thr3ads.net - samba - [Samba] Problem DNS samba

If this information is useful, please help other people find it:
Share via:

Tadeusz Kasprzycki

2018-Nov-10 20:47 UTC

[Samba] Problem DNS samba_dnsupdate

Hi all

I have configured domain controler in debian 9 (samba 4.5.12-Debian).
Dns is internal samba. locally works well (I think) but from another
computer I can not query DNS. The problem is with samba_dnsupdate
My configuration:

smb.conf

# Global parameters
[global]
    netbios name = DC
    realm = BEWPHOTO.LOCAL
    workgroup = BEWPHOTO
    dns forwarder = 8.8.8.8
    server role = active directory domain controller
    #allow dns updates = nosecure

[netlogon]
    path = /var/lib/samba/sysvol/bewphoto.local/scripts
    read only = No

[sysvol]
    path = /var/lib/samba/sysvol
    read only = No

/etc/krb5.conf

[libdefaults]
    default_realm = BEWPHOTO.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = true


systemctl status samba-ad-dc.service

● samba-ad-dc.service - Samba AD Daemon
   Loaded: loaded (/lib/systemd/system/samba-ad-dc.service; enabled;
vendor preset: enabled)
   Active: active (running) since Sat 2018-11-10 19:01:10 CET; 2h 35min ago
     Docs: man:samba(8)
           man:samba(7)
           man:smb.conf(5)
 Main PID: 2189 (samba)
   Status: "smbd: ready to serve connections..."
    Tasks: 20 (limit: 4915)
   CGroup: /system.slice/samba-ad-dc.service
           ├─2189 /usr/sbin/samba
           ├─2190 /usr/sbin/samba
           ├─2191 /usr/sbin/samba
           ├─2192 /usr/sbin/samba
           ├─2193 /usr/sbin/samba
           ├─2194 /usr/sbin/samba
           ├─2195 /usr/sbin/samba
           ├─2196 /usr/sbin/samba
           ├─2197 /usr/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─2198 /usr/sbin/samba
           ├─2199 /usr/sbin/samba
           ├─2200 /usr/sbin/samba
           ├─2201 /usr/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           ├─2202 /usr/sbin/samba
           ├─2203 /usr/sbin/samba
           ├─2205 /usr/sbin/samba
           ├─2207 /usr/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─2208 /usr/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ├─2210 /usr/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           └─2211 /usr/sbin/smbd -D --option=server role
check:inhibit=yes --foreground


lis 10 19:01:10 dc samba[2189]:   samba: using 'standard' process model
lis 10 19:01:10 dc systemd[1]: Started Samba AD Daemon.
lis 10 19:01:10 dc samba[2189]: [2018/11/10 19:01:10.713944,  0]
../lib/util/become_daemon.c:124(daemon_ready)
lis 10 19:01:10 dc samba[2189]:   STATUS=daemon 'samba' finished
starting up and ready to serve connections
lis 10 19:01:10 dc winbindd[2201]:[2018/11/10 19:01:10.867317,  0]
../source3/winbindd/winbindd_cache.c:3244(initialize_winbindd_cache)
lis 10 19:01:10 dc winbindd[2201]:  initialize_winbindd_cache: clearing
cache and re-creating with version number 2
lis 10 19:01:11 dc winbindd[2201]:[2018/11/10 19:01:11.563060,  0]
../lib/util/become_daemon.c:124(daemon_ready)
lis 10 19:01:11 dc winbindd[2201]:   STATUS=daemon 'winbindd' finished
starting up and ready to serve connections
lis 10 19:01:11 dc smbd[2197]: [2018/11/10 19:01:11.613922,  0]
../lib/util/become_daemon.c:124(daemon_ready)
lis 10 19:01:11 dc smbd[2197]:   STATUS=daemon 'smbd' finished starting
up and ready to serve connections


netstat -lantp

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address        
State       PID/Program name   
tcp        0      0 0.0.0.0:464             0.0.0.0:*              
LISTEN      2196/samba         
tcp        0      0 0.0.0.0:53              0.0.0.0:*              
LISTEN      2205/samba         
tcp        0      0 0.0.0.0:22              0.0.0.0:*              
LISTEN      370/sshd           
tcp        0      0 0.0.0.0:88              0.0.0.0:*              
LISTEN      2196/samba         
tcp        0      0 0.0.0.0:636             0.0.0.0:*              
LISTEN      2194/samba         
tcp        0      0 0.0.0.0:445             0.0.0.0:*              
LISTEN      2197/smbd          
tcp        0      0 0.0.0.0:1024            0.0.0.0:*              
LISTEN      2191/samba         
tcp        0      0 0.0.0.0:3268            0.0.0.0:*              
LISTEN      2194/samba         
tcp        0      0 0.0.0.0:3269            0.0.0.0:*              
LISTEN      2194/samba         
tcp        0      0 0.0.0.0:389             0.0.0.0:*              
LISTEN      2194/samba         
tcp        0      0 0.0.0.0:135             0.0.0.0:*              
LISTEN      2191/samba         
tcp        0      0 0.0.0.0:139             0.0.0.0:*              
LISTEN      2197/smbd          
tcp        0      0 192.168.88.7:22         192.168.88.52:60228    
ESTABLISHED 516/sshd: tk [priv]
tcp6       0      0 :::464                  :::*                   
LISTEN      2196/samba         
tcp6       0      0 :::53                   :::*                   
LISTEN      2205/samba         
tcp6       0      0 :::22                   :::*                   
LISTEN      370/sshd           
tcp6       0      0 :::88                   :::*                   
LISTEN      2196/samba         
tcp6       0      0 :::636                  :::*                   
LISTEN      2194/samba         
tcp6       0      0 :::445                  :::*                   
LISTEN      2197/smbd          
tcp6       0      0 :::1024                 :::*                   
LISTEN      2191/samba         
tcp6       0      0 :::3268                 :::*                   
LISTEN      2194/samba         
tcp6       0      0 :::3269                 :::*                   
LISTEN      2194/samba         
tcp6       0      0 :::389                  :::*                   
LISTEN      2194/samba         
tcp6       0      0 :::135                  :::*                   
LISTEN      2191/samba         
tcp6       0      0 :::139                  :::*                   
LISTEN      2197/smbd

root at dc:~# host -t A dc.bewphoto.local.
dc.bewphoto.local has address 192.168.88.7

root at dc:~# host -t SRV _kerberos._udp.bewphoto.local.
_kerberos._udp.bewphoto.local has SRV record 0 100 88 dc.bewphoto.local.

root at dc:~# host -t SRV _ldap._tcp.bewphoto.local.
_ldap._tcp.bewphoto.local has SRV record 0 100 389 dc.bewphoto.local

cat /etc/resolv.conf
nameserver 192.168.88.7
domain bewphoto.local
search bewphoto.local


samba_dnsupdate --verbose --all-names
IPs: ['fd90:9497:9932:2300:5054:ff:fe3e:8aa9', '192.168.88.7']
force update: A dc.bewphoto.local 192.168.88.7
force update: AAAA dc.bewphoto.local fd90:9497:9932:2300:5054:ff:fe3e:8aa9
force update: NS bewphoto.local dc.bewphoto.local
force update: NS _msdcs.bewphoto.local dc.bewphoto.local
force update: A bewphoto.local 192.168.88.7
force update: AAAA bewphoto.local fd90:9497:9932:2300:5054:ff:fe3e:8aa9
force update: SRV _ldap._tcp.bewphoto.local dc.bewphoto.local 389
force update: SRV _ldap._tcp.dc._msdcs.bewphoto.local dc.bewphoto.local 389
force update: SRV
_ldap._tcp.e44a23b3-339d-4f9d-9333-53a15916a532.domains._msdcs.bewphoto.local
dc.bewphoto.local 389
force update: SRV _kerberos._tcp.bewphoto.local dc.bewphoto.local 88
force update: SRV _kerberos._udp.bewphoto.local dc.bewphoto.local 88
force update: SRV _kerberos._tcp.dc._msdcs.bewphoto.local
dc.bewphoto.local 88
force update: SRV _kpasswd._tcp.bewphoto.local dc.bewphoto.local 464
force update: SRV _kpasswd._udp.bewphoto.local dc.bewphoto.local 464
force update: CNAME
5301734c-93c8-4b3f-867b-a6aee754e5b2._msdcs.bewphoto.local dc.bewphoto.local
force update: SRV
_ldap._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 389
force update: SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 389
force update: SRV
_kerberos._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 88
force update: SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 88
force update: SRV _ldap._tcp.pdc._msdcs.bewphoto.local dc.bewphoto.local 389
force update: A gc._msdcs.bewphoto.local 192.168.88.7
force update: AAAA gc._msdcs.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
force update: SRV _gc._tcp.bewphoto.local dc.bewphoto.local 3268
force update: SRV _ldap._tcp.gc._msdcs.bewphoto.local dc.bewphoto.local 3268
force update: SRV _gc._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 3268
force update: SRV
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.bewphoto.local
dc.bewphoto.local 3268
force update: A DomainDnsZones.bewphoto.local 192.168.88.7
force update: AAAA DomainDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
force update: SRV _ldap._tcp.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389
force update: SRV
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389
force update: A ForestDnsZones.bewphoto.local 192.168.88.7
force update: AAAA ForestDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
force update: SRV _ldap._tcp.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389
force update: SRV
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389
34 DNS updates and 0 DNS deletes needed
Successfully obtained Kerberos ticket to DNS/dc.bewphoto.local as DC$
update(nsupdate): A dc.bewphoto.local 192.168.88.7
Calling nsupdate for A dc.bewphoto.local 192.168.88.7 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
dc.bewphoto.local.    900    IN    A    192.168.88.7

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): AAAA dc.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
Calling nsupdate for AAAA dc.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
dc.bewphoto.local.    900    IN    AAAA   
fd90:9497:9932:2300:5054:ff:fe3e:8aa9

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): NS bewphoto.local dc.bewphoto.local
Calling nsupdate for NS bewphoto.local dc.bewphoto.local (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
bewphoto.local.        900    IN    NS    dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): NS _msdcs.bewphoto.local dc.bewphoto.local
Calling nsupdate for NS _msdcs.bewphoto.local dc.bewphoto.local (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_msdcs.bewphoto.local.    900    IN    NS    dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): A bewphoto.local 192.168.88.7
Calling nsupdate for A bewphoto.local 192.168.88.7 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
bewphoto.local.        900    IN    A    192.168.88.7

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): AAAA bewphoto.local fd90:9497:9932:2300:5054:ff:fe3e:8aa9
Calling nsupdate for AAAA bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
bewphoto.local.        900    IN    AAAA   
fd90:9497:9932:2300:5054:ff:fe3e:8aa9

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.bewphoto.local dc.bewphoto.local 389
Calling nsupdate for SRV _ldap._tcp.bewphoto.local dc.bewphoto.local 389
(add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.bewphoto.local. 900    IN    SRV    0 100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.dc._msdcs.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV _ldap._tcp.dc._msdcs.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.dc._msdcs.bewphoto.local. 900 IN SRV    0 100 389
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.e44a23b3-339d-4f9d-9333-53a15916a532.domains._msdcs.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV
_ldap._tcp.e44a23b3-339d-4f9d-9333-53a15916a532.domains._msdcs.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.e44a23b3-339d-4f9d-9333-53a15916a532.domains._msdcs.bewphoto.local.
900 IN SRV 0 100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _kerberos._tcp.bewphoto.local dc.bewphoto.local 88
Calling nsupdate for SRV _kerberos._tcp.bewphoto.local dc.bewphoto.local
88 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kerberos._tcp.bewphoto.local. 900 IN    SRV    0 100 88 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _kerberos._udp.bewphoto.local dc.bewphoto.local 88
Calling nsupdate for SRV _kerberos._udp.bewphoto.local dc.bewphoto.local
88 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kerberos._udp.bewphoto.local. 900 IN    SRV    0 100 88 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _kerberos._tcp.dc._msdcs.bewphoto.local
dc.bewphoto.local 88
Calling nsupdate for SRV _kerberos._tcp.dc._msdcs.bewphoto.local
dc.bewphoto.local 88 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kerberos._tcp.dc._msdcs.bewphoto.local. 900 IN    SRV 0 100 88
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _kpasswd._tcp.bewphoto.local dc.bewphoto.local 464
Calling nsupdate for SRV _kpasswd._tcp.bewphoto.local dc.bewphoto.local
464 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kpasswd._tcp.bewphoto.local. 900 IN    SRV    0 100 464 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _kpasswd._udp.bewphoto.local dc.bewphoto.local 464
Calling nsupdate for SRV _kpasswd._udp.bewphoto.local dc.bewphoto.local
464 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kpasswd._udp.bewphoto.local. 900 IN    SRV    0 100 464 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): CNAME
5301734c-93c8-4b3f-867b-a6aee754e5b2._msdcs.bewphoto.local dc.bewphoto.local
Calling nsupdate for CNAME
5301734c-93c8-4b3f-867b-a6aee754e5b2._msdcs.bewphoto.local
dc.bewphoto.local (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
5301734c-93c8-4b3f-867b-a6aee754e5b2._msdcs.bewphoto.local. 900    IN
CNAME dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV
_ldap._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.Default-First-Site-Name._sites.bewphoto.local. 900 IN SRV 0
100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local.
900    IN SRV 0 100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_kerberos._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 88
Calling nsupdate for SRV
_kerberos._tcp.Default-First-Site-Name._sites.bewphoto.local
dc.bewphoto.local 88 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kerberos._tcp.Default-First-Site-Name._sites.bewphoto.local. 900 IN SRV
0 100 88 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 88
Calling nsupdate for SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local
dc.bewphoto.local 88 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.bewphoto.local.   
900 IN SRV 0 100 88 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.pdc._msdcs.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV _ldap._tcp.pdc._msdcs.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.pdc._msdcs.bewphoto.local. 900 IN SRV 0 100 389
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): A gc._msdcs.bewphoto.local 192.168.88.7
Calling nsupdate for A gc._msdcs.bewphoto.local 192.168.88.7 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
gc._msdcs.bewphoto.local. 900    IN    A    192.168.88.7

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): AAAA gc._msdcs.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
Calling nsupdate for AAAA gc._msdcs.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
gc._msdcs.bewphoto.local. 900    IN    AAAA   
fd90:9497:9932:2300:5054:ff:fe3e:8aa9

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _gc._tcp.bewphoto.local dc.bewphoto.local 3268
Calling nsupdate for SRV _gc._tcp.bewphoto.local dc.bewphoto.local 3268
(add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_gc._tcp.bewphoto.local. 900    IN    SRV    0 100 3268 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.gc._msdcs.bewphoto.local
dc.bewphoto.local 3268
Calling nsupdate for SRV _ldap._tcp.gc._msdcs.bewphoto.local
dc.bewphoto.local 3268 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.gc._msdcs.bewphoto.local. 900 IN SRV    0 100 3268
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_gc._tcp.Default-First-Site-Name._sites.bewphoto.local dc.bewphoto.local
3268
Calling nsupdate for SRV
_gc._tcp.Default-First-Site-Name._sites.bewphoto.local dc.bewphoto.local
3268 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_gc._tcp.Default-First-Site-Name._sites.bewphoto.local.    900 IN SRV 0
100 3268 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.bewphoto.local
dc.bewphoto.local 3268
Calling nsupdate for SRV
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.bewphoto.local
dc.bewphoto.local 3268 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.bewphoto.local.
900    IN SRV 0 100 3268 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): A DomainDnsZones.bewphoto.local 192.168.88.7
Calling nsupdate for A DomainDnsZones.bewphoto.local 192.168.88.7 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
DomainDnsZones.bewphoto.local. 900 IN    A    192.168.88.7

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): AAAA DomainDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
Calling nsupdate for AAAA DomainDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
DomainDnsZones.bewphoto.local. 900 IN    AAAA   
fd90:9497:9932:2300:5054:ff:fe3e:8aa9

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV _ldap._tcp.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.DomainDnsZones.bewphoto.local. 900 IN SRV 0 100 389
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bewphoto.local.
900 IN    SRV 0 100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): A ForestDnsZones.bewphoto.local 192.168.88.7
Calling nsupdate for A ForestDnsZones.bewphoto.local 192.168.88.7 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
ForestDnsZones.bewphoto.local. 900 IN    A    192.168.88.7

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): AAAA ForestDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9
Calling nsupdate for AAAA ForestDnsZones.bewphoto.local
fd90:9497:9932:2300:5054:ff:fe3e:8aa9 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
ForestDnsZones.bewphoto.local. 900 IN    AAAA   
fd90:9497:9932:2300:5054:ff:fe3e:8aa9

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV _ldap._tcp.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV _ldap._tcp.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.ForestDnsZones.bewphoto.local. 900 IN SRV 0 100 389
dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
update(nsupdate): SRV
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389
Calling nsupdate for SRV
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bewphoto.local
dc.bewphoto.local 389 (add)
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bewphoto.local.
900 IN    SRV 0 100 389 dc.bewphoto.local.

; TSIG error with server: tsig verify failure
Failed nsupdate: 2
Failed update of 34 entries

Rowland Penny

2018-Nov-10 21:38 UTC

head link

[Samba] Problem DNS samba_dnsupdate

On Sat, 10 Nov 2018 21:47:13 +0100
Tadeusz Kasprzycki via samba <samba at lists.samba.org> wrote:
> Hi all
> 
> I have configured domain controler in debian 9 (samba 4.5.12-Debian).
> Dns is internal samba. locally works well (I think) but from another
> computer I can not query DNS. The problem is with samba_dnsupdate
> My configuration:
> 
> smb.conf
> 
> # Global parameters
> [global]
>     netbios name = DC
>     realm = BEWPHOTO.LOCAL
I take it you didn't get the message that using '.local' is a bad
idea.
If Avahi is running, stop it.
>     workgroup = BEWPHOTO
>     dns forwarder = 8.8.8.8
>     server role = active directory domain controller
>     #allow dns updates = nosecure
The parameter value is 'nonsecure', not 'nosecure'

If that doesn't help, try adding this line:

dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool

> 
> cat /etc/resolv.conf
> nameserver 192.168.88.7
> domain bewphoto.local
> search bewphoto.local
'domain' and 'search' in resolv.conf are mutually exclusive, you
shouldn't have both, but if you do, the last one wins, luckily in your
case the correct one is last.

Rowland

Tadeusz Kasprzycki

2018-Nov-10 23:20 UTC

head link

[Samba] Problem DNS samba_dnsupdate

Thanks Rowland Penny.

I have added the option nonsecure and dns update command = / usr / sbin
/ samba_dnsupdate --use-samba-tool. did not help it still displays TSIG
error with server: tsig verify failure.

Sorry for the confusion. A client with LAN had a wrongly entered dns
address (198.168.88.7) and therefore did not receive a response from the
dns server.

An error with TSIG does not affect the work of users but it would be
nice to remove it

Maybe Matching Threads

Search for more apparently analagous threads

samba - Nov 2018 - Problem DNS samba_dnsupdate

[Samba] Problem DNS samba_dnsupdate

[Samba] Problem DNS samba_dnsupdate

[Samba] Problem DNS samba_dnsupdate

Maybe Matching Threads