Hey all,

I for some reason do not ever get responses from doing DNS lookups to my
new servers that have been stood up and replicated as Masters with CA, and
DNS options entered at command line.

Is there any trick or configuration to allow anonymous for my servers
without IPA Client installed to talk to these?

it does not allow lookups,
Ip-tables have even been turned off for testing.
telnet to server via 53 Works
 Stand alone IPA server LDAP DNS Kerberose usages

 [root@DOMAIN ~]# ipa dnsconfig-show --rights --all --raw
Global DNS configuration is empty
  dn: cn=dns,dc=int,dc=DOMAIN,dc=com
  aci: (targetattr = "*")(version 3.0; acl "Allow read access"; allow
(read,search,compare) groupdn = "ldap:///cn=Read DNS
Entries,cn=permissions,cn=pbac,dc=int,dc=DOMAIN,dc=com" or userattr =
  aci: (target =
"ldap:///idnsname=*,cn=dns,dc=int,dc=DOMAIN,dc=com";)(version 3.0;acl "Add
DNS entries in a zone";allow (add) userattr =
  aci: (target =
"ldap:///idnsname=*,cn=dns,dc=int,dc=DOMAIN,dc=com";)(version 3.0;acl
"Remove DNS entries from a zone";allow (delete) userattr =
  aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl ||
dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord ||
ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord
|| minforecord || afsdbrecord || sigrecord || keyrecord || locrecord ||
nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord ||
dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname ||
idnszoneactive || idnssoamname || idnssoarname || idnssoaserial ||
idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum ||
idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr
|| idnsforwardpolicy || idnsforwarders")(target =
"ldap:///idnsname=*,cn=dns,dc=int,dc=DOMAIN,dc=com";)(version 3.0;acl
"Update DNS entries in a zone";allow (write) userattr =
  attributelevelrights: {'cn': u'rscwo', 'idnsforwardpolicy': u'rscwo',
'objectclass': u'rscwo', 'idnsallowsyncptr': u'rscwo', 'idnsforwarders':
u'rscwo', 'idnspersistentsearch': u'rscwo', 'idnszonerefresh': u'rscwo',
'aci': u'rscwo', 'nsaccountlock': u'rscwo'}
  cn: dns
  objectclass: idnsConfigObject
  objectclass: nsContainer
  objectclass: top
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to