Hello there,
Having an issue with named on one of our IPA servers. Our IPA server gets
the following messages in named.run when it starts:
0 master zones from LDAP instance 'ipa' loaded (0 zones defined, 0
inactive, 0 failed to load)
0 master zones is suspicious number, please check access control
instructions on LDAP server
We have been rolling through and upgrading our IPA infrastructure, and it
looks like DNS privileges were lost for this host during the upgrade, and
the issue was exposed on a restart of named. We're looking to get this
server back into the proper pbac group so that it can read in authoritative
zones. Any assistance is greatly appreciated!
Host information:
Upgraded from 4.2.0-15 to 4.5.0-22
OS Version: CentOS 7.2.1511
Issue description:
named starts, but cannot get authoritative zones from LDAP. Kerberos
authentication is functioning (Tested using the named.keytab and ldapsearch
as shown below), but the host does not have DNS Server privileges. Followed
troubleshooting steps located at:
https://docs.pagure.org/bind-dyndb-ldap/BIND9/NamedCannotStart.html
Domain name has been scrubbed, but host names are intact. I assure you, we
are not
example.net. :)
In any of this output we are looking for
ipa-002.example.net.
From the non-functioning host (FreeIPA version 4.5):
kinit -kt /etc/named.keytab
DNS/ipa-002.example.net
ldapsearch -H 'ldapi://%2fvar%2frun%2fslapd-EXAMPLE-NET.socket' -Y GSSAPI
-b 'cn=dns,dc=example,dc=net'
SASL/GSSAPI authentication started
SASL username: DNS/ipa-002.example.net(a)EXAMPLE.NET
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=dns,dc=example,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# dns,
example.net
dn: cn=dns,dc=example,dc=net
cn: dns
objectClass: idnsConfigObject
objectClass: nsContainer
objectClass: ipaConfigObject
objectClass: top
objectClass: ipadnscontainer
# sec, dns,
example.net
dn: cn=sec,cn=dns,dc=example,dc=net
cn: sec
objectClass: nsContainer
objectClass: top
# keys, sec, dns,
example.net
dn: cn=keys,cn=sec,cn=dns,dc=example,dc=net
cn: keys
objectClass: nsContainer
objectClass: top
# servers, dns,
example.net
dn: cn=servers,cn=dns,dc=example,dc=net
cn: servers
objectClass: nsContainer
objectClass: top
# servers + 79ae4ffe-6b7211e7-9fb996c1-641091b3, dns,
example.net
dn:
cn=servers+nsuniqueid=79ae4ffe-6b7211e7-9fb996c1-641091b3,cn=dns,dc=example
,dc=net
cn: servers
objectClass: nsContainer
objectClass: top
# search result
search: 4
result: 0 Success
# numResponses: 6
# numEntries: 5
ipa privilege-show 'DNS Servers' --all --raw
dn:
cn=DNS Servers,cn=privileges,cn=pbac,dc=example,dc=net
cn: DNS Servers
description: DNS Servers
member: krbprincipalname=DNS/ipa-001.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/ipa-001.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/eu-ipa-02.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/eu-ipa-02.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/eu-ipa-01.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/eu-ipa-01.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/dev-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
dev-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rslon-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rslon-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rslon-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rslon-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rsiad-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rsiad-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rsiad-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rsiad-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rsdfw-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rsdfw-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/rsdfw-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
rsdfw-ipa-02.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=DNS/prod-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
member: krbprincipalname=ipa-dnskeysyncd/
prod-ipa-01.mgmt.example.net(a)EXAMPLE.NET
,cn=services,cn=accounts,dc=example,dc=net
memberof: cn=System: Read DNS
Configuration,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Write DNS
Configuration,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Add DNS
Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Manage DNSSEC
keys,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Manage DNSSEC
metadata,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Read DNS
Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Remove DNS
Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Update DNS
Entries,cn=permissions,cn=pbac,dc=example,dc=net
memberof: cn=System: Read DNS Servers
Configuration,cn=permissions,cn=pbac,dc=example,dc=net
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
--
Matt Ungaro (mungaro(a)armsbusinesssolutions.com)
Phone: 608-616-5367
Engineer 3
ARMS Business Solutions
--
IMPORTANT: This e-mail (including
any attachments) is intended for
the use of
the individual or entity to which it is addressed and may
contain information
that is classified, private, or confidential. If the
reader of this message is
not the intended recipient, or the employee or
agent responsible for delivering
the message to the intended recipient, you
are hereby notified that any
dissemination, distribution, or copying of
this communication is prohibited. If
you have received this communication
in error, please notify us immediately by
replying to this e-mail. Thank
you.