Simon Matthews via FreeIPA-users wrote:
My primary nameserver is on another machine. It is already configured
with an RNDC key to allow updates from DHCP.
How would I tell IPA to use this RNDC key to update the primary?
I assume that these updates come from the IPA server, not the client when enrolling a
client.
Currently, the SSH keys are in the user's home directory, which will be accessible on
any machine that a user would log into, but it might be useful to have an alternative to
this.
The updates come from the client directly, they own the keys after all.
The IPA client only supports GSS-TSIG and unauthenticated updates. If
the GSS-TSIG fails during ipa-client-install then it will fall back and
try an unauthenticated nsupdate with 4.9.6+. Prior to that only GSS-TSIG
was supported.
This of course requires the DNS admin to configure their zones to allow
unauthenticated dynamic DNS updates which isn't a terrific idea.
See
https://bugzilla.redhat.com/show_bug.cgi?id=1854557
rob