On Fri, Aug 2, 2019 at 10:43 AM Boyd Ako <boyd.hanalei.ako(a)gmail.com> wrote:
> On Aug 1, 2019, at 02:22, François Cami <fcami(a)redhat.com>
wrote:
>
> Which version of sssd, ipa-server and ipa-client?
>
— server —
[root@ipa data]# for pkg in sssd ipa-server ipa-client; do printf "=== %s
===\n" "$pkg"; yum info $pkg | egrep -e "Version" -e
"Release" -e "Repo" ; done
=== sssd ===
Version : 1.16.2
Release : 13.el7_6.8
Repo : installed
=== ipa-server ===
Version : 4.6.4
Release : 10.el7.centos.3
Repo : installed
=== ipa-client ===
Version : 4.6.4
Release : 10.el7.centos.3
Repo : installed
— client —
=== sssd ===
Version : 1.16.2
Release : 13.el7_6.8
Repo : installed
=== ipa-server ===
Version : 4.6.4
Release : 10.el7.centos.6
Repo : updates/7/x86_64
=== ipa-client ===
Version : 4.6.4
Release : 10.el7.centos.6
Repo : installed
>
> Even in /var/named/data/named.run ?
>
Ah… so I changed resolve.conf to direct use the IPA server for DNS
==== Client ====
[root@luna void]# /usr/bin/nsupdate -v -g /etc/ipa/.dns_update.txt
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
luna.neverland.ddns.me. 0 ANY A
update failed: REFUSED
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
luna.neverland.ddns.me. 0 ANY AAAA
update failed: REFUSED
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
luna.neverland.ddns.me. 1200 IN A 10.0.0.19
update failed: REFUSED
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
luna.neverland.ddns.me. 1200 IN AAAA 2605:e000:1127:713::7
update failed: REFUSED
==== IPA Server ====
[root@ipa data]# tail -n 0 -f named.run
01-Aug-2019 22:42:52.834 client 2605:e000:1127:713::7#46253/key admin\(a)NEVERLAND.DDNS.ME:
updating zone 'neverland.ddns.me/IN': update failed: rejected by secure update
(REFUSED)
01-Aug-2019 22:42:52.867 client 2605:e000:1127:713::7#50118/key admin\(a)NEVERLAND.DDNS.ME:
updating zone 'neverland.ddns.me/IN': update failed: rejected by secure update
(REFUSED)
01-Aug-2019 22:42:52.901 client 2605:e000:1127:713::7#59892/key admin\(a)NEVERLAND.DDNS.ME:
updating zone 'neverland.ddns.me/IN': update failed: rejected by secure update
(REFUSED)
01-Aug-2019 22:42:52.945 client 2605:e000:1127:713::7#49581/key admin\(a)NEVERLAND.DDNS.ME:
updating zone 'neverland.ddns.me/IN': update failed: rejected by secure update
(REFUSED)
So please first, as Flo asked before, check that the client FQDN
belongs to a domain managed by IPA server.
You can check the zones managed by IPA with
$ kinit admin
$ ipa dnszone-find
If the client FQDN (luna.neverland.ddns.me right?) belongs to such a
zone, please check that the zone accepts dynamic updates using e.g.
for neverland.ddns.me:
$ ipa dnszone-show --all neverland.ddns.me.
Regards,
François
>
>
>
> Domo,
>
> Boyd H. Ako
>
>
> boyd.hanalei.ako(a)gmail.com
> (424) 244-9653
>
https://www.boydhanaleiako.me
>
> “Coming together is a beginning. Keeping together is progress. Working together is
success.” -Henry Ford
>
> PGP/GPG Public Key:
https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
>