<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hello, records are updated by nslookup do you have allowed dynamic updates in the zone settings? Martin <div class="moz-cite-prefix">On 06.05.2016 21:18, Sean Hogan wrote: </div> <blockquote cite="mid:201605061918.u46JIOhO018136@d03av04.boulder.ibm.com" type="cite"> Hi All, Wondering if someone knows how the SSHFPs of a box are getting uploaded to IPA during ipa-client-install --enable-dns-updates? Is it going over port 389,636,22? Have an issue that on one network my enrolls work fine and everything gets updated. A new network was put in place but still part of the same domain and I get SSHFP failed to upload. I was assuming this has something to do with DNS but Network team says bi directional port 53 is good and I can nslookup. Both new and old networks point to the same IPA DNS server for enrolling. The IPs of the new network still fall in my reverse zone. So My DNS is setup with: test.local 10.in-addr.arpa and the IP scheme for new net is 10.5.x.x, old net is 10.35.x.x Results of current Network <table border="0" cellpadding="0" cellspacing="0"> <tbody> <tr valign="top"> <td width="431">Enrolled in IPA realm TEST.LOCAL Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TEST.LOCAL trying <a moz-do-not-send="true" href="https://rtpvxl0068.watson.local/ipa/xml">https://bob.test.local/ipa/xml</a> Forwarding 'env' to server u'<a class="moz-txt-link-freetext" href="https://bob.test.local/ipa/xml">https://bob.test.local/ipa/xml</a>' DNS server record set to: dingle.test.local -> IP of dingle Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Forwarding 'host_mod' to server u'<a class="moz-txt-link-freetext" href="https://bob.test.local/ipa/xml">https://bob.test.local/ipa/xml</a>' SSSD enabled Configuring test.local as NIS domain Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete. </td> </tr> </tbody> </table> Results of New network <table border="0" cellpadding="0" cellspacing="0"> <tbody> <tr valign="top"> <td width="431">Enrolled in IPA realm TEST.LOCAL Attempting to get host TGT... Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm TEST.LOCAL trying <a moz-do-not-send="true" href="https://rtpvxl0068.watson.local/ipa/xml">https://bob.test.local/ipa/xml</a> Forwarding 'env' to server u'<a class="moz-txt-link-freetext" href="https://bob.test.local/ipa/xml">https://bob.test.local/ipa/xml</a>' Failed to update DNS records. Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub Forwarding 'host_mod' to server u'<a class="moz-txt-link-freetext" href="https://bob.test.local/ipa/xml">https://bob.test.local/ipa/xml</a>' Could not update DNS SSHFP records. SSSD enabled Configuring test.local as NIS domain Configured /etc/openldap/ldap.conf NTP enabled Configured /etc/ssh/ssh_config Configured /etc/ssh/sshd_config Client configuration complete </td> </tr> </tbody> </table> Sean Hogan <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>