Hello there,
Having an issue with named on one of our IPA servers. Our IPA server gets the following messages in named.run when it starts:
0 master zones from LDAP instance 'ipa' loaded (0 zones defined, 0 inactive, 0 failed to load)
0 master zones is suspicious number, please check access control instructions on LDAP server
We have been rolling through and upgrading our IPA infrastructure, and it looks like DNS privileges were lost for this host during the upgrade, and the issue was exposed on a restart of named. We're looking to get this server back into the proper pbac group so that it can read in authoritative zones. Any assistance is greatly appreciated!
Host information:
Upgraded from 4.2.0-15 to 4.5.0-22
OS Version: CentOS 7.2.1511
Issue description:
Domain name has been scrubbed, but host names are intact. I assure you, we are not
example.net. :)
From the non-functioning host (FreeIPA version 4.5):
> ldapsearch -H 'ldapi://%2fvar%2frun%2fslapd-EXAMPLE-NET.socket' -Y GSSAPI -b 'cn=dns,dc=example,dc=net'
SASL/GSSAPI authentication started
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=dns,dc=example,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
dn: cn=dns,dc=example,dc=net
cn: dns
objectClass: idnsConfigObject
objectClass: nsContainer
objectClass: ipaConfigObject
objectClass: top
objectClass: ipadnscontainer
dn: cn=sec,cn=dns,dc=example,dc=net
cn: sec
objectClass: nsContainer
objectClass: top
dn: cn=keys,cn=sec,cn=dns,dc=example,dc=net
cn: keys
objectClass: nsContainer
objectClass: top
dn: cn=servers,cn=dns,dc=example,dc=net
cn: servers
objectClass: nsContainer
objectClass: top
# servers + 79ae4ffe-6b7211e7-9fb996c1-641091b3, dns,
example.netdn: cn=servers+nsuniqueid=79ae4ffe-6b7211e7-9fb996c1-641091b3,cn=dns,dc=example
,dc=net
cn: servers
objectClass: nsContainer
objectClass: top
# search result
search: 4
result: 0 Success
# numResponses: 6
# numEntries: 5
> ipa privilege-show 'DNS Servers' --all --raw
dn: cn=DNS Servers,cn=privileges,cn=pbac,dc=example,dc=net
cn: DNS Servers
description: DNS Servers
memberof: cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=example,dc=net
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
-- IMPORTANT: This e-mail (including
any attachments) is intended for the use of
the individual or entity to which it is addressed and may contain information
that is classified, private, or confidential. If the reader of this message is
not the intended recipient, or the employee or agent responsible for delivering
the message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is prohibited. If
you have received this communication in error, please notify us immediately by
replying to this e-mail. Thank you.