Igor Sousa
2019-Aug-12 16:57 UTC
[Samba] Bind9 doesn't updated - TSIG error with server: tsig verify failure
Hi Rowland,
I've done how you have said and I've set nameserver on
'/etc/resolv.conf'
file as 'king' IP (10.41.20.67) and add 'dns update command
/usr/sbin/samba_dnsupdate --use-samba-tool' on
'/usr/local/samba/etc/smb.conf' file. I've still seen
samba_dnsupdate fails
on 'systemctl status samba-ad-dc'. Is there other way to check if dns
entries are update correctly instead of use 'samba_dnsupdate --verbose
--all-names --use-samba-tool'?
[root at king ~]# cat /usr/local/samba/etc/smb.conf
# Global parameters
[global]
netbios name = KING
realm = SMB
server role = active directory domain controller
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd,
ntp_signd, kcc, dnsupdate
workgroup = SMB
idmap_ldb:use rfc2307 = yes
dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool
[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No
[netlogon]
path = /usr/local/samba/var/locks/sysvol/smb/scripts
read only = No
[root at king ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search SMB
nameserver 10.41.20.67
[root at king ~]# systemctl status samba-ad-dc -l
? samba-ad-dc.service - Samba Active Directory Domain Controller
Loaded: loaded (/etc/systemd/system/samba-ad-dc.service; enabled; vendor
preset: disabled)
Active: active (running) since Mon 2019-08-12 10:08:47 -03; 44min ago
Main PID: 4771 (samba)
Status: "smbd: ready to serve connections..."
CGroup: /system.slice/samba-ad-dc.service
??4771 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4773 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4774 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4775 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4776 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4777 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
??4778 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4779 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4780 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4781 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4782 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4783 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4784 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4785 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4786 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4787 /usr/local/samba/sbin/samba --foreground
--no-process-group
??4788 /usr/local/samba/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
??4795 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
??4796 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
??4799 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
Aug 12 10:28:46 king samba[4786]: [2019/08/12 10:28:46.806315, 0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:28:46 king samba[4786]: dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
Aug 12 10:38:46 king samba[4786]: [2019/08/12 10:38:46.874731, 0]
../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
Aug 12 10:38:46 king samba[4786]: /usr/sbin/samba_dnsupdate: Failed to
exec child - No such file or directory
Aug 12 10:38:46 king samba[4786]: [2019/08/12 10:38:46.877919, 0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:38:46 king samba[4786]: dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
Aug 12 10:48:46 king samba[4786]: [2019/08/12 10:48:46.894473, 0]
../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
Aug 12 10:48:46 king samba[4786]: /usr/sbin/samba_dnsupdate: Failed to
exec child - No such file or directory
Aug 12 10:48:46 king samba[4786]: [2019/08/12 10:48:46.897140, 0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:48:46 king samba[4786]: dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
--
Igor Sousa
Em dom, 11 de ago de 2019 ?s 05:18, Rowland penny via samba <
samba at lists.samba.org> escreveu:
> On 11/08/2019 02:36, Igor Sousa wrote:
> > Hi Rowland,
> >
> > I've added 'dns update command' on global section of
smb.conf file and
> > I've configured namesever on '/etc/resolv.conf' as
127.0.0.1 (I've
> > tried with 'kings' IP address too), but I don't know if
this has
> > worked. I've seen some dns updates errors on 'systemctl status
> > samba-ad-dc' though the same command has returned status
'Active
> > (running)'. And I've use 'samba_dnsupdate', as
I've mentioned
> > previously, and I've received 'dns_tkey_negotiategss: TKEY is
> > unacceptable' error and all entries have had their dns update
failed.
> > I've read
> >
>
https://wiki.samba.org/index.php/Dns_tkey_negotiategss:_TKEY_is_unacceptable
> > but I think my case doesn't match with described cases.
> >
> > I've thought for a time to demote 'king' from
'SMB' and create a new
> > DC to join 'SMB'. I haven't done it because I've had
no guarantees
> > that this will work.
> >
> > OBS: I've used Cent OS7 with firewalld and SElinux disabled.
>
> Do not use '127.0.0.1' in /etc/resolv.conf, use the DC's
ipaddress.
>
> Stop running 'samba_dnsupdate' directly, but if you must, add
> '--use-samba-tool'
>
> By using '--use-samba-tool' you are doing the updates over RPC
instead
> of kerberos.
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
Rowland penny
2019-Aug-12 17:36 UTC
[Samba] Bind9 doesn't updated - TSIG error with server: tsig verify failure
On 12/08/2019 17:57, Igor Sousa wrote:> Hi Rowland, > > I've done how you have said and I've set nameserver on > '/etc/resolv.conf' file as 'king' IP (10.41.20.67) and add 'dns update > command = /usr/sbin/samba_dnsupdate --use-samba-tool' on > '/usr/local/samba/etc/smb.conf' file. I've still seen samba_dnsupdate > fails on 'systemctl status samba-ad-dc'. Is there other way to check > if dns entries are update correctly instead of use 'samba_dnsupdate > --verbose --all-names --use-samba-tool'? > > [root at king ~]# cat /usr/local/samba/etc/smb.conf > dns update command = /usr/sbin/samba_dnsupdate --use-samba-toolOOOOOPPPPSSSS You have compiled Samba yourself, so samba_dnsupdate will not be in /usr/sbin, it will be in /usr/local/samba/sbin so change the line in smb.conf to: dns update command = /usr/local/samba/sbin/samba_dnsupdate --use-samba-tool Rowland
Igor Sousa
2019-Aug-12 23:27 UTC
[Samba] Bind9 doesn't updated - TSIG error with server: tsig verify failure
Em seg, 12 de ago de 2019 ?s 14:36, Rowland penny via samba < samba at lists.samba.org> escreveu:> > OOOOOPPPPSSSS > > > > You have compiled Samba yourself, so samba_dnsupdate will not be in > > /usr/sbin, it will be in /usr/local/samba/sbin > > > > so change the line in smb.conf to: > > > > dns update command = /usr/local/samba/sbin/samba_dnsupdate > --use-samba-tool >My bad! I haven't paid attention to samba_dnsupdate directory. ;-D I've corrected it and the dnsupdate errors has disappeared from 'systemctl status samba-ad-dc'. I don't know to check if really works though. Thanks a lot for your help!