freeipa

#5760 ipa-replica-install script is ignoring the nameserver entries in resolv.conf file
Closed: invalid by rcritten. Opened by pvoborni.

Closed: invalid
Reopen Issue

ipa-replica-install script is ignoring the nameserver entries in resolv.conf file and trying to communicate with master IPA server directly.

Installation of replica in DMZ may fail, if replica tries to contact a master server which is behind a firewall.

E.g.

2016-02-26T15:06:25Z DEBUG Check forward/reverse DNS resolution
2016-02-26T15:06:25Z DEBUG Search DNS server master.test.local.test (['10.10.10.20', '10.10.10.20', '10.10.10.20']) for replica.test.local.test
2016-02-26T15:07:25Z ERROR Could not resolve hostname replica.test.local.test using DNS. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.)

10.10.10.20 is in this case a master server.

It works with nameservers in resolv.conf.

triage:

pspacek: I believe that IPA should take values from resolv.conf and do not try to outsmart admin.

Reasoning:

  1. IPA does not have sufficient information to decide on its own which servers should be used (see the DMZ example in the bug).
  2. IPA is not a network configuration tool.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1314820 (Red Hat Enterprise Linux 7)

4.4.0 was released, moving open tickets to 4.4.1

moving out tickets not implemented in 4.4.1

4.4.2 is a stabilization milestone. If this bug is important stabilization bug then please put it to NEEDS TRIAGE milestone for retriage.

Metadata Update from @pvoborni:
- Issue assigned to mbasti
- Issue set to the milestone: FreeIPA 4.5 backlog

Metadata Update from @mbasti:
- Assignee reset

ipa-replica-install has --no-host-dns option to skip the DNS check for special environments like this one.

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
High
defect
Installation
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.