On to, 12 marras 2020, Damjan Kumin via FreeIPA-users wrote:
thx Alexander for such a quick reply. So here is mine.
On this newly deployed freeipa there are *no* files under /etc/named/ - directory is
empty. I looked from backup of old ipa server, there is one file called
"ipa-ext.conf" but it is empty. Not sure how can I disable then DNSSEC check
because I believe that server that I use does not provide DNSSEC (though I need to check
this).
On the note of failed installation, in log I see:
2020-11-12T18:55:34Z DEBUG The ipa-server-install command failed, exception: RuntimeError:
DNS server 193.2.1.66: query '. SOA': The DNS operation timed out after
11.602912902832031 seconds
2020-11-12T18:55:34Z ERROR DNS server 193.2.1.66: query '. SOA': The DNS operation
timed out after 11.602912902832031 seconds
2020-11-12T18:55:34Z ERROR The ipa-server-install command failed. See
/var/log/ipaserver-install.log for more information
This means 193.2.1.66 is not usable as a forwarder to query . SOA
record. May be it is not accessible at all or may be it does not allow
to query that.
What happens if you'd ask it manually from the same machine?
dig @193.2.1.66 .
From my side I am (obviously) getting refusal:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 13166
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 68 msec
;; SERVER: 193.2.1.66#53(193.2.1.66)
;; WHEN: to marras 12 22:15:01 EET 2020
;; MSG SIZE rcvd: 12
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland