Hi Florence,
From what I can see it is setup correctly on both the master(s) and replica.
I now understand the confusion: the logs provided in
You can identify which master is used in the ipareplica-install.log file. Can you then share the logs from the corresponding master?
I got the following during `ipa-replica-install`:
```
Search DNS server se-rhidm01x.se.example.com (['10.0.13.139', '10.0.13.139', '10.0.13.139']) for se-rhidm03x.se.example.com
Could not resolve hostname se-rhidm03x.se.example.com using DNS. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.)
Continue? [no]:
```
Which I solved by enabling rescursion in the named config on the masters. `ipa-replica-install` now outputs this instead:
```
...
raw: domainlevel_get(version='2.251')
domainlevel_get(version='2.251')
raw: hostgroup_find(None, cn='ipaservers', version='2.251', host=['usidc1-rhidm01x.idc1.us.example.com'])
hostgroup_find(None, cn='ipaservers', all=False, raw=False, version='2.251', no_members=True, pkey_only=False, host=('usidc1-rhidm01x.idc1.us.example.com',))
Lookup failed: Preferred host usidc1-rhidm01x.idc1.us.example.com does not provide DNS.
Check forward/reverse DNS resolution
Search DNS server se-rhidm04x.se.example.com (['10.0.11.190', '10.0.11.190', '10.0.11.190']) for se-rhidm03x.se.example.com
Check reverse address 10.0.13.146 (se-rhidm03x.se.example.com)
Address 10.0.13.146 resolves to: se-rhidm03x.se.example.com..
Search DNS server se-rhidm04x.se.example.com (['10.0.11.190', '10.0.11.190', '10.0.11.190']) for usidc1-rhidm01x.idc1.us.example.com
Check reverse address 192.168.224.21 (usidc1-rhidm01x.idc1.us.example.com)
Address 192.168.224.21 resolves to: usidc1-rhidm01x.idc1.us.example.com..
Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
raw: dns_is_enabled(version='2.251')
dns_is_enabled(version='2.251')
Name usidc1-rhidm01x.idc1.us.example.com resolved to {UnsafeIPAddress('192.168.224.21')}
Searching for an interface of IP address: 192.168.224.21
Testing local IP address: 127.0.0.1/255.0.0.0 (interface: lo)
Testing local IP address: 192.168.224.21/255.255.255.128 (interface: eth0)
IP address 192.168.224.21 belongs to a private range, using forward policy only
Checking DNS forwarders, please wait ...
Checking DNS server: 10.0.2.200
DNS server 10.0.2.200 does not support DNSSEC: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
DNS server 10.0.2.200: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
Checking DNS server: 10.0.2.201
DNS server 10.0.2.201 does not support DNSSEC: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
DNS server 10.0.2.201: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
Checking DNS server: 10.0.2.202
DNS server 10.0.2.202 does not support DNSSEC: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
DNS server 10.0.2.202: answer to query '. SOA' is missing DNSSEC signatures (no RRSIG data)
Please fix forwarder configuration to enable DNSSEC support.
WARNING: DNSSEC validation will be disabled
will use DNS forwarders: [CheckedIPAddressLoopback('10.0.2.200'), CheckedIPAddressLoopback('10.0.2.201'), CheckedIPAddressLoopback('10.0.2.202')]
The above message is only a warning and should not prevent the installation. If your DNS servers don't support DNSSEC, you can also provide the option --no-dnssec-validation.
flo
...
```
--
Markus
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue