<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle18
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Courier;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">My configuration is a single ipa server and both the code path and the bash prompt path are running on the node that is also running the ipa server. I thought that since FreeIPA was installed with --no-dnssec-validation
that I should never see this warning. And I confirmed that both dnssec-enabled and dnssec-validation are set to 'no' in the /etc/named.conf.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So I'm confused that you say the DNSSEC should always fail.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for your help!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Martin Bašti <mbasti@redhat.com><br>
<b>Date: </b>Wednesday, April 19, 2017 at 3:59 AM<br>
<b>To: </b>Dan Dietterich <dan@cazena.com>, "freeipa-users@redhat.com" <freeipa-users@redhat.com><br>
<b>Subject: </b>Re: [Freeipa-users] DNSSEC warning when DNSSEC should be disabled<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><o:p> </o:p></span></p>
</div>
<p><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 13.04.2017 22:50, Dan Dietterich wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt">I am seeing inconsistent results configuring a DNS forward zone.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">At a bash prompt, as root, after kinit admin, I do:</span><o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:Courier">ipa dnsforwardzone-add domain.internal --forwarder= ww.xx.yy.zz --forward-policy=only</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">That works fine and does not warn about DNSSEC.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">In a Java webapp running as root under a Jetty, I run a shell sub-process and issue the kinit and the same ipa statement.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">_<i>Sometimes</i>_, I get </span>
<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:Courier">ipa: WARNING: DNSSEC validation failed: record 'domain.internal. SOA' failed DNSSEC validation on server ww.xx.yy.zz.</span><o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:Courier">Please verify your DNSSEC configuration or disable DNSSEC validation on all IPA servers.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I modified the /etc/named.conf file to say:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><span style="font-size:11.0pt;font-family:Courier">dnssec-enable no;</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Courier"> dnssec-validation no;</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">and </span><span style="font-size:11.0pt;font-family:Courier">systemctl restart ipa</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Any clue why the results are different?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ipa –version: VERSION: 4.4.0, API_VERSION: 2.213</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Linux … 3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for any insight!</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dan</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><br>
<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><br>
Hello,<br>
<br>
checks are done on IPA server side, how many servers do you have? Is possible that CLI connects to different servers.<br>
<br>
However in this case, DNSSEC check should always fail and report error, so it is weird why it passed.<br>
<br>
Martin<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Martin Bašti<o:p></o:p></pre>
<pre>Software Engineer<o:p></o:p></pre>
<pre>Red Hat Czech<o:p></o:p></pre>
</div>
</body>
</html>