freeipa

#9805 client: DNSSEC validation turned on for unbound by default
Closed: fixed by frenaud. Opened by twoerner.

Closed: fixed
Reopen Issue

Issue

Installing IPA client using an IPA DNS server with DoT set in /etc/resolv.conf results in deployment issue.

Enrolled in IPA realm COS10.LOCAL
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Hostname (ipaclient1.cos10.local) does not have A/AAAA record.
DNS encryption support was enabled. Unbound is configured to listen on 127.0.0.55:53 and forward to upstream DoT servers.
[Errno -2] Name or service not known
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

Steps to Reproduce

ipa-client-install --unattended --principal=admin --password=SomeADMINpassword --domain=cos10.local --dns-over-tls

Version/Release/Distribution

ipa-client-encrypted-dns-4.12.2-17.el10.x86_64
ipa-client-4.12.2-17.el10.x86_64

Additional info:

error log:

Jun 12 15:46:35 ipaclient1 unbound-checkconf[2306]: unbound-checkconf: no errors in /etc/unbound/unbound.conf
Jun 12 15:46:35 ipaclient1 unbound[2307]: [2307:0] notice: init module 0: ipsecmod
Jun 12 15:46:35 ipaclient1 unbound[2307]: [2307:0] notice: init module 1: validator
Jun 12 15:46:35 ipaclient1 unbound[2307]: [2307:0] notice: init module 2: iterator
Jun 12 15:46:35 ipaclient1 unbound[2307]: [2307:0] info: start of service (unbound 1.20.0).
Jun 12 15:46:35 ipaclient1 systemd[1]: Started unbound.service - Unbound recursive Domain Name Server.
Jun 12 15:46:35 ipaclient1 systemd[1]: Reached target nss-lookup.target - Host and Network Name Lookups.
Jun 12 15:46:35 ipaclient1 unbound[2307]: [2307:0] info: generate keytag query _ta-4f66. NULL IN
Jun 12 15:46:36 ipaclient1 unbound[2307]: [2307:0] info: validation failure <ipaserver.cos10.local. A IN>: no NSEC3 records from 192.168.155.2 for DS local. while building chain of trust
Jun 12 15:46:36 ipaclient1 unbound[2307]: [2307:0] info: validation failure <ipaserver.cos10.local. AAAA IN>: no NSEC3 records from 192.168.155.2 for DS local. while building chain of trust

Fix proposal

Unbound is by default configured to do DNSSEC validation with the "validator" module.

diff --git a/client/share/unbound.conf.template b/client/share/unbound.conf.template
index 166036f65..a9fb8bafe 100644
--- a/client/share/unbound.conf.template
+++ b/client/share/unbound.conf.template
@@ -3,6 +3,7 @@ server:
     tls-upstream: yes
     interface: 127.0.0.55
     log-servfail: yes
+    module-config: "iterator"
 forward-zone:
     name: "."
     forward-tls-upstream: yes

The default is "validator iterator" which turns on DNSSEC validation.

When the server is built with EDNS client subnet support this should be changed to "subnetcache iterator" according to the unbound man page.

master:

  • 4b877c7ccd68a829b3d05aa3b5de01df5730a4dd ipa-client-install: New --no-dnssec-validation option
  • 0bc089681c77c7c65412ca8f02b724ff9088e0f7 ipaserver/install/dns.py: Allow to Turn off DNSSEC validation for unbound

ipa-4-12:

  • 5db3bfafe6c12222b656f67d5ae3f6745e5f2644 ipa-client-install: New --no-dnssec-validation option
  • 0412252dd9a27138411e942305cdf54e70c06f27 ipaserver/install/dns.py: Allow to Turn off DNSSEC validation for unbound

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-95374, https://issues.redhat.com/browse/RHEL-100450
- Issue status updated to: Open (was: Closed)

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.