Bug 811074 - ipa dns delegation and bind-dyndb-ldap plugin ?
Summary: ipa dns delegation and bind-dyndb-ldap plugin ?
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: bind-dyndb-ldap
Version: 6.2
Hardware: Unspecified
OS: Unspecified
medium
high
Target Milestone: rc
: ---
Assignee: Adam Tkac
QA Contact: IDM QE LIST
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-10 02:48 UTC by Marc Sauton
Modified: 2018-11-29 21:16 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-20 13:52:45 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0837 normal SHIPPED_LIVE bind-dyndb-ldap bug fix and enhancement update 2012-06-19 20:49:06 UTC

Description Marc Sauton 2012-04-10 02:48:46 UTC
Description of problem:

It seem like IPA DNS delegation may not work as expected.
If I have a test system running named to host a zone like sub1.example.com, and add a A and NS records on an IPA server to delegate that zone to the test system, the IPA server does not seem to be able to resolve DNS entries recorded in the zone sub1.example.com

initially reported in the FreeIPA user list, reference:
https://www.redhat.com/archives/freeipa-users/2012-February/msg00015.html


Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 6.2 (Santiago)
Linux ipaserver1.example.com 2.6.32-220.el6.x86_64 #1 SMP Wed Nov 9 08:03:13 EST 2011 x86_64 x86_64 x86_64 GNU/Linux

ipa-server-2.1.3-9.el6.x86_64
krb5-server-1.9-22.el6_2.1.x86_64
krb5-server-ldap-1.9-22.el6_2.1.x86_64
pki-java-tools-9.0.3-20.el6.noarch
pki-symkey-9.0.3-20.el6.x86_64
krb5-libs-1.9-22.el6_2.1.x86_64
ipa-client-2.1.3-9.el6.x86_64
pki-common-9.0.3-20.el6.noarch
pki-silent-9.0.3-20.el6.noarch
ipa-server-selinux-2.1.3-9.el6.x86_64
ipa-pki-common-theme-9.0.3-7.el6.noarch
krb5-pkinit-openssl-1.9-22.el6_2.1.x86_64
pam_krb5-2.3.11-9.el6.x86_64
krb5-workstation-1.9-22.el6_2.1.x86_64
ipa-python-2.1.3-9.el6.x86_64
pki-setup-9.0.3-20.el6.noarch
pki-util-9.0.3-20.el6.noarch
pki-selinux-9.0.3-20.el6.noarch
ipa-admintools-2.1.3-9.el6.x86_64
pki-ca-9.0.3-20.el6.noarch
ipa-pki-ca-theme-9.0.3-7.el6.noarch
pki-native-tools-9.0.3-20.el6.x86_64


How reproducible:
aleays


Steps to Reproduce:

1. have a test system with named, test.sub1.example.com
vi /etc/named.conf
...snip...
zone "sub1.example.com" IN {
        type master;
        file "data/sub1.example.com";
        allow-update { none; };
        allow-query { otherhosts; };
        allow-transfer { none; };
};

zone "5.14.10.in-addr.arpa" IN {
        type master;
        file "data/5.14.10.in-addr.arpa";
        allow-update { none; };
        allow-query { otherhosts; };
        allow-transfer { none; };
};

2. on test.sub1.example.com
create a named configuration, to host a sub domain, sub1.example.com, with an A record for test.sub1.example.com and test2.example.com

vi /var/named/chroot/var/named/data/sub1.example.com
;
@               IN      SOA     ipaclient2.example.com. dns.ipaclient2.example.com. (
                2010040108
                10800
                3600
                604800
                86400 )
;
                IN NS ipaclient2.example.com.
;
ipaclient2            IN A 10.14.5.39
test            IN A 10.14.5.39
test2            IN A 10.14.5.39
;

/etc/init.d/named start


3. have an IPA server already configured, ipaserver1.example.com

4. add A and NS NDS records on ipaserver1.example.com to delegate sub1.example.com

[root@ipaserver1 ~]# kinit admin
Password for admin@EXAMPLE.COM:
[root@ipaserver1 ~]# 
[root@ipaserver1 ~]# ipa dnsrecord-add example.com test.sub1 --a-rec=10.14.5.39
  Record name: test.sub1
  A record: 10.14.5.39
[root@ipaserver1 ~]# 
[root@ipaserver1 ~]# host test.sub1.example.com
test.sub1.example.com has address 10.14.5.39
[root@ipaserver1 ~]#
[root@ipaserver1 ~]# ipa dnsrecord-add example.com sub1 --ns-rec=test.sub1.example.com
  Record name: sub1
  NS record: test.sub1.example.com
[root@ipaserver1 ~]#


5. verify configuration, positive test to get A record of DNS server for sub1.example.com :

[root@ipaserver1 ~]# dig -t a test.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39449
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION: 
;test.sub1.example.com.         IN      A

;; ANSWER SECTION:   
test.sub1.example.com.  86400   IN      A       10.14.5.39

;; AUTHORITY SECTION:
example.com.            86400   IN      NS      ipaserver1.example.com.

;; ADDITIONAL SECTION:
ipaserver1.example.com. 86400   IN      A       10.14.5.36

;; Query time: 14 msec
;; SERVER: 10.14.5.36#53(10.14.5.36)
;; WHEN: Mon Apr  9 19:27:07 2012
;; MSG SIZE  rcvd: 96

[root@ipaserver1 ~]# 



6. verify a DNS entry test2.sub1.example.com exist in test.sub1.example.com :


[root@ipaserver1 ~]# dig -t a test2.sub1.example.com @test.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test2.sub1.example.com @test.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36070
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION: 
;test2.sub1.example.com.                IN      A

;; ANSWER SECTION:   
test2.sub1.example.com. 86400   IN      A       10.14.5.39

;; AUTHORITY SECTION:
sub1.example.com.       86400   IN      NS      ipaclient2.example.com.

;; Query time: 2 msec
;; SERVER: 10.14.5.39#53(10.14.5.39)
;; WHEN: Mon Apr  9 19:29:04 2012
;; MSG SIZE  rcvd: 81

[root@ipaserver1 ~]# 


7. do the same test but query the IPA server, it does not resolve.


Actual results:

[root@ipaserver1 ~]# dig -t a test2.sub1.example.com

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6 <<>> -t a test2.sub1.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43595
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION: 
;test2.sub1.example.com.                IN      A

;; AUTHORITY SECTION:
example.com.            3600    IN      SOA     ipaserver1.example.com. admin.example.com. 2012 3600 900 1209 3600

;; Query time: 2 msec
;; SERVER: 10.14.5.36#53(10.14.5.36)
;; WHEN: Mon Apr  9 19:28:37 2012
;; MSG SIZE  rcvd: 93

[root@ipaserver1 ~]# 



Expected results:

DNS resolution of delegated zones.


Additional info:

issue with bind-dyndb-ldap plugin ?

Comment 4 Petr Spacek 2012-04-10 11:21:42 UTC
Please specify exact version of bind-dyndb-ldap plugin.

You can use this command:
rpm -q bind-dyndb-ldap

Comment 6 Marc Sauton 2012-04-10 17:54:16 UTC
ah, yes, forgot this small detail:
bind-dyndb-ldap-0.2.0-7.el6.x86_64
this is RHEL6.2

Comment 11 Adam Tkac 2012-04-11 09:37:18 UTC
(In reply to comment #7)
> side note: I was wondering if the step 4 on the IPA server is
> correct/sufficient, add a A record for a named server, and a NS record for a
> zone, with:
> ipa dnsrecord-add example.com test.sub1 --a-rec=10.14.5.39
> ipa dnsrecord-add example.com sub1 --ns-rec=test.sub1.example.com

Yes, this is correct delegation glue.

Comment 18 Petr Spacek 2012-04-11 20:43:59 UTC
Second issue (NS record for subdomain cannot contain name in subdomain itself) is also present in bind-dyndb-ldap-1.1.0-0.5.b1.el6.

Comment 20 Adam Tkac 2012-04-12 13:06:27 UTC
After further inspection delegation still doesn't work in the latest RHEL 6.3 build. This patch fixes it:

http://git.fedorahosted.org/git?p=bind-dyndb-ldap.git;a=commit;h=9bcd08be60aad4cb55393d494887b97bd31526be

Comment 30 Gowrishankar Rajaiyan 2012-05-28 15:16:09 UTC
Verified: ipa-server-2.2.0-16.el6.x86_64

Comment 32 errata-xmlrpc 2012-06-20 13:52:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0837.html


Note You need to log in before you can comment on or make changes to this bug.