<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>IPA servers always check if DNSSEC is working on forwarders, but
it is just warning. If you have disabled dnssec in named.conf
then it is okay.</p>
<p>I'm not sure why sometimes you see this warning and sometimes
don't, maybe inconsistent replies from forwarder.</p>
<p>domain ".internal" should always fail because it is unregistered
TLD</p>
<p>Martin<br>
</p>
<br>
<div class="moz-cite-prefix">On 19.04.2017 15:11, Dan Dietterich
wrote:<br>
</div>
<blockquote
cite="mid:BA9EB006-5049-4CD6-9346-5AA202DCA0DF@cazena.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle18
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Courier;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">My
configuration is a single ipa server and both the code path
and the bash prompt path are running on the node that is
also running the ipa server. I thought that since FreeIPA
was installed with --no-dnssec-validation that I should
never see this warning. And I confirmed that both
dnssec-enabled and dnssec-validation are set to 'no' in the
/etc/named.conf.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So I'm
confused that you say the DNSSEC should always fail.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for
your help!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span
style="color:black">Martin Bašti <a class="moz-txt-link-rfc2396E" href="mailto:mbasti@redhat.com"><mbasti@redhat.com></a><br>
<b>Date: </b>Wednesday, April 19, 2017 at 3:59 AM<br>
<b>To: </b>Dan Dietterich <a class="moz-txt-link-rfc2396E" href="mailto:dan@cazena.com"><dan@cazena.com></a>,
<a class="moz-txt-link-rfc2396E" href="mailto:freeipa-users@redhat.com">"freeipa-users@redhat.com"</a>
<a class="moz-txt-link-rfc2396E" href="mailto:freeipa-users@redhat.com"><freeipa-users@redhat.com></a><br>
<b>Subject: </b>Re: [Freeipa-users] DNSSEC warning when
DNSSEC should be disabled<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Times New
Roman""><o:p> </o:p></span></p>
</div>
<p><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 13.04.2017 22:50, Dan Dietterich
wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt">I am
seeing inconsistent results configuring a DNS forward
zone.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">At a bash
prompt, as root, after kinit admin, I do:</span><o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span
style="font-size:11.0pt;font-family:Courier">ipa
dnsforwardzone-add domain.internal --forwarder=
ww.xx.yy.zz --forward-policy=only</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">That works
fine and does not warn about DNSSEC.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">In a Java
webapp running as root under a Jetty, I run a shell
sub-process and issue the kinit and the same ipa
statement.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">_<i>Sometimes</i>_,
I get </span>
<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span
style="font-size:11.0pt;font-family:Courier">ipa: WARNING:
DNSSEC validation failed: record 'domain.internal. SOA'
failed DNSSEC validation on server ww.xx.yy.zz.</span><o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><span
style="font-size:11.0pt;font-family:Courier">Please verify
your DNSSEC configuration or disable DNSSEC validation on
all IPA servers.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I modified
the /etc/named.conf file to say:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">
</span><span style="font-size:11.0pt;font-family:Courier">dnssec-enable
no;</span><o:p></o:p></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:Courier">
dnssec-validation no;</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">and </span><span
style="font-size:11.0pt;font-family:Courier">systemctl
restart ipa</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Any clue
why the results are different?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ipa
–version: VERSION: 4.4.0, API_VERSION: 2.213</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Linux …
3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC
2017 x86_64 x86_64 x86_64 GNU/Linux</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for
any insight!</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dan</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Times New
Roman""><br>
<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-family:"Times New
Roman""><br>
Hello,<br>
<br>
checks are done on IPA server side, how many servers do you
have? Is possible that CLI connects to different servers.<br>
<br>
However in this case, DNSSEC check should always fail and
report error, so it is weird why it passed.<br>
<br>
Martin<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Martin Bašti<o:p></o:p></pre>
<pre>Software Engineer<o:p></o:p></pre>
<pre>Red Hat Czech<o:p></o:p></pre>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Martin Bašti
Software Engineer
Red Hat Czech</pre>
</body>
</html>