On Пят, 26 кра 2024, slek kus via FreeIPA-users wrote:
Hi Sumit, that does not return anything good on the replica. See
below.
On the main IPA node node:
----
[alma@idm01 ~]$ host -t SRV _ldap._tcp.redacted.domain
_ldap._tcp.redacted.domain has SRV record 0 100 389 dc01.redacted.domain.
_ldap._tcp.redacted.domain has SRV record 0 100 389 dc01.redacted.domain.
[alma@idm01 ~]$ host -t SRV _ldap._tcp.domaina.redacted.domain
_ldap._tcp.domaina.redacted.domain has SRV record 0 100 389
windc-dc01.domaina.redacted.domain.
_ldap._tcp.domaina.redacted.domain has SRV record 0 100 389
windc-dc02.domaina.redacted.domain.
[alma@idm01 ~]$ host -t SRV _ldap._tcp.domainb.redacted.domain
_ldap._tcp.domainb.redacted.domain has SRV record 0 100 389
windc-dc02.domainb.redacted.domain.
_ldap._tcp.domainb.redacted.domain has SRV record 0 100 389
windc-dc01.domainb.redacted.domain.
On the secondary (replica):
----
[alma@idm02 ~]$ host -t SRV _ldap._tcp.redacted.domain
Host _ldap._tcp.redacted.domain not found: 2(SERVFAIL)
[alma@idm02 ~]$ host -t SRV _ldap._tcp.domainb.redacted.domain
Host _ldap._tcp.domainb.redacted.domain not found: 2(SERVFAIL)
[alma@idm02 ~]$ host -t SRV _ldap._tcp.domaina.redacted.domain
Host _ldap._tcp.domaina.redacted.domain not found: 2(SERVFAIL)
The DNS zone seems replicated and OK on the replica. The record is present there too.
What is used as a DNS server for the idm02? Are you running idm02 with
an integrated DNS server or it is some other machine that resolves the
queries?
SERVFAIL means DNS server did return an error when processing your
request. Judging that this error happens for IPA domain's DNS zone and
for others too, I wonder if you have a generic DNS resolution issue from
idm02? For example, if idm01 is used as a DNS server there and idm02 is
in a different IP network, then BIND on idm01 will not allow DNS client
from idm02 to perform DNS queries. You'd need to add an ACL to allow
that.
Or it could be a DNSSEC error where a client is configured to have
DNSSEC validation but the DNS server responds without DNSSEC.
On the main IPA node node:
----
[alma@idm01 ~]$ ipa dnsrecord-find linux.redacted.domain.
Record name: _ldap._tcp
SRV record: 0 100 389 idm01.linux.redacted.domain., 0 200 389
idm02.linux.redacted.domain.
On the secondary (replica):
-----
[alma@idm02 ~]$ ipa dnsrecord-find linux.redacted.domain.
Record name: _ldap._tcp
SRV record: 0 100 389 idm01.linux.redacted.domain., 0 200 389
idm02.linux.redacted.domain.
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland