#2573 Incorrect SOA serial number set for forward zone during ipa-server installation.
Closed: Invalid None Opened 12 years ago by mkosek.

https://bugzilla.redhat.com/show_bug.cgi?id=805871 (Red Hat Enterprise Linux 6)

Description of problem:


Version-Release number of selected component (if applicable):
ipa-server-2.2.0-5.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. ipa-server-install --setup-dns
2. ipa dnszone-find

Actual results:
"SOA serial" for forward zone has just "YYYY".

[root@primenova ~]# ipa dnszone-find
  Zone name: 201.65.10.in-addr.arpa.
  Authoritative nameserver: primenova.lab.eng.pnq.redhat.com.
  Administrator e-mail address: hostmaster.201.65.10.in-addr.arpa.
  SOA serial: 2012220301
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;

  Zone name: lab.eng.pnq.redhat.com
  Authoritative nameserver: primenova.lab.eng.pnq.redhat.com.
  Administrator e-mail address: hostmaster.lab.eng.pnq.redhat.com.
  SOA serial: 2012         <<<<<<<<<<<<<<<
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;
----------------------------
Number of entries returned 2
----------------------------
[root@primenova ~]#


Expected results:
SOA serial for forward zone after installation should be of the format
"YYYMMDDnn".

Additional info:
This is not seen for any new zone created thereafter.

[root@primenova ~]# ipa dnszone-find
  Zone name: 201.65.10.in-addr.arpa.
  Authoritative nameserver: primenova.lab.eng.pnq.redhat.com.
  Administrator e-mail address: hostmaster.201.65.10.in-addr.arpa.
  SOA serial: 2012220301
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;

  Zone name: example.com
  Authoritative nameserver: primenova.lab.eng.pnq.redhat.com.
  Administrator e-mail address: hostmaster.example.com.
  SOA serial: 2012220301       <<<<<<<<<<<<<<
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;

  Zone name: lab.eng.pnq.redhat.com
  Authoritative nameserver: primenova.lab.eng.pnq.redhat.com.
  Administrator e-mail address: hostmaster.lab.eng.pnq.redhat.com.
  SOA serial: 2012          <<<<<<<<<<<<<<<<<
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;
----------------------------
Number of entries returned 3
----------------------------
[root@primenova ~]#

I found out that this is not really an issue in FreeIPA, it created the forward zone correctly but it got changed by nsupdate/bind-dyndb-ldap which is run as a part of ipa-client-install. This can be easily reproduced this way:

# ldapsearch -h localhost -Y GSSAPI -b idnsname=idm.lab.bos.redhat.com,cn=dns,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com -s base

# idm.lab.bos.redhat.com, dns, idm.lab.bos.redhat.com
dn: idnsname=idm.lab.bos.redhat.com,cn=dns,dc=idm,dc=lab,dc=bos,dc=redhat,dc=c
 om
idnsZoneActive: TRUE
nSRecord: vm-068.idm.lab.bos.redhat.com.
objectClass: top
objectClass: idnsrecord
objectClass: idnszone
idnsAllowTransfer: none;
idnsSOAretry: 900
idnsSOAminimum: 3600
idnsUpdatePolicy: grant IDM.LAB.BOS.REDHAT.COM krb5-self * A; grant IDM.LAB.BO
 S.REDHAT.COM krb5-self * AAAA; grant IDM.LAB.BOS.REDHAT.COM krb5-self * SSHFP
 ;
idnsSOArefresh: 3600
idnsName: idm.lab.bos.redhat.com
idnsAllowDynUpdate: TRUE
idnsSOAmName: vm-068.idm.lab.bos.redhat.com.
idnsSOArName: hostmaster.idm.lab.bos.redhat.com.
idnsAllowQuery: any;
idnsSOAexpire: 1209100       <<<<<<
idnsSOAserial: 2014032201    <<<<<<

# search result
search: 4
result: 0 Success

# numResponses: 2
# numEntries: 1

# cat /tmp/nsupdate.txt 
zone idm.lab.bos.redhat.com.
update delete vm-068.idm.lab.bos.redhat.com. IN SSHFP
send
update add vm-068.idm.lab.bos.redhat.com. 1200 IN SSHFP 1 1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
update add vm-068.idm.lab.bos.redhat.com. 1200 IN SSHFP 2 1 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
send

# /usr/bin/kinit -k -t /etc/krb5.keytab host/vm-068.idm.lab.bos.redhat.com

# /usr/bin/nsupdate -g /tmp/nsupdate.txt

# ldapsearch -h localhost -Y GSSAPI -b idnsname=idm.lab.bos.redhat.com,cn=dns,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com -s base

# idm.lab.bos.redhat.com, dns, idm.lab.bos.redhat.com
dn: idnsname=idm.lab.bos.redhat.com,cn=dns,dc=idm,dc=lab,dc=bos,dc=redhat,dc=c
 om
idnsZoneActive: TRUE
nSRecord: vm-068.idm.lab.bos.redhat.com.
objectClass: top
objectClass: idnsrecord
objectClass: idnszone
idnsAllowTransfer: none;
idnsSOAretry: 900
idnsSOAminimum: 3600
idnsUpdatePolicy: grant IDM.LAB.BOS.REDHAT.COM krb5-self * A; grant IDM.LAB.BO
 S.REDHAT.COM krb5-self * AAAA; grant IDM.LAB.BOS.REDHAT.COM krb5-self * SSHFP
 ;
idnsSOArefresh: 3600
idnsName: idm.lab.bos.redhat.com
idnsAllowDynUpdate: TRUE
idnsSOAmName: vm-068.idm.lab.bos.redhat.com.
idnsSOArName: hostmaster.idm.lab.bos.redhat.com.
idnsAllowQuery: any;
idnsSOAexpire: 1209    <<<<<
idnsSOAserial: 2015    <<<<<

# search result
search: 4
result: 0 Success

# numResponses: 2
# numEntries: 1

Metadata Update from @mkosek:
- Issue assigned to mkosek
- Issue set to the milestone: FreeIPA 2.2 Core Effort - 2012/03

7 years ago

Login to comment on this ticket.

Metadata