.fi <-- the one not working.
GUI throws an error "Login failed due to an unknown reason"
httpd error log has the following line after error:
[Fri Feb 25 19:32:50.776457 2022] [wsgi:error] [pid 17977:tid 18319] [remote 10.20.11.2:49472] ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/bin/kinit', '-n', '-c', '/run/ipa/ccaches/armor_17977', '-X', 'X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt', '-X', 'X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem'] returned non-zero exit status 1: 'kinit: Cannot read password while getting initial credentials\\n')
Now if I try to run
" KRB5_TRACE=/dev/stdout /usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_15581 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem"
I get the following output
[19260] 1645812760.557398: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IPA.WEB1.FI
[19260] 1645812760.557400: Sending unauthenticated request
[19260] 1645812760.557401: Sending request (186 bytes) to IPA.WEB1.FI
[19260] 1645812760.557402: Initiating TCP connection to stream 10.20.13.5:88
[19260] 1645812760.557403: Sending TCP request to stream 10.20.13.5:88
[19260] 1645812760.557404: Received answer (538 bytes) from stream 10.20.13.5:88
[19260] 1645812760.557405: Terminating TCP connection to stream 10.20.13.5:88
[19260] 1645812760.557406: Response was from primary KDC
[19260] 1645812760.557407: Received error from KDC: -1765328359/Additional pre-authentication required
[19260] 1645812760.557410: Preauthenticating using KDC method data
[19260] 1645812760.557411: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[19260] 1645812760.557412: Selected etype info: etype aes256-cts, salt "IPA.WEB1.FIWELLKNOWNANONYMOUS", params ""
[19260] 1645812760.557413: Received cookie: MIT1\x00\x00\x00\x01\x8f\xcb\x99\x9c~\xed!^Qj\xa3\x0a\x82~\xe94\x04\x0ck[j=\x08\xd2\x97j'K2\x8f\xa0\xf6\xc3\x89Z@\x8b]\xc3K\xc2h\xfa\xaek\x11\x91y\xc9\xf0\xadG\x13\x9a\xb2\xb6\x1c\x12\xbfr\x0a'Z\xfe\x12\x81\x1a>2\x8c\x1a\xf2\x96\xdc]&qH\x08\x1f\x0d\xc0a{\xe8\xff\xbbF\x9c\x86`\xd6G\xc4*5\xccL\xc1m\xc0\xa7b\x8b]od\xfa*\xd4.bmB\x9d\x92\xb7\xf9($\xa4D\xea\xcd\xc6\xe3p\xac$\xf4
[19260] 1645812760.557414: Preauth module pkinit (147) (info) returned: 0/Success
[19260] 1645812760.557415: PKINIT client received freshness token from KDC
[19260] 1645812760.557416: Preauth module pkinit (150) (info) returned: 0/Success
[19260] 1645812760.557417: PKINIT loading CA certs and CRLs from FILE
[19260] 1645812760.557418: PKINIT loading CA certs and CRLs from FILE
[19260] 1645812760.557419: PKINIT loading CA certs and CRLs from FILE
[19260] 1645812760.557420: PKINIT client computed kdc-req-body checksum 9/B79768B0DAD630709ABFE35C1E2B6FDAB714913D
[19260] 1645812760.557422: PKINIT client making DH request
[19260] 1645812760.557423: Preauth module pkinit (16) (real) returned: 0/Success
[19260] 1645812760.557424: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
[19260] 1645812760.557425: Sending request (1674 bytes) to IPA.WEB1.FI
[19260] 1645812760.557426: Initiating TCP connection to stream 10.20.13.5:88
[19260] 1645812760.557427: Sending TCP request to stream 10.20.13.5:88
[19260] 1645812760.557428: Received answer (2619 bytes) from stream 10.20.13.5:88
[19260] 1645812760.557429: Terminating TCP connection to stream 10.20.13.5:88
[19260] 1645812760.557430: Response was from primary KDC
[19260] 1645812760.557431: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
[19260] 1645812760.557432: Preauth module pkinit (147) (info) returned: 0/Success
[19260] 1645812760.557433: PKINIT OpenSSL error: Failed to verify CMS message
[19260] 1645812760.557434: PKINIT OpenSSL error: error:1700006B:CMS routines::content type not enveloped data
[19260] 1645812760.557435: PKINIT OpenSSL error: error:03000098:digital envelope routines::invalid digest
[19260] 1645812760.557436: PKINIT client could not verify DH reply
[19260] 1645812760.557437: Preauth module pkinit (17) (real) returned: -1765328320/Failed to verify CMS message: content type not enveloped data
[19260] 1645812760.557438: Produced preauth for next request: (empty)
[19260] 1645812760.557439: Getting AS key, salt "IPA.WEB1.FIWELLKNOWNANONYMOUS", params ""
Password for WELLKNOWN/ANONYMOUS(a)IPA.WEB1.FI:
[19260] 1645812776.928337: AS key obtained from gak_fct: aes256-cts/3840
kinit: Password incorrect while getting initial credentials
But this only happens on the "dc2" one.
If I would run this on the "dc1" it would work just fine.
I have tried running
ipa-pkinit-manage disable
ipa-pkinit-manage enable
to regen the cert but it didn't help. Any suggestions / pointers at why the OpenSSL error on the tku-2 is showing up.
2 months, 3 weeks
Allow AD users to manage multiple certificates
by Pedro Bezunartea Lopez
Hi!
This is our currently working setup:
- AD Domain: ourdomain.local (working fine for Windows users' authentication, Domain Controllers, etc...)
- IPA Domain: idm.ourdomain.local (Trust relation successfully setup with the Domain Controllers)
- AD users can login to the IPA Server with their AD credentials.
Goal: Allow AD users to add and manage their own certificates for different services (VPN access and the like). The workflow would be something like:
1. Users adds a new CSR. (The user creates his key and generates the CSR locally)
2. IPA admins approve and issue the certificate.
3. The user downloads the certificate.
"Local" IPA users can add certificate requests in their profile by clicking on Actions > New Certificate.
AD users are only allowed to edit their profile description, GECOS, Login shell, add SSH public keys and add Certificates in PEM format, not add Certificate Requests.
We have tried a few things already:
- Certificate Mappings. They are designed for user authentication to idm.ourdomain.local, no go.
- From the docs https://www.freeipa.org/page/Active_Directory_trust_setup: Allow access for users from AD domain to protected resources: Which "protected resource" allows for users' certificates?
- From RH docs: CHAPTER 73. ENABLING AD USERS TO ADMINISTER IDM: AD users can administer IDM, but they cannot add a new Certificate Signing Request to their own profile.
Any ideas?
Sorry for the length of the post... TIA
Pedro.
2 months, 3 weeks
ipa-dnskeysyncd DEBUG messages
by Kees Bakker
Hi,
On the two CentOS 8 Stream masters (upgraded a few days ago) we now get quite
a few DEBUG messages. I haven't seen these before.
There is also a WARN - content-sync-plugin.
Is this something to be worried about?
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=example.com.,cn=dns,dc=example,dc=com 1e89eb86-e201-11e8-8820-f96efc0c60a4
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206227
Jul 13 14:06:56 linge.example.com named-pkcs11[283005]: zone example.com/IN: sending notifies (serial 1626178016)
Jul 13 14:06:56 linge.example.com named-pkcs11[283005]: client @0x7f54e416c880 172.16.16.31#45677: received notify for zone 'example.com'
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=example.com.,cn=dns,dc=example,dc=com 1e89eb86-e201-11e8-8820-f96efc0c60a4
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206230
Jul 13 14:06:56 linge.example.com ns-slapd[282944]: [13/Jul/2021:14:06:56.745067868 +0200] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=206231,cn=changelog" (op=0x7fd372024000 idx_pl=1) => op not changed in PL
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=example.com.,cn=dns,dc=example,dc=com 1e89eb86-e201-11e8-8820-f96efc0c60a4
Jul 13 14:06:56 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206232
Jul 13 14:06:56 linge.example.com named-pkcs11[283005]: client @0x7f54e416c880 172.16.16.75#48866: received notify for zone '30.16.172.in-addr.arpa'
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=example.com.,cn=dns,dc=example,dc=com 1e89eb86-e201-11e8-8820-f96efc0c60a4
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206235
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=30.16.172.in-addr.arpa.,cn=dns,dc=example,dc=com d79d0401-e29b-11e8-8820-f96efc0c60a4
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206236
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=30.16.172.in-addr.arpa.,cn=dns,dc=example,dc=com d79d0401-e29b-11e8-8820-f96efc0c60a4
Jul 13 14:06:57 linge.example.com ipa-dnskeysyncd[283246]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: linge.example.com:389#krbprincipalname=ipa-dnskeysyncd/linge.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#206237
--
Kees
2 months, 3 weeks
named-pkcs11 takes 15 minutes to restart/reload
by Brian J. Murrell
Hi.
My named-pkcs11 (9.11.26-6.el8 on EL8.5 clearly) seems to be taking on
the order of about 25 minutes to be ready to serve it's local zones
after a reload. During that time, queries for the local zones fail.
From my journal of a reload (it looks like there were actually two --
both a result of logrotate):
Feb 20 03:49:01 server.example.com systemd[1]: Reloading Berkeley Internet Name Domain (DNS) with native PKCS#11.
Feb 20 03:49:09 server.example.com sh[1708198]: WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
Feb 20 03:49:09 server.example.com named-pkcs11[1593328]: received control channel command 'reload'
Feb 20 03:49:11 server.example.com named-pkcs11[1593328]: zone 22.75.10.in-addr.arpa/IN: shutting down
Feb 20 03:49:11 server.example.com named-pkcs11[1593328]: zone 0.8.10.in-addr.arpa/IN: shutting down
Feb 20 03:49:11 server.example.com named-pkcs11[1593328]: zone 101.168.192.in-addr.arpa/IN: shutting down
Feb 20 03:49:12 server.example.com named-pkcs11[1593328]: zone a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:12 server.example.com named-pkcs11[1593328]: zone 3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:12 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:12 server.example.com named-pkcs11[1593328]: zone 0.0.7.1.0.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: checkhints: unable to get root NS rrset from cache: not found
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone 0.0.6.d.1.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone 0.0.9.2.3.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone 2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.f.d.8.4.1.b.e.a.1.3.d.f.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone 2.6.5.c.c.9.2.c.4.0.6.5.c.8.d.f.ip6.arpa/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone example.com/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: zone rbl.example.com/IN: shutting down
Feb 20 03:49:13 server.example.com named-pkcs11[1593328]: checkhints: unable to get root NS rrset from cache: not found
Feb 20 03:49:14 server.example.com httpd[85393]: Server configured, listening on: port 443, port 80
Feb 20 03:49:15 server.example.com named-pkcs11[1593328]: zone joip.com/IN: shutting down
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: loading configuration from '/etc/named.conf'
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: unable to open '/etc/bind.keys'; using built-in keys instead
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: looking for GeoIP2 databases in '/usr/share/GeoIP'
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: opened GeoIP2 database '/usr/share/GeoIP/GeoLite2-Country.mmdb'
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: opened GeoIP2 database '/usr/share/GeoIP/GeoLite2-City.mmdb'
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: using default UDP/IPv4 port range: [32768, 60999]
Feb 20 03:50:30 server.example.com named-pkcs11[1593328]: using default UDP/IPv6 port range: [32768, 60999]
Feb 20 03:50:31 server.example.com named-pkcs11[1593328]: sizing zone task pool based on 13 zones
Feb 20 03:50:32 server.example.com named-pkcs11[1593328]: none:105: 'max-cache-size 90%' - setting to 6889MB (out of 7654MB)
Feb 20 03:50:32 server.example.com named-pkcs11[1593328]: dns64 reverse zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:33 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 10.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 16.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 17.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 18.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 19.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 20.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 21.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 22.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 23.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 24.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 25.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 26.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 27.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 28.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 29.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 30.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 31.172.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 168.192.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 64.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 65.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 66.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 67.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 68.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 69.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 70.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 71.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 72.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 73.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 74.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 75.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 76.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 77.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 78.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 79.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 80.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 81.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 82.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 83.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 84.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 85.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 86.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 87.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 88.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 89.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 90.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 91.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 92.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 93.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 94.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 95.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 96.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 97.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 98.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 99.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 100.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 101.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 102.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 103.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 104.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 105.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 106.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 107.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 108.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 109.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 110.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 111.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 112.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 113.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 114.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 115.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 116.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 117.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 118.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 119.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 120.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 121.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 122.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 123.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 124.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 125.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 126.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 127.100.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 127.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 254.169.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 100.51.198.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 113.0.203.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: D.F.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 8.E.F.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 9.E.F.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: A.E.F.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: B.E.F.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: EMPTY.AS112.ARPA
Feb 20 03:50:34 server.example.com named-pkcs11[1593328]: automatic empty zone: HOME.ARPA
Feb 20 03:50:35 server.example.com named-pkcs11[1593328]: none:105: 'max-cache-size 90%' - setting to 6889MB (out of 7654MB)
Feb 20 03:50:35 server.example.com named-pkcs11[1593328]: configuring command channel from '/etc/rndc.key'
Feb 20 03:50:35 server.example.com named-pkcs11[1593328]: configuring command channel from '/etc/rndc.key'
Feb 20 03:50:35 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa/IN: (master) removed
Feb 20 03:50:36 server.example.com named-pkcs11[1593328]: reloading configuration succeeded
Feb 20 03:50:36 server.example.com named-pkcs11[1593328]: reloading zones succeeded
Feb 20 03:50:36 server.example.com sh[1708198]: server reload successful
Feb 20 03:50:36 server.example.com systemd[1]: Reloaded Berkeley Internet Name Domain (DNS) with native PKCS#11.
Feb 20 03:51:20 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:20 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:20 server.example.com named-pkcs11[1593328]: managed-keys-zone: Unable to fetch DNSKEY set '.': timed out
Feb 20 03:51:20 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:20 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:51:21 server.example.com named-pkcs11[1593328]: all zones loaded
Feb 20 03:51:21 server.example.com systemd[1]: Reloading Berkeley Internet Name Domain (DNS) with native PKCS#11.
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: running
Feb 20 03:51:22 server.example.com sh[1708655]: WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: received control channel command 'reload'
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: loading configuration from '/etc/named.conf'
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: unable to open '/etc/bind.keys'; using built-in keys instead
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: looking for GeoIP2 databases in '/usr/share/GeoIP'
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: opened GeoIP2 database '/usr/share/GeoIP/GeoLite2-Country.mmdb'
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: opened GeoIP2 database '/usr/share/GeoIP/GeoLite2-City.mmdb'
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: using default UDP/IPv4 port range: [32768, 60999]
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: using default UDP/IPv6 port range: [32768, 60999]
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: sizing zone task pool based on 13 zones
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: none:105: 'max-cache-size 90%' - setting to 6889MB (out of 7654MB)
Feb 20 03:51:22 server.example.com named-pkcs11[1593328]: dns64 reverse zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.
Feb 20 03:51:22 server.example.com ns-slapd[1840]: [20/Feb/2022:03:51:22.710241429 -0500] - NOTICE - ldbm_back_search - Unindexed search: search base="cn=dns,dc=example,dc=com" scope=2 filter="(|(objectClass=idnsConfigObject)(&(objectClass=idnsServerConfigObject)(idnsServerId=server.example.com))(|(objectClass=idnsZone)(objectClass=idnsForwardZone)(objectClass=idnsRecord)))" conn=11939 op=3
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 10.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 16.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 17.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 18.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 19.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 20.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 21.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 22.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 23.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 24.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 25.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 26.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 27.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 28.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 29.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 30.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 31.172.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 168.192.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 64.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 65.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 66.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 67.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 68.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 69.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 70.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 71.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 72.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 73.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 74.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 75.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 76.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 77.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 78.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 79.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 80.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 81.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 82.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 83.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 84.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 85.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 86.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 87.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 88.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 89.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 90.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 91.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 92.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 93.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 94.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 95.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 96.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 97.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 98.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 99.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 100.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 101.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 102.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 103.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 104.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 105.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 106.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 107.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 108.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 109.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 110.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 111.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 112.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 113.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 114.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 115.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 116.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 117.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 118.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 119.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 120.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 121.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 122.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 123.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 124.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 125.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 126.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 127.100.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 127.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 254.169.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 2.0.192.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 100.51.198.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 113.0.203.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: D.F.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 8.E.F.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 9.E.F.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: A.E.F.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: B.E.F.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: EMPTY.AS112.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: automatic empty zone: HOME.ARPA
Feb 20 03:51:30 server.example.com named-pkcs11[1593328]: none:105: 'max-cache-size 90%' - setting to 6889MB (out of 7654MB)
Feb 20 03:51:37 server.example.com named-pkcs11[1593328]: configuring command channel from '/etc/rndc.key'
Feb 20 03:51:37 server.example.com named-pkcs11[1593328]: configuring command channel from '/etc/rndc.key'
Feb 20 03:51:37 server.example.com systemd[1]: Reloaded Berkeley Internet Name Domain (DNS) with native PKCS#11.
Feb 20 03:51:37 server.example.com sh[1708655]: server reload successful
Feb 20 03:51:37 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa/IN: (master) removed
Feb 20 03:51:37 server.example.com named-pkcs11[1593328]: reloading configuration succeeded
Feb 20 03:51:37 server.example.com named-pkcs11[1593328]: reloading zones succeeded
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: all zones loaded
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: running
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: GSSAPI client step 1
Feb 20 03:51:38 server.example.com named-pkcs11[1593328]: GSSAPI client step 2
Feb 20 03:51:38 server.example.com ns-slapd[1840]: [20/Feb/2022:03:51:38.637062550 -0500] - NOTICE - ldbm_back_search - Unindexed search: search base="cn=dns,dc=example,dc=com" scope=2 filter="(|(objectClass=idnsConfigObject)(&(objectClass=idnsServerConfigObject)(idnsServerId=server.example.com))(|(objectClass=idnsZone)(objectClass=idnsForwardZone)(objectClass=idnsRecord)))" conn=11942 op=3
Feb 20 03:51:39 server.example.com named-pkcs11[1593328]: managed-keys-zone: Key 20326 for zone . acceptance timer complete: key now trusted
Feb 20 03:51:41 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=example.com.,cn=dns,dc=example,dc=com fa486b2d-3df5-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:41 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1411
Feb 20 03:51:43 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.0.0.f.d.8.4.1.b.e.a.1.3.d.f.ip6.arpa.,cn=dns,dc=example,dc=com fa486b31-3df5-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:43 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1412
Feb 20 03:51:44 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com fa486b33-3df5-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:44 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1413
Feb 20 03:51:45 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.0.0.3.d.5.d.1.c.3.4.2.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com fa486b35-3df5-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:45 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1414
Feb 20 03:51:48 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=22.75.10.in-addr.arpa.,cn=dns,dc=example,dc=com fa486b37-3df5-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:48 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1415
Feb 20 03:51:49 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.8.10.in-addr.arpa.,cn=dns,dc=example,dc=com 43bdb682-3ed9-11e5-b0d0-8e21c4e9261b
Feb 20 03:51:49 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1416
Feb 20 03:51:51 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa.,cn=dns,dc=example,dc=com 1ed0b809-82fd-11e5-93a0-8e21c4e9261b
Feb 20 03:51:51 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1417
Feb 20 03:51:53 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=joip.com.,cn=dns,dc=example,dc=com d0d05586-f36c-11e5-8ec6-8e21c4e9261b
Feb 20 03:51:53 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1418
Feb 20 03:51:54 server.example.com named-pkcs11[1593328]: zone 10.IN-ADDR.ARPA/IN: shutting down
Feb 20 03:51:55 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.7.1.0.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com 86728702-c388-11e6-bbce-8e21c4e9261b
Feb 20 03:51:55 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1419
Feb 20 03:51:56 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=101.168.192.in-addr.arpa.,cn=dns,dc=example,dc=com 59274702-eebf-11e7-82b4-8e21c4e9261b
Feb 20 03:51:56 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1420
Feb 20 03:51:59 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=rbl.example.com.,cn=dns,dc=example,dc=com 9d5d0506-4c6f-11e8-be06-8e21c4e9261b
Feb 20 03:51:59 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1421
Feb 20 03:52:02 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.9.2.3.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com c5593001-c8c1-11e8-a42f-8e21c4e9261b
Feb 20 03:52:02 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1422
Feb 20 03:52:05 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.6.d.1.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com b33bcc01-08c9-11e9-803d-8e21c4e9261b
Feb 20 03:52:05 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1423
Feb 20 03:52:08 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=2.6.5.c.c.9.2.c.4.0.6.5.c.8.d.f.ip6.arpa.,cn=dns,dc=example,dc=com 79072a01-112b-11ea-b32b-8e21c4e9261b
Feb 20 03:52:08 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1424
Feb 20 03:52:09 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=0.0.0.0.3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com e3beaa01-ce24-11eb-8263-8e21c4e9261b
Feb 20 03:52:09 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1425
Feb 20 03:52:17 server.example.com logrotate[1708733]: ALERT exited abnormally with [1]
Feb 20 03:52:17 server.example.com run-parts[1708735]: (/etc/cron.daily) finished logrotate
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1617/info
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1619/info
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 03:58:21 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt161b/info
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt161d/info
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt161d/info
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt161f/info
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:00:12 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1621/info
Feb 20 04:01:01 server.example.com CROND[1709388]: (root) CMD (run-parts /etc/cron.hourly)
Feb 20 04:01:01 server.example.com run-parts[1709391]: (/etc/cron.hourly) starting 0anacron
Feb 20 04:01:02 server.example.com anacron[1709397]: Anacron started on 2022-02-20
Feb 20 04:01:02 server.example.com run-parts[1709399]: (/etc/cron.hourly) finished 0anacron
Feb 20 04:01:02 server.example.com run-parts[1709401]: (/etc/cron.hourly) starting voipbl_org
Feb 20 04:01:02 server.example.com anacron[1709397]: Job `cron.daily' locked by another anacron - skipping
Feb 20 04:01:02 server.example.com anacron[1709397]: Normal exit (0 jobs run)
Feb 20 04:01:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:01:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:01:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:01:30 server.example.com sssd_be[1225]: GSSAPI client step 2
Feb 20 04:02:15 server.example.com rsyslogd[1799]: [origin software="rsyslogd" swVersion="8.2102.0-5.el8" x-pid="1799" x-info="https://www.rsyslog.com"] rsyslogd was HUPed
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1623/info
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1625/info
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:03:18 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1627/info
Feb 20 04:05:48 server.example.com anacron[1704693]: Job `cron.daily' terminated (produced output)
Feb 20 04:05:49 server.example.com anacron[1704693]: Normal exit (1 job run)
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1629/info
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1629/info
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt162b/info
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:06:03 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt162d/info
Feb 20 04:06:36 server.example.com named-pkcs11[1593328]: client @0x7f9a48307110 140.238.153.74#44385 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): bad zone transfer request: 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': non-authoritative zone (NOTAUTH)
Feb 20 04:06:36 server.example.com named-pkcs11[1593328]: client @0x7f9a473957d0 fd8c:5604:c29c:c562::1001#38333 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): bad zone transfer request: 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': non-authoritative zone (NOTAUTH)
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt162f/info
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt162f/info
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1631/info
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: unable to resolve 2001:123:aa:123:0:90cc:a629:cf42:5877 to hostname: Name or service not known
Feb 20 04:14:00 server.example.com rpc.gssd[1849]: ERROR: failed to parse nfs/clnt1633/info
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.519225905 -0500] - ERR - _entry_set_tombstone_rdn - Failed to convert DN cn=KDC to RDN
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.606982072 -0500] - ERR - id2entry - str2entry returned NULL for id 134196, string="rdn"
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.648749894 -0500] - ERR - _entry_set_tombstone_rdn - Failed to convert DN cn=KPASSWD to RDN
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.690446337 -0500] - ERR - id2entry - str2entry returned NULL for id 134197, string="rdn"
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.747113034 -0500] - ERR - _entry_set_tombstone_rdn - Failed to convert DN cn=HTTP to RDN
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.827238589 -0500] - ERR - id2entry - str2entry returned NULL for id 134198, string="rdn"
Feb 20 04:15:12 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:12.949172078 -0500] - ERR - _entry_set_tombstone_rdn - Failed to convert DN cn=OTPD to RDN
Feb 20 04:15:13 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:13.022169147 -0500] - ERR - id2entry - str2entry returned NULL for id 134199, string="rdn"
Feb 20 04:15:13 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:13.078265941 -0500] - ERR - _entry_set_tombstone_rdn - Failed to convert DN cn=KEYS to RDN
Feb 20 04:15:13 server.example.com ns-slapd[1840]: [20/Feb/2022:04:15:13.173632231 -0500] - ERR - id2entry - str2entry returned NULL for id 134200, string="rdn"
Feb 20 04:15:14 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG Detected modify of entry: idnsname=3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa.,cn=dns,dc=example,dc=com 8d1f2201-91a2-11ec-88b1-dfbaae19c7b5
Feb 20 04:15:14 server.example.com ipa-dnskeysyncd[4725]: ipaserver.dnssec.syncrepl: DEBUG New cookie is: server.example.com:389#krbprincipalname=ipa-dnskeysyncd/server.example.com@example.com,cn=services,cn=accounts,dc=example,dc=com:cn=dns,dc=example,dc=com:(|(objectClass=idnsZone)(objectClass=idnsSecKey)(objectClass=ipk11PublicKey))#1426
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 22.75.10.in-addr.arpa/IN: loaded serial 1645347105
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 22.75.10.in-addr.arpa/IN: sending notifies (serial 1645347105)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.8.10.in-addr.arpa/IN: loaded serial 1645347108
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 101.168.192.in-addr.arpa/IN: loaded serial 1645347114
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.8.10.in-addr.arpa/IN: sending notifies (serial 1645347108)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN: loaded serial 1645347103
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 101.168.192.in-addr.arpa/IN: sending notifies (serial 1645347114)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347103)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: loaded serial 1645348513
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: loaded serial 1645347128
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.7.1.0.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: loaded serial 1645347113
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.6.d.1.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: loaded serial 1645347122
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645348513)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.9.2.3.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: loaded serial 1645347120
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.6.d.1.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347122)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347128)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.7.1.0.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347113)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.9.2.3.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347120)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN: loaded serial 1645347109
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN: sending notifies (serial 1645347109)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.f.d.8.4.1.b.e.a.1.3.d.f.ip6.arpa/IN: loaded serial 1645347102
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.f.d.8.4.1.b.e.a.1.3.d.f.ip6.arpa/IN: sending notifies (serial 1645347102)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 2.6.5.c.c.9.2.c.4.0.6.5.c.8.d.f.ip6.arpa/IN: loaded serial 1645347125
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 2.6.5.c.c.9.2.c.4.0.6.5.c.8.d.f.ip6.arpa/IN: sending notifies (serial 1645347125)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone example.com/IN: loaded serial 1645347100
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone example.com/IN: sending notifies (serial 1645347100)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone rbl.example.com/IN: loaded serial 1645347116
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone rbl.example.com/IN: sending notifies (serial 1645347116)
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone joip.com/IN: loaded serial 1645347111
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone joip.com/IN: sending notifies (serial 1645347111)
Feb 20 04:15:15 server.example.com named-pkcs11[1593328]: checkhints: unable to get root NS rrset from cache: not found
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 22.75.10.in-addr.arpa/IN: sending notifies (serial 1645347105)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.8.10.in-addr.arpa/IN: sending notifies (serial 1645347108)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 101.168.192.in-addr.arpa/IN: sending notifies (serial 1645347114)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347103)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645348513)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.0.6.d.1.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347122)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.3.2.1.a.a.3.2.1.0.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347128)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.0.9.2.3.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347120)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN: sending notifies (serial 1645347109)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.0.7.1.0.3.2.1.6.8.7.3.1.0.0.2.ip6.arpa/IN: sending notifies (serial 1645347113)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 0.0.0.0.f.d.8.4.1.b.e.a.1.3.d.f.ip6.arpa/IN: sending notifies (serial 1645347102)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone 2.6.5.c.c.9.2.c.4.0.6.5.c.8.d.f.ip6.arpa/IN: sending notifies (serial 1645347125)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone example.com/IN: sending notifies (serial 1645347100)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone rbl.example.com/IN: sending notifies (serial 1645347116)
Feb 20 04:15:19 server.example.com named-pkcs11[1593328]: zone joip.com/IN: sending notifies (serial 1645347111)
Feb 20 04:16:16 server.example.com named-pkcs11[1593328]: client @0x7f9a4863a7b0 140.238.153.74#52749 (2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa): transfer of '2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN': AXFR-style IXFR started (serial 1645347109)
Feb 20 04:16:16 server.example.com named-pkcs11[1593328]: client @0x7f9a4863a7b0 140.238.153.74#52749 (2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa): transfer of '2.3.4.5.6.7.8.9.d.c.b.a.7.0.6.2.ip6.arpa/IN': AXFR-style IXFR ended
Feb 20 04:16:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:16:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:16:30 server.example.com sssd_be[1225]: GSSAPI client step 1
Feb 20 04:16:30 server.example.com sssd_be[1225]: GSSAPI client step 2
Feb 20 04:19:08 server.example.com named-pkcs11[1593328]: client @0x7f9a4855a3e0 140.238.153.74#44705 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): transfer of 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': AXFR-style IXFR started (serial 1645347103)
Feb 20 04:19:08 server.example.com named-pkcs11[1593328]: client @0x7f9a4855a3e0 140.238.153.74#44705 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): transfer of 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': AXFR-style IXFR ended
Notice the huge gap of time between:
Feb 20 03:51:54 server.example.com named-pkcs11[1593328]: zone 10.IN-ADDR.ARPA/IN: shutting down
and:
Feb 20 04:15:14 server.example.com named-pkcs11[1593328]: zone 22.75.10.in-addr.arpa/IN: loaded serial 1645347105
Where even within that gap, named clearly is not serving the local zones:
Feb 20 04:06:36 server.example.com named-pkcs11[1593328]: client @0x7f9a48307110 140.238.153.74#44385 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): bad zone transfer request: 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': non-authoritative zone (NOTAUTH)
Feb 20 04:06:36 server.example.com named-pkcs11[1593328]: client @0x7f9a473957d0 fd8c:5604:c29c:c562::1001#38333 (a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa): bad zone transfer request: 'a.b.c.d.e.1.2.3.4.5.0.1.0.0.2.ip6.arpa/IN': non-authoritative zone (NOTAUTH)
Any ideas on why the huge delay in serving local zones on reload?
Cheers,
b.
2 months, 3 weeks