Bug 729166

Summary: ipa-server-install creates wrong reverse zone record in LDAP
Product: Red Hat Enterprise Linux 6 Reporter: Dmitri Pal <dpal>
Component: ipaAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: Chandrasekar Kannan <ckannan>
Severity: unspecified Docs Contact:
Priority: high    
Version: 6.1CC: atkac, benl, dpal, grajaiya, jgalipea, rcritten, ssorce
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: ipa-2.1.0-1.el6 Doc Type: Bug Fix
Doc Text:
Do not document
Story Points: ---
Clone Of: 728925 Environment:
Last Closed: 2011-12-06 18:29:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 728925    
Bug Blocks:    

Description Dmitri Pal 2011-08-08 21:38:44 UTC
+++ This bug was initially created as a clone of Bug #728925 +++

Description of problem:
ipa-server-install creates wrong reverse zone record in LDAP

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. run ipa-server-install --selfsign --setup-dns --forwarder <ip>
2. select that you want to create reverse zone
Actual results:
Reverse zone record in LDAP looks:

# 24.34.10.in-addr.arpa., dns, atkac.brq.redhat.com
dn: idnsname=24.34.10.in-addr.arpa.,cn=dns,dc=atkac,dc=brq,dc=redhat,dc=com
idnsZoneActive: TRUE
idnsSOAexpire: 1209600
nSRecord: ipa.atkac.brq.redhat.com.
idnsSOAserial: 2011080801
idnsSOAretry: 900
idnsSOAminimum: 3600
idnsUpdatePolicy: grant ATKAC.BRQ.REDHAT.COM krb5-subdomain 24.34.10.in-addr.a
 rpa.. PTR;
idnsSOArefresh: 3600
objectClass: top
objectClass: idnsrecord
objectClass: idnszone
idnsName: 24.34.10.in-addr.arpa.
idnsAllowDynUpdate: TRUE
idnsSOArName: root.24.34.10.in-addr.arpa.
idnsSOAmName: ipa.atkac.brq.redhat.com.

Please check the idnsUpdatePolicy attribute. It contains "24.34.10.in-addr.a
 rpa.. PTR" which contains double dot. It is wrong, FQDN must be terminated only with one dot.

Expected results:
idnsUpdatePolicy attribute contains FQDN with only one dot. In my case it will be:

idnsUpdatePolicy: grant ATKAC.BRQ.REDHAT.COM krb5-subdomain 24.34.10.in-addr.arpa. PTR;

--- Additional comment from dpal@redhat.com on 2011-08-08 17:37:48 EDT ---


Comment 1 Rob Crittenden 2011-08-16 13:55:34 UTC
master: bc6e12842640099aaf97200e856075b9440eae28

Comment 3 Rob Crittenden 2011-11-01 12:51:40 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    New Contents:
Do not document

Comment 4 Gowrishankar Rajaiyan 2011-11-06 10:28:43 UTC
[root@mudflap ~]# ipa-server-install --selfsign --setup-dns --forwarder=

The log file for this installation can be found in /var/log/ipaserver-install.log
This program will set up the IPA Server.

This includes:
  * Configure NSS to handle a self-signed CA
    WARNING: certificate management capabilities will be limited
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure DNS (bind)

To accept the default shown in brackets, press the Enter key.

Existing BIND configuration detected, overwrite? [no]: yes
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
Example: master.example.com.

Server host name [mudflap.testrelm]: 

Warning: skipping DNS resolution of host mudflap.testrelm
The domain name has been calculated based on the host name.

Please confirm the domain name [testrelm]: 

The IPA Master Server will be configured with
Hostname:    mudflap.testrelm
IP address:
Domain name: testrelm

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [TESTRELM]: 
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: 
Password (confirm): 

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: 
Password (confirm): 

Do you want to configure the reverse zone? [yes]: 
Please specify the reverse zone name [201.65.10.in-addr.arpa.]: 
Using reverse zone 201.65.10.in-addr.arpa.

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server: Estimated time 31 minutes
  [1/35]: creating directory server user
  [2/35]: creating directory server instance
  [3/35]: adding default schema
  [4/35]: enabling memberof plugin
  [5/35]: enabling referential integrity plugin
  [6/35]: enabling winsync plugin
  [7/35]: configuring replication version plugin
  [8/35]: enabling IPA enrollment plugin
  [9/35]: enabling ldapi
  [10/35]: configuring uniqueness plugin
  [11/35]: configuring uuid plugin
  [12/35]: configuring modrdn plugin
  [13/35]: enabling entryUSN plugin
  [14/35]: configuring lockout plugin
  [15/35]: creating indices
  [16/35]: configuring ssl for ds instance
  [17/35]: configuring certmap.conf
  [18/35]: configure autobind for root
  [19/35]: configure new location for managed entries
  [20/35]: restarting directory server
  [21/35]: adding default layout
  [22/35]: adding delegation layout
  [23/35]: adding replication acis
  [24/35]: creating container for managed entries
  [25/35]: configuring user private groups
  [26/35]: configuring netgroups from hostgroups
  [27/35]: creating default Sudo bind user
  [28/35]: creating default Auto Member layout
  [29/35]: creating default HBAC rule allow_all
  [30/35]: initializing group membership
  [31/35]: adding master entry
  [32/35]: configuring Posix uid/gid generation
  [33/35]: enabling compatibility plugin
Restarting IPA to initialize updates before performing deletes:
  [1/2]: stopping directory server
  [2/2]: starting directory server
done configuring dirsrv.
  [34/35]: tuning directory server
  [35/35]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC: Estimated time 30 minutes 30 seconds
  [1/14]: setting KDC account password
  [2/14]: adding sasl mappings to the directory
  [3/14]: adding kerberos entries to the DS
  [4/14]: adding default ACIs
  [5/14]: configuring KDC
  [6/14]: adding default keytypes
  [7/14]: adding default password policy
  [8/14]: creating a keytab for the directory
  [9/14]: creating a keytab for the machine
  [10/14]: exporting the kadmin keytab
  [11/14]: adding the password extension to the directory
  [12/14]: adding the kerberos master key to the directory
  [13/14]: starting the KDC
  [14/14]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
  [1/2]: starting ipa_kpasswd 
  [2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface: Estimated time 31 minutes
  [1/13]: disabling mod_ssl in httpd
  [2/13]: setting mod_nss port to 443
  [3/13]: setting mod_nss password file
  [4/13]: enabling mod_nss renegotiate
  [5/13]: adding URL rewriting rules
  [6/13]: configuring httpd
  [7/13]: setting up ssl
  [8/13]: setting up browser autoconfig
  [9/13]: publish CA cert
  [10/13]: creating a keytab for httpd
  [11/13]: configuring SELinux for httpd
  [12/13]: restarting httpd
  [13/13]: configuring httpd to start on boot
done configuring httpd.
Applying LDAP updates
Restarting IPA to initialize updates before performing deletes:
  [1/2]: stopping directory server
  [2/2]: starting directory server
done configuring dirsrv.
Restarting the directory server
Restarting the KDC
Restarting the web server
Configuring named:
  [1/9]: adding DNS container
  [2/9]: setting up our zone
  [3/9]: setting up reverse zone
  [4/9]: setting up our own record
  [5/9]: setting up kerberos principal
  [6/9]: setting up named.conf
  [7/9]: restarting named
  [8/9]: configuring named to start on boot
  [9/9]: changing resolv.conf to point to ourselves
done configuring named.
Setup complete

Next steps:
	1. You must make sure these network ports are open:
		TCP Ports:
		  * 80, 443: HTTP/HTTPS
		  * 389, 636: LDAP/LDAPS
		  * 88, 464: kerberos
		  * 53: bind
		UDP Ports:
		  * 88, 464: kerberos
		  * 53: bind
		  * 123: ntp

	2. You can now obtain a kerberos ticket using the command: 'kinit admin'
	   This ticket will allow you to use the IPA tools (e.g., ipa user-add)
	   and the web user interface.

Be sure to back up the CA certificate stored in /etc/httpd/alias/cacert.p12
The password for this file is in /etc/httpd/alias/pwdfile.txt
[root@mudflap ~]# kinit admin
Password for admin@TESTRELM: 
[root@mudflap ~]# ipa dnszone-find --all --raw
  dn: idnsname=201.65.10.in-addr.arpa.,cn=dns,dc=testrelm
  idnsname: 201.65.10.in-addr.arpa.
  idnssoamname: mudflap.testrelm.
  idnssoarname: root.201.65.10.in-addr.arpa.
  idnssoaserial: 2011061101
  idnssoarefresh: 3600
  idnssoaretry: 900
  idnssoaexpire: 1209600
  idnssoaminimum: 3600
  idnsupdatepolicy: grant TESTRELM krb5-subdomain 201.65.10.in-addr.arpa. PTR; <<<<<<<<<<<<<
  idnszoneactive: TRUE
  idnsallowdynupdate: TRUE
  nsrecord: mudflap.testrelm.
  objectclass: top
  objectclass: idnsrecord
  objectclass: idnszone

  dn: idnsname=testrelm,cn=dns,dc=testrelm
  idnsname: testrelm
  idnssoamname: mudflap.testrelm.
  idnssoarname: root.mudflap.testrelm.
  idnssoaserial: 2011061101
  idnssoarefresh: 3600
  idnssoaretry: 900
  idnssoaexpire: 1209600
  idnssoaminimum: 3600
  idnsupdatepolicy: grant TESTRELM krb5-self * A; grant TESTRELM krb5-self * AAAA;
  idnszoneactive: TRUE
  idnsallowdynupdate: TRUE
  nsrecord: mudflap.testrelm.
  objectclass: top
  objectclass: idnsrecord
  objectclass: idnszone
Number of entries returned 2
[root@mudflap ~]# 

[root@mudflap ~]# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.1.3                             Vendor: Red Hat, Inc.
Release     : 8.el6                         Build Date: Wed 02 Nov 2011 03:21:27 AM IST
Install Date: Thu 03 Nov 2011 10:02:33 AM IST      Build Host: x86-012.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.1.3-8.el6.src.rpm
Size        : 3381421                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
[root@mudflap ~]#

Comment 5 errata-xmlrpc 2011-12-06 18:29:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.