Sorry if this is thread hijack (happy to start another) but further to this, is the single resolver 127.0.0.1 the blessed / recommended setup? We've had some chicken and egg situations recently where dirsrv being sad has broken local DNS resolution, and then krb behaviours and lookup for the other IPA servers has been impaired as a result.
If using local bind is the recommended state, should we be putting the other IPA servers in /etc/hosts or anything to make sure they can identify one and other in the case of dirsrv sadness? Thanks in advance, David On Wed, 8 May 2024 at 16:34, Sam Morris via FreeIPA-users < [email protected]> wrote: > On 08/05/2024 16:16, Tania Hagan via FreeIPA-users wrote: > > Turns out this was a DNS issue, thank you for responding. > > > > We had our /etc/resolv.conf pointing to local host and adding another > ipa server as the top nameserver solved the issue. This begs the question > by default installing with the ansible playbook it adds the localhost has > the nameserver, which is the preferred setup? > > Assuming your IPA server runs the integrated DNS service, it should have > 127.0.0.1 as the only nameserver. > > It's then the job of BIND on that server to provide recursive DNS > service for other stuff running on the server. Typically you'd configure > global and/or per-server forwarders so that queries for names outside of > your domain's configured DNS zones are forwarded elsewhere. > > So if DNS resolution on a server breaks, BIND is the component to > investigate & fix. > > -- > Sam Morris <https://robots.org.uk/> > PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9 > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
