freeipa dns install does not correctly configure reverse zones due to systemd-resolved

Bug #1772405 reported by gianluca
32
This bug affects 6 people
Affects Status Importance Assigned to Milestone
freeipa (Ubuntu)
Triaged
High
Unassigned
systemd (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

In Ubuntu 18.04, ipa-dns-intall (or ipa-server-install when asking to configure BIND) does not create reverse DNS zones for my domain. Note that I already fixed (or more correctly, circumvented) other bugs involving BIND, such as https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1769440.

The problem seems due to the presence of systemd-resolved. When ipa-dns-install valuates whether to create a reverse DNS zone, it tries to use the local DNS for resolving the IP address of the server. When you want to install BIND alongside IPA, this normally fails, and the installer knows he needs to configure an appropriate reverse zone. But when systemd-resolved is active, it takes the role of local DNS and answers this query: therefore, the installer thinks a reverse DNS zone is already present.

To fix this problem I had to perform the following steps before calling ipa-dns-install (or ipa-server-install):
1) stop systemd-resolved with "systemctl stop systemd-resolved".
2) disable systemd-resolved with "systemctl disable systemd-resolved".
3) delete the file "/etc/resolv.conf", which is a symlink to a file created by systemd.
4) optionally, recreate "/etc/resolv.conf" pointing to the (real) local DNS.

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Fedora doesn't enable systemd-resolved, which is probably why this hasn't been hit before. It was proposed but apparently shot down.

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

maybe I can modify ipa-server-install to disable systemd-resolved, but it feels fragile and I wish there was a way to make them work together...

Timo Aaltonen (tjaalton)
Changed in freeipa (Ubuntu):
importance: Undecided → High
status: New → Triaged
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in systemd (Ubuntu):
status: New → Confirmed
Revision history for this message
Dan Streetman (ddstreet) wrote :

please reopen if this is still an issue

Changed in systemd (Ubuntu):
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.