Home / server / Questions / 177820
In Process
netlinxman
Asked: 2010-09-04 08:08:09 +0800 CST

ISC Bind support for GSS-TSIG DDNS Updates?

  • 772

First, has anyone EVER configured ISC bind 9.5.0 OR greater with support for GSS-TSIG Dynamic DNS Updates AND gotten it to work? If so, what is the configuration that was used to make that happen?

I feel close to having this working. I see that GSS cred passes w/o apparent error during the TKEY negotiation with an Active Directory DC and the BIND DNS server:

client 192.168.0.30#52314: query gss cred: "DNS/[email protected]", GSS_C_ACCEPT, 4294967256 gss-api source name (accept) is [email protected] process_gsstkey(): dns_tsigerror_noerror client 192.168.0.30#52314: send

But, when the Update is sent, it is refused:

client 192.168.0.30#58330: update client 192.168.0.30#58330: updating zone 'example.com/IN': update failed: rejected by secure update (REFUSED) client 192.168.0.30#58330: send

Does anyone have this working in the real world?

domain-name-system active-directory dyndns

1 Answers

  1. I actually managed to get dynamic updates to work using a patch provided by the samba 4 team.

    http://wiki.samba.org/index.php/Samba4/HOWTO#Step_10_Configure_kerberos_DNS_dynamic_updates

    There seems to be issues with the version of windows running and it's method of doing dynamic updates.

    If you're trying to do the same outside of a samba4 domain... your next-best-bet is to try & follow the howto here:

    http://freeipa.org/page/Dynamic_updates_with_GSS-TSIG

    I'm sorry if I don't have more info on that subject.

    • 2