Bug 1695125

Summary: [RFE] dns-check-system-records would be _very_ helpful
Product: Red Hat Enterprise Linux 8 Reporter: Oliver Falk <ofalk>
Component: ipa-healthcheckAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: ---CC: afarley, fcami, fhanzelk, ksiddiqu, mkosek, pcech, pvoborni, rcritten, sumenon, tscherf
Target Milestone: rcKeywords: FutureFeature, TestCaseProvided
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-healthcheck-0.4-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-28 15:43:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Oliver Falk 2019-04-02 14:21:47 UTC 
Description of problem:
I had the issue that the AD admins removed the DNS records and nobody noticed, until some "strange" issue appeared. I already guessed that the DNS records could be affected and checked them. However, since there are some to check, I though eventually there is a subcommand like dns-check-system-records, analogous to dns-update-system-records. Unfortunately, that is not the case.

Version-Release number of selected component (if applicable): ipa-client-4.6.4


How reproducible: Always


Steps to Reproduce: n/a

Actual results:
ipa doesn't have dns-check-system-records command.


Expected results:
ipa hould have dns-check-system-records command for an easy way to check if all dns records are correct.


Additional info:
Upstream issue already filed: https://pagure.io/freeipa/issue/7871
Comment 3 Rob Crittenden 2019-04-02 14:24:46 UTC 
Upstream ticket:
https://pagure.io/freeipa/issue/7871
Comment 4 Amy Farley 2019-08-16 19:23:50 UTC 
Moving this to RHEL 8
Comment 7 Rob Crittenden 2019-11-19 20:06:20 UTC 
Fixed upstream in master:
95dbb7ff70d686f93a0230532c02eb8969ab8a16

This checks the equivalent of:

ipa dns-update-system-records --dry-run

It only checks the first resolver that answers on the current system.
Comment 12 Sudhir Menon 2020-01-13 12:18:59 UTC 
Verified the bug using ipa-healthcheck-0.4-3.module+el8.2.0+5089+8260dc50.noarch.

[root@master yum.repos.d]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.2 Beta (Ootpa)

[root@master ~]# rpm -q ipa-healthcheck
ipa-healthcheck-0.4-3.module+el8.2.0+5089+8260dc50.noarch

Scenario1: IPA server with --setup-dns

[root@master ~]# ipa-healthcheck --source ipahealthcheck.ipa.idns
[
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "e03f05a8-0d84-4849-92aa-fc9abfbf6689",
    "when": "20200113115950Z",
    "duration": "0.021425",
    "kw": {
      "key": "_ldap._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "52bf2904-73ce-4117-bf77-26873e00b965",
    "when": "20200113115950Z",
    "duration": "0.022131",
    "kw": {
      "key": "_kerberos._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "eaf16eb1-849c-427b-89f3-7ac1da573191",
    "when": "20200113115950Z",
    "duration": "0.022802",
    "kw": {
      "key": "_kerberos._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "883ae1e5-13df-40fe-a1b1-beed8ef8b8cd",
    "when": "20200113115950Z",
    "duration": "0.023477",
    "kw": {
      "key": "_kerberos-master._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "05cfa1ef-f2f8-46f5-86d6-d3caee35cc8e",
    "when": "20200113115950Z",
    "duration": "0.024152",
    "kw": {
      "key": "_kerberos-master._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "e96fe767-06c0-40ff-812f-025a49ce91cd",
    "when": "20200113115950Z",
    "duration": "0.024820",
    "kw": {
      "key": "_kpasswd._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "1c39fd08-78d7-41a4-988f-5ff3dc39925f",
    "when": "20200113115950Z",
    "duration": "0.025489",
    "kw": {
      "key": "_kpasswd._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "6e98ee9c-7487-422b-bc42-e5db4ba9f5bb",
    "when": "20200113115950Z",
    "duration": "0.026072",
    "kw": {
      "key": "\"RHEL82.TEST\""
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "SUCCESS",
    "uuid": "bbb7e31c-cdd0-4487-bada-b53d766aab33",
    "when": "20200113115950Z",
    "duration": "0.026655",
    "kw": {
      "key": "192.168.122.110"
    }
  }
]

=== Scenario 2: IPA_Server without dns installed ===

[root@master ~]# ipa-healthcheck --source ipahealthcheck.ipa.idns
[
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "a463bbc6-87d9-40e0-9ab8-de97e7fd3c3c",
    "when": "20200113120808Z",
    "duration": "0.031086",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_ldap._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "6d148fdc-3ebe-4342-93bd-10b0c4ba6092",
    "when": "20200113120808Z",
    "duration": "0.101711",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kerberos._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "7f04f517-c4bc-4961-9260-4da0e48516d9",
    "when": "20200113120808Z",
    "duration": "0.176847",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kerberos._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "69988bad-a798-474d-ac66-3ee999c9b82a",
    "when": "20200113120808Z",
    "duration": "0.252321",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kerberos-master._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "027d647b-5265-4184-8a14-cc5326636851",
    "when": "20200113120808Z",
    "duration": "0.328644",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kerberos-master._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "3451baae-7cd6-4e20-9c8e-2cc532032d74",
    "when": "20200113120808Z",
    "duration": "0.402386",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kpasswd._tcp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "1d6197d9-2dc3-4a9a-9b8a-6c186e9b622a",
    "when": "20200113120808Z",
    "duration": "0.477942",
    "kw": {
      "msg": "Expected SRV record missing",
      "key": "_kpasswd._udp.rhel82.test.:master.rhel82.test."
    }
  },
  {
    "source": "ipahealthcheck.ipa.idns",
    "check": "IPADNSSystemRecordsCheck",
    "result": "WARNING",
    "uuid": "28346051-8333-4786-8352-6d0c5ff68a49",
    "when": "20200113120808Z",
    "duration": "0.632176",
    "kw": {
      "msg": "Got {count} ipa-ca A records, expected {expected}",
      "count": 0,
      "expected": 1
    }
  }
]
Comment 15 Rob Crittenden 2020-03-03 12:51:46 UTC 
clearing needinfo
Comment 17 Rob Crittenden 2020-03-31 15:54:22 UTC 
Upstream test
master:
https://pagure.io/freeipa/c/fd9f1b3d5bf35f8286505d1ed0971a42349a476b
Comment 18 Rob Crittenden 2020-03-31 17:49:18 UTC 
Upstream test
ipa-4-8:
https://pagure.io/freeipa/c/f6171fd6271d8a9de47337ea1852c08980a83302
Comment 20 errata-xmlrpc 2020-04-28 15:43:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:1640