thr3ads.net - samba - [Samba] Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm) [Mar 2015]

If this information is useful, please help other people find it:
Share via:

sambalist.1.olol13 at spamgourmet.com

2015-Mar-19 07:48 UTC

[Samba] Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

Good morning!

First of all thanks Rowland for the fast answer yesterday! I realized that
samba-technical might have been the wrong mailing list and switched it to
the normal samba users list (hopefully it worked, as it does get a bit
confusing with spamgourmets sendto addresses!). Unfortunately the problem
with samba_dnsupdate remains after the changes.
I did changed the smb.conf, krb5.conf, and hosts as requested. I am pretty
new to both samba and linux and added most lines that looked promising from
other threads. Expected the DC itself to be able to join the domain
(again), as I remembered it to be possible after a classicupgrade with the
samba internal dns.

Regarding BIND, I am using version 9.9 on Debian Jessie and read it is not
necessary to build it yourself and configure it with dlopen (see here
<https://lists.samba.org/archive/samba/2015-January/188049.html>).
The driver is supposedly included and also seems to load alright:

named -g -c /etc/bind/named.conf -u named -d3 2>&1 | grep -i dlz
19-Mar-2015 08:05:26.396 Registering DLZ_dlopen driver
19-Mar-2015 08:05:26.396 Registering SDLZ driver 'dlopen'
19-Mar-2015 08:05:26.396 Registering DLZ driver 'dlopen'
19-Mar-2015 08:05:26.405 Loading SDLZ driver.
19-Mar-2015 08:05:26.646 samba_dlz: started for DN
DC=intranet,DC=mayweg,DC=net
19-Mar-2015 08:05:26.646 SDLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 DLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 samba_dlz: starting configure
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone
'11.168.192.in-addr.arpa'
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone '
intranet.mayweg.net'
19-Mar-2015 08:05:26.648 samba_dlz: configured writeable zone '_
msdcs.intranet.mayweg.net'


The error for samba_dnsupdate --all-names remains (btw, without --all-names
it works):
ldb: Destroying timer event 0x233f310 "ltdb_timeout"
ldb: Ending timer event 0x1d2bb70 "ltdb_callback"
Traceback (most recent call last):
  File "/usr/sbin/samba_dnsupdate", line 612, in <module>
    get_credentials(lp)
  File "/usr/sbin/samba_dnsupdate", line 125, in get_credentials
    raise e
RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
contact any KDC for requested realm)


Again, I'm very grateful for any hints where the problem could originate
from.
Greetings,
Timo


On 18 March 2015 at 19:57, Rowland Penny - repenny241155 at gmail.com <
sambalist.olol13.20ba6b371d.repenny241155#gmail.com at ob.0sg.net> wrote:
> On 18/03/15 17:05, sambalist.1.olol13 at spamgourmet.com wrote:
>
>> Hello,
>>
>> I am trying to upgrade an Samba 3 DC to an Samba 4 AD DC with BIND9_DLZ
>> backend on Debian Jessie. Before I was using tinydns on a different
server
>> and want to replace it with BIND.
>> I'm trying this with copies of virtual machines in a different
subnet (The
>> debian jessie AD DC and DNS, a Win7 Client used for RSAT tools
>> administration, a debian squeezy file server that is part of the domain
>> and
>> an xp client).
>> For the most part the new configuration is working, a lot thanks to
>> exploration of the wiki and the mailing list archives, but I cannot
>> resolve
>> the hostnames of domain members and think it is because dynamic DNS
>> updates
>> through kerberos aren't working.
>>
>> When I try "samba_dnsupdate --verbose --all-names", I get the
following
>> error:
>> ldb: Destroying timer event 0x1a42d10 "ltdb_timeout"
>> ldb: Ending timer event 0x1859f30 "ltdb_callback"
>> Traceback (most recent call last):
>>    File "/usr/sbin/samba_dnsupdate", line 612, in
<module>
>>      get_credentials(lp)
>>    File "/usr/sbin/samba_dnsupdate", line 125, in
get_credentials
>>      raise e
>> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
>> contact any KDC for requested realm)
>>
>> I can join the domain with windows & linux machines and administer
it and
>> the dns server with RSAT tools. Neither SELinux nor Apparmor are
present.
>>
>> The dns tests from the samba ad dc howto
>>
<https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO#BIND9_DNS_Backend>
>> were
>> all successful:
>> host -t SRV _ldap._tcp.intranet.mayweg.net.
>> _ldap._tcp.intranet.mayweg.net has SRV record 0 100 389
>> server06.intranet.mayweg.net.
>> host -t SRV _kerberos._udp.intranet.mayweg.net.
>> _kerberos._udp.intranet.mayweg.net has SRV record 0 100 88
>> server06.intranet.mayweg.net.
>> host -t A server06.intranet.mayweg.net.
>> server06.intranet.mayweg.net has address 192.168.11.250
>>
>> I can resolve the server06.intranet.mayweg.net and intranet.mayweg.net
on
>> all machines, but hostnames of machines I joined to the domain are not
>> resolvable from other domain members. A linux machine that joined had
the
>> output:
>> Joined 'SERVER13' to realm 'intranet.mayweg.net'
>> DNS update failed!
>>
>> I can get kerberos tickets on all machines, and join the domain using
net
>> ads join from all of them but the ad dc itself.
>> On server06 "net ads join -Uadministrator" returns
>> Failed to join domain: This operation is only allowed for the PDC of
the
>> domain. Maybe this has something to do with the dns updates not
working.
>>
>
> You do not run 'net ads join' on a DC, the provision does it for
you (or
> as in your case, the upgrade procedure)
>
>
>>
>> I'll follow up with version info and configuration files
(interfaces,
>> resolv.conf, hosts, smb.conf, krb5.conf, named.conf).
>> Samba version is 4.1.17, BIND 9.9.5. Unnecessarily I had the MIT
>> implementations of krb5-admin-server and krb5-kdc installed and
configured
>> until I realized Samba4 brings the heimdal implementation of kerberos
with
>> it. I uninstalled the MIT parts afterwards. Configuration files:
>>
>>
>> /etc/network/interfaces:
>> auto lo
>> iface lo inet loopback
>>
>> auto eth0
>> iface eth0 inet static
>>          address 192.168.11.250
>>          netmask 255.255.255.0
>>          network 192.168.11.0
>>          broadcast 192.168.11.255
>>
>>
>> /etc/resolv.conf:
>> nameserver 192.168.11.250 #had 127.0.0.1 before with the same error
>> domain intranet.mayweg.net
>>
>>
>> /etc/hosts:
>> 127.0.0.1       localhost localhost.localdomain
>> 192.168.11.250  server06.intranet.mayweg.net server06
>> krb.intranet.mayweg.net kdc.intranet.mayweg.net intranet.mayweg.net
>>
>
> Remove everything from the '192.168.11.250' line from 'krb'
onwards, they
> shouldn't be there.
>
>
>
>> # The following lines are desirable for IPv6 capable hosts
>> ::1     localhost ip6-localhost ip6-loopback
>> ff02::1 ip6-allnodes
>> ff02::2 ip6-allrouters
>>
>>
>> /etc/samba/smb.conf:
>> [global]
>> workgroup = MAYWEG.NET
>> realm = INTRANET.MAYWEG.NET
>> netbios name = SERVER06
>> interfaces = lo, eth0
>> bind interfaces only = Yes
>> server role = active directory domain controller
>> server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
winbind,
>> ntp_signd, kcc, dnsupdate
>> idmap_ldb:use rfc2307 = yes
>> #added after classicupgrade
>> kerberos method = system keytab
>> client ldap sasl wrapping = sign
>> allow dns updates = nonsecure and secure
>> nsupdate command =  /usr/bin/nsupdate -g
>> domain logons = yes
>>
>> [netlogon]
>> path = /var/lib/samba/sysvol/intranet.mayweg.net/scripts
>> read only = No
>>
>> [sysvol]
>> path = /var/lib/samba/sysvol
>> read only = No
>>
>>
> remove everything you added to smb.conf
>
>  /etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf):
>> [libdefaults]
>> default_realm = INTRANET.MAYWEG.NET
>> dns_lookup_realm = true #changed to true
>> dns_lookup_kdc = true
>>
>> #added after classicupgrade
>>
>> [realms]
>> INTRANET.MAYWEG.NET = {
>>          kdc = krb.intranet.mayweg.net
>>          admin_server = krb.intranet.mayweg.net
>>          default_domain = intranet.mayweg.net
>> }
>>
>> [domain_realm]
>>
>> .intranet.mayweg.net = INTRANET.MAYWEG.NET
>> intranet.mayweg.net = INTRANET.MAYWEG.NET
>>
>> [logging]
>> kdc = FILE:/var/log/kerberos/krb5kdc.log
>> admin_server = FILE:/var/log/kerberos/kadmin.log
>> default = FILE:/var/log/kerberos/krb5lib.log
>>
>>
> Change krb5.conf back to what it was.
>
>
>  /etc/bind/named.conf (copied together from the includes...):
>> zone "." {
>> type hint;
>> file "/etc/bind/db.root";
>> };
>> // be authoritative for the localhost forward and reverse zones, and
for
>> // broadcast zones as per RFC 1912
>>
>> zone "localhost" {
>> type master;
>> file "/etc/bind/db.local";
>> };
>>
>> zone "127.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.127";
>> };
>>
>> zone "0.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.0";
>> };
>>
>> zone "255.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.255";
>> };
>> dlz "AD DNS Zone" {
>>      # For BIND 9.8.x
>>      # database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9.so";
>>
>>      # For BIND 9.9.x
>>      database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9_9.so";
>>
>>      # For BIND 9.10.x
>>      # database "dlopen
>> /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
>> };
>> logging {
>>          channel update_debug {
>>                  file "/var/log/update_debug.log" versions 3
size 100k;
>>                  severity debug;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel security_info {
>>                  file "/var/log/security_info.log" versions 1
size 100k;
>>                  severity info;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel bind_log {
>>                  file "/var/log/bind.log" versions 3 size 1m;
>>                  severity info;
>>                  print-category  yes;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>
>>          category default { bind_log; };
>>          category lame-servers { null; };
>>          category update { update_debug; };
>>          category update-security { update_debug; };
>>          category security { security_info; };
>> };
>> options {
>>          directory "/var/named";
>>          recursion yes;
>>          dnssec-validation auto;
>>        tkey-gssapi-keytab
"/var/lib/samba/private/dns.keytab";
>> auth-nxdomain yes;
>>      notify no;
>>      empty-zones-enable no;
>>      allow-query {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-query-cache {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-recursion {
>>          192.168.11.0/24;
>> 127.0.0.1;
>>          # add other networks you want to allow to do recursive queries
>>      };
>>      forwarders {
>>          # Google public DNS server here - replace with your own if
>> necessary
>>       };
>>      allow-transfer {
>>          # this config is for a single master DNS server
>>          none;
>>      };
>> };
>>
>> I hope I provided all the necessary information and am grateful for any
>> hints on where to look for a fix to this problem.
>>
>> Greetings,
>> Timo
>>
>
> Finally, was the version of bind you are using configured with dlopen ?
>
> Rowland
>
>
>

sambalist.1.olol13 at spamgourmet.com

2015-Mar-19 08:38 UTC

head link

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

Good morning!

First of all thanks Rowland for the fast answer yesterday! I realized that
samba-technical might have been the wrong mailing list and switched it to
the normal samba users list (hopefully it worked, as it does get a bit
confusing with spamgourmets addresses!). Unfortunately the problem with
samba_dnsupdate remains after the changes.
I did changed the smb.conf, krb5.conf, and hosts as requested. I am pretty
new to both samba and linux and added most lines to the configs that looked
promising.
Expected the DC itself to be able to join the domain (again), as I
remembered it to be possible after a classicupgrade with the samba internal
dns.

Regarding BIND, I am using version 9.9 on Debian Jessie and read it is not
necessary to build it yourself and configure it with dlopen (see here
<https://lists.samba.org/archive/samba/2015-January/188049.html>).
The driver is supposedly included and also seems to load alright:

named -g -c /etc/bind/named.conf -u named -d3 2>&1 | grep -i dlz
19-Mar-2015 08:05:26.396 Registering DLZ_dlopen driver
19-Mar-2015 08:05:26.396 Registering SDLZ driver 'dlopen'
19-Mar-2015 08:05:26.396 Registering DLZ driver 'dlopen'
19-Mar-2015 08:05:26.405 Loading SDLZ driver.
19-Mar-2015 08:05:26.646 samba_dlz: started for DN
DC=intranet,DC=mayweg,DC=net
19-Mar-2015 08:05:26.646 SDLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 DLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 samba_dlz: starting configure
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone
'11.168.192.in-addr.arpa'
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone '
intranet.mayweg.net'
19-Mar-2015 08:05:26.648 samba_dlz: configured writeable zone '_
msdcs.intranet.mayweg.net'


The error for samba_dnsupdate --all-names remains (btw, without --all-names
it works):
ldb: Destroying timer event 0x233f310 "ltdb_timeout"
ldb: Ending timer event 0x1d2bb70 "ltdb_callback"
Traceback (most recent call last):
  File "/usr/sbin/samba_dnsupdate", line 612, in <module>
    get_credentials(lp)
  File "/usr/sbin/samba_dnsupdate", line 125, in get_credentials
    raise e
RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
contact any KDC for requested realm)


Again, I'm very grateful for any hints where the problem could originate
from.
Greetings,
Timo


On 18 March 2015 at 19:57, Rowland Penny - repenny241155 at gmail.com <
sambalist.olol13.20ba6b371d.repenny241155#gmail.com at ob.0sg.net> wrote:
> On 18/03/15 17:05, sambalist.1.olol13 at spamgourmet.com wrote:
>
>> Hello,
>>
>> I am trying to upgrade an Samba 3 DC to an Samba 4 AD DC with BIND9_DLZ
>> backend on Debian Jessie. Before I was using tinydns on a different
server
>> and want to replace it with BIND.
>> I'm trying this with copies of virtual machines in a different
subnet (The
>> debian jessie AD DC and DNS, a Win7 Client used for RSAT tools
>> administration, a debian squeezy file server that is part of the domain
>> and
>> an xp client).
>> For the most part the new configuration is working, a lot thanks to
>> exploration of the wiki and the mailing list archives, but I cannot
>> resolve
>> the hostnames of domain members and think it is because dynamic DNS
>> updates
>> through kerberos aren't working.
>>
>> When I try "samba_dnsupdate --verbose --all-names", I get the
following
>> error:
>> ldb: Destroying timer event 0x1a42d10 "ltdb_timeout"
>> ldb: Ending timer event 0x1859f30 "ltdb_callback"
>> Traceback (most recent call last):
>>    File "/usr/sbin/samba_dnsupdate", line 612, in
<module>
>>      get_credentials(lp)
>>    File "/usr/sbin/samba_dnsupdate", line 125, in
get_credentials
>>      raise e
>> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
>> contact any KDC for requested realm)
>>
>> I can join the domain with windows & linux machines and administer
it and
>> the dns server with RSAT tools. Neither SELinux nor Apparmor are
present.
>>
>> The dns tests from the samba ad dc howto
>>
<https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO#BIND9_DNS_Backend>
>> were
>> all successful:
>> host -t SRV _ldap._tcp.intranet.mayweg.net.
>> _ldap._tcp.intranet.mayweg.net has SRV record 0 100 389
>> server06.intranet.mayweg.net.
>> host -t SRV _kerberos._udp.intranet.mayweg.net.
>> _kerberos._udp.intranet.mayweg.net has SRV record 0 100 88
>> server06.intranet.mayweg.net.
>> host -t A server06.intranet.mayweg.net.
>> server06.intranet.mayweg.net has address 192.168.11.250
>>
>> I can resolve the server06.intranet.mayweg.net and intranet.mayweg.net
on
>> all machines, but hostnames of machines I joined to the domain are not
>> resolvable from other domain members. A linux machine that joined had
the
>> output:
>> Joined 'SERVER13' to realm 'intranet.mayweg.net'
>> DNS update failed!
>>
>> I can get kerberos tickets on all machines, and join the domain using
net
>> ads join from all of them but the ad dc itself.
>> On server06 "net ads join -Uadministrator" returns
>> Failed to join domain: This operation is only allowed for the PDC of
the
>> domain. Maybe this has something to do with the dns updates not
working.
>>
>
> You do not run 'net ads join' on a DC, the provision does it for
you (or
> as in your case, the upgrade procedure)
>
>
>>
>> I'll follow up with version info and configuration files
(interfaces,
>> resolv.conf, hosts, smb.conf, krb5.conf, named.conf).
>> Samba version is 4.1.17, BIND 9.9.5. Unnecessarily I had the MIT
>> implementations of krb5-admin-server and krb5-kdc installed and
configured
>> until I realized Samba4 brings the heimdal implementation of kerberos
with
>> it. I uninstalled the MIT parts afterwards. Configuration files:
>>
>>
>> /etc/network/interfaces:
>> auto lo
>> iface lo inet loopback
>>
>> auto eth0
>> iface eth0 inet static
>>          address 192.168.11.250
>>          netmask 255.255.255.0
>>          network 192.168.11.0
>>          broadcast 192.168.11.255
>>
>>
>> /etc/resolv.conf:
>> nameserver 192.168.11.250 #had 127.0.0.1 before with the same error
>> domain intranet.mayweg.net
>>
>>
>> /etc/hosts:
>> 127.0.0.1       localhost localhost.localdomain
>> 192.168.11.250  server06.intranet.mayweg.net server06
>> krb.intranet.mayweg.net kdc.intranet.mayweg.net intranet.mayweg.net
>>
>
> Remove everything from the '192.168.11.250' line from 'krb'
onwards, they
> shouldn't be there.
>
>
>
>> # The following lines are desirable for IPv6 capable hosts
>> ::1     localhost ip6-localhost ip6-loopback
>> ff02::1 ip6-allnodes
>> ff02::2 ip6-allrouters
>>
>>
>> /etc/samba/smb.conf:
>> [global]
>> workgroup = MAYWEG.NET
>> realm = INTRANET.MAYWEG.NET
>> netbios name = SERVER06
>> interfaces = lo, eth0
>> bind interfaces only = Yes
>> server role = active directory domain controller
>> server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
winbind,
>> ntp_signd, kcc, dnsupdate
>> idmap_ldb:use rfc2307 = yes
>> #added after classicupgrade
>> kerberos method = system keytab
>> client ldap sasl wrapping = sign
>> allow dns updates = nonsecure and secure
>> nsupdate command =  /usr/bin/nsupdate -g
>> domain logons = yes
>>
>> [netlogon]
>> path = /var/lib/samba/sysvol/intranet.mayweg.net/scripts
>> read only = No
>>
>> [sysvol]
>> path = /var/lib/samba/sysvol
>> read only = No
>>
>>
> remove everything you added to smb.conf
>
>  /etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf):
>> [libdefaults]
>> default_realm = INTRANET.MAYWEG.NET
>> dns_lookup_realm = true #changed to true
>> dns_lookup_kdc = true
>>
>> #added after classicupgrade
>>
>> [realms]
>> INTRANET.MAYWEG.NET = {
>>          kdc = krb.intranet.mayweg.net
>>          admin_server = krb.intranet.mayweg.net
>>          default_domain = intranet.mayweg.net
>> }
>>
>> [domain_realm]
>>
>> .intranet.mayweg.net = INTRANET.MAYWEG.NET
>> intranet.mayweg.net = INTRANET.MAYWEG.NET
>>
>> [logging]
>> kdc = FILE:/var/log/kerberos/krb5kdc.log
>> admin_server = FILE:/var/log/kerberos/kadmin.log
>> default = FILE:/var/log/kerberos/krb5lib.log
>>
>>
> Change krb5.conf back to what it was.
>
>
>  /etc/bind/named.conf (copied together from the includes...):
>> zone "." {
>> type hint;
>> file "/etc/bind/db.root";
>> };
>> // be authoritative for the localhost forward and reverse zones, and
for
>> // broadcast zones as per RFC 1912
>>
>> zone "localhost" {
>> type master;
>> file "/etc/bind/db.local";
>> };
>>
>> zone "127.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.127";
>> };
>>
>> zone "0.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.0";
>> };
>>
>> zone "255.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.255";
>> };
>> dlz "AD DNS Zone" {
>>      # For BIND 9.8.x
>>      # database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9.so";
>>
>>      # For BIND 9.9.x
>>      database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9_9.so";
>>
>>      # For BIND 9.10.x
>>      # database "dlopen
>> /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
>> };
>> logging {
>>          channel update_debug {
>>                  file "/var/log/update_debug.log" versions 3
size 100k;
>>                  severity debug;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel security_info {
>>                  file "/var/log/security_info.log" versions 1
size 100k;
>>                  severity info;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel bind_log {
>>                  file "/var/log/bind.log" versions 3 size 1m;
>>                  severity info;
>>                  print-category  yes;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>
>>          category default { bind_log; };
>>          category lame-servers { null; };
>>          category update { update_debug; };
>>          category update-security { update_debug; };
>>          category security { security_info; };
>> };
>> options {
>>          directory "/var/named";
>>          recursion yes;
>>          dnssec-validation auto;
>>        tkey-gssapi-keytab
"/var/lib/samba/private/dns.keytab";
>> auth-nxdomain yes;
>>      notify no;
>>      empty-zones-enable no;
>>      allow-query {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-query-cache {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-recursion {
>>          192.168.11.0/24;
>> 127.0.0.1;
>>          # add other networks you want to allow to do recursive queries
>>      };
>>      forwarders {
>>          # Google public DNS server here - replace with your own if
>> necessary
>>       };
>>      allow-transfer {
>>          # this config is for a single master DNS server
>>          none;
>>      };
>> };
>>
>> I hope I provided all the necessary information and am grateful for any
>> hints on where to look for a fix to this problem.
>>
>> Greetings,
>> Timo
>>
>
> Finally, was the version of bind you are using configured with dlopen ?
>
> Rowland
>
>
>

Peter Serbe

2015-Mar-19 09:04 UTC

head link

[Samba] Fwd: Dynamic DNS Updates not working.

sambalist.1.olol13 at spamgourmet.com schrieb am 19.03.2015 09:38:
> The error for samba_dnsupdate --all-names remains (btw, without --all-names
> it works):
> ldb: Destroying timer event 0x233f310 "ltdb_timeout"
> ldb: Ending timer event 0x1d2bb70 "ltdb_callback"
> Traceback (most recent call last):
>  File "/usr/sbin/samba_dnsupdate", line 612, in <module>
>    get_credentials(lp)
>  File "/usr/sbin/samba_dnsupdate", line 125, in get_credentials
>    raise e
> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
> contact any KDC for requested realm)
Obviously the first thing to do is to get Kerberos working. 
See: https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO 
Go to 'Testing Kerberos'. Check the hosts file, too, as 
it is needed to resolve the name of the KDC. 

HTH 
- Peter

Timo Altun

2015-Mar-19 09:30 UTC

head link

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

Thank you for the answers Peter and Rowland and sorry to everybody for the
spam...switched to another e-mail address and hope my messages will arrive
only once from now on.
As I wrote in my first mail, Kerberos does work. I can successfully request
and list a ticket on the AC DC.

kinit administrator at INTRANET.MAYWEG.NET
Password for administrator at INTRANET.MAYWEG.NET:

klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator at INTRANET.MAYWEG.NET
Valid starting       Expires              Service principal
19.03.2015 10:05:48  19.03.2015 20:05:48  krbtgt/
INTRANET.MAYWEG.NET at INTRANET.MAYWEG.NET
renew until 20.03.2015 10:05:46

Rowland, I did not change the DNS-Server to bind, I removed smb.conf and
/var/lib/samba/private and redid the classicupgrade with the
--dns-backend=BIND9_DLZ
option.

Timo



Good morning!

First of all thanks Rowland for the fast answer yesterday! I realized that
samba-technical might have been the wrong mailing list and switched it to
the normal samba users list (hopefully it worked, as it does get a bit
confusing with spamgourmets sendto addresses!). Unfortunately the problem
with samba_dnsupdate remains after the changes.
I did changed the smb.conf, krb5.conf, and hosts as requested. I am pretty
new to both samba and linux and added most lines that looked promising from
other threads. Expected the DC itself to be able to join the domain
(again), as I remembered it to be possible after a classicupgrade with the
samba internal dns.

Regarding BIND, I am using version 9.9 on Debian Jessie and read it is not
necessary to build it yourself and configure it with dlopen (see here
<https://lists.samba.org/archive/samba/2015-January/188049.html>).
The driver is supposedly included and also seems to load alright:

named -g -c /etc/bind/named.conf -u named -d3 2>&1 | grep -i dlz
19-Mar-2015 08:05:26.396 Registering DLZ_dlopen driver
19-Mar-2015 08:05:26.396 Registering SDLZ driver 'dlopen'
19-Mar-2015 08:05:26.396 Registering DLZ driver 'dlopen'
19-Mar-2015 08:05:26.405 Loading SDLZ driver.
19-Mar-2015 08:05:26.646 samba_dlz: started for DN
DC=intranet,DC=mayweg,DC=net
19-Mar-2015 08:05:26.646 SDLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 DLZ driver loaded successfully.
19-Mar-2015 08:05:26.646 samba_dlz: starting configure
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone
'11.168.192.in-addr.arpa'
19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone '
intranet.mayweg.net'
19-Mar-2015 08:05:26.648 samba_dlz: configured writeable zone '_
msdcs.intranet.mayweg.net'


The error for samba_dnsupdate --all-names remains (btw, without --all-names
it works):
ldb: Destroying timer event 0x233f310 "ltdb_timeout"
ldb: Ending timer event 0x1d2bb70 "ltdb_callback"
Traceback (most recent call last):
  File "/usr/sbin/samba_dnsupdate", line 612, in <module>
    get_credentials(lp)
  File "/usr/sbin/samba_dnsupdate", line 125, in get_credentials
    raise e
RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
contact any KDC for requested realm)


Again, I'm very grateful for any hints where the problem could originate
from.
Greetings,
Timo


On 18 March 2015 at 19:57, Rowland Penny - repenny241155 at gmail.com <
sambalist.olol13.20ba6b371d.repenny241155#gmail.com at ob.0sg.net> wrote:
> On 18/03/15 17:05, sambalist.1.olol13 at spamgourmet.com wrote:
>
>> Hello,
>>
>> I am trying to upgrade an Samba 3 DC to an Samba 4 AD DC with BIND9_DLZ
>> backend on Debian Jessie. Before I was using tinydns on a different
server>> and want to replace it with BIND.
>> I'm trying this with copies of virtual machines in a different
subnet
(The>> debian jessie AD DC and DNS, a Win7 Client used for RSAT tools
>> administration, a debian squeezy file server that is part of the domain
>> and
>> an xp client).
>> For the most part the new configuration is working, a lot thanks to
>> exploration of the wiki and the mailing list archives, but I cannot
>> resolve
>> the hostnames of domain members and think it is because dynamic DNS
>> updates
>> through kerberos aren't working.
>>
>> When I try "samba_dnsupdate --verbose --all-names", I get the
following
>> error:
>> ldb: Destroying timer event 0x1a42d10 "ltdb_timeout"
>> ldb: Ending timer event 0x1859f30 "ltdb_callback"
>> Traceback (most recent call last):
>>    File "/usr/sbin/samba_dnsupdate", line 612, in
<module>
>>      get_credentials(lp)
>>    File "/usr/sbin/samba_dnsupdate", line 125, in
get_credentials
>>      raise e
>> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
>> contact any KDC for requested realm)
>>
>> I can join the domain with windows & linux machines and administer
it and
>> the dns server with RSAT tools. Neither SELinux nor Apparmor are
present.
>>
>> The dns tests from the samba ad dc howto
>>
<https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO#BIND9_DNS_Backend>
>> were
>> all successful:
>> host -t SRV _ldap._tcp.intranet.mayweg.net.
>> _ldap._tcp.intranet.mayweg.net has SRV record 0 100 389
>> server06.intranet.mayweg.net.
>> host -t SRV _kerberos._udp.intranet.mayweg.net.
>> _kerberos._udp.intranet.mayweg.net has SRV record 0 100 88
>> server06.intranet.mayweg.net.
>> host -t A server06.intranet.mayweg.net.
>> server06.intranet.mayweg.net has address 192.168.11.250
>>
>> I can resolve the server06.intranet.mayweg.net and intranet.mayweg.net
on
>> all machines, but hostnames of machines I joined to the domain are not
>> resolvable from other domain members. A linux machine that joined had
the
>> output:
>> Joined 'SERVER13' to realm 'intranet.mayweg.net'
>> DNS update failed!
>>
>> I can get kerberos tickets on all machines, and join the domain using
net
>> ads join from all of them but the ad dc itself.
>> On server06 "net ads join -Uadministrator" returns
>> Failed to join domain: This operation is only allowed for the PDC of
the
>> domain. Maybe this has something to do with the dns updates not
working.
>>
>
> You do not run 'net ads join' on a DC, the provision does it for
you (or
> as in your case, the upgrade procedure)
>
>
>>
>> I'll follow up with version info and configuration files
(interfaces,
>> resolv.conf, hosts, smb.conf, krb5.conf, named.conf).
>> Samba version is 4.1.17, BIND 9.9.5. Unnecessarily I had the MIT
>> implementations of krb5-admin-server and krb5-kdc installed and
configured>> until I realized Samba4 brings the heimdal implementation of kerberos
with>> it. I uninstalled the MIT parts afterwards. Configuration files:
>>
>>
>> /etc/network/interfaces:
>> auto lo
>> iface lo inet loopback
>>
>> auto eth0
>> iface eth0 inet static
>>          address 192.168.11.250
>>          netmask 255.255.255.0
>>          network 192.168.11.0
>>          broadcast 192.168.11.255
>>
>>
>> /etc/resolv.conf:
>> nameserver 192.168.11.250 #had 127.0.0.1 before with the same error
>> domain intranet.mayweg.net
>>
>>
>> /etc/hosts:
>> 127.0.0.1       localhost localhost.localdomain
>> 192.168.11.250  server06.intranet.mayweg.net server06
>> krb.intranet.mayweg.net kdc.intranet.mayweg.net intranet.mayweg.net
>>
>
> Remove everything from the '192.168.11.250' line from 'krb'
onwards, they
> shouldn't be there.
>
>
>
>> # The following lines are desirable for IPv6 capable hosts
>> ::1     localhost ip6-localhost ip6-loopback
>> ff02::1 ip6-allnodes
>> ff02::2 ip6-allrouters
>>
>>
>> /etc/samba/smb.conf:
>> [global]
>> workgroup = MAYWEG.NET
>> realm = INTRANET.MAYWEG.NET
>> netbios name = SERVER06
>> interfaces = lo, eth0
>> bind interfaces only = Yes
>> server role = active directory domain controller
>> server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
winbind,>> ntp_signd, kcc, dnsupdate
>> idmap_ldb:use rfc2307 = yes
>> #added after classicupgrade
>> kerberos method = system keytab
>> client ldap sasl wrapping = sign
>> allow dns updates = nonsecure and secure
>> nsupdate command =  /usr/bin/nsupdate -g
>> domain logons = yes
>>
>> [netlogon]
>> path = /var/lib/samba/sysvol/intranet.mayweg.net/scripts
>> read only = No
>>
>> [sysvol]
>> path = /var/lib/samba/sysvol
>> read only = No
>>
>>
> remove everything you added to smb.conf
>
>  /etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf):
>> [libdefaults]
>> default_realm = INTRANET.MAYWEG.NET
>> dns_lookup_realm = true #changed to true
>> dns_lookup_kdc = true
>>
>> #added after classicupgrade
>>
>> [realms]
>> INTRANET.MAYWEG.NET = {
>>          kdc = krb.intranet.mayweg.net
>>          admin_server = krb.intranet.mayweg.net
>>          default_domain = intranet.mayweg.net
>> }
>>
>> [domain_realm]
>>
>> .intranet.mayweg.net = INTRANET.MAYWEG.NET
>> intranet.mayweg.net = INTRANET.MAYWEG.NET
>>
>> [logging]
>> kdc = FILE:/var/log/kerberos/krb5kdc.log
>> admin_server = FILE:/var/log/kerberos/kadmin.log
>> default = FILE:/var/log/kerberos/krb5lib.log
>>
>>
> Change krb5.conf back to what it was.
>
>
>  /etc/bind/named.conf (copied together from the includes...):
>> zone "." {
>> type hint;
>> file "/etc/bind/db.root";
>> };
>> // be authoritative for the localhost forward and reverse zones, and
for
>> // broadcast zones as per RFC 1912
>>
>> zone "localhost" {
>> type master;
>> file "/etc/bind/db.local";
>> };
>>
>> zone "127.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.127";
>> };
>>
>> zone "0.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.0";
>> };
>>
>> zone "255.in-addr.arpa" {
>> type master;
>> file "/etc/bind/db.255";
>> };
>> dlz "AD DNS Zone" {
>>      # For BIND 9.8.x
>>      # database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9.so";
>>
>>      # For BIND 9.9.x
>>      database "dlopen /usr/lib/x86_64-linux-gnu/
>> samba/bind9/dlz_bind9_9.so";
>>
>>      # For BIND 9.10.x
>>      # database "dlopen
>> /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
>> };
>> logging {
>>          channel update_debug {
>>                  file "/var/log/update_debug.log" versions 3
size 100k;
>>                  severity debug;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel security_info {
>>                  file "/var/log/security_info.log" versions 1
size 100k;
>>                  severity info;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>          channel bind_log {
>>                  file "/var/log/bind.log" versions 3 size 1m;
>>                  severity info;
>>                  print-category  yes;
>>                  print-severity  yes;
>>                  print-time      yes;
>>          };
>>
>>          category default { bind_log; };
>>          category lame-servers { null; };
>>          category update { update_debug; };
>>          category update-security { update_debug; };
>>          category security { security_info; };
>> };
>> options {
>>          directory "/var/named";
>>          recursion yes;
>>          dnssec-validation auto;
>>        tkey-gssapi-keytab
"/var/lib/samba/private/dns.keytab";
>> auth-nxdomain yes;
>>      notify no;
>>      empty-zones-enable no;
>>      allow-query {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-query-cache {
>>          127.0.0.1;
>>          192.168.11.0/24;
>>          # add other networks you want to allow to query your DNS
>>      };
>>      allow-recursion {
>>          192.168.11.0/24;
>> 127.0.0.1;
>>          # add other networks you want to allow to do recursive queries
>>      };
>>      forwarders {
>>          # Google public DNS server here - replace with your own if
>> necessary
>>       };
>>      allow-transfer {
>>          # this config is for a single master DNS server
>>          none;
>>      };
>> };
>>
>> I hope I provided all the necessary information and am grateful for any
>> hints on where to look for a fix to this problem.
>>
>> Greetings,
>> Timo
>>
>
> Finally, was the version of bind you are using configured with dlopen ?
>
> Rowland
>
>
>--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Rowland Penny

2015-Mar-19 09:51 UTC

head link

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

On 19/03/15 09:30, Timo Altun wrote:> Thank you for the answers Peter and Rowland and sorry to everybody for the
> spam...switched to another e-mail address and hope my messages will arrive
> only once from now on.
> As I wrote in my first mail, Kerberos does work. I can successfully request
> and list a ticket on the AC DC.
>
> kinit administrator at INTRANET.MAYWEG.NET
> Password for administrator at INTRANET.MAYWEG.NET:
>
> klist
> Ticket cache: FILE:/tmp/krb5cc_0
> Default principal: administrator at INTRANET.MAYWEG.NET
> Valid starting       Expires              Service principal
> 19.03.2015 10:05:48  19.03.2015 20:05:48  krbtgt/
> INTRANET.MAYWEG.NET at INTRANET.MAYWEG.NET
> renew until 20.03.2015 10:05:46
>
> Rowland, I did not change the DNS-Server to bind, I removed smb.conf and
> /var/lib/samba/private and redid the classicupgrade with the
> --dns-backend=BIND9_DLZ
> option.
>
> Timo
>
>
>
> Good morning!
>
> First of all thanks Rowland for the fast answer yesterday! I realized that
> samba-technical might have been the wrong mailing list and switched it to
> the normal samba users list (hopefully it worked, as it does get a bit
> confusing with spamgourmets sendto addresses!). Unfortunately the problem
> with samba_dnsupdate remains after the changes.
> I did changed the smb.conf, krb5.conf, and hosts as requested. I am pretty
> new to both samba and linux and added most lines that looked promising from
> other threads. Expected the DC itself to be able to join the domain
> (again), as I remembered it to be possible after a classicupgrade with the
> samba internal dns.
>
> Regarding BIND, I am using version 9.9 on Debian Jessie and read it is not
> necessary to build it yourself and configure it with dlopen (see here
> <https://lists.samba.org/archive/samba/2015-January/188049.html>).
> The driver is supposedly included and also seems to load alright:
>
> named -g -c /etc/bind/named.conf -u named -d3 2>&1 | grep -i dlz
> 19-Mar-2015 08:05:26.396 Registering DLZ_dlopen driver
> 19-Mar-2015 08:05:26.396 Registering SDLZ driver 'dlopen'
> 19-Mar-2015 08:05:26.396 Registering DLZ driver 'dlopen'
> 19-Mar-2015 08:05:26.405 Loading SDLZ driver.
> 19-Mar-2015 08:05:26.646 samba_dlz: started for DN
> DC=intranet,DC=mayweg,DC=net
> 19-Mar-2015 08:05:26.646 SDLZ driver loaded successfully.
> 19-Mar-2015 08:05:26.646 DLZ driver loaded successfully.
> 19-Mar-2015 08:05:26.646 samba_dlz: starting configure
> 19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone
> '11.168.192.in-addr.arpa'
> 19-Mar-2015 08:05:26.647 samba_dlz: configured writeable zone '
> intranet.mayweg.net'
> 19-Mar-2015 08:05:26.648 samba_dlz: configured writeable zone '_
> msdcs.intranet.mayweg.net'
>
>
> The error for samba_dnsupdate --all-names remains (btw, without --all-names
> it works):
> ldb: Destroying timer event 0x233f310 "ltdb_timeout"
> ldb: Ending timer event 0x1d2bb70 "ltdb_callback"
> Traceback (most recent call last):
>    File "/usr/sbin/samba_dnsupdate", line 612, in <module>
>      get_credentials(lp)
>    File "/usr/sbin/samba_dnsupdate", line 125, in get_credentials
>      raise e
> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed (Cannot
> contact any KDC for requested realm)
>
>
> Again, I'm very grateful for any hints where the problem could
originate
> from.
> Greetings,
> Timo
>
>
> On 18 March 2015 at 19:57, Rowland Penny - repenny241155 at gmail.com <
> sambalist.olol13.20ba6b371d.repenny241155#gmail.com at ob.0sg.net>
wrote:
>
>> On 18/03/15 17:05, sambalist.1.olol13 at spamgourmet.com wrote:
>>
>>> Hello,
>>>
>>> I am trying to upgrade an Samba 3 DC to an Samba 4 AD DC with
BIND9_DLZ
>>> backend on Debian Jessie. Before I was using tinydns on a different
> server
>>> and want to replace it with BIND.
>>> I'm trying this with copies of virtual machines in a different
subnet
> (The
>>> debian jessie AD DC and DNS, a Win7 Client used for RSAT tools
>>> administration, a debian squeezy file server that is part of the
domain
>>> and
>>> an xp client).
>>> For the most part the new configuration is working, a lot thanks to
>>> exploration of the wiki and the mailing list archives, but I cannot
>>> resolve
>>> the hostnames of domain members and think it is because dynamic DNS
>>> updates
>>> through kerberos aren't working.
>>>
>>> When I try "samba_dnsupdate --verbose --all-names", I get
the following
>>> error:
>>> ldb: Destroying timer event 0x1a42d10 "ltdb_timeout"
>>> ldb: Ending timer event 0x1859f30 "ltdb_callback"
>>> Traceback (most recent call last):
>>>     File "/usr/sbin/samba_dnsupdate", line 612, in
<module>
>>>       get_credentials(lp)
>>>     File "/usr/sbin/samba_dnsupdate", line 125, in
get_credentials
>>>       raise e
>>> RuntimeError: kinit for SERVER06$@INTRANET.MAYWEG.NET failed
(Cannot
>>> contact any KDC for requested realm)
>>>
>>> I can join the domain with windows & linux machines and
administer it and
>>> the dns server with RSAT tools. Neither SELinux nor Apparmor are
present.
>>>
>>> The dns tests from the samba ad dc howto
>>>
<https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO#BIND9_DNS_Backend>
>>> were
>>> all successful:
>>> host -t SRV _ldap._tcp.intranet.mayweg.net.
>>> _ldap._tcp.intranet.mayweg.net has SRV record 0 100 389
>>> server06.intranet.mayweg.net.
>>> host -t SRV _kerberos._udp.intranet.mayweg.net.
>>> _kerberos._udp.intranet.mayweg.net has SRV record 0 100 88
>>> server06.intranet.mayweg.net.
>>> host -t A server06.intranet.mayweg.net.
>>> server06.intranet.mayweg.net has address 192.168.11.250
>>>
>>> I can resolve the server06.intranet.mayweg.net and
intranet.mayweg.net on
>>> all machines, but hostnames of machines I joined to the domain are
not
>>> resolvable from other domain members. A linux machine that joined
had the
>>> output:
>>> Joined 'SERVER13' to realm 'intranet.mayweg.net'
>>> DNS update failed!
>>>
>>> I can get kerberos tickets on all machines, and join the domain
using net
>>> ads join from all of them but the ad dc itself.
>>> On server06 "net ads join -Uadministrator" returns
>>> Failed to join domain: This operation is only allowed for the PDC
of the
>>> domain. Maybe this has something to do with the dns updates not
working.
>>>
>> You do not run 'net ads join' on a DC, the provision does it
for you (or
>> as in your case, the upgrade procedure)
>>
>>
>>> I'll follow up with version info and configuration files
(interfaces,
>>> resolv.conf, hosts, smb.conf, krb5.conf, named.conf).
>>> Samba version is 4.1.17, BIND 9.9.5. Unnecessarily I had the MIT
>>> implementations of krb5-admin-server and krb5-kdc installed and
> configured
>>> until I realized Samba4 brings the heimdal implementation of
kerberos
> with
>>> it. I uninstalled the MIT parts afterwards. Configuration files:
>>>
>>>
>>> /etc/network/interfaces:
>>> auto lo
>>> iface lo inet loopback
>>>
>>> auto eth0
>>> iface eth0 inet static
>>>           address 192.168.11.250
>>>           netmask 255.255.255.0
>>>           network 192.168.11.0
>>>           broadcast 192.168.11.255
>>>
>>>
>>> /etc/resolv.conf:
>>> nameserver 192.168.11.250 #had 127.0.0.1 before with the same error
>>> domain intranet.mayweg.net
>>>
>>>
>>> /etc/hosts:
>>> 127.0.0.1       localhost localhost.localdomain
>>> 192.168.11.250  server06.intranet.mayweg.net server06
>>> krb.intranet.mayweg.net kdc.intranet.mayweg.net intranet.mayweg.net
>>>
>> Remove everything from the '192.168.11.250' line from
'krb' onwards, they
>> shouldn't be there.
>>
>>
>>
>>> # The following lines are desirable for IPv6 capable hosts
>>> ::1     localhost ip6-localhost ip6-loopback
>>> ff02::1 ip6-allnodes
>>> ff02::2 ip6-allrouters
>>>
>>>
>>> /etc/samba/smb.conf:
>>> [global]
>>> workgroup = MAYWEG.NET
>>> realm = INTRANET.MAYWEG.NET
>>> netbios name = SERVER06
>>> interfaces = lo, eth0
>>> bind interfaces only = Yes
>>> server role = active directory domain controller
>>> server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
> winbind,
>>> ntp_signd, kcc, dnsupdate
>>> idmap_ldb:use rfc2307 = yes
>>> #added after classicupgrade
>>> kerberos method = system keytab
>>> client ldap sasl wrapping = sign
>>> allow dns updates = nonsecure and secure
>>> nsupdate command =  /usr/bin/nsupdate -g
>>> domain logons = yes
>>>
>>> [netlogon]
>>> path = /var/lib/samba/sysvol/intranet.mayweg.net/scripts
>>> read only = No
>>>
>>> [sysvol]
>>> path = /var/lib/samba/sysvol
>>> read only = No
>>>
>>>
>> remove everything you added to smb.conf
>>
>>   /etc/krb5.conf (copied from /var/lib/samba/private/krb5.conf):
>>> [libdefaults]
>>> default_realm = INTRANET.MAYWEG.NET
>>> dns_lookup_realm = true #changed to true
>>> dns_lookup_kdc = true
>>>
>>> #added after classicupgrade
>>>
>>> [realms]
>>> INTRANET.MAYWEG.NET = {
>>>           kdc = krb.intranet.mayweg.net
>>>           admin_server = krb.intranet.mayweg.net
>>>           default_domain = intranet.mayweg.net
>>> }
>>>
>>> [domain_realm]
>>>
>>> .intranet.mayweg.net = INTRANET.MAYWEG.NET
>>> intranet.mayweg.net = INTRANET.MAYWEG.NET
>>>
>>> [logging]
>>> kdc = FILE:/var/log/kerberos/krb5kdc.log
>>> admin_server = FILE:/var/log/kerberos/kadmin.log
>>> default = FILE:/var/log/kerberos/krb5lib.log
>>>
>>>
>> Change krb5.conf back to what it was.
>>
>>
>>   /etc/bind/named.conf (copied together from the includes...):
>>> zone "." {
>>> type hint;
>>> file "/etc/bind/db.root";
>>> };
>>> // be authoritative for the localhost forward and reverse zones,
and for
>>> // broadcast zones as per RFC 1912
>>>
>>> zone "localhost" {
>>> type master;
>>> file "/etc/bind/db.local";
>>> };
>>>
>>> zone "127.in-addr.arpa" {
>>> type master;
>>> file "/etc/bind/db.127";
>>> };
>>>
>>> zone "0.in-addr.arpa" {
>>> type master;
>>> file "/etc/bind/db.0";
>>> };
>>>
>>> zone "255.in-addr.arpa" {
>>> type master;
>>> file "/etc/bind/db.255";
>>> };
>>> dlz "AD DNS Zone" {
>>>       # For BIND 9.8.x
>>>       # database "dlopen /usr/lib/x86_64-linux-gnu/
>>> samba/bind9/dlz_bind9.so";
>>>
>>>       # For BIND 9.9.x
>>>       database "dlopen /usr/lib/x86_64-linux-gnu/
>>> samba/bind9/dlz_bind9_9.so";
>>>
>>>       # For BIND 9.10.x
>>>       # database "dlopen
>>> /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
>>> };
>>> logging {
>>>           channel update_debug {
>>>                   file "/var/log/update_debug.log"
versions 3 size 100k;
>>>                   severity debug;
>>>                   print-severity  yes;
>>>                   print-time      yes;
>>>           };
>>>           channel security_info {
>>>                   file "/var/log/security_info.log"
versions 1 size 100k;
>>>                   severity info;
>>>                   print-severity  yes;
>>>                   print-time      yes;
>>>           };
>>>           channel bind_log {
>>>                   file "/var/log/bind.log" versions 3
size 1m;
>>>                   severity info;
>>>                   print-category  yes;
>>>                   print-severity  yes;
>>>                   print-time      yes;
>>>           };
>>>
>>>           category default { bind_log; };
>>>           category lame-servers { null; };
>>>           category update { update_debug; };
>>>           category update-security { update_debug; };
>>>           category security { security_info; };
>>> };
>>> options {
>>>           directory "/var/named";
>>>           recursion yes;
>>>           dnssec-validation auto;
>>>         tkey-gssapi-keytab
"/var/lib/samba/private/dns.keytab";
>>> auth-nxdomain yes;
>>>       notify no;
>>>       empty-zones-enable no;
>>>       allow-query {
>>>           127.0.0.1;
>>>           192.168.11.0/24;
>>>           # add other networks you want to allow to query your DNS
>>>       };
>>>       allow-query-cache {
>>>           127.0.0.1;
>>>           192.168.11.0/24;
>>>           # add other networks you want to allow to query your DNS
>>>       };
>>>       allow-recursion {
>>>           192.168.11.0/24;
>>> 127.0.0.1;
>>>           # add other networks you want to allow to do recursive
queries
>>>       };
>>>       forwarders {
>>>           # Google public DNS server here - replace with your own
if
>>> necessary
>>>        };
>>>       allow-transfer {
>>>           # this config is for a single master DNS server
>>>           none;
>>>       };
>>> };
>>>
>>> I hope I provided all the necessary information and am grateful for
any
>>> hints on where to look for a fix to this problem.
>>>
>>> Greetings,
>>> Timo
>>>
>> Finally, was the version of bind you are using configured with dlopen ?
>>
>> Rowland
>>
>>
>>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
OK, I am using Debian wheezy with samba and bind9 from backports.

These are the conf files I use (comments removed to save space) :

/etc/resolv.conf

search example.com
nameserver 192.168.0.3 <-- this my second DC
nameserver 127.0.0.1

/etc/krb5.conf

[libdefaults]
         default_realm = EXAMPLE.COM
         dns_lookup_realm = false
         dns_lookup_kdc = true

/etc/samba/smb.conf

# Global parameters
[global]
         workgroup = EXAMPLE
         realm = example.com
         netbios name = DC01
         server role = active directory domain controller
         server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, 
drepl, winbind, ntp_signd, kcc, dnsupdate
         idmap_ldb:use rfc2307 = yes

[netlogon]
         path = /var/lib/samba/sysvol/example.com/scripts
         read only = No

[sysvol]
         path = /var/lib/samba/sysvol
         read only = No

/etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/var/lib/samba/private/named.conf";

/etc/bind/named.conf.options

options {
         directory "/var/cache/bind";

         forwarders { 8.8.8.8; 8.8.4.4; };

         dnssec-validation no;

         auth-nxdomain no;    # conform to RFC1035
         listen-on-v6 { any; };
         tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";
};

/var/lib/samba/private/named.conf

dlz "AD DNS Zone" {
     # For BIND 9.9.0
     database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_9.so";
};

These work for me :-)

Rowland

Peter Serbe

2015-Mar-19 14:31 UTC

head link

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

Timo Altun schrieb am 19.03.2015 10:30:
> As I wrote in my first mail, Kerberos does work. I can successfully request
> and list a ticket on the AC DC.
OK, then next things, which come to my mind are: 
is the keytab, you set in named.conf.options readable 
for the user, under which bind is run. 

Then, is the /etc/bind/namedb writable for bind. 

And in the end, it might be a screwed up installation. 
I had troubles with dynamic updates a long time ago, 
when it turned out, that I screwed something up during 
the installation. 

HTH
- Peter

Apparently Analagous Threads

Search for more reasonably related threads

samba - Mar 2015 - Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

[Samba] Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

[Samba] Fwd: Dynamic DNS Updates not working.

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

[Samba] Fwd: Dynamic DNS Updates not working. samba_dnsupdate : (sambalist: message 3 of 20) RuntimeError: (sambalist: to exclusive) kinit for [DC@Realm] failed (Cannot contact any KDC for requested realm)

Apparently Analagous Threads