RCA-2026-03-09-001: Prevention

Key Lessons

  1. Always configure dual DNS for HA (bind-01 + bind-02)

  2. Use ipv4.method manual for infrastructure workstations

  3. Document EAP-TLS parameters - certificates, identity, etc.

  4. 802-1x.private-key-password-flags 4 means "not required" (unencrypted key)