[SSSD-users] ddns updates not required?

John Hodrien J.H.Hodrien at leeds.ac.uk
Sat Jun 7 17:49:56 UTC 2014


On 7 Jun 2014 18:38, steve <steve at steve-ss.com> wrote:
> Hi
> Thanks.
> Yes, same here. Even though bind allows the signed updates from sssd, we
> don't need them. We can authenticate using sssd no matter what IP is
> assigned and no matter what is stored in AD. Maybe the ddns requirement
> could be removed from the default ad-backend?

You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation.  You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal.

jh


More information about the sssd-users mailing list