freeipa

#9502 FreeIPA Server Removes Static A Record after Configuring Dynamic DNS with Opnsense
Closed: invalid by abbra. Opened by kadmin.

Closed: invalid
Reopen Issue

Issue

Hi guys
I have a problem with freeipa version 4.9.12 installed on AlmaLinux 8.7.
We use Freeipa for DNS, user authentication and SSL certificates.
Recently we configured Dynamic DNS on our Opnsense version 23.7.10_1.
The configuration seems to work, DNS entries are updated automatically, but now we have a bug that causes Freeipa to remove the static A record pointing to itself.

Steps to reproduce

  1. Configure DDNS with Opnsense
  2. Wait 2-3 days

Actual behavior

Dec 21 23:13:08 server01.example.com named-pkcs11[2003]: checkhints: unable to get root NS rrset from cache: not found
Dec 21 23:13:09 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/A (###.###.###.###) missing from hints
Dec 21 23:13:09 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/A (###.###.##.###) extra record in hints
Dec 21 23:13:09 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/AAAA (####:####:##::#) missing from hints
Dec 21 23:13:09 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/AAAA (####:####:###::#) extra record in hints
Dec 21 23:13:43 server01.example.com named-pkcs11[2003]: client @0x7f11f5b8a370 ###.###.##.###/#39575/key host/server01.example.com\@EXAMPLE.COM: updating zone 'example.com/IN': deleting rrset at 'server01.hostname.com' A
Dec 21 23:13:43 server01.example.com named-pkcs11[2003]: client @0x7f11f5b8a370 ###.###.##.###/#39575/key host/server01.example.com\@EXAMPLE.COM: updating zone 'example.com/IN': update rejected: post update name server sanity check failed
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: client @0x7f11f593d3b0 ###.###.##.###/#50353/key host/server01.example.com\@EXAMPLE.COM: updating zone 'example.com/IN': deleting rrset at 'server01.hostname.com' AAAA
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/A (###.###.###.###) missing from hints
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/A (###.###.##.###) extra record in hints
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/AAAA (####:####:##::#) missing from hints
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: checkhints: b.root-servers.net/AAAA (####:####:###::#) extra record in hints
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: client @0x7f11f58ac270 ###.###.##.###/#49053/key host/server01.hostname.com\@EXAMPLE.COM: updating zone 'example.com/IN': deleting rrset at 'server01.hostname.com' A
Dec 21 23:13:44 server01.example.com named-pkcs11[2003]: client @0x7f11f5b8a370 ###.###.##.###/#51083/key host/server01.hostname.com\@EXAMPLE.COM: updating zone 'example.com/IN': deleting rrset at 'server01.hostname.com' AAAA

As a result, all LDAP authentications will fail.
To resolve this we need to manually recreate the deleted entry and restart the named-pkcs11 service.

Expected behaviour

The IPA server should not remove the A record.

Version/release/distribution

rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
[root@ipa02 /]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.12-9.module_el8.9.0+3682+f63caf3e.alma.1.x86_64
ipa-client-4.9.12-9.module_el8.9.0+3682+f63caf3e.alma.1.x86_64
389-ds-base-1.4.3.30-6.module_el8.7.0+3308+a7150fd3.x86_64
package pki-ca is not installed
krb5-server-1.18.2-26.el8_9.x86_64

Additional information:

The removed IP is statically configured on the Freeipa server. As part of the debugging we also configured a static lease in Opnsense which made no difference.

Please provide ipaserver-install.log, ipaclient-install.log files and SSSD configuration details.. Did you reconfigure sssd to perform dynamic DNS updates on the IPA server?

Hi abbra,
Many thanks for your assistance.

For context, we successfully migrated FreeIPA to a new server on 02.08.2022 with minimal issues.
I reused the DDNS configurations, as we had previously set this up with pfSense, after i did not reconfigure SSSD.

ipa-client-install.logipaclient-uninstall.logipaserver-install._logsssd.conf

IPA server must have static setup. So the following is wrong on IPA server:

dyndns_update = True
dyndns_iface = ens18

Can i comment this 2 lines out without any other steps then systemctl restart sssd?
Edited by kadmin

Yes, and restart sssd.

These two lines are not part of IPA setup. They must have been added afterwards by some of your administrators.

okay thanks, I will try this this weekend.
You think this is the main cause for my problem? If so how have you a guess why this did not happen with pfsense before?

FreeIPA is not concerned with pfsense. Clearly someone modified your sssd configuration and that one is wrong, causing your trouble.

This is not a problem in FreeIPA code, hence closing this ticket.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.