dyndns: asym auth for nsupdate

[joakim-tjernlund]

We have an asymmetrical auth scheme for DNS updates and wonder if sssd can add that ?
Something like
dyndns_auth = xxx
dyndns_auth_ptr = yyy

[sumit-bose]

Hi,

do I understand correctly that you e.g. want to set

dyndns_auth = GSS-TSIG

for A and AAAA records and

dyndns_auth_ptr = none

for PTR records?

Currently SSSD only supports 'GSS-TSIG' and 'none' as values here. So do I understand correctly that your DNS server requires authentication to update on type but does not allow authentication to update the other type?

bye,
Sumit

[joakim-tjernlund]

Yes, that is so.
I started hacking at https://github.com/joakim-tjernlund/sssd/tree/dyndns_auth_ptr
but I have not tested it at all, yet

[joakim-tjernlund]

My dyndns_auth_ptr branch above seems to work OK.

One thing that I find odd is that I cannot modify the RDNS record with nsupdate:

nsupdate -gv
> update delete 2.71.210.10.in-addr.arpa. in PTR
> send
; TSIG error with server: tsig verify failure
update failed: REFUSED

sssd managed to add that record using gss-tsig though.
Am I missing something?

[sumit-bose]

My dyndns_auth_ptr branch above seems to work OK.

One thing that I find odd is that I cannot modify the RDNS record with nsupdate:

nsupdate -gv
> update delete 2.71.210.10.in-addr.arpa. in PTR
> send
; TSIG error with server: tsig verify failure
update failed: REFUSED

sssd managed to add that record using gss-tsig though.
Am I missing something?

Hi,

it looks like SSSD will use delete only together with an add, maybe this helps here as well?

bye,
Sumit

[joakim-tjernlund]

My dyndns_auth_ptr branch above seems to work OK.
One thing that I find odd is that I cannot modify the RDNS record with nsupdate:

nsupdate -gv
> update delete 2.71.210.10.in-addr.arpa. in PTR
> send
; TSIG error with server: tsig verify failure
update failed: REFUSED

sssd managed to add that record using gss-tsig though.
Am I missing something?

Hi,

it looks like SSSD will use delete only together with an add, maybe this helps here as well?

bye,
Sumit

Sortof, if I do the same delete/add it works, but if I change TTL at all, it fails.

[joakim-tjernlund]

somehow sssd uses a different TSIG signature ? How is that possible ?

[joakim-tjernlund]

I can add/del a new RDNS entry with nsupdate, but I cannot change one that sssd has created

[joakim-tjernlund]

Does sssd ever remove DNS/RDNS entries? Like when shutting down?

[pbrezina]

Pushed PR: #5283

• master
  • 0b06908 - Add dyndns_auth_ptr support

[alexey-tikhonov]

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1884301