Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation

  • Comments
  • This program will set up IPA client: Failed to update DNS records.

    Posted on

    CHAPTER 2. INSTALLING AN IDM SERVER: WITH INTEGRATED
    DNS, WITH AN INTEGRATED CA AS THE ROOT CA

    I successfully "Enrolled in IPA realm" a client accept I had some failures,

    1. Failed to update DNS records.
    2. Could not update DNS SSHFP records.
    [root@mariadbserver etc]# ipa-client-install --enable-dns-updates --mkhomedir
    This program will set up IPA client.
    Version 4.10.0
    
    Discovery was successful!
    Do you want to configure chrony with NTP server or pool address? [no]: yes
    Enter NTP source server addresses separated by comma, or press Enter to skip: 10.30.70.1
    Enter a NTP source pool address, or press Enter to skip: 
    Client hostname: mariadbserver.kbbn-7.com
    Realm: KBBN-7.COM
    DNS Domain: kbbn-7.com
    IPA Server: idmserver1c.kbbn-7.com
    BaseDN: dc=kbbn-7,dc=com
    NTP server: 10.30.70.1
    
    Continue to configure the system with these values? [no]: yes
    Synchronizing time
    Configuration of chrony was changed by installer.
    Attempting to sync time with chronyc.
    Time synchronization was successful.
    User authorized to enroll computers: admin
    Password for admin@KBBN-7.COM: 
    Successfully retrieved CA cert
        Subject:     CN=Certificate Authority,O=KBBN-7.COM
        Issuer:      CN=Certificate Authority,O=KBBN-7.COM
        Valid From:  2023-04-03 08:49:27
        Valid Until: 2043-04-03 08:49:27
    
    Enrolled in IPA realm KBBN-7.COM
    Created /etc/ipa/default.conf
    Configured /etc/sssd/sssd.conf
    Systemwide CA database updated.
    Failed to update DNS records. --------------------------------------
    Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
    Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
    Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
    Could not update DNS SSHFP records. -----------------------------
    SSSD enabled
    Configured /etc/openldap/ldap.conf
    Configured /etc/ssh/ssh_config
    Configured /etc/ssh/sshd_config.d/04-ipa.conf
    Configuring kbbn-7.com as NIS domain.
    Configured /etc/krb5.conf for IPA realm KBBN-7.COM
    Client configuration complete.
    The ipa-client-install command was successful
    

    I was not able to do this until I added the SRV to pfSense DNS Resolver:

    server:
    include: /var/unbound/pfb_dnsbl.*conf
    local-data: "_kerberos-master._tcp.kbbn-7.com. 3600 IN SRV 0 100 88 idmserver1c.kbbn-7.com."
    local-data: "_kerberos-master._udp.kbbn-7.com. 3600 IN SRV 0 100 88 idmserver1c.kbbn-7.com."
    local-data: "_kerberos._tcp.kbbn-7.com. 3600 IN SRV 0 100 88 idmserver1c.kbbn-7.com."
    local-data: "_kerberos._udp.kbbn-7.com. 3600 IN SRV 0 100 88 idmserver1c.kbbn-7.com."
    local-data: "_kerberos.kbbn-7.com. 3600 IN TXT KBBN-7.COM"
    local-data: "_kerberos.kbbn-7.com. 3600 IN URI 0 100 krb5srv:m:tcp:idmserver1c.kbbn-7.com."
    local-data: "_kerberos.kbbn-7.com. 3600 IN URI 0 100 krb5srv:m:udp:idmserver1c.kbbn-7.com."
    local-data: "_kpasswd._tcp.kbbn-7.com. 3600 IN SRV 0 100 464 idmserver1c.kbbn-7.com."
    local-data: "_kpasswd._udp.kbbn-7.com. 3600 IN SRV 0 100 464 idmserver1c.kbbn-7.com."
    local-data: "_kpasswd.kbbn-7.com. 3600 IN URI 0 100 krb5srv:m:tcp:idmserver1c.kbbn-7.com."
    local-data: "_kpasswd.kbbn-7.com. 3600 IN URI 0 100 krb5srv:m:udp:idmserver1c.kbbn-7.com."
    local-data: "_ldap._tcp.kbbn-7.com. 3600 IN SRV 0 100 389 idmserver1c.kbbn-7.com."
    local-data: "ipa-ca.kbbn-7.com. 3600 IN A 10.30.70.106"
    

    What may have caused this and how to correct it? I'm using pfSense for my DHCP, DNS Resovler as the Forwarder from the IDM Server, and NTP for the IDM Domain clock sync.

    Network Topology.
    Network Topology

    by

    points

    Responses

    Red Hat LinkedIn YouTube Facebook X, formerly Twitter

    Quick Links

    Help

    Site Info

    Related Sites

    © 2026 Red Hat