[SSSD] 1.11.4 can't update reverse zone

Jakub Hrozek jhrozek at redhat.com
Tue Feb 18 15:51:10 UTC 2014


On Tue, Feb 18, 2014 at 04:20:02PM +0100, steve wrote:
> Hi
> We have Samba4 AD with dyndns updates working fine for the forward zone:
> (Tue Feb 18 16:12:37 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
> (0x0040): DNS update finished
> 
> But not the reverse zone:
> (Tue Feb 18 16:13:41 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
> (0x0040): DNS update finished
> update failed: REFUSED
> (Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [child_sig_handler]
> (0x0020): child [27754] failed with status [2].
> (Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [nsupdate_child_handler]
> (0x0040): Dynamic DNS child failed with status [512]
> (Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [be_nsupdate_done]
> (0x0040): nsupdate child execution failed [1432158228]: Dynamic DNS
> update failed
> (Tue Feb 18 16:13:51 2014) [sssd[be[default]]]
> [sdap_dyndns_update_ptr_done] (0x0080): nsupdate failed, retrying with
> server name
> update failed: REFUSED

We haven't changed anything for quite some time in the nsupdate code..

> 
> And named with bind dlz over on the DC:
> 2014-02-18T16:11:51.243855+01:00 hh16 named[2657]: samba_dlz: starting
> transaction on zone 1.168.192.in-addr.arpa
> 2014-02-18T16:11:51.246508+01:00 hh16 named[2657]: samba_dlz:
> disallowing update of signer=CATRAL\$\@HH3.SITE
> name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
> 2014-02-18T16:11:51.247290+01:00 hh16 named[2657]: client
> 192.168.1.21#39914/key CATRAL\$\@HH3.SITE: updating zone
> '1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
> (REFUSED)
> 2014-02-18T16:11:51.247830+01:00 hh16 named[2657]: samba_dlz: cancelling
> transaction on zone 1.168.192.in-addr.arpa
> 2014-02-18T16:11:51.672609+01:00 hh16 named[2657]: samba_dlz: starting
> transaction on zone 1.168.192.in-addr.arpa
> 2014-02-18T16:11:51.675807+01:00 hh16 named[2657]: samba_dlz:
> disallowing update of signer=CATRAL\$\@HH3.SITE
> name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
> 2014-02-18T16:11:51.676405+01:00 hh16 named[2657]: client
> 192.168.1.21#33287/key CATRAL\$\@HH3.SITE: updating zone
> '1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
> (REFUSED)

^^^ isn't this the error you were looking for? Seems like your server
doesn't allow updating PTR records.. Can you try setting
dyndns_update_ptr=False ?



More information about the sssd-devel mailing list