Cloned Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=767725
Moved to FreeIPA from https://fedorahosted.org/sssd/ticket/1089
Customers have requested on the mailing lists that updating DNS entries with SSSD should also update the reverse entry in DNS. For security reasons, we cannot have SSSD do this with GSS-TSIG (because it would require giving each client the capability to update any reverse entry in the domain).
Our recommended solution would be to add a plugin to the BIND LDAP driver to allow it to set the reverse entry automatically whenever the forward entry is updated.
This was already fixed in bind-dyndb-ldap upstream: https://fedorahosted.org/bind-dyndb-ldap/ticket/33
bind-dyndb-ldap
We just have to add some means of per-zone configuration to FreeIPA DNS module. bind-dyndb-ldap upstream ticket is already worked on:
https://fedorahosted.org/bind-dyndb-ldap/ticket/39
This is to track server side.
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=767725
attachment freeipa-mkosek-199-add-api-for-ptr-sync-control.patch
A relevant bug I filed: https://bugzilla.redhat.com/show_bug.cgi?id=784815
How to test:
Go to client and get host/$HOST@$REALM
/usr/bin/kinit -k -t /etc/krb5.keytab host/hostname
hostname
Prepare data for nsupdate to update. The example below will create/update forward record in zone example.com managed by FreeIPA server:
nsupdate
zone exaple.com. update delete client.example.com. IN A send update add client.example.com. 1200 IN A 10.0.0.2 send
Run the update:
/usr/bin/nsupdate -g nsupdate.txt
Now, if the relevant zones on the server do not have PTR sync enabled:
... Allow PTR sync: TRUE
then no PTR record should be created in appropriate reverse zone and just the forward record for client.example.com. should be created. 7. If you allow PTR sync for relevant zones (dnszone-mod ZONE --allow-sync-ptr=1) and restart the name server, the nsupdate command should also create PTR record in the reverse zone.
client.example.com.
dnszone-mod ZONE --allow-sync-ptr=1
Moving to next month iteration.
master: 1c898e3[[BR]] ipa-2-2: 40063c0
Metadata Update from @sgallagh: - Issue assigned to mkosek - Issue set to the milestone: FreeIPA 2.2 Core Effort - 2012/02
Login to comment on this ticket.