<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 03/02/15 16:52, Craig White wrote:<br> </div> <blockquote cite="mid:BLUPR08MB4888A0EDE05B4AC9C02847FB33D0@BLUPR08MB488.namprd08.prod.outlook.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a class="moz-txt-link-freetext" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] <b>On Behalf Of </b>Roberto Cornacchia<br> <b>Sent:</b> Tuesday, February 03, 2015 5:20 AM<br> <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br> <b>Subject:</b> [Freeipa-users] basic question on DNS configuration<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">Hi guys,<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I can't wait to get freeIPA installed in our small enterprise, but I'd first like to get a couple of basic things straight. <o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">My first doubt is about the DNS configuration. Currently, we use a setting that I guess is rather common for small enterprises:<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">We own an <a moz-do-not-send="true" href="http://example.com">example.com</a> domain which is managed by the DNS of an external provider. <o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">A couple of subdomains point to public IP addresses outside our local network (e.g. <a moz-do-not-send="true" href="http://www.example.com">www.example.com</a> is hosted at our internet provider, <a moz-do-not-send="true" href="http://server1.example.com">server1.example.com</a> points at a server hosted in a datacenter, etc).<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">All the remaining subdomain (*.<a moz-do-not-send="true" href="http://example.com">example.com</a>) point at one IP which corresponds to our local router. <o:p></o:p></p> </div> <div> <p class="MsoNormal">Then we use some simple forwarding rules to forward on to machines that are behind the router (<a moz-do-not-send="true" href="http://service1.example.com">service1.example.com</a>, <a moz-do-not-send="true" href="http://desktop1.example.com">desktop1.example.com</a>, <a moz-do-not-send="true" href="http://desktop2.example.com"> desktop2.example.com</a>, etc).<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Internally, because the enterprise is rather small, we are not using a DNS, but simply /etc/hosts files on each machine. When they can't resolve <a moz-do-not-send="true" href="http://whatever.example.com">whatever.example.com</a>, then the request goes to the external DNS.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">(sorry about the long-ish background information, probably this configuration is commonly named somehow, but I don't know how)<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Now, a first simple question for you guys would be: <o:p></o:p></p> </div> <div> <p class="MsoNormal">When installing freeIPA, with DNS, is the network configuration above still advisable? Can there be any problem? Or should I rather use a different domain for the internal network (I would really NOT like this option, but I'm very interested to know why I should, if that is the case).<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">A second basic question is:<o:p></o:p></p> </div> <div> <p class="MsoNormal">Would you see any potential problem in installing freeIPA on a FC21 Server which currently hosts Atlassian Jira + Atlassian Stash (therefore git repositories) + the required mysql databases?<o:p></o:p></p> </div> <div> <p class="MsoNormal">My guess would be that they would not interfere, as:<o:p></o:p></p> </div> <div> <p class="MsoNormal">- httpd (and related ports) is currently unused)<o:p></o:p></p> </div> <div> <p class="MsoNormal">- Both Jira and Stash use thier own tomcat installation on custom ports<o:p></o:p></p> </div> <div> <p class="MsoNormal">- mysql shouldn't be a problem?<o:p></o:p></p> </div> <div> <p class="MsoNormal">- The machine isn't overloaded at all (4-5 developers use those services)<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Am I overlooking something? Obviously I'd rather have a dedicated freeIPA server, but if the above mentioned coexistence isn't a problem, then this would be more cost-effective.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Thank you very much for your help, I'm looking forward to this upgrade.<o:p></o:p></p> </div> <div> <div style="mso-element:para-border-div;border:none;border-bottom:solid windowtext 1.0pt;padding:0in 0in 1.0pt 0in"> <p class="MsoNormal" style="border:none;padding:0in">Roberto<o:p></o:p></p> </div> </div> <div> <p class="MsoNormal"><span style="color:#1F497D">I would recommend that you create a ‘local’ domain for your internal LAN though you certainly can use your domain name for both the internal LAN and the external world. Obviously you would have to create ‘manual’ entries in DNS for the external servers (like <a moz-do-not-send="true" href="http://www.example.com">www.example.com</a>) so your internal LAN systems can resolve it. If you have a ‘local’ domain for your internal LAN, there aren’t name collisions, no need to manually maintain DNS entries for off-LAN servers and no confusion of essentially faking your LAN systems into believing that the IPA server is authoritative for example.com domain when the rest of the world thinks otherwise. The choice is yours.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D">As for using F21 – you get the latest version of FreeIPA which is something I wish I had here.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D">Git / Stash / Jira represent a fairly hefty memory footprint even if there isn’t that much CPU load. If you have the RAM and cpu cores to handle tossing FreeIPA onto the stack, go for it. You probably will want a replica too as the replica keeps your LAN running if the primary server is unavailable for whatever reason and it minimizes backup needs substantially.<o:p></o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="color:#1F497D">Craig</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> </div> <br> <fieldset class="mimeAttachmentHeader"></fieldset> <br> </blockquote> Hello,<br> <br> For using 'local.' domain please read following message, to avoid issues on Fedora:<br> <a class="moz-txt-link-freetext" href="https://www.redhat.com/archives/freeipa-users/2015-February/msg00010.html">https://www.redhat.com/archives/freeipa-users/2015-February/msg00010.html</a><br> <br> You cant use 'example.com' zone for internal IPA DNS.<br> <br> You can create your internal sub zone, like 'internal.example.com', 'corp.example.com', where IPA managed hosts will be added. It is preferred solution instead of creating '.local' hostnames. Then you can set up global forwarder on IPA DNS to your external DNS, where other names than 'internal.example.com' will be resolved.<br> <br> If I understand correctly, it is internal network, so you do not need public resolvable domain names.<br> <pre class="moz-signature" cols="72">-- Martin Basti</pre> </body> </html>