samba - Dec 2017 - Samba 4.7.2 + bind on Fedora 27: samba_dlz: spnego update failed

Il giorno lun, 04/12/2017 alle 14.48 +0000, Rowland Penny via samba ha
scritto:
> 
> 
> The cure is to STOP your windows clients trying to update their own
> records.
Yes, this is true, on windows I will stop this service.

But my problem now is another

The samba command

    samba_dnsupdate --verbose  --all-names --fail-immediately

not work

It's possible to resolve this problem?
Or I have to ignore it ?

Thanks
Dario



> 
> Rowland
-- 
Dario Lesca
(inviato dal mio Linux Fedora 27 Workstation)

Il giorno lun, 04/12/2017 alle 16.00 +0100, Dario Lesca via samba ha
scritto:
> The samba command
> 
>     samba_dnsupdate --verbose  --all-names --fail-immediately
> 
> not work
I have add '-d 9' to dlz section

    dlz "AD DNS Zone" {
        # For BIND 9.11.x
         database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so -d
9";
    };

And this is the debug message:

    [    root at server-addc     ~]# samba_dnsupdate --all-names
--fail-immediately
    update failed: REFUSED

    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: starting
transaction on zone dogma-to.loc
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: Starting
GENSEC mechanism spnego
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: Starting
GENSEC submechanism gssapi_krb5
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: GSS server
Update(krb5)(1) Update failed: Unspecified GSS failure.  Minor code may provide
more information: Request is a replay
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: spnego
update failed
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: client @0x7fafe90c3400
192.168.41.1#57335/key SERVER-ADDC\$\@DOGMA-TO.LOC: updating zone
'dogma-to.loc/NONE': update failed: rejected by secure update (REFUSED)
    dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: cancelling
transaction on zone dogma-to.loc

Can this help us?

Thanks

-- 
Dario Lesca
(inviato dal mio Linux Fedora 27 Workstation)

Il giorno lun, 04/12/2017 alle 16.00 +0100, Dario Lesca via samba ha
scritto:
> The samba command
> 
>     samba_dnsupdate --verbose  --all-names --fail-immediately
> 
> not work

Following this howto, 
https://wiki.samba.org/index.php/Dns_tkey_negotiategss:_TKEY_is_unacceptable#Verifying_That_the_BIND_AD_Account_Exists_for_the_DC

I have try this:

    [    root at server-addc     ~]# LDB_MODULES_PATH=/usr/lib64/samba/ldb/
ldbsearch -H /var/lib/samba/bind-dns/dns/sam.ldb 'cn=dns-DC1' dn
    # Referral
    ref: ldap://dogma-to.loc/CN=Configuration,DC=dogma-to,DC=loc

    # Referral
    ref: ldap://dogma-to.loc/DC=DomainDnsZones,DC=dogma-to,DC=loc

    # Referral
    ref: ldap://dogma-to.loc/DC=ForestDnsZones,DC=dogma-to,DC=loc

    # returned 3 records
    # 0 entries
    # 3 referrals

This is not output what howto say I can see.

Seem the account dns-DC1 not exist

    [    root at server-addc     ~]# samba-tool user list 
    Administrator
    Guest
    krbtgt
    dns-server-addc
    ospite

Then I run

    [    root at server-addc     ~]# samba_upgradedns --verbose
--dns-backend=BIND9_DLZ
    Reading domain information
    DNS accounts already exist
    No zone file /var/lib/samba/bind-dns/dns/DOGMA-TO.LOC.zone
    DNS records will be automatically created
    DNS partitions already exist
    dns-server-addc account already exists
    Could not remove /var/lib/samba/private/named.conf: No such file or
directory
    Could not remove /var/lib/samba/private/named.conf.update: No such file or
directory
    Could not remove /var/lib/samba/private/named.txt: No such file or directory
    Could not delete dir /var/lib/samba/private/dns: No such file or directory
    See /var/lib/samba/bind-dns/named.conf for an example configuration include
file for BIND
    and /var/lib/samba/bind-dns/named.txt for further documentation required for
secure DNS updates
    Finished upgrading DNS

But I cannot see the "Adding dns-DC1 account" message like howto say


I also run:

    [    root at server-addc     ~]# klist -k /var/lib/samba/bind-dns/dns.keytab
    Keytab name: FILE:/var/lib/samba/bind-dns/dns.keytab
    KVNO Principal
    ---- -------------------------------------------------------------
    -------------
       1     DNS/server-addc.dogma-to.loc at DOGMA-TO.LOC
   1 dns-server-addc at DOGMA-TO.LOC
   1 DNS/server-addc.dogma-to.loc at DOGMA-TO.LOC
   1 dns-server-addc at DOGMA-TO.LOC
   1 DNS/server-addc.dogma-to.loc at DOGMA-TO.LOC
   1 dns-server-addc at DOGMA-TO.LOC
   1 DNS/server-addc.dogma-to.loc at DOGMA-TO.LOC
   1 dns-server-addc at DOGMA-TO.LOC
   1 DNS/server-addc.dogma-to.loc at DOGMA-TO.LOC
   1 dns-server-addc at DOGMA-TO.LOC

Can help this?

Thanks

-- 
Dario Lesca
(inviato dal mio Linux Fedora 27 Workstation)

On Mon, 04 Dec 2017 16:31:16 +0100
Dario Lesca via samba <samba at lists.samba.org> wrote:
> Il giorno lun, 04/12/2017 alle 16.00 +0100, Dario Lesca via samba ha
> scritto:
> > The samba command
> > 
> >     samba_dnsupdate --verbose  --all-names --fail-immediately
> > 
> > not work
> 
> I have add '-d 9' to dlz section
> 
>     dlz "AD DNS Zone" {
>         # For BIND 9.11.x
>          database "dlopen /usr/lib64/samba/bind9/dlz_bind9_11.so -d
> 9"; };
> 
> And this is the debug message:
> 
>     [    root at server-addc     ~]# samba_dnsupdate --all-names
> --fail-immediately update failed: REFUSED
> 
>     dic 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz:
> starting transaction on zone dogma-to.loc dic 04 16:25:21
> server-addc.dogma-to.loc named[1121]: samba_dlz: Starting GENSEC
> mechanism spnego dic 04 16:25:21 server-addc.dogma-to.loc
> named[1121]: samba_dlz: Starting GENSEC submechanism gssapi_krb5 dic
> 04 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: GSS
> server Update(krb5)(1) Update failed: Unspecified GSS failure.  Minor
> code may provide more information: Request is a replay dic 04
> 16:25:21 server-addc.dogma-to.loc named[1121]: samba_dlz: spnego
> update failed dic 04 16:25:21 server-addc.dogma-to.loc named[1121]:
> client @0x7fafe90c3400 192.168.41.1#57335/key
> SERVER-ADDC\$\@DOGMA-TO.LOC: updating zone 'dogma-to.loc/NONE':
> update failed: rejected by secure update (REFUSED) dic 04 16:25:21
> server-addc.dogma-to.loc named[1121]: samba_dlz: cancelling
> transaction on zone dogma-to.loc
> 
> Can this help us?
> 
> Thanks
> 
The significant word there is 'replay'.

see here:

https://lists.samba.org/archive/samba/2017-November/211990.html

Rowland

On Mon, 04 Dec 2017 16:57:15 +0100
Dario Lesca via samba <samba at lists.samba.org> wrote:
> Il giorno lun, 04/12/2017 alle 16.00 +0100, Dario Lesca via samba ha
> scritto:
> > The samba command
> > 
> >     samba_dnsupdate --verbose  --all-names --fail-immediately
> > 
> > not work
> 
> 
> Following this howto, 
>
https://wiki.samba.org/index.php/Dns_tkey_negotiategss:_TKEY_is_unacceptable#Verifying_That_the_BIND_AD_Account_Exists_for_the_DC
> 
> I have try this:
> 
>     [    root at server-addc     ~]#
> LDB_MODULES_PATH=/usr/lib64/samba/ldb/ ldbsearch
> -H /var/lib/samba/bind-dns/dns/sam.ldb 'cn=dns-DC1' dn # Referral
> ref: ldap://dogma-to.loc/CN=Configuration,DC=dogma-to,DC=loc
> 
>     # Referral
>     ref: ldap://dogma-to.loc/DC=DomainDnsZones,DC=dogma-to,DC=loc
> 
>     # Referral
>     ref: ldap://dogma-to.loc/DC=ForestDnsZones,DC=dogma-to,DC=loc
> 
>     # returned 3 records
>     # 0 entries
>     # 3 referrals
> 
> This is not output what howto say I can see.
> 
> Seem the account dns-DC1 not exist
> 
>     [    root at server-addc     ~]# samba-tool user list 
>     Administrator
>     Guest
>     krbtgt
>     dns-server-addc
>     ospite
> 
> Then I run
> 
>     [    root at server-addc     ~]# samba_upgradedns --verbose
> --dns-backend=BIND9_DLZ Reading domain information
>     DNS accounts already exist
>     No zone file /var/lib/samba/bind-dns/dns/DOGMA-TO.LOC.zone
>     DNS records will be automatically created
>     DNS partitions already exist
>     dns-server-addc account already exists
>     Could not remove /var/lib/samba/private/named.conf: No such file
> or directory Could not
> remove /var/lib/samba/private/named.conf.update: No such file or
> directory Could not remove /var/lib/samba/private/named.txt: No such
> file or directory Could not delete dir /var/lib/samba/private/dns: No
> such file or directory See /var/lib/samba/bind-dns/named.conf for an
> example configuration include file for BIND
> and /var/lib/samba/bind-dns/named.txt for further documentation
> required for secure DNS updates Finished upgrading DNS
> 
> But I cannot see the "Adding dns-DC1 account" message like howto
say
Follow what it says in the blue box under the ldbsearch output on the
wiki page.

Rowland