freeipa

#9819 DDNS special characters
Opened by thinkdez. Modified

Open
Close Issue

Issue

I am using DDNS to update the FreeIPA dns zones with clients. I have had some IoT devices with names that include Spaces or brackets that update the DDNS zone. This creates a warning message in FreeIPA when accessing through the UI and cannot display the record. I cannot modify the record or delete it with the IPA tools. I have to use the ldapsearch/ldapdelete commands to remove the record.

Steps to Reproduce

  1. Setup DDNS from DHCP server to IPA server
  2. Put device with non-standard name on network and have it obtain a DHCP IP
  3. Review records through UI and recieve error message

Actual behavior

Warning message that some records could not be displayed. One Such Record was: (none)
dnsrecord-find and dnsrecord-del would not accept the escape character"\". I had to use ldapdelete to remove the record. Also I had another record with a space and it used \032 which wasn't recognized either

Expected behavior

Either the system needs to not accept the DDNS record with special characters or the native commands should include options to remove the special characters.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.12.2-14.el9_6.1.x86_64
ipa-client-4.12.2-14.el9_6.1.x86_64
389-ds-base-2.6.1-9.el9_6.x86_64
package pki-ca is not installed
krb5-server-1.21.1-6.el9.x86_64

Can you provide some specific examples of these non-standard names?

What errors are logged in /var/log/httpd/error_log when trying to view/manipulate these entries?

One example is I had the following entry added: (none).mydomain.com
It didn't like the brackets and it tried to escape the special characters with a backslash. Unfortunately I think my logs rotated out so I don't have much to go on with regards to the error_log file. However I did find that when I was trying to delete/search the entry I got the following [IP and domainame redacted]:
[Fri Jun 27 11:24:27.143977 2025] [wsgi:error] [pid 300264:tid 300500] [remote x.x.x.x:51564] ipa: INFO: [jsonserver_session] username@DOMAIN.COM: dnsrecord_show/1('domain.com', , version='2.254'): NotFound

I was trying to escape the brackets and it seemed to double up the backslash. The only other one I had was a device that somehow inserted a space in the name. I was doing this with IoT devices so I was able to workaround the problem by using ldapdelete command which stopped the error in the UI however it doesn't prevent this from happening again unless I update the hostname before bringing it on the network. It seems that while DNS will allow the naming convention LDAP doesn't like the special characters or the interface doesn't like it.

I hope that helps.

Thanks for the details.
It appears that the double-escape is a logging thing. I added a similar A record locally and it is stored as (none) and it works in both the UI and CLI for me.

I guess the next step is to see how your is stored in LDAP. Querying will be weird since the DN needs to be escaped. Probably the best way to find it is something like (with a Kerberos ticket)
$ ldapsearch -Y GSSAPI -b idnsname=example.test.,cn=dns,dc=example,dc=test

Replacing example.test and dc=example,dc=test with your domain. Dig through that to find none.

Mine is encoded as:
dn: idnsname=\5C(none\5C),idnsname=example.test.,cn=dns,dc=example,dc=test
I'm not using exactly the same version of IPA but pretty close.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.