<div dir="ltr">Any other ideas? I just spun up a new VM and took the defaults on everything while running ipa-server-install (the defaults did make sense) and my new VM can't resolve -anything- in the domain in which it lives. The "old" VM (running the same versions of everything on the same OS) can't even resolve the clients I have registered with it!<div><br></div><div>So I'm pretty frustrated and am wondering, what _exactly_ is the role of bind in the IPA server and how is it expected to know anything about the local DNS domain without becoming a bind slave server?</div><div><br></div><div>Thanks.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 2, 2014 at 11:58 AM, Petr Spacek <span dir="ltr"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 2.12.2014 17:36, Martin Basti wrote:<br>
> On 02/12/14 17:28, Matthew Herzog wrote:<br>
>> I just realized that my IPA servers cannot resolve ANY servers in my domain.<br>
>> What do I need to do to fix this? Below is my named.conf.<br>
>><br>
>><br>
>> options {<br>
>> // turns on IPv6 for port 53, IPv4 is on by default for all ifaces<br>
>> listen-on-v6 {any;};<br>
>><br>
>> // Put files that named is allowed to write in the data/ directory:<br>
>> directory "/var/named"; // the default<br>
>> dump-file "data/cache_dump.db";<br>
>> statistics-file "data/named_stats.txt";<br>
>> memstatistics-file "data/named_mem_stats.txt";<br>
>><br>
>> forward first;<br>
>> forwarders {<br>
>> 10.100.8.41;<br>
>> 10.100.8.40;<br>
>> 10.100.4.13;<br>
>> 10.100.4.14;<br>
>> 10.100.4.19;<br>
>> 10.100.4.44;<br>
>> };<br>
>><br>
>> // Any host is permitted to issue recursive queries<br>
>> allow-recursion { any; };<br>
>><br>
>> tkey-gssapi-keytab "/etc/named.keytab";<br>
>> pid-file "/run/named/named.pid";<br>
>> };<br>
>><br>
>> /* If you want to enable debugging, eg. using the 'rndc trace' command,<br>
>> * By default, SELinux policy does not allow named to modify the /var/named<br>
>> directory,<br>
>> * so put the default debug log file in data/ :<br>
>> */<br>
>> logging {<br>
>> channel default_debug {<br>
>> file "data/named.run";<br>
>> severity dynamic;<br>
>> print-time yes;<br>
>> };<br>
>> };<br>
>> };<br>
>><br>
>> zone "." IN {<br>
>> type hint;<br>
</div></div>>> file "<a href="http://named.ca" target="_blank">named.ca</a> <<a href="http://named.ca" target="_blank">http://named.ca</a>>";<br>
<span class="">>> };<br>
>><br>
>> include "/etc/named.rfc1912.zones";<br>
>><br>
>> dynamic-db "ipa" {<br>
>> library "ldap.so";<br>
>> arg "uri ldapi://%2fvar%2frun%2fslapd-BO3-E-BOZO-COM.socket";<br>
>> arg "base cn=dns, dc=bo3,dc=e-bozo,dc=com";<br>
>> arg "fake_mname <a href="http://freeipa-poc01.bo3.e-bozo.com" target="_blank">freeipa-poc01.bo3.e-bozo.com</a><br>
</span>>> <<a href="http://freeipa-poc01.bo3.e-bozo.com" target="_blank">http://freeipa-poc01.bo3.e-bozo.com</a>>.";<br>
<span class="">>> arg "auth_method sasl";<br>
>> arg "sasl_mech GSSAPI";<br>
>> arg "sasl_user DNS/<a href="http://freeipa-poc01.bo3.e-bozo.com" target="_blank">freeipa-poc01.bo3.e-bozo.com</a><br>
</span>>> <<a href="http://freeipa-poc01.bo3.e-bozo.com" target="_blank">http://freeipa-poc01.bo3.e-bozo.com</a>>";<br>
<span class="">>> arg "serial_autoincrement yes";<br>
>> };<br>
>><br>
>><br>
>><br>
>><br>
> Hello,<br>
><br>
> which version ipa do you use? which platform? Which version bind-dyndb-ldap?<br>
><br>
> Can you run these commands, and check if there any errors?<br>
> ipactl status<br>
> systemctl status named (respectively journalctl -u named)<br>
<br>
</span>We also may want to see information listed on page<br>
<a href="https://fedorahosted.org/bind-dyndb-ldap/wiki/BugReporting" target="_blank">https://fedorahosted.org/bind-dyndb-ldap/wiki/BugReporting</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Petr^2 Spacek<br>
<br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><h1 style="margin-top:0pt;margin-right:0pt;margin-bottom:0pt;margin-left:0pt"></h1>If life gives you melons, you may be dyslexic.
</div></div>
</div>