[SSSD] 1.11.4 can't update reverse zone

Jakub Hrozek jhrozek at redhat.com
Wed Feb 26 17:45:50 UTC 2014


On Wed, Feb 26, 2014 at 03:01:30PM +0100, steve wrote:
> On Tue, 2014-02-18 at 16:51 +0100, Jakub Hrozek wrote:
> > On Tue, Feb 18, 2014 at 04:20:02PM +0100, steve wrote:
> > > Hi
> > > We have Samba4 AD with dyndns updates working fine for the forward zone:
> 
> > > 2014-02-18T16:11:51.672609+01:00 hh16 named[2657]: samba_dlz: starting
> > > transaction on zone 1.168.192.in-addr.arpa
> > > 2014-02-18T16:11:51.675807+01:00 hh16 named[2657]: samba_dlz:
> > > disallowing update of signer=CATRAL\$\@HH3.SITE
> > > name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
> > > 2014-02-18T16:11:51.676405+01:00 hh16 named[2657]: client
> > > 192.168.1.21#33287/key CATRAL\$\@HH3.SITE: updating zone
> > > '1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
> > > (REFUSED)
> > 
> > ^^^ isn't this the error you were looking for? Seems like your server
> > doesn't allow updating PTR records.. Can you try setting
> > dyndns_update_ptr=False ?
> 
> Hi
> Yes, thanks. That is indeed it. I thought it was because the DNS user
> did not have permission to write to the reverse zone, but that can't be
> the case since all the zones are in the same partition and that
> partition is 0660 root:named.
> 
> I tried manually deleting the entry on the DC but the error was the
> same. In the end, I had to delete the whole zone and recreate it,
> whereupon the updates went in fine. It's not easy to trace as we're in
> production but it looks as though that if the IP was previously
> populated by a windows client and then we attempt a sssd/nsupdate
> update, it fails.
> 
> Do excuse us the pun in advance, but any pointers would be most welcome.
> Cheers,
> Steve

Did you try (maybe with nsupdate) if any DNS update would be rejected or
only updating the PTR records? The only suggestion I'd have is to check
the properties in the zone and see if the "Dynamic updates" selection
box is set to "Secure only" on the "General" tab.



More information about the sssd-devel mailing list