Bug 729166 - ipa-server-install creates wrong reverse zone record in LDAP
Summary: ipa-server-install creates wrong reverse zone record in LDAP
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.1
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On: 728925
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-08-08 21:38 UTC by Dmitri Pal
Modified: 2015-01-04 23:50 UTC (History)
7 users (show)

Fixed In Version: ipa-2.1.0-1.el6
Doc Type: Bug Fix
Doc Text:
Do not document
Clone Of: 728925
Environment:
Last Closed: 2011-12-06 18:29:35 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1533 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2011-12-06 01:23:31 UTC

Description Dmitri Pal 2011-08-08 21:38:44 UTC
+++ This bug was initially created as a clone of Bug #728925 +++

Description of problem:
ipa-server-install creates wrong reverse zone record in LDAP

Version-Release number of selected component (if applicable):
freeipa-server-2.0.1-2.fc15.x86_64

How reproducible:
always

Steps to Reproduce:
1. run ipa-server-install --selfsign --setup-dns --forwarder <ip>
2. select that you want to create reverse zone
  
Actual results:
Reverse zone record in LDAP looks:

# 24.34.10.in-addr.arpa., dns, atkac.brq.redhat.com
dn: idnsname=24.34.10.in-addr.arpa.,cn=dns,dc=atkac,dc=brq,dc=redhat,dc=com
idnsZoneActive: TRUE
idnsSOAexpire: 1209600
nSRecord: ipa.atkac.brq.redhat.com.
idnsSOAserial: 2011080801
idnsSOAretry: 900
idnsSOAminimum: 3600
idnsUpdatePolicy: grant ATKAC.BRQ.REDHAT.COM krb5-subdomain 24.34.10.in-addr.a
 rpa.. PTR;
idnsSOArefresh: 3600
objectClass: top
objectClass: idnsrecord
objectClass: idnszone
idnsName: 24.34.10.in-addr.arpa.
idnsAllowDynUpdate: TRUE
idnsSOArName: root.24.34.10.in-addr.arpa.
idnsSOAmName: ipa.atkac.brq.redhat.com.

Please check the idnsUpdatePolicy attribute. It contains "24.34.10.in-addr.a
 rpa.. PTR" which contains double dot. It is wrong, FQDN must be terminated only with one dot.

Expected results:
idnsUpdatePolicy attribute contains FQDN with only one dot. In my case it will be:

idnsUpdatePolicy: grant ATKAC.BRQ.REDHAT.COM krb5-subdomain 24.34.10.in-addr.arpa. PTR;

--- Additional comment from dpal@redhat.com on 2011-08-08 17:37:48 EDT ---

https://fedorahosted.org/freeipa/ticket/1591

Comment 1 Rob Crittenden 2011-08-16 13:55:34 UTC
master: bc6e12842640099aaf97200e856075b9440eae28

Comment 3 Rob Crittenden 2011-11-01 12:51:40 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Do not document

Comment 4 Gowrishankar Rajaiyan 2011-11-06 10:28:43 UTC
[root@mudflap ~]# ipa-server-install --selfsign --setup-dns --forwarder=10.65.201.77

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.

This includes:
  * Configure NSS to handle a self-signed CA
    WARNING: certificate management capabilities will be limited
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure DNS (bind)

To accept the default shown in brackets, press the Enter key.

Existing BIND configuration detected, overwrite? [no]: yes
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.


Server host name [mudflap.testrelm]: 

Warning: skipping DNS resolution of host mudflap.testrelm
The domain name has been calculated based on the host name.

Please confirm the domain name [testrelm]: 

The IPA Master Server will be configured with
Hostname:    mudflap.testrelm
IP address:  10.65.201.66
Domain name: testrelm

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [TESTRELM]: 
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: 
Password (confirm): 

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: 
Password (confirm): 

Do you want to configure the reverse zone? [yes]: 
Please specify the reverse zone name [201.65.10.in-addr.arpa.]: 
Using reverse zone 201.65.10.in-addr.arpa.

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring ntpd
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
done configuring ntpd.
Configuring directory server: Estimated time 31 minutes
  [1/35]: creating directory server user
  [2/35]: creating directory server instance
  [3/35]: adding default schema
  [4/35]: enabling memberof plugin
  [5/35]: enabling referential integrity plugin
  [6/35]: enabling winsync plugin
  [7/35]: configuring replication version plugin
  [8/35]: enabling IPA enrollment plugin
  [9/35]: enabling ldapi
  [10/35]: configuring uniqueness plugin
  [11/35]: configuring uuid plugin
  [12/35]: configuring modrdn plugin
  [13/35]: enabling entryUSN plugin
  [14/35]: configuring lockout plugin
  [15/35]: creating indices
  [16/35]: configuring ssl for ds instance
  [17/35]: configuring certmap.conf
  [18/35]: configure autobind for root
  [19/35]: configure new location for managed entries
  [20/35]: restarting directory server
  [21/35]: adding default layout
  [22/35]: adding delegation layout
  [23/35]: adding replication acis
  [24/35]: creating container for managed entries
  [25/35]: configuring user private groups
  [26/35]: configuring netgroups from hostgroups
  [27/35]: creating default Sudo bind user
  [28/35]: creating default Auto Member layout
  [29/35]: creating default HBAC rule allow_all
  [30/35]: initializing group membership
  [31/35]: adding master entry
  [32/35]: configuring Posix uid/gid generation
  [33/35]: enabling compatibility plugin
Restarting IPA to initialize updates before performing deletes:
  [1/2]: stopping directory server
  [2/2]: starting directory server
done configuring dirsrv.
  [34/35]: tuning directory server
  [35/35]: configuring directory to start on boot
done configuring dirsrv.
Configuring Kerberos KDC: Estimated time 30 minutes 30 seconds
  [1/14]: setting KDC account password
  [2/14]: adding sasl mappings to the directory
  [3/14]: adding kerberos entries to the DS
  [4/14]: adding default ACIs
  [5/14]: configuring KDC
  [6/14]: adding default keytypes
  [7/14]: adding default password policy
  [8/14]: creating a keytab for the directory
  [9/14]: creating a keytab for the machine
  [10/14]: exporting the kadmin keytab
  [11/14]: adding the password extension to the directory
  [12/14]: adding the kerberos master key to the directory
  [13/14]: starting the KDC
  [14/14]: configuring KDC to start on boot
done configuring krb5kdc.
Configuring ipa_kpasswd
  [1/2]: starting ipa_kpasswd 
  [2/2]: configuring ipa_kpasswd to start on boot
done configuring ipa_kpasswd.
Configuring the web interface: Estimated time 31 minutes
  [1/13]: disabling mod_ssl in httpd
  [2/13]: setting mod_nss port to 443
  [3/13]: setting mod_nss password file
  [4/13]: enabling mod_nss renegotiate
  [5/13]: adding URL rewriting rules
  [6/13]: configuring httpd
  [7/13]: setting up ssl
  [8/13]: setting up browser autoconfig
  [9/13]: publish CA cert
  [10/13]: creating a keytab for httpd
  [11/13]: configuring SELinux for httpd
  [12/13]: restarting httpd
  [13/13]: configuring httpd to start on boot
done configuring httpd.
Applying LDAP updates
Restarting IPA to initialize updates before performing deletes:
  [1/2]: stopping directory server
  [2/2]: starting directory server
done configuring dirsrv.
Restarting the directory server
Restarting the KDC
Restarting the web server
Configuring named:
  [1/9]: adding DNS container
  [2/9]: setting up our zone
  [3/9]: setting up reverse zone
  [4/9]: setting up our own record
  [5/9]: setting up kerberos principal
  [6/9]: setting up named.conf
  [7/9]: restarting named
  [8/9]: configuring named to start on boot
  [9/9]: changing resolv.conf to point to ourselves
done configuring named.
==============================================================================
Setup complete

Next steps:
	1. You must make sure these network ports are open:
		TCP Ports:
		  * 80, 443: HTTP/HTTPS
		  * 389, 636: LDAP/LDAPS
		  * 88, 464: kerberos
		  * 53: bind
		UDP Ports:
		  * 88, 464: kerberos
		  * 53: bind
		  * 123: ntp

	2. You can now obtain a kerberos ticket using the command: 'kinit admin'
	   This ticket will allow you to use the IPA tools (e.g., ipa user-add)
	   and the web user interface.

Be sure to back up the CA certificate stored in /etc/httpd/alias/cacert.p12
The password for this file is in /etc/httpd/alias/pwdfile.txt
[root@mudflap ~]# kinit admin
Password for admin@TESTRELM: 
[root@mudflap ~]# ipa dnszone-find --all --raw
  dn: idnsname=201.65.10.in-addr.arpa.,cn=dns,dc=testrelm
  idnsname: 201.65.10.in-addr.arpa.
  idnssoamname: mudflap.testrelm.
  idnssoarname: root.201.65.10.in-addr.arpa.
  idnssoaserial: 2011061101
  idnssoarefresh: 3600
  idnssoaretry: 900
  idnssoaexpire: 1209600
  idnssoaminimum: 3600
  idnsupdatepolicy: grant TESTRELM krb5-subdomain 201.65.10.in-addr.arpa. PTR; <<<<<<<<<<<<<
  idnszoneactive: TRUE
  idnsallowdynupdate: TRUE
  nsrecord: mudflap.testrelm.
  objectclass: top
  objectclass: idnsrecord
  objectclass: idnszone

  dn: idnsname=testrelm,cn=dns,dc=testrelm
  idnsname: testrelm
  idnssoamname: mudflap.testrelm.
  idnssoarname: root.mudflap.testrelm.
  idnssoaserial: 2011061101
  idnssoarefresh: 3600
  idnssoaretry: 900
  idnssoaexpire: 1209600
  idnssoaminimum: 3600
  idnsupdatepolicy: grant TESTRELM krb5-self * A; grant TESTRELM krb5-self * AAAA;
  idnszoneactive: TRUE
  idnsallowdynupdate: TRUE
  nsrecord: mudflap.testrelm.
  objectclass: top
  objectclass: idnsrecord
  objectclass: idnszone
----------------------------
Number of entries returned 2
----------------------------
[root@mudflap ~]# 


[root@mudflap ~]# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.1.3                             Vendor: Red Hat, Inc.
Release     : 8.el6                         Build Date: Wed 02 Nov 2011 03:21:27 AM IST
Install Date: Thu 03 Nov 2011 10:02:33 AM IST      Build Host: x86-012.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.1.3-8.el6.src.rpm
Size        : 3381421                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
[root@mudflap ~]#

Comment 5 errata-xmlrpc 2011-12-06 18:29:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html


Note You need to log in before you can comment on or make changes to this bug.