On 11/05/13 09:54, steve wrote:> Hi
> I know that this has been addressed before but I couldn't find a
> solution. Summary: when attempting to write a dns record using
> nsupdate, nothing gets written to the zone due to the error:
> ; TSIG error with server: tsig verify failure
>
> Everything is working. We can login to the domain from the same client
> and we have sssd sending the dyndns update requests which also produce
> the same error but still send the correct IP to the server after a
> change in I on the client but still nothing is written.
>
> Test: we can't ping the client by name from the DC after the update
> request is sent. The DC responds correctly as for e.g. successful
> updates from xp clients.
>
> Question, does this work against a DC with bind dlz? Any solution
> meanwhile?
> Thanks,
> Steve
>
> Here is the output:
>
> sudo nsupdate -g -d
> [sudo] password for steve:
> > server 192.168.1.16
> > realm HH3.SITE
> > update add pinoso.hh3.site 3600 A 192.168.1.100
> > send
> Reply from SOA query:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7006
> ;; flags: qr; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
> ;; QUESTION SECTION:
> ;pinoso.hh3.site. IN SOA
>
> Reply from SOA query:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25384
> ;; flags: qr aa ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
> ;; QUESTION SECTION:
> ;hh3.site. IN SOA
>
> ;; ANSWER SECTION:
> hh3.site. 3600 IN SOA hh16.hh3.site.
> hostmaster.hh3.site. 6 900 600 86400 0
>
> Found zone name: hh3.site
> The master is: hh16.hh3.site
> start_gssrequest
> send_gssrequest
> Outgoing update query:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3099
> ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> ;; QUESTION SECTION:
> ;3768628576.sig-hh16.hh3.site. ANY TKEY
>
> ;; ADDITIONAL SECTION:
> 3768628576.sig-hh16.hh3.site. 0 ANY TKEY gss-tsig. 1368261695
> 1368261695 3 NOERROR 1244
> YIIE2AYGKwYBBQUCoIIEzDCCBMigDTALBgkqhkiG9xIBAgKiggS1BIIE
> sWCCBK0GCSqGSIb3EgECAgEAboIEnDCCBJigAwIBBaEDAgEOogcDBQAg
> AAAAo4IDmmGCA5YwggOSoAMCAQWhChsISEgzLlNJVEWiHzAdoAMCAQGh
> FjAUGwNETlMbDWhoMTYuaGgzLnNpdGWjggNcMIIDWKADAgEXoQMCAQGi
> ggNKBIIDRlUabLy43CC30nH0ztt7pJM4GMIzCsGtI/fq2Cpy9+xiLCFi
> s0cK6oMdAgTxXBXKHBugCAw/2Nc/Bq2hueJp+mgkO0YrNklk0KqNCHcT
> xlsa2+Iysb3JAeOQKFiF3rfirW8GNP+5c7d79ZVf6vXPRXnKCQ/waxum
> BJhUZkzcUZT1d34E4xIdZJBSp7vD3kFk5odFPMCehkXt/122hMAbvOKu
> 0QG0dI3hVhadgAN8RUDyCyAOaAcY2hwfdLnodQACSdJBc3mnw6y6UJvp
> RjyaibVx8rbDY3kLE5qDPR+ttB46B1kkrRqzbFAQU9bju63Ipbb/naa+
> KxoA753ImXCCpDYA/biXGu0tLz8EsWk1HoO+Ij+aqjtqNPAa4u6+qS/0
> XtZTeRPzjNBs2nkleWVHwr6PRB5Lfa8W9POZwAw5+CiY1DHN7BbmYqwW
> kIxTO4pFg6mrOe9IaYspfO6bVmrNS45snNJraURPEwXIwAm2O0RwBvZR
> wG+W8tP04yFyI7eszyvU1IJJTwaFX8DO/abSrmIaMPvgvoTi9eDb5YYo
> mqJmOQKFQkJMmSOkBkc+KIqIJXuXPVtz3ArRY6gE44Ju+1WAJvMDXopz
> fIxRydSxbu1Fyd1UR0YkBqRs0KfnGAY4YnnjspfgcrQFmCTROauBidea
> MkyJOaeARZZDfA/9D4b/giHEjZxDxQ8roWrv1eggaQSGqa3kILma5rB3
> IZzbGmCkXz1QRPMNncxtoA+MU/63S0Ebd0ubcyqkG0fImZFFYkpTO4BS
> 7R/0u1E1iIb2jAkxZT6H0EtpeC/yPAYzCkgSphfT6rbpqZvET3W2q2Sp
> Ig3fwlOFGWTz8GvFH8aBjSnAQkaNarTvlaxt1D0pcn3kSLhpV1SzpYMA
> DL+mnSXGhCxypvVYyZ8scXf+eW0jXy/th4B6tzrocz/x9d76hWYlIzFd
> Fhs78rz8yKauXn/1H2sJRldg0atYOFMTjfMAgTigLDuDOBt4YPFfArow
> OYtBkA/ykZBCjlIgV5BmrqOBpNqBeeGWPRxUrXrnO3W4nebQUH3LRYie
> WaEaUbeBnCR8QD1ekQJ1rKIYC8tEKK17tTiYW2YSgrlUYPPt8FvL526H
> 5sjZFu2kgeQwgeGgAwIBF6KB2QSB1hA7lI/olfXairjMfhodpVSAOTgu
> lM1BFzb44h8+Mu5to6ZiG/ZBPC3EdXkHKiyy1Z3tzOJIA6MRtU971vNp
> FVj8WCG8r+0MJNi2EpgbrSJswRcJER2TPdZt7LROdztKM30WEaSOH+5W
> mVWdgrzdJnt1CnAu+Xgt9ZryB+D/ClHgoc8x9ubJqJsAGb2HkoKx5wL6
> 0INBenMRvUcpGBGQpwm5TTzLhWm8PzgY8fgXq0tHKupIEhKhGtWCOLa3
> 4KLM1vg/cpf92sL6O+4vBiFHtVzMwTBW1iE= 0
>
> recvmsg reply from GSS-TSIG query
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3099
> ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> ;; QUESTION SECTION:
> ;3768628576.sig-hh16.hh3.site. ANY TKEY
>
> ;; ANSWER SECTION:
> 3768628576.sig-hh16.hh3.site. 0 ANY TKEY gss-tsig. 1368261695
> 1368261695 3 NOERROR 182
> oYGzMIGwoAMKAQChCwYJKoZIhvcSAQICooGbBIGYYIGVBgkqhkiG9xIB
> AgICAG+BhTCBgqADAgEFoQMCAQ+idjB0oAMCAReibQRrSKJ1+4+PHfd7
> OARWsz4211kkiXorLDD3Q/cA99dJ3KVNpfjTza9+5jQ9cvygULCqo73Q
> 70a8Or+USG3q+TAaCzEUuJ/McPpmcly5fXFkY3ES5xtIXv/yp0tJXXsA
> ixNl/6pt2FqLT+10SI4= 0
>
> ;; TSIG PSEUDOSECTION:
> 3768628576.sig-hh16.hh3.site. 0 ANY TSIG gss-tsig. 1368261704
> 300 28 BAQF//////8AAAAAFKquCK9Y5B2dtDDIUnGo8g== 3099 NOERROR 0
>
> Sending update to 192.168.1.16#53
> Outgoing update query:
> ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 49895
> ;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
> ;; UPDATE SECTION:
> pinoso.hh3.site. 3600 IN A 192.168.1.100
>
> ;; TSIG PSEUDOSECTION:
> 3768628576.sig-hh16.hh3.site. 0 ANY TSIG gss-tsig. 1368261695
> 300 28 BAQE//////8AAAAACnjz67DpwRhWZSDZ2gT5HQ== 49895 NOERROR 0
>
> ; TSIG error with server: tsig verify failure
>
> Reply from update query:
> ;; ->>HEADER<<- opcode: UPDATE, status: SERVFAIL, id: 49895
> ;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
> ;; ZONE SECTION:
> ;hh3.site. IN SOA
>
> ;; UPDATE SECTION:
> pinoso.hh3.site. 3600 IN A 192.168.1.100
>
> ;; TSIG PSEUDOSECTION:
> 3768628576.sig-hh16.hh3.site. 0 ANY TSIG gss-tsig. 1368261695
> 300 28 BAQE//////8AAAAACnjz67DpwRhWZSDZ2gT5HQ== 49895 NOERROR 0
>
Hi Steve, I use a script (run by dhcp) that runs nsupdate and this
works, I can ping clients by name & ip from the server, but I am using
bind9 instead of the internal dns.
Rowland
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.