freeipa

#9783 PTR lookup fails after 'ipa host-add --ip-address'
Opened by jstephen. Modified

Open
Close Issue

Issue

SSSD has a test that started failing intermittently due to a DNS reverse lookup failure, which causes a subsequent SSSD operation to fail.

The test performs an 'ipa host-add' for a new host with the '--ip-address' argument. The IP address is added to a reverse zone that already exists.

[root@master /]# ipa dnszone-find
  Zone name: 251.255.10.in-addr.arpa.
  Active zone: True
  Authoritative nameserver: master.ipa.test.
  Administrator e-mail address: hostmaster
  SOA serial: 1747067092
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant IPA.TEST krb5-subdomain 251.255.10.in-addr.arpa. PTR;
  Dynamic update: False
  Allow query: any;
  Allow transfer: none;

Host-add command below:

                                                  Command: ipa host-add ssh-host.ipa.test --ip-address 10.255.251.10 --sshpubkey 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCI56aGtsWIbjz8XhODRT8NAio+TIHMXdiKoG6SdCtVlCR6xNP6gXgmChVWJ9DXlOF3WztOBf9om5SsPGX73/to=' --sshpubkey 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeSgRv4Vyq6ehrcA8hc6LFd9cUR1H3vdtH+WMJXvf1h' --sshpubkey 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4O+2dXWi4iTJR3vlsqZE9707K0sKTeEnWHyMoWUY0N/p6TZgxoLWfUW8XPbj4Yt4BaI6M48/jWZjHjXPJjLfgon3BT5LvyZHrlnN34APcZ7+r73mMt4pIPI7WnzqJluRGgcdEQuJhaSUbTGBUoHwCmp5JAREqWMappkwwSo9QQEzeAxT58dLTEyENTxB1DCP7sJShZd9p+37+5XJ1m1fkpnpDb/JMnTX9jSApk6r2DOZgcpX2aNFMbxSQ5zASfhmzJCfx52c97GD85Zx+LMXBJ4KzNKAbvTsruFj3k5jh7pYvqZseUuReBDCjSGQ4Q4MDBm+XAPbCNfQcgLPo678kkIFK8bZfKLDeJH4g64EO1xHGxBhmcYiXkc0gyqpECKekiUb3ltkyUA/R+Q8Jo+Zr70IHEM2fFvyiIqyz2Nx3PH/FTLDSBguQuEtzBHcMfb9/sO8lbofJneAfsAk3C3TYxqJ176xYqk4C24pB8UrOAflni+P0RqS1Zwte2u3ZD0E='
                                                  Input: None
                                                  Working directory: None
                                                  Extra environment: 
INFO     2025-05-12 12:19:23,772  master.ipa.test Previous command completed with exit code 0
                                                  Output: |
                                                    ------------------------------
                                                    Added host "ssh-host.ipa.test"
                                                    ------------------------------
                                                      Host name: ssh-host.ipa.test
                                                      Principal name: host/ssh-host.ipa.test@IPA.TEST
                                                      Principal alias: host/ssh-host.ipa.test@IPA.TEST
                                                      SSH public key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCI56aGtsWIbjz8XhODRT8NAio+TIHMXdiKoG6SdCtVlCR6xNP6gXgmChVWJ9DXlOF3WztOBf9om5SsPGX73/to=, ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeSgRv4Vyq6ehrcA8hc6LFd9cUR1H3vdtH+WMJXvf1h, ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4O+2dXWi4iTJR3vlsqZE9707K0sKTeEnWHyMoWUY0N/p6TZgxoLWfUW8XPbj4Yt4BaI6M48/jWZjHjXPJjLfgon3BT5LvyZHrlnN34APcZ7+r73mMt4pIPI7WnzqJluRGgcdEQuJhaSUbTGBUoHwCmp5JAREqWMappkwwSo9QQEzeAxT58dLTEyENTxB1DCP7sJShZd9p+37+5XJ1m1fkpnpDb/JMnTX9jSApk6r2DOZgcpX2aNFMbxSQ5zASfhmzJCfx52c97GD85Zx+LMXBJ4KzNKAbvTsruFj3k5jh7pYvqZseUuReBDCjSGQ4Q4MDBm+XAPbCNfQcgLPo678kkIFK8bZfKLDeJH4g64EO1xHGxBhmcYiXkc0gyqpECKekiUb3ltkyUA/R+Q8Jo+Zr70IHEM2fFvyiIqyz2Nx3PH/FTLDSBguQuEtzBHcMfb9/sO8lbofJneAfsAk3C3TYxqJ176xYqk4C24pB8UrOAflni+P0RqS1Zwte2u3ZD0E=
                                                      SSH public key fingerprint: SHA256:QC8XilGyktQmXT84um5KuQjwvYjMAMRWpxqwbhpNNHM (ecdsa-sha2-nistp256), SHA256:LhkKZlFPqON0ZauGekLe104NB0vjZsPfYLITECrcvMk (ssh-ed25519), SHA256:YmQhehyPg99XDUodS6vSsSlknMaHT3TEWvfRqQmWC4c (ssh-rsa)

After the host-add operation, this command will fail 'dig -t PTR 10.251.255.10.in-addr.arpa.' 

INFO     2025-05-12 11:55:01,713      client.test Previous command completed with exit code 0
                                                  Output: |
                                                    ; <<>> DiG 9.18.33 <<>> -t PTR 10.251.255.10.in-addr.arpa.
                                                    ;; global options: +cmd
                                                    ;; Got answer:
                                                    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35206
                                                    ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
                                                    ;; OPT PSEUDOSECTION:
                                                    ; EDNS: version: 0, flags:; udp: 1232
                                                    ; COOKIE: 1255ffb09e6b35bb01000000682219d5b6404950705b77ca (good)
                                                    ;; QUESTION SECTION:
                                                    ;10.251.255.10.in-addr.arpa.    IN  PTR
                                                    ;; AUTHORITY SECTION:
                                                    251.255.10.in-addr.arpa. 3600   IN  SOA master.ipa.test. hostmaster.251.255.10.in-addr.arpa. 1747065245 3600 900 1209600 3600
                                                    ;; Query time: 1 msec
                                                    ;; SERVER: 172.16.100.1#53(172.16.100.1) (UDP)
                                                    ;; WHEN: Mon May 12 15:55:01 UTC 2025
                                                    ;; MSG SIZE  rcvd: 145

Adding a sleep (10), or sleep (5) after the 'ipa host-add' operation does not help.

The workaround we found to make the test green is to restart 'named' on the IPA server: https://github.com/SSSD/sssd/pull/7934/

With the workaround, the same dig command above returns the expected answer consistently:

                      ;; ANSWER SECTION: 
                     10.251.255.10.in-addr.arpa. 86400 IN    PTR ssh-host.ipa.test.

Version/Release/Distribution

[root@master /]# rpm -q freeipa-server
freeipa-server-4.12.2-13.fc42.x86_64
[root@master /]# rpm -q bind
bind-9.18.36-1.fc42.x86_64

[root@client /]# rpm -q freeipa-client
freeipa-client-4.12.2-13.fc42.x86_64

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.