我正在建立一个FreeIPA域名.在我的实验室中有三个虚拟机：域控制器ipadc1,两个客户端puppet和wordpress(创意,是的,我知道).所有三个虚拟机都运行新安装的CentOS 6.4(FreeIPA 3.0.0).
我已经安装了IPA服务器,创建了一个域名,我们在这里称之为example.us,启用了DNS服务和自动DNS更新.
我已成功将两个虚拟机加入域.但动态DNS更新只是将AAAA记录放入DNS.没有插入A记录.
我对dyanmic更新和BIND更新策略的DNS区域设置似乎也是正确的.
两个客户端虚拟机实际上都有IPv4地址; puppet有一个静态IPv4地址,wordpress从DHCP获取其IPv4地址.这似乎没有什么区别.
# ip a s dev eth0
2: eth0: <broADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:3c:d5:f5 brd ff:ff:ff:ff:ff:ff
inet 172.25.50.227/24 brd 172.25.50.255 scope global eth0
inet6 2001:db8:16:bf:5054:ff:fe3c:d5f5/64 scope global dynamic
valid_lft 86180sec preferred_lft 14180sec
inet6 fe80::5054:ff:fe3c:d5f5/64 scope link
valid_lft forever preferred_lft forever
问题实际上似乎是sssd,我学到的实际上是负责推动动态DNS更新.我使用debug_level = 9进行了调试,并在日志中找到了它.这似乎表明sssd甚至没有尝试发送A记录,尽管它并没有真正给我任何指示.
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_update_send] (0x4000): Performing update (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ok_for_dns] (0x0200): Multicast IPv4 address 172.25.50.227 (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ok_for_dns] (0x0200): Link local IPv6 address fe80::5054:ff:fe3c:d5f5 (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_step] (0x1000): Checking if the update is needed (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_get_family_order] (0x1000): Lookup order: ipv6_first (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_is_address] (0x4000): [wordpress.example.us] does not look like an IP address (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve AAAA record of 'wordpress.example.us' in DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'wordpress.example.us' in DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0100): No more hosts databases to retry (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_is_address] (0x4000): [wordpress.example.us] does not look like an IP address (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'wordpress.example.us' in DNS (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0100): No more hosts databases to retry (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_check] (0x1000): Address on localhost only: 2001:db8:16:bf:5054:ff:fe3c:d5f5 (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_check] (0x0400): Detected IP addresses change,will perform an update (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0200): Creating update message for realm [EXAMPLE.US] and zone [example.us]. (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0400): -- Begin nsupdate message -- realm EXAMPLE.US zone example.us. update delete wordpress.example.us. in A send update delete wordpress.example.us. in AAAA send update add wordpress.example.us. 86400 in AAAA 2001:db8:16:bf:5054:ff:fe3c:d5f5 send (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0400): -- End nsupdate message -- (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [2144] (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_handler_setup] (0x2000): Signal handler set up for pid [2144] (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [write_pipe_handler] (0x0400): All data has been sent! (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_stdin_done] (0x4000): Sending nsupdate data complete (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_sig_handler] (0x1000): Waiting for child [2144]. (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_sig_handler] (0x0100): child [2144] finished successfully. (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [sss_child_handler] (0x2000): waitpid Failed [10]: No child processes (Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_update_done] (0x0020): DNS update finished
我的sssd.conf是：
[domain/example.us] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = example.us id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = wordpress.example.us chpass_provider = ipa ipa_dyndns_update = True ipa_server = _srv_,ipadc1.example.us ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss,pam,ssh config_file_version = 2 domains = example.us [nss] [pam] [sudo] [autofs] [ssh] [pac]
ipa dnszone-show example.us –all的结果是：
dn: idnsname=example.us,cn=dns,dc=example,dc=us
Zone name: example.us
Authoritative nameserver: ipadc1.example.us.
Administrator e-mail address: hostmaster.example.us.
SOA serial: 1374982142
SOA refresh: 3600
SOA retry: 900
SOA expire: 1209600
SOA minimum: 3600
BIND update policy: grant EXAMPLE.US krb5-self * A; grant EXAMPLE.US krb5-self
* AAAA; grant EXAMPLE.US krb5-self * SSHFP;
Active zone: TRUE
Dynamic update: TRUE
Allow query: any;
Allow transfer: none;
mxrecord: 0 mail.example.us
nsrecord: ipadc1.example.us.
objectclass: top,idnsrecord,idnszone
txtrecord: v=spf1 a mx -all
虽然这对我来说真的是一个小问题,因为我可以在没有IPv4 DNS更新的情况下上线(很好地成为100％双栈),不知道这里发生了什么仍然很烦人.也许我错过了可以揭示情况的日志？
(哦,我把它关了再打开.)
添加后
ipa_dyndns_iface = eth0
在那个pastebin中,我看到sssd将你的ip识别为多播：
“(Tue Jul 9 10:00:01 2013)[sssd [be [example.us]]] [ok_for_dns](0x0200)：Multicast IPv4 address 172.25.50.227”
在雅各布编写的代码中,他将测试looback地址,多播地址e.t.c.不向dns报告你会发现你的错误：
if (IN_MULTICAST(ntohl(addr->s_addr))) {
DEBUG(SSSDBG_FUNC_DATA,("Multicast IPv4 address %s\n",sTraddr));
return false;
} else if (inet_netof(*addr) == IN_LOOPBACKNET) {
DEBUG(SSSDBG_FUNC_DATA,("Loopback IPv4 address %s\n",sTraddr));
return false;
} else if ((addr->s_addr & 0xffff0000) == 0xa9fe0000) {
/* 169.254.0.0/16 */
DEBUG(SSSDBG_FUNC_DATA,("Link-local IPv4 address %s\n",sTraddr));
return false;
} else if (addr->s_addr == htonl(INADDR_broADCAST)) {
DEBUG(SSSDBG_FUNC_DATA,("broadcast IPv4 address %s\n",sTraddr));
return false;
}
} else {
DEBUG(SSSDBG_CRIT_FAILURE,("UnkNown address family\n"));
return false;
}
return true;
现在问题是为什么它被认为是“多播地址”我不知道.作为IN中的IN_MULTICAST,您可以看到：
"IN_MULTICAST(a)" - tests whether a is a multicast address. and it is in "inet.h/in.h": #define IN_CLASSD(i) (((long)(i) & 0xf0000000) == 0xe0000000) #define IN_MULTICAST(i) IN_CLASSD(i)
那么IP地址如何评估多播,我会尝试对它进行分析并查看.你也可以问Jacob Hrozek,他写了那段sssd代码.他通常总是在freenode的#sssd上可用,如果你分享你最终的结果,那将是很棒的.
希望它有所帮助.
编辑
是的,您的1.9.2版本中存在一个错误.你有：
if (IN_MULTICAST(addr->s_addr))) {
它应该是：
if (IN_MULTICAST(ntohl(addr->s_addr))) {