<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif">This is fixed. Found an issue with BIND Update Policy and got some reference from "<a href="https://www.redhat.com/archives/freeipa-users/2015-May/msg00399.html">https://www.redhat.com/archives/freeipa-users/2015-May/msg00399.html</a>" . Working fine now.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style=""><font face="verdana, sans-serif">grant <a href="http://KLIKPAY.INT">KLIKPAY.INT</a> krb5-self * A; grant <a href="http://KLIKPAY.INT">KLIKPAY.INT</a> krb5-self * AAAA; grant <a href="http://KLIKPAY.INT">KLIKPAY.INT</a> krb5-self * SSHFP;</font><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><i style="font-size:12.8000001907349px"><span style="font-family:verdana,sans-serif">Best Regards,</span></i><br></div><div dir="ltr"><div style="font-size:12.8000001907349px"><div><i><span style="font-family:verdana,sans-serif">__________________________________________<br></span></i></div><i><span style="font-family:verdana,sans-serif">Yogesh Sharma<br></span></i></div><span style="font-size:12.8000001907349px;font-family:verdana,sans-serif"><i>Email: <a href="mailto:yks0000@gmail.com" target="_blank">yks0000@gmail.com</a> | Web: <span style="color:rgb(0,0,0)"><a href="http://www.initd.in/" target="_blank">www.initd.in</a> </span></i></span><br></div><div dir="ltr"><span style="font-size:12.8000001907349px;font-family:verdana,sans-serif"><i><span style="color:rgb(0,0,0)"><br></span></i></span></div><div><span style="font-size:12.8000001907349px;font-family:verdana,sans-serif"><i><span style="color:rgb(0,0,0)">RHCE, VCE-CIA, RACKSPACE CLOUD U Certified</span></i></span></div><div dir="ltr"><br></div><div dir="ltr"><a href="https://www.fb.com/yks0000" target="_blank"><img src="http://i.imgbox.com/ojTDSuw0.gif" alt=""></a> <a href="http://in.linkedin.com/in/yks0000" target="_blank"><img src="http://i.imgbox.com/fHLDBlyz.gif"></a> <a href="https://twitter.com/checkwithyogesh" target="_blank"><img src="http://i.imgbox.com/vTX3eOJ5.gif"></a> <a href="http://google.com/+YogeshSharmaOnGooglePlus" target="_blank"><img src="http://i.imgbox.com/W2bQouRN.gif"></a></div></div></div></div></div></div></div></div></div> <br><div class="gmail_quote">On Thu, Jan 7, 2016 at 5:13 PM, Yogesh Sharma <span dir="ltr"><<a href="mailto:yks0000@gmail.com" target="_blank">yks0000@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif">List,</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">I have a FreeIPA Server in domain/Realm <b><i><a href="http://klikpay.int" target="_blank">klikpay.int</a></i></b>. We have few hosts/client in another domain <b><a href="http://sd.int" target="_blank">sd.int</a>. </b>As the number of servers are very few we do not want to have a new FreeIPA server for same, and I think having a common will be easy to manage.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">I have create a separate forward and reverse zone for <a href="http://sd.int" target="_blank">sd.int</a>, and able to register the server successfully, but somehow, while registering a client, we noticed that the <a href="http://sd.int" target="_blank">sd.int</a> domain servers are still going in <a href="http://klikpay.int" target="_blank">klikpay.int</a> realm only. Further, they are not getting registered with DNS also.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Below are the some test I executed:</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default"><div class="gmail_default">Test-1</div><div class="gmail_default"><br></div><div style="font-family:verdana,sans-serif"><div><b><i>ipa-client-install --principal=admin --password=xxxxxxxxxxxxx --mkhomedir --no-ntp</i></b></div><div>DNS discovery failed to determine your DNS domain</div><div>Provide the domain name of your IPA server (ex: <a href="http://example.com" target="_blank">example.com</a>): </div></div></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Test-2</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><div class="gmail_default"><b><i>ipa-client-install --principal=admin --password=xxxxxxxxxxxxxxxxxxx --mkhomedir --no-ntp --domain=<a href="http://sd.int" target="_blank">sd.int</a></i></b></div><div class="gmail_default">Provide your IPA server name (ex: <a href="http://ipa.example.com" target="_blank">ipa.example.com</a>): <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a></div><div class="gmail_default">Failed to verify that <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> is an IPA Server.</div><div class="gmail_default">This may mean that the remote server is not up or is not reachable due to network or firewall settings.</div><div class="gmail_default">Please make sure the following ports are opened in the firewall settings:</div><div class="gmail_default"> TCP: 80, 88, 389</div><div class="gmail_default"> UDP: 88 (at least one of TCP/UDP ports 88 has to be open)</div><div class="gmail_default">Also note that following ports are necessary for ipa-client working properly after enrollment:</div><div class="gmail_default"> TCP: 464</div><div class="gmail_default"> UDP: 464, 123 (if NTP enabled)</div><div class="gmail_default">Installation failed. Rolling back changes.</div><div class="gmail_default">IPA client is not configured on this system.</div><div class="gmail_default"><br></div><div class="gmail_default">However, I can confirm all ports are reachable </div><div><b><i><br></i></b></div></div><div class="gmail_default"><div class="gmail_default" style="font-family:verdana,sans-serif"><b><i># for i in 80 88 389 636 464;do nc -vz <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> $i;done</i></b></div><div class="gmail_default" style="font-family:verdana,sans-serif">Connection to <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> 80 port [tcp/http] succeeded!</div><div class="gmail_default" style="font-family:verdana,sans-serif">Connection to <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> 88 port [tcp/kerberos] succeeded!</div><div class="gmail_default" style="font-family:verdana,sans-serif">Connection to <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> 389 port [tcp/ldap] succeeded!</div><div class="gmail_default" style="font-family:verdana,sans-serif">Connection to <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> 636 port [tcp/ldaps] succeeded!</div><div class="gmail_default" style="font-family:verdana,sans-serif">Connection to <a href="http://ipa-inf-prd-sg1-01.klikpay.int" target="_blank">ipa-inf-prd-sg1-01.klikpay.int</a> 464 port [tcp/kpasswd] succeeded!</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Test-3:</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default"><div class="gmail_default"><font face="verdana, sans-serif"><b><i>ipa-client-install --principal=admin --password=xxxxxxxxxxxxxxxxxxx --mkhomedir --no-ntp --domain=<a href="http://klikpay.int" target="_blank">klikpay.int</a> --nisdomain=<a href="http://sd.int" target="_blank">sd.int</a></i></b></font></div><div class="gmail_default"><font face="verdana, sans-serif">Discovery was successful!</font></div><div class="gmail_default"><font face="verdana, sans-serif">Hostname: <a href="http://imsadmin-app-prd-sg1-01.sd.int" target="_blank">imsadmin-app-prd-sg1-01.sd.int</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">Realm: <a href="http://KLIKPAY.INT" target="_blank">KLIKPAY.INT</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">DNS Domain: <a href="http://klikpay.int" target="_blank">klikpay.int</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">IPA Server: <a href="http://ipa-inf-prd-ng2-02.klikpay.int" target="_blank">ipa-inf-prd-ng2-02.klikpay.int</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">BaseDN: dc=klikpay,dc=int</font></div><div class="gmail_default"><font face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font face="verdana, sans-serif">Continue to configure the system with these values? [no]: yes</font></div><div class="gmail_default"><font face="verdana, sans-serif">Synchronizing time with KDC...</font></div><div class="gmail_default"><font face="verdana, sans-serif">Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.</font></div><div class="gmail_default"><font face="verdana, sans-serif">Successfully retrieved CA cert</font></div><div class="gmail_default"><font face="verdana, sans-serif"> Subject: CN=Certificate Authority,O=<a href="http://KLIKPAY.INT" target="_blank">KLIKPAY.INT</a></font></div><div class="gmail_default"><font face="verdana, sans-serif"> Issuer: CN=Certificate Authority,O=<a href="http://KLIKPAY.INT" target="_blank">KLIKPAY.INT</a></font></div><div class="gmail_default"><font face="verdana, sans-serif"> Valid From: Fri Aug 14 11:39:47 2015 UTC</font></div><div class="gmail_default"><font face="verdana, sans-serif"> Valid Until: Tue Aug 14 11:39:47 2035 UTC</font></div><div class="gmail_default"><font face="verdana, sans-serif"><br></font></div><div class="gmail_default"><font face="verdana, sans-serif" color="#ff0000"><b>Enrolled in IPA realm <a href="http://KLIKPAY.INT" target="_blank">KLIKPAY.INT</a></b></font></div><div class="gmail_default"><font face="verdana, sans-serif">Created /etc/ipa/default.conf</font></div><div class="gmail_default"><font face="verdana, sans-serif">New SSSD config will be created</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured sudoers in /etc/nsswitch.conf</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured /etc/sssd/sssd.conf</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured /etc/krb5.conf for IPA realm <a href="http://KLIKPAY.INT" target="_blank">KLIKPAY.INT</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">trying <a href="https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml" target="_blank">https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml</a></font></div><div class="gmail_default"><font face="verdana, sans-serif">Forwarding 'env' to server u'<a href="https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml" target="_blank">https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml</a>'</font></div><div class="gmail_default"><font face="verdana, sans-serif" color="#ff0000"><b>Hostname (<a href="http://imsadmin-app-prd-sg1-01.sd.int" target="_blank">imsadmin-app-prd-sg1-01.sd.int</a>) not found in DNS</b></font></div><div class="gmail_default"><font face="verdana, sans-serif" color="#ff0000"><b>Failed to update DNS records.</b></font></div><div class="gmail_default"><font face="verdana, sans-serif">Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub</font></div><div class="gmail_default"><font face="verdana, sans-serif">Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub</font></div><div class="gmail_default"><font face="verdana, sans-serif">Forwarding 'host_mod' to server u'<a href="https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml" target="_blank">https://ipa-inf-prd-ng2-02.klikpay.int/ipa/xml</a>'</font></div><div class="gmail_default"><font face="verdana, sans-serif">Could not update DNS SSHFP records.</font></div><div class="gmail_default"><font face="verdana, sans-serif">SSSD enabled</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configuring <a href="http://sd.int" target="_blank">sd.int</a> as NIS domain</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured /etc/openldap/ldap.conf</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured /etc/ssh/ssh_config</font></div><div class="gmail_default"><font face="verdana, sans-serif">Configured /etc/ssh/sshd_config</font></div><div class="gmail_default"><font face="verdana, sans-serif">Client configuration complete.</font></div><div style="font-family:verdana,sans-serif"><br></div></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Would be helpful I can get some reference as how can we do it.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><i style="font-size:12.8px"><span style="font-family:verdana,sans-serif">Best Regards,</span></i><br></div><div dir="ltr"><div style="font-size:12.8px"><div><i><span style="font-family:verdana,sans-serif">__________________________________________<br></span></i></div><i><span style="font-family:verdana,sans-serif">Yogesh Sharma<br></span></i></div><span style="font-size:12.8px;font-family:verdana,sans-serif"><i>Email: <a href="mailto:yks0000@gmail.com" target="_blank">yks0000@gmail.com</a> | Web: <span style="color:rgb(0,0,0)"><a href="http://www.initd.in/" target="_blank">www.initd.in</a> </span></i></span><br></div><div dir="ltr"><span style="font-size:12.8px;font-family:verdana,sans-serif"><i><span style="color:rgb(0,0,0)"><br></span></i></span></div><div><span style="font-size:12.8px;font-family:verdana,sans-serif"><i><span style="color:rgb(0,0,0)">RHCE, VCE-CIA, RACKSPACE CLOUD U Certified</span></i></span></div><div dir="ltr"><br></div><div dir="ltr"><a href="https://www.fb.com/yks0000" target="_blank"><img src="http://i.imgbox.com/ojTDSuw0.gif" alt=""></a> <a href="http://in.linkedin.com/in/yks0000" target="_blank"><img src="http://i.imgbox.com/fHLDBlyz.gif"></a> <a href="https://twitter.com/checkwithyogesh" target="_blank"><img src="http://i.imgbox.com/vTX3eOJ5.gif"></a> <a href="http://google.com/+YogeshSharmaOnGooglePlus" target="_blank"><img src="http://i.imgbox.com/W2bQouRN.gif"></a></div></div></div></div></div></div></div></div></div> </div> </blockquote></div><br></div>