Bug 918697
| Summary: | IP lookup failing with multiple DNS entries | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Nathan Kinder <nkinder> |
| Component: | 389-ds-base | Assignee: | Rich Megginson <rmeggins> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Sankar Ramalingam <sramling> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | amsharma, jgalipea, mgregg, nhosoi, sramling |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.1.2-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 09:44:21 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Nathan Kinder
2013-03-06 18:14:27 UTC
moving all ON_QA bugs to MODIFIED in order to add them to the errata (can't add bugs in the ON_QA state to an errata). When the errata is created, the bugs should be automatically moved back to ON_QA. Hi Noriko, Request you to please add verification steps from command line. Should I make use of dnsalias keyword in ACI and use something like :: aci: (targetattr = "*") (version 3.0;acl "dnsalias example";allow (all) dns="hostA.example.com" or dnsalias="hostB.example.com" or dnslias= "hostC.example.com";) ? Thanks, Ami (In reply to Amita Sharma from comment #3) > Hi Noriko, > > Request you to please add verification steps from command line. > Should I make use of dnsalias keyword in ACI and use something like :: > aci: (targetattr = "*") (version 3.0;acl "dnsalias example";allow (all) > dns="hostA.example.com" or dnsalias="hostB.example.com" or dnslias= > "hostC.example.com";) ? Hi Ami, That's correct. You are supposed to have a host which has multiple host names associated with. And let nslookup return non-FQDN hostname (hostB.example.com or hostC.example.com in the above ACI sample). Accessing the DS from the client host used to fail with this ACI "aci: (targetattr = "*") (version 3.0;acl "...";allow (all) dns="hostA.example.com";) (Note: there was no dnsalias keyword available before.) But with the ACI you put in the comment3, the requests from the client host are always allowed. [root@dhcp201-149 export]# rpm -qa | grep 389 389-adminutil-1.1.15-3.fc19.1.x86_64 389-ds-base-debuginfo-1.3.1.6-15.el7.x86_64 389-ds-base-libs-1.3.1.6-15.el7.x86_64 389-ds-base-1.3.1.6-15.el7.x86_64 389-console-1.1.7-4.fc19.noarch [root@dhcp201-149 ~]# nslookup 10.65.201.149 Server: 10.65.201.135 Address: 10.65.201.135#53 149.201.65.10.in-addr.arpa name = hostB.testzone.com. 149.201.65.10.in-addr.arpa name = hostC.testzone.com. 149.201.65.10.in-addr.arpa name = hostA.testzone.com. [root@dhcp201-149 ~]# nslookup 10.65.201.149 Server: 10.65.201.135 Address: 10.65.201.135#53 149.201.65.10.in-addr.arpa name = hostC.testzone.com. 149.201.65.10.in-addr.arpa name = hostA.testzone.com. 149.201.65.10.in-addr.arpa name = hostB.testzone.com. [root@dhcp201-149 ~]# nslookup 10.65.201.149 Server: 10.65.201.135 Address: 10.65.201.135#53 149.201.65.10.in-addr.arpa name = hostA.testzone.com. 149.201.65.10.in-addr.arpa name = hostB.testzone.com. 149.201.65.10.in-addr.arpa name = hostC.testzone.com. [root@dhcp201-149 export]# ldapadd -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF dn: uid=amsharma1,ou=people,dc=example,dc=com cn: ams sn: ams givenname: ams objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson uid: ams mail: ams userpassword: amsamsams aci: (targetattr = "*") (version 3.0;acl "dnsalias example";allow (all) dns="hostA.example.com" or dnsalias="hostB.example.com" or dnslias="hostC.example.com";) EOF ldapsearch -x -h 10.16.96.134 -p 389 -D "uid=amsharma1,ou=people,dc=example,dc=com" -w amsamsams -b "ou=people,dc=example,dc=com" # People, example.com dn: ou=People,dc=example,dc=com objectClass: top objectClass: organizationalunit ou: People . . . . Hence marking as VERIFIED. This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |