[SSSD-users] DDNS update problem with SSSD (1.11.7)
Dmitri Pal
dpal at redhat.com
Tue Feb 24 15:55:13 UTC 2015
On 02/24/2015 10:10 AM, Longina Przybyszewska wrote:
>
> Hi,
>
> We have a problem with the way SSSD tries to find out where to send
> DDNS updates. The problem is that SSSD doesn’t use DNS to find the
> authoritative name server for a given zone, but assume that it must be
> the Active Directory Domain Controller to which it is connected.
>
> In our case this is not correct in any way.
>
> Our DNS setup is like this:
>
> DNS-PTR.example.com is Authoritative for all our DNS PTR/reverse
> records (xxx.in-addr.arpa) and for the forward zone example.com with
> the exception of local.example.com (and subdomains), which is
> delegated to localserver1.local.example.com.
>
> (This is purely internal – external we have another DNS service let’s
> call it DNS-external.example.com, but it doesn’t matter in this
> example/problem).
>
> Our Active directory is a forrest named local.example.com with
> subdomains a.local.example.com, b.local.example.com, etc. each Active
> directory subdomain has it’s own domain controllers let’s say
> localserverA.a.local.example.com, localserverB.b.local.example.com, etc.
>
> Active Directory computer objects (accounts) are located in
> sub-domains ex. nfsserverA.a.local.example.com,
> nfsclientB.b.local.example.com, etc.
>
> Just for your information: Active Directory user objects (accounts)
> are located in all Active Directory domains – including top domain
> local.example.com.
>
> The problem:
>
> When nfsserverA.a.local.example.com is trying to update it’s DNS
> record it’s sending the update to the Active Directory Domain
> Controller localserverA.a.local.example.com, which is only running
> Active Directory Services (Domain Controller, Global Catalog, etc.)
> and not a DNS service, because it assumes that the Active Directory
> Domain Controller also is running DNS service.
>
> If SSSD had done a DNS lookup for the DNS Name Server record for
> a.local.example.com it’s told that the DNS Name Server is
> localserver1.local.example.com. And if it’s looking for the
> responsible DNS name server for the reverse zone x.y.10.in-addr.arpa.
> (we are running 10.0.0.0/8 divided into /24 subnets as our internal IP
> subnets) it’s told to that the responsible server is
> DNS-PTR.example.com (only accessible from our internal network).
>
> PS: I have seen the comments in
> https://lists.fedorahosted.org/pipermail/sssd-users/2014-June/001878.html
> talking about creating an option in sssd.conf called something like
> fallback_dns_master, but I find that very inflexible and not the right
> way to go … because, if we move the DNS service form one server to
> another we’ll have to change a lot of local client configuration.
> Another argument is that we actually have multiple servers
> authoritative for local.example.com and I suppose that it’s only
> possible to configure one server in the suggested attribute
> “fallback_dns_master”.
>
> Best,
>
> Longina
>
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Sounds like and RFE. Please file a ticket.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150224/646d6d51/attachment-0001.html>
More information about the sssd-users
mailing list