# ipa dnszone-show dev.mcs.az-eastus2.mob.nuance.com --all
dn: idnsname=dev.mcs.az-eastus2.mob.nuance.com.,cn=dns,dc=mob,dc=nuance,dc=com
Zone name: dev.mcs.az-eastus2.mob.nuance.com.
Active zone: TRUE
Managedby permission: cn=Manage DNS zone dev.mcs.az-eastus2.mob.nuance.com.,cn=permissions,cn=pbac,dc=mob,dc=nuance,dc=com
Authoritative nameserver: freeipa-01.prod.mcs.som.mob.nuance.com.
Administrator e-mail address: hostmaster
SOA serial: 1496769265
SOA refresh: 3600
SOA retry: 900
SOA expire: 1209600
SOA minimum: 3600
BIND update policy: grant MOB.NUANCE.COM krb5-self * A; grant MOB.NUANCE.COM krb5-self * AAAA; grant MOB.NUANCE.COM krb5-self * SSHFP;
Dynamic update: TRUE
Allow query: any;
Allow transfer: none;
Allow PTR sync: TRUE
nsrecord: freeipa-01.prod.mcs.som.mob.nuance.com., freeipa-02.dev.mcs.az-eastus2.mob.nuance.com., freeipa-01.dev.mcs.az-eastus2.mob.nuance.com.
objectclass: idnszone, top, idnsrecord, ipadnszone
I meant dynamic updates in zone config. ipa dnszone-show dev.mcs.az-eastus2.mob.nuance.
com --all
On 06.06.2017 19:08, Josh Pavel wrote:
Dynamic updates are enabled:
dynamic-db "ipa" {
library "ldap.so";
arg "uri ldapi://%2fvar%2frun%2fslapd-
MOB-NUANCE-COM.socket"; arg "base cn=dns, dc=mob,dc=nuance,dc=com";
arg "server_id freeipa-01.dev.mcs.az-eastus2.
mob.nuance.com ";arg "auth_method sasl";
arg "sasl_mech GSSAPI";
arg "sasl_user DNS/freeipa-01.dev.mcs.az-
eastus2.mob.nuance.com ";arg "serial_autoincrement yes";
};
Nothing was logged at the default level (dynamic), but I changed it to debug 10. Nothing strikes me when I look at that log... everything I see has query approved, the only thing that surprised me a bit was that the requests are signed - I'm not sure if they're supposed to be or not.
Here's a snippet - as you'd expect from debug 10, there is a lot of logs.
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182: UDP request
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182: using view '_default'
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182: request is not signed
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182: recursion available
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182: query
06-Jun-2017 15:54:22.214 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): ns_client_attach: ref = 106-Jun-2017 15:54:22.214 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): query (cache) 'metrics-frontend-01.dev.mcs.az-eastus2.mob.nuance.com/ ' approvedAAAA/IN 06-Jun-2017 15:54:22.214 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): replace06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): send06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): sendto06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): senddone06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): next06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): ns_client_detach: ref = 006-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): endrequest06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): send06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): sendto06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): senddone06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): next06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): ns_client_detach: ref = 0
06-Jun-2017 15:54:23.525 client 10.0.3.7#46182 (metrics-frontend-01.dev.mcs.
az-eastus2.mob.nuance.com ): endrequest
On Tue, Jun 6, 2017 at 7:41 AM, Martin Bašti <mbasti@redhat.com> wrote:
I was told and now I see you used host principal. Could you please check zone settings of this zone dev.mcs.az-eastus2.mob.nuance.
On 06.06.2017 13:00, Martin Bašti via FreeIPA-users wrote:
On 05.06.2017 20:39, Josh Pavel via FreeIPA-users wrote:
I have a setup with 2 zones:
My IPA realm is mob.nuance.comMy first IPA server was built out with the DNS zone prod.mcs.som.mob.nuance.comMy second IPA server is in a DNS zone of dev.mcs.az-eastus2.mob.nuance.com
I can successfully add client to my first IPA server, and everything works as expected, including DNS updates.When I add clients to my second IPA server, they complete successfully for everything except updating DNS.
I recreated the DNS Update file from ipa-client install log, and executed it manually as "admin" with debug. Any ideas what is wrong?
# kinit admin
Password for admin@MOB.NUANCE.COM:
# id admin
uid=1294000000(admin) gid=1294000000(admins) groups=1294000000(admins)
# getent passwd admin
admin:*:1294000000:1294000000:
Administrator:/home/admin:/bin /bash # kinit -k
# klist
Ticket cache: KEYRING:persistent:0:krb_ccach
e_3k4KdJI Default principal: host/metrics-frontend-01.dev.m
cs.az-eastus2.mob.nuance.com@M OB.NUANCE.COM
Valid starting Expires Service principal
06/05/2017 18:11:39 06/06/2017 18:11:39 krbtgt/MOB.NUANCE.COM@MOB.NUAN
CE.COM
# nsupdate -v -g ./dns_update.txt
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
metrics-frontend-01.dev.mcs.az
-eastus2.mob.nuance.com . 0 ANY A
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58840
;; flags: qr aa rd ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;metrics-frontend-01.dev.mcs.a
z-eastus2.mob.nuance.com . IN SOA
;; AUTHORITY SECTION:
dev.mcs.az-eastus2.mob.nuance.
com . 0 IN SOA freeipa-01.dev.mcs.az-eastus2.mob.nuance.com . hostmaster.dev.mcs.az-eastus2.mob.nuance.com . 1496548206 3600 900 1209600 3600
Found zone name: dev.mcs.az-eastus2.mob.nuance.
com The master is: freeipa-01.dev.mcs.az-eastus2.
mob.nuance.com start_gssrequest
send_gssrequest
Outgoing update query:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14301
;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;2603545440.sig-freeipa-01.dev
.mcs.az-eastus2.mob.nuance.com . ANY TKEY
;; ADDITIONAL SECTION:
2603545440.sig-freeipa-01.dev.
mcs.az-eastus2.mob.nuance.com . 0 ANY TKEY gss-tsig. 1496686456 1496686456 3 NOERROR 750 YIIC6gYJKoZIhvcSAQICAQBuggLZMIIC1aADAgEFoQMCAQ6iBwMFACAA AACjggGyYYIBrjCCAaqgAwIBBaEQGw 5NT0IuTlVBTkNFLkNPTaI+MDyg AwIBA6E1MDMbA0ROUxssZnJlZWlwYS 0wMS5kZXYubWNzLmF6LWVhc3R1 czIubW9iLm51YW5jZS5jb22jggFPMI IBS6ADAgESoQMCAQKiggE9BIIB OT6iIBKUylVkyZojuFesiyK9xr2TNs JcCxjHSKxRxDTI781ECObVev0r 5FEux+izbNYji5vEZpfZDela6vLLJu ieQ7EUz02jEMU9lvkhfuiaA9w8 UGLjT+l7TsKLLa6O+gnZ9bLWoTeR++ QTE3g/5ePKCLd5rv/h3fvsHoW9 MxUD896pNNYCSutwm9Q6WigpMabxz4 oli2l2YpbABJGEk6ZOB3Dr65m6 j4ou1LCnJpy0pkCwQfNPqPtF6UXUiL 7DBvZfDhr+MlOeH7o0EBmUEiy2 uNIj9D6VaXeThLBMzyOeZRAVgutqSG xCiBraZ2hVGCQ5Xdet2XuJtUMq gZEn7uS6B8d5iIRDhsiOZ2eGUfZqRe XaoE9YFBROvvyn0tosoqwW7YUZ 1Yc6gItyh2p7T8s3VBu1H4K8+vSkgg EIMIIBBKADAgESooH8BIH56H4C tKcmdKBDujhBN3UmWECEm1stlWq1Cc mSqtYmU6LpWa2duyX4rUDHfHVC 1eHhxrWB9mdEb3DKPHiJrJ0vLOuKJp rPFEJpf/RGJylnglPs0JCf0Caa dGZpgeXCQ10xNIdKFsxzcgSChF5ClY K5A+Axg8zxVnLnNKCLR3TGdMrJ +YIOe04oHl4SdREVP09IrtubcOZSJe G3lRt4v/NHHuSMXXb337y/7ErU 1/8YoSs1K3H9du22vLF2VxB8k70DDt DKKpYFj1PzNXD5Tk7yuuWb//Ze voVsTc9g86212KzDYOfDdaN5JM2j51 R/O/ummcYw8GnqR5Kt 0
recvmsg reply from GSS-TSIG query
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 14301
;; flags: qr ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;2603545440.sig-freeipa-01.dev
.mcs.az-eastus2.mob.nuance.com . ANY TKEY
response to GSS-TSIG query was unsuccessful
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahost ed.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Hello,
please kinit as host, only hosts are allowed to update their DNS records over DDNS
kinit -kt /etc/krb5.keytab
nsupdate -v -g ....
Could you please provide output of nsupdate from ipa-client-install log?
Martin
-- Martin Bašti Software Engineer Red Hat Czech
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahost ed.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
com , do you have dynamic updates enabled?
Do you have any error output in journalct -u named-pkcs11 on the DNS server?
Martin
-- Martin Bašti Software Engineer Red Hat Czech
-- Martin Bašti Software Engineer Red Hat Czech