[SSSD] 1.11.4 can't update reverse zone

steve steve at steve-ss.com
Wed Feb 26 14:01:30 UTC 2014


On Tue, 2014-02-18 at 16:51 +0100, Jakub Hrozek wrote:
> On Tue, Feb 18, 2014 at 04:20:02PM +0100, steve wrote:
> > Hi
> > We have Samba4 AD with dyndns updates working fine for the forward zone:

> > 2014-02-18T16:11:51.672609+01:00 hh16 named[2657]: samba_dlz: starting
> > transaction on zone 1.168.192.in-addr.arpa
> > 2014-02-18T16:11:51.675807+01:00 hh16 named[2657]: samba_dlz:
> > disallowing update of signer=CATRAL\$\@HH3.SITE
> > name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
> > 2014-02-18T16:11:51.676405+01:00 hh16 named[2657]: client
> > 192.168.1.21#33287/key CATRAL\$\@HH3.SITE: updating zone
> > '1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
> > (REFUSED)
> 
> ^^^ isn't this the error you were looking for? Seems like your server
> doesn't allow updating PTR records.. Can you try setting
> dyndns_update_ptr=False ?

Hi
Yes, thanks. That is indeed it. I thought it was because the DNS user
did not have permission to write to the reverse zone, but that can't be
the case since all the zones are in the same partition and that
partition is 0660 root:named.

I tried manually deleting the entry on the DC but the error was the
same. In the end, I had to delete the whole zone and recreate it,
whereupon the updates went in fine. It's not easy to trace as we're in
production but it looks as though that if the IP was previously
populated by a windows client and then we attempt a sssd/nsupdate
update, it fails.

Do excuse us the pun in advance, but any pointers would be most welcome.
Cheers,
Steve





More information about the sssd-devel mailing list