Navigation Menu

Background

In my ever evolving lab, it came time to integrate Red Hat Enterprise Linux (RHEV) with Identity, Policy, Audit (IPA).There were a few caveats and searching Google didn’t help, so hopefully this article can save you some time.

Integrating the two was fairly straitforward. The biggest challenge was finding a quick and easy way to provide reverse DNS. I use an external DNS provider which does not do reverse DNS for internal IP addresses. This article will dig into how to setup a full blown proof of concept without needing an external DNS server to provide reverse DNS.

For those that might need a brief primer on DNS records, the following article is excellent.

 

 

Installation/Configuration

The following items are assumed to be available and working.

Prerequisites

  • Clean Red Hat Enterprise Linux 6.3+ Server
  • Working forward and reverse DNS (both can be satisfied with dnsmasq, described below)
  • Fully installed and working Red Hat Enterprise Virtualization (RHEV) environment

 

Integration Steps

  • Install IPA on Clean Red Hat Enterprise Linux 6.3+ Server
  • Option: Install/Configure Dnsmasq on RHEV Server
  • Configure RHEV Domain

 

Install Identity, Policy, Audit

Option: if an external DNS server is available, the following SRV entries should be added. For those unfamiliar with SRV records, this will allow services such as RHEV or the IPA client to discover the correct Kerberos/LDAP/NTP servers by searching DNS.

 

Option: If host based firewall rules are required, the following entries should be added to: /etc/sysconfig/iptables

 

Install packages

 

Configure

 

Restart ssh

 

Option: Dnsmasq

Reverse DNS lookup of the IPA server is a strict requirement. rDNS can be provided by Dnsmasq, which is available from the base RHEL channel.

Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server.

If there is no access to a reverse DNS server, dnsmasq can be installed and configured on the RHEV-M host.

 

Add the following line to /etc/dnsmasq.conf

 

Configure the upstream DNS server in /etc/dnsmasq-resolve.conf

 

Configure the standard DNS resolver to look to local host. This will chain all lookups through the local dnsmasq daemon.

 

Option: Forward DNS SRV records can also be satisfied with dnsmasq

 

Red Hat Enterprise Virtualization (RHEV)

Configure the new domain (Version 3.2)

 

Configure the new domain (Version 3.4)

 

Troubleshooting

Finally, here are some techniques used to troubleshoot integrating RHEV and IPA. Some of these are specific to certain versions of RHEV

Logs

The RHEV-M logs do not display much information with regard to a reverse DNS issue.

 

The logs for the Kerberos domain will show nothing because the RHEV-M host isn’t resolving the correct controller.

 

Network

Check the SRV records

 

Watch DNS and Kerberos activity

 

    1 Comment

Post a Reply

Your email address will not be published.