freeipa

#9351 Issue with long FQDN set in hostname
Closed: wontfix by rcritten. Opened by db3922.

Closed: wontfix
Reopen Issue

Request for enhancement

As user running freeipa-client-install, I want the application to properly handle FQDN with hostnamectl and /etc/host. The /etc/host is only for the 63 character host name, not the FQDN.

Issue

validate_hostname() in /ipalib/util.py

The function validate_hostname() checks for 64 character limit for host name, but the parameter hostname is the FQDN. Long names are rejected. The function validate_hostname() should split the hostname on '.' and take the 0 index of the string to validate 64 characters.
The function validate_hostname() should also check if hostname has '.' in it. If so, check that its less than DNS maximum for FQDN of 255.

set_hostname() in /ipaplatform/redhat/tasks.py

The function should check if hostname has '.' in string, if so split the string and take 0 index to pass to hostnamectl. Currently it passes the FQDN which can exceed the 64 character limit of the hostname.

Steps to Reproduce

  1. Use a hostname that will exceed the 64 character when combined with domain name.

Actual behavior

The ipa-client-install will fail ldap calls after hostnamectl is called from task.py. This is due to the hostname being truncated in the /etc/hostfile at 64 characters by hostnamectl.

Expected behavior

The hostname portion of the FQDN should be passed to hostnamectl instead.

Version/Release/Distribution

pa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
package ipa-server is not installed
ipa-client-4.10.0-8.el9_1.x86_64
package 389-ds-base is not installed
package pki-ca is not installed
package krb5-server is not installed

Additional info:

Changes to correct the issue.

validate_hostname() in /ipalib/util.py

def validate_hostname(hostname, check_fqdn=True, allow_underscore=False,
                      allow_slash=False, maxlen=255):
    if len(hostname) > 255:
        raise ValueError(_('fqdn cannot be longer that {} characters'.format(255)))    if '.' in hostname:
        actual_host_name = hostname.split('.')[0]
        if len(actual_host_name) > 64:
            raise ValueError(_('hostname cannot be longer that {} characters'.format(64)))

set_hostname() in /ipaplatform/redhat/tasks.py

    def set_hostname(self, hostname):
        print(f"set_hostname(hostname={hostname})")
        temp_host_name = hostname
        if '.' in hostname:
            temp_host_name = hostname.split('.')[0]
        print(f"set_hostname(hostname={temp_host_name})")
        ipautil.run([paths.BIN_HOSTNAMECTL, 'set-hostname', temp_host_name])

NOTE: There are multiple tasks.py for different versions of OS. Each would need to be updated.

The maximum length of a hostname in Linux is controlled by MAXHOSTNAMELEN in the kernel and defaults to 64. Some other operating systems, Solaris for example, allows hostnames up to 255 characters.

You can set a different maximum using ipa config-mod.

It looks like the client doesn't honor this setting:

validate_hostname(hostname, maxlen=MAXHOSTNAMELEN)

That's correct, but the big issue is; setting the FQDN in the hostname file. We did use ipa config-mod setting to 255 to match DNS max and IPA counts the host and domain as hostname when checking.

In the validation example, I did some hard coding but I did see constants and possibly add optional params for checking FQDN and hostname independently.

The biggest issue is in the set_hostname(), uses the FQDN when callling hostnamectl.
And hostnamectl has a limit of 64 chars, so it truncates the name it inserts into the file.

The set_hostname() is called in the ipa-client-install about 1/2 way through the process roughly. There are more LDAP calls that are being made after this command is executed. If the FQDN longer than 64 chars it gets truncated. Then the hostname does not match and all of the remaining LDAP calls in the ipa-install-client fail. Resulting in the install being rolled back.

I resolved this by updating the set_hostname() to only set the hostname and not the FQDN.

I have made these changes manually and tested with Rocky 9, RedHat 9, Ubuntu 20.04 successfully.

We ran into this due to having long hostnames and long domain names. When the FQDN is below 64 characters it works as is.

LIke I said, there is a bug in the client installer where it doesn't honor the modified length, and perhaps as you demonstrated in the platform code as well.

You will run into problems if you want to run a Kerberized or TLS service on any of these clients configured this way because both require consistent hostnames which are best provided by FQDN.

To do this we'd need to fetch the IPA config prior to the client being configured at all which while possible, seems a heavy lift to just validate the length of the hostname. It will be rejected by the server if not compliant.
I don't think it is worth the effort.

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.