Hello there,
Having an issue with named on one of our IPA servers. Our IPA server
gets the following messages in named.run when it starts:
0 master zones from LDAP instance 'ipa' loaded (0 zones defined, 0
inactive, 0 failed to load)
0 master zones is suspicious number, please check access control
instructions on LDAP server
We have been rolling through and upgrading our IPA infrastructure, and
it looks like DNS privileges were lost for this host during the upgrade,
and the issue was exposed on a restart of named. We're looking to get
this server back into the proper pbac group so that it can read in
authoritative zones. Any assistance is greatly appreciated!
Host information:
Upgraded from 4.2.0-15 to 4.5.0-22
OS Version: CentOS 7.2.1511
Issue description:
named starts, but cannot get authoritative zones from LDAP. Kerberos
authentication is functioning (Tested using the named.keytab and
ldapsearch as shown below), but the host does not have DNS Server
privileges. Followed troubleshooting steps located at:
https://docs.pagure.org/bind-dyndb-ldap/BIND9/NamedCannotStart.html
Domain name has been scrubbed, but host names are intact. I assure you,
we are not
example.net <
http://example.net>. :)
In any of this output we are looking for
ipa-002.example.net
<
http://ipa-002.example.net>.
From the non-functioning host (FreeIPA version 4.5):
> kinit -kt /etc/named.keytab
DNS/ipa-002.example.net
<
http://ipa-002.example.net>
> ldapsearch -H 'ldapi://%2fvar%2frun%2fslapd-EXAMPLE-NET.socket' -Y
GSSAPI -b 'cn=dns,dc=example,dc=net'
SASL/GSSAPI authentication started
SASL username: DNS/ipa-002.example.net(a)EXAMPLE.NET
<mailto:ipa-002.example.net@EXAMPLE.NET>
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=dns,dc=example,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# dns,
example.net <
http://example.net>
dn: cn=dns,dc=example,dc=net
cn: dns
objectClass: idnsConfigObject
objectClass: nsContainer
objectClass: ipaConfigObject
objectClass: top
objectClass: ipadnscontainer
# sec, dns,
example.net <
http://example.net>
dn: cn=sec,cn=dns,dc=example,dc=net
cn: sec
objectClass: nsContainer
objectClass: top
# keys, sec, dns,
example.net <
http://example.net>
dn: cn=keys,cn=sec,cn=dns,dc=example,dc=net
cn: keys
objectClass: nsContainer
objectClass: top
# servers, dns,
example.net <
http://example.net>
dn: cn=servers,cn=dns,dc=example,dc=net
cn: servers
objectClass: nsContainer
objectClass: top
# servers + 79ae4ffe-6b7211e7-9fb996c1-641091b3, dns,
example.net
<
http://example.net>
dn:
cn=servers+nsuniqueid=79ae4ffe-6b7211e7-9fb996c1-641091b3,cn=dns,dc=example
,dc=net
cn: servers
objectClass: nsContainer
objectClass: top