Hi
We have Samba4 AD with dyndns updates working fine for the forward zone:
(Tue Feb 18 16:12:37 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
(0x0040): DNS update finished
But not the reverse zone:
(Tue Feb 18 16:13:41 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
(0x0040): DNS update finished
update failed: REFUSED
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [child_sig_handler]
(0x0020): child [27754] failed with status [2].
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [nsupdate_child_handler]
(0x0040): Dynamic DNS child failed with status [512]
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [be_nsupdate_done]
(0x0040): nsupdate child execution failed [1432158228]: Dynamic DNS
update failed
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]]
[sdap_dyndns_update_ptr_done] (0x0080): nsupdate failed, retrying with
server name
update failed: REFUSED
And named with bind dlz over on the DC:
2014-02-18T16:11:51.243855+01:00 hh16 named[2657]: samba_dlz: starting
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.246508+01:00 hh16 named[2657]: samba_dlz:
disallowing update of signer=CATRAL\$\(a)HH3.SITE
name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
2014-02-18T16:11:51.247290+01:00 hh16 named[2657]: client
192.168.1.21#39914/key CATRAL\$\(a)HH3.SITE: updating zone
'1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
(REFUSED)
2014-02-18T16:11:51.247830+01:00 hh16 named[2657]: samba_dlz: cancelling
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.672609+01:00 hh16 named[2657]: samba_dlz: starting
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.675807+01:00 hh16 named[2657]: samba_dlz:
disallowing update of signer=CATRAL\$\(a)HH3.SITE
name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
2014-02-18T16:11:51.676405+01:00 hh16 named[2657]: client
192.168.1.21#33287/key CATRAL\$\(a)HH3.SITE: updating zone
'1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
(REFUSED)
Question: Does the new code work against AD?
Thanks,
Steve
sssd.conf
[sssd]
#debug_level = 9
services = nss, pam, autofs
config_file_version = 2
domains = default
[nss]
[pam]
[autofs]
[domain/default]
#debug_level = 9
dyndns_update=true
dyndns_update_ptr=true
dyndns_refresh_interval = 8
ad_hostname = catral.hh3.site
ad_server = hh16.hh3.site
ad_domain = hh3.site
ldap_schema = ad
id_provider = ad
access_provider = ad
enumerate = false
cache_credentials = true
#entry_cache_timeout = 60
auth_provider = ad
chpass_provider = ad
krb5_realm = hh3.site
krb5_server = hh16.hh3.site
krb5_kpasswd = hh16.hh3.site
ldap_id_mapping=false
ldap_referrals = false
ldap_uri = ldap://hh16.hh3.site
ldap_search_base = dc=hh3,dc=site
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = group
ldap_group_search_base = dc=hh3,dc=site
ldap_group_name = cn
ldap_group_member = member
ldap_sasl_mech = gssapi
ldap_sasl_authid = CATRAL$(a)HH3.SITE
krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
autofs_provider=ldap
ldap_autofs_search_base = OU=automount,DC=hh3,DC=site
ldap_autofs_map_object_class = automountMap
ldap_autofs_entry_object_class = automount
ldap_autofs_map_name = automountMapName
ldap_autofs_entry_key = automountKey
ldap_autofs_entry_value = automountInformation