Hi
If this is set:
Allow PTR sync: TRUE
Then why, when a host is added with ipa host-add, does only the forward DNS record get set and not the PTR?
Anywhere else to look?
Thanks
From the RedHat documentation https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/managing-dynamic-dns-updates :
"Changes made through the IdM web UI, through the IdM command-line tools, or by editing the LDAP entry directly *do not* update the PTR record. Only changes made by the DNS service itself trigger PTR record synchronization."
Dynamic updates via nsupdate will automatically sync the PTR record.
John
That makes no sense - when I add DNS records, I can check the box for including PTR record and it updates. What is the point of having PTR Sync if PTR sync never happens? From reading man page on nsupdate, I am not even sure how that is going to work with IPA? Does not seem to make much sense. Why integrate a DNS server in a product if you have to run outside commands to keep them in sync?
Call me confused K
On 7/24/18 17:07, John Petrini wrote:
From the RedHat documentation https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/managing-dynamic-dns-updates:
"Changes made through the IdM web UI, through the IdM command-line tools, or by editing the LDAP entry directly *do not* update the PTR record. Only changes made by the DNS service itself trigger PTR record synchronization."
Dynamic updates via nsupdate will automatically sync the PTR record.
On ke, 25 heinä 2018, Kat via FreeIPA-users wrote:
John
That makes no sense - when I add DNS records, I can check the box for including PTR record and it updates. What is the point of having PTR Sync if PTR sync never happens? From reading man page on nsupdate, I am not even sure how that is going to work with IPA? Does not seem to make much sense. Why integrate a DNS server in a product if you have to run outside commands to keep them in sync?
Call me confused
By defining it in web UI or IPA CLI, you are giving a permission to synchronize the records to bind-dyndb-ldap. This permission is taken into account by bind-dyndb-ldap driver which is loaded into a bind which serves the zones. When a client (nsupdate) comes to update a record, bind-dyndb-ldap driver will use this permission to automatically update the PTR record.
See https://docs.pagure.org/bind-dyndb-ldap/BIND9/SyncPTR.html for details how this works.
The commands like nsupdate are run by clients when they register updates. In IPA context this is performed automatically by SSSD which runs nsupdate using host credentials (host/$client-fqdn Kerberos principal) when it notices an IP address change.
'dyndns_update' option in sssd.conf (see sssd-ipa manual page) is used to control whether SSSD performs this operation or not. If you install IPA client with ipa-client-install, then --enable-dns-updates is the option that configures SSSD to do it.
Hopefully, this is less confusing.
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
John Petrini -
Kat