4.4. Configuring Capsule Server with External IdM DNS

Creating a Kerberos Principal on the IdM Server

1. Obtain a Kerberos ticket for the account obtained from the IdM administrator:

   # kinit idm_user

   Copy to Clipboard Toggle word wrap

2. Create a new Kerberos principal for Capsule Server to use to authenticate on the IdM server.

   # ipa service-add capsule.example.com

   Copy to Clipboard Toggle word wrap

Installing and Configuring the IdM Client

1. On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the ipa-client package:

   # satellite-maintain packages install ipa-client

   Copy to Clipboard Toggle word wrap

2. Configure the IdM client by running the installation script and following the on-screen prompts:

   # ipa-client-install

   Copy to Clipboard Toggle word wrap

3. Obtain a Kerberos ticket:

   # kinit admin

   Copy to Clipboard Toggle word wrap

4. Remove any preexisting keytab:

   # rm /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap

5. Obtain the keytab for this system:

   # ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \
   -s idm1.example.com -k /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap
   注記

   When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid.

6. For the dns.keytab file, set the group and owner to foreman-proxy:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap

7. Optional: To verify that the keytab file is valid, enter the following command:

   # kinit -kt /etc/foreman-proxy/dns.keytab \
   capsule/satellite.example.com@EXAMPLE.COM

   Copy to Clipboard Toggle word wrap

Configuring DNS Zones in the IdM web UI

1. Create and configure the zone that you want to manage:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add and enter the zone name. For example, example.com.
   3. Click Add and Edit.

   4. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule/047satellite.example.com@EXAMPLE.COM wildcard * ANY;

      Copy to Clipboard Toggle word wrap
   5. Set Dynamic update to True.
   6. Enable Allow PTR sync.
   7. Click Save to save the changes.

2. Create and configure the reverse zone:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Click Add.
   3. Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
   4. Click Add and Edit.

   5. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

      Copy to Clipboard Toggle word wrap
   6. Set Dynamic update to True.
   7. Click Save to save the changes.

Configuring the Satellite or Capsule Server that Manages the DNS Service for the Domain

1. Use the satellite-installer command to configure the Satellite or Capsule that manages the DNS Service for the domain:

   • On Satellite, enter the following command:

     satellite-installer --scenario satellite \
     --foreman-proxy-dns=true \
     --foreman-proxy-dns-managed=true \
     --foreman-proxy-dns-provider=nsupdate_gss \
     --foreman-proxy-dns-server="idm1.example.com" \
     --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \
     --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
     --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \
     --foreman-proxy-dns-zone=example.com \
     --foreman-proxy-dns-ttl=86400

     Copy to Clipboard Toggle word wrap

   • On Capsule, enter the following command:

     satellite-installer --scenario capsule \
     --foreman-proxy-dns=true \
     --foreman-proxy-dns-managed=true \
     --foreman-proxy-dns-provider=nsupdate_gss \
     --foreman-proxy-dns-server="idm1.example.com" \
     --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \
     --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
     --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \
     --foreman-proxy-dns-zone=example.com \
     --foreman-proxy-dns-ttl=86400

     Copy to Clipboard Toggle word wrap

2. Restart the Satellite or Capsule’s Proxy Service.

   # systemctl restart foreman-proxy

   Copy to Clipboard Toggle word wrap

Updating the Configuration in the Satellite web UI

1. Navigate to Infrastructure > Capsules, locate the Capsule Server, and from the list in the Actions column, select Refresh.

2. Configure the domain:

   1. Navigate to Infrastructure > Domains and select the domain name.
   2. In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

3. Configure the subnet:

   1. Navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to None.
   3. In the Domains tab, select the domain that you want to manage using the IdM server.
   4. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.