On 7 Jun 2014 18:38, steve steve@steve-ss.com wrote:
Hi Thanks. Yes, same here. Even though bind allows the signed updates from sssd, we don't need them. We can authenticate using sssd no matter what IP is assigned and no matter what is stored in AD. Maybe the ddns requirement could be removed from the default ad-backend?
You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.
jh
On Sat, 2014-06-07 at 18:49 +0100, John Hodrien wrote:
On 7 Jun 2014 18:38, steve steve@steve-ss.com wrote:
Hi Thanks. Yes, same here. Even though bind allows the signed updates from sssd, we don't need them. We can authenticate using sssd no matter what IP is assigned and no matter what is stored in AD. Maybe the ddns requirement could be removed from the default ad-backend?
You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.
It doesn't seem to matter either. sssd autofs cifs works fine irrespective of dns.
On Sun, 2014-06-08 at 12:15 +0200, steve wrote:
On Sat, 2014-06-07 at 18:49 +0100, John Hodrien wrote:
On 7 Jun 2014 18:38, steve steve@steve-ss.com wrote:
Hi Thanks. Yes, same here. Even though bind allows the signed updates from sssd, we don't need them. We can authenticate using sssd no matter what IP is assigned and no matter what is stored in AD. Maybe the ddns requirement could be removed from the default ad-backend?
You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.
It doesn't seem to matter either. sssd autofs cifs works fine irrespective of dns.
The reason why DNS updates matter is that if your client ever needs to be a *server*, then you want to be able to actually "find" it.
Think laptops that expose SSH in order to be accessed for admin purposes.
If your client never exposes any services/never needs to be contacted from a remote party and use Kerberos as authentication then it is not strictly required to update the DNS, though it is nice to know the right addresses.
We do enable it by default because in some environment DNS-scrubbing is used, ie if the client doesn't update the DNS for long enough it is considered old and the whole computer account may be nuked.
HTH, Simo.
What about NFS protocol? Server used to check client's identity in reverse DNS addresses.
Best, Longina
-----Original Message----- From: sssd-users-bounces@lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Simo Sorce Sent: 8. juni 2014 19:45 To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] ddns updates not required?
On Sun, 2014-06-08 at 12:15 +0200, steve wrote:
On Sat, 2014-06-07 at 18:49 +0100, John Hodrien wrote:
On 7 Jun 2014 18:38, steve steve@steve-ss.com wrote:
Hi Thanks. Yes, same here. Even though bind allows the signed updates from sssd, we don't need them. We can authenticate using sssd no matter what IP is assigned and no matter what is stored in AD. Maybe the ddns requirement could be removed from the default ad-backend?
You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.
It doesn't seem to matter either. sssd autofs cifs works fine irrespective of dns.
The reason why DNS updates matter is that if your client ever needs to be a *server*, then you want to be able to actually "find" it.
Think laptops that expose SSH in order to be accessed for admin purposes.
If your client never exposes any services/never needs to be contacted from a remote party and use Kerberos as authentication then it is not strictly required to update the DNS, though it is nice to know the right addresses.
We do enable it by default because in some environment DNS-scrubbing is used, ie if the client doesn't update the DNS for long enough it is considered old and the whole computer account may be nuked.
HTH, Simo.
-- Simo Sorce * Red Hat, Inc * New York
_______________________________________________ sssd-users mailing list sssd-users@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users
On Tue, 2014-06-10 at 08:37 +0000, Longina Przybyszewska wrote:
What about NFS protocol? Server used to check client's identity in reverse DNS addresses.
Kind of, it just used reverse DNS lookups for no good reason, in fact I sent a patch a while ago to suppress the behavior, now it is optional.
Simo.
sssd-users@lists.fedorahosted.org
-
John Hodrien -
Longina Przybyszewska -
Simo Sorce -
steve