thr3ads.net - samba - [Samba] Joining a new Samba AD DC [Aug 2023]

If this information is useful, please help other people find it:
Share via:

Mark Foley

2023-Jul-31 15:17 UTC

[Samba] Joining a new Samba AD DC

On Jul 31 03:00:37 2023 Rowland Penny via samba <samba at lists.samba.org>
wrote:
> On 30/07/2023 22:24, Mark Foley via samba wrote:
> > That gave me:
> > 
> > # host -t A 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local
> > host: idnkit idn_encodename to idn failed: prohibited character found
> > 
>
> That is strange, if I obtain the GUID's on my DCs and run a similar 
> command, I get this:
>
> adminuser at rpidc1:~ $ host -t A 
> fb453823-737c-4a8b-93e1-dc197e236d50._msdcs.samdom.example.com
> fb453823-737c-4a8b-93e1-dc197e236d50._msdcs.samdom.example.com is an 
> alias for rpidc1.samdom.example.com.
> rpidc1.samdom.example.com has address 192.168.1.2
>
> Rowland
It could be a difference in host command versions (I have version 9.11.37), as
well as my version of Samba on the current DC is very old (4.8.2).  It seems to
me to get your results the host command has to be aware of the Samba DC config.
The host version on my "new" DC is 9.16.42.

My results when running 'host -t A':

# host -t A 
Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W time]
            [-R number] [-m flag] hostname [server]
       -a is equivalent to -v -t ANY
       -c specifies query class for non-IN data
       -C compares SOA records on authoritative nameservers
       -d is equivalent to -v
       -i IP6.INT reverse lookups
       -l lists all hosts in a domain, using AXFR
       -m set memory debugging flag (trace|record|usage)
       -N changes the number of dots allowed before root lookup is done
       -p specifies the port on the server to query
       -r disables recursive processing
       -R specifies number of retries for UDP packets
       -s a SERVFAIL response should stop query
       -t specifies the query type
       -T enables TCP/IP mode
       -U enables UDP mode
       -v enables verbose output
       -V print version number and exit
       -w specifies to wait forever for a reply
       -W specifies how long to wait for a reply
       -4 use IPv4 query transport only
       -6 use IPv6 query transport only

It looks like a hostname is required.

The "prohibited character" error seems really odd. I found this: 
https://bind-users.isc.narkive.com/9nA0Aqea/idn-dig-and-underscore which is a
very similar problem related to the underscore. However, unlike the author
'dig'
works for me, albeit it does give a warning about the .local. Perhaps this is
part of the problem?

# dig 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local 

; <<>> DiG 9.11.37 <<>>
0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34161
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: d5d048ee14fed75757f3619b64c7cad7587b47cc169284b0 (good)
;; QUESTION SECTION:
;0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local.        IN A

;; AUTHORITY SECTION:
hprs.local.             3600    IN      SOA     mail.hprs.local.
hostmaster.hprs.local. 2014159838 10800 3600 28800 3600

If I remove the underscore from the
0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local'
the 'host -t A 0d2...' command does not give the "prohibited
character found"
error, but of course doesn't find the host.
> Of the top of my head, is the locale set up correctly ?
My local is en_US.UTF-8 and TZ is EDT -0400.

# locale
LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE=C
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=

Mark Foley

2023-Aug-01 21:40 UTC

head link

[Samba] Joining a new Samba AD DC

On Mon Jul 31 11:17:57 2023 Mark Foley via samba <samba at
lists.samba.org> wrote:
> On Jul 31 03:00:37 2023 Rowland Penny via samba <samba at
lists.samba.org> wrote:
>
> > On 30/07/2023 22:24, Mark Foley via samba wrote:
> > > That gave me:
> > > 
> > > # host -t A
0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local
> > > host: idnkit idn_encodename to idn failed: prohibited character
found
> >
> > That is strange, if I obtain the GUID's on my DCs and run a
similar
> > command, I get this:
> >
> > adminuser at rpidc1:~ $ host -t A 
> > fb453823-737c-4a8b-93e1-dc197e236d50._msdcs.samdom.example.com
> > fb453823-737c-4a8b-93e1-dc197e236d50._msdcs.samdom.example.com is an 
> > alias for rpidc1.samdom.example.com.
> > rpidc1.samdom.example.com has address 192.168.1.2
> >
> > Rowland
>
> It could be a difference in host command versions (I have version 9.11.37),
as
> well as my version of Samba on the current DC is very old (4.8.2). 
[deleted]>
> My results when running 'host -t A':
>
> # host -t A 
> Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W time]
>             [-R number] [-m flag] hostname [server]
[deleted]>
> It looks like a hostname is required.
>
> The "prohibited character" error seems really odd. I found this: 
> https://bind-users.isc.narkive.com/9nA0Aqea/idn-dig-and-underscore which is
a
> very similar problem related to the underscore. However, unlike the author
'dig'
> works for me, albeit it does give a warning about the .local. Perhaps this
is
> part of the problem?
>
> # dig 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local 
>
> ; <<>> DiG 9.11.37 <<>>
0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local
> ;; global options: +cmd
> ;; Got answer:
> ;; WARNING: .local is reserved for Multicast DNS
[deleted]>
> ;; AUTHORITY SECTION:
> hprs.local.             3600    IN      SOA     mail.hprs.local.
hostmaster.hprs.local. 2014159838 10800 3600 28800 3600
>
> If I remove the underscore from the
0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local'
> the 'host -t A 0d2...' command does not give the "prohibited
character found"
> error, but of course doesn't find the host.
>
> > Of the top of my head, is the locale set up correctly ?
>
> My local is en_US.UTF-8 and TZ is EDT -0400.
>
> # locale
> LANG=en_US.UTF-8[deleted]

Is not being able to run 'host -t A' a show stopper here? The wiki
'host -t CNAME'
gave, as expected:

# host -t CNAME 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local.
Host 0d2a3ba9-4ade-45de-85c7-321ba69caee0._msdcs.hprs.local. not found:
3(NXDOMAIN)

and when trying to add with 'samba-tool' I got:

# samba-tool dns add MAIL _msdcs.hprs.local 0d2a3ba9-4ade-45de-85c7-321ba69caee0
CNAME DC1.hprs.local -Uadministrator
[deleted]
Password for [HPRS\administrator]:
gensec_update_send: gssapi_krb5[0xd83f00]: subreq: 0xd85680
gensec_update_send: spnego[0xd831e0]: subreq: 0xd83820
gensec_update_done: gssapi_krb5[0xd83f00]: NT_STATUS_MORE_PROCESSING_REQUIRED
tevent_req[0xd85680/../source4/auth/gensec/gensec_gssapi.c:1054]: state[2]
error[0 (0x0)]  state[struct gensec_gssapi_update_state (0xd85810)] timer[(nil)]
finish[../source4/auth/gensec/gensec_gssapi.c:1064]
gensec_update_done: spnego[0xd831e0]: NT_STATUS_MORE_PROCESSING_REQUIRED
tevent_req[0xd83820/../auth/gensec/spnego.c:1601]: state[2] error[0 (0x0)] 
state[struct gensec_spnego_update_state (0xd839b0)] timer[(nil)]
finish[../auth/gensec/spnego.c:2070]
gensec_update_send: gssapi_krb5[0xd83f00]: subreq: 0xd85680
gensec_update_send: spnego[0xd831e0]: subreq: 0xd834f0
gensec_update_done: gssapi_krb5[0xd83f00]: NT_STATUS_OK
tevent_req[0xd85680/../source4/auth/gensec/gensec_gssapi.c:1054]: state[2]
error[0 (0x0)]  state[struct gensec_gssapi_update_state (0xd85810)] timer[(nil)]
finish[../source4/auth/gensec/gensec_gssapi.c:1071]
gensec_update_done: spnego[0xd831e0]: NT_STATUS_MORE_PROCESSING_REQUIRED
tevent_req[0xd834f0/../auth/gensec/spnego.c:1601]: state[2] error[0 (0x0)] 
state[struct gensec_spnego_update_state (0xd83680)] timer[(nil)]
finish[../auth/gensec/spnego.c:2070]
gensec_update_send: spnego[0xd831e0]: subreq: 0xd85350
gensec_update_done: spnego[0xd831e0]: NT_STATUS_OK
tevent_req[0xd85350/../auth/gensec/spnego.c:1601]: state[2] error[0 (0x0)] 
state[struct gensec_spnego_update_state (0xd854e0)] timer[(nil)]
finish[../auth/gensec/spnego.c:2070]
ERROR(runtime): uncaught exception - (9711,
'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
  File "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib64/python2.7/site-packages/samba/netcmd/dns.py", line
940, in run
    raise e

which you seemed to think was a bogus error with
WERR_DNS_ERROR_RECORD_ALREADY_EXISTS.
Nevertheless the ojectGUID CNAME record was not added.

So, is there another way to add this record? Perhaps ldbedit'ing some .ldb
file?

Was your 'host -t A' suggestion intended to be another way to get this
done? If
so, I can update my BIND package to a newer version which does not have the
"prohibited character" issue. I have it on good authority from the
"father" of
Slackware himself that I should be able to upgrade this package w/o too much
difficulty.

--Mark

Reasonably Related Threads

Search for more reasonably related threads

samba - Aug 2023 - Joining a new Samba AD DC

[Samba] Joining a new Samba AD DC

[Samba] Joining a new Samba AD DC

Reasonably Related Threads