samba - Aug 2019 - Bind9 doesn't updated - TSIG error with server: tsig verify failure

Hi Rowland,

I've done how you have said and I've set nameserver on
'/etc/resolv.conf'
file as 'king' IP (10.41.20.67) and add 'dns update command
/usr/sbin/samba_dnsupdate --use-samba-tool' on
'/usr/local/samba/etc/smb.conf' file. I've still seen
samba_dnsupdate fails
on 'systemctl status samba-ad-dc'. Is there other way to check if dns
entries are update correctly instead of use 'samba_dnsupdate --verbose
--all-names --use-samba-tool'?

[root at king ~]# cat /usr/local/samba/etc/smb.conf
# Global parameters
[global]
netbios name = KING
realm = SMB
server role = active directory domain controller
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd,
ntp_signd, kcc, dnsupdate
workgroup = SMB
idmap_ldb:use rfc2307  = yes
dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool

[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No

[netlogon]
path = /usr/local/samba/var/locks/sysvol/smb/scripts
read only = No


[root at king ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search SMB
nameserver 10.41.20.67

[root at king ~]# systemctl status samba-ad-dc -l
? samba-ad-dc.service - Samba Active Directory Domain Controller
   Loaded: loaded (/etc/systemd/system/samba-ad-dc.service; enabled; vendor
preset: disabled)
   Active: active (running) since Mon 2019-08-12 10:08:47 -03; 44min ago
 Main PID: 4771 (samba)
   Status: "smbd: ready to serve connections..."
   CGroup: /system.slice/samba-ad-dc.service
           ??4771 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4773 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4774 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4775 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4776 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4777 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ??4778 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4779 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4780 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4781 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4782 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4783 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4784 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4785 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4786 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4787 /usr/local/samba/sbin/samba --foreground
--no-process-group
           ??4788 /usr/local/samba/sbin/winbindd -D --option=server role
check:inhibit=yes --foreground
           ??4795 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ??4796 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground
           ??4799 /usr/local/samba/sbin/smbd -D --option=server role
check:inhibit=yes --foreground

Aug 12 10:28:46 king samba[4786]: [2019/08/12 10:28:46.806315,  0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:28:46 king samba[4786]:   dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
Aug 12 10:38:46 king samba[4786]: [2019/08/12 10:38:46.874731,  0]
../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
Aug 12 10:38:46 king samba[4786]:   /usr/sbin/samba_dnsupdate: Failed to
exec child - No such file or directory
Aug 12 10:38:46 king samba[4786]: [2019/08/12 10:38:46.877919,  0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:38:46 king samba[4786]:   dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
Aug 12 10:48:46 king samba[4786]: [2019/08/12 10:48:46.894473,  0]
../../lib/util/util_runcmd.c:327(samba_runcmd_io_handler)
Aug 12 10:48:46 king samba[4786]:   /usr/sbin/samba_dnsupdate: Failed to
exec child - No such file or directory
Aug 12 10:48:46 king samba[4786]: [2019/08/12 10:48:46.897140,  0]
../../source4/dsdb/dns/dns_update.c:331(dnsupdate_nameupdate_done)
Aug 12 10:48:46 king samba[4786]:   dnsupdate_nameupdate_done: Failed DNS
update with exit code 255
--
Igor Sousa


Em dom, 11 de ago de 2019 ?s 05:18, Rowland penny via samba <
samba at lists.samba.org> escreveu:
> On 11/08/2019 02:36, Igor Sousa wrote:
> > Hi Rowland,
> >
> > I've added 'dns update command' on global section of
smb.conf file and
> > I've configured namesever on '/etc/resolv.conf' as
127.0.0.1 (I've
> > tried with 'kings' IP address too), but I don't know if
this has
> > worked. I've seen some dns updates errors on 'systemctl status
> > samba-ad-dc' though the same command has returned status
'Active
> > (running)'. And I've use 'samba_dnsupdate', as
I've mentioned
> > previously, and I've received 'dns_tkey_negotiategss: TKEY is
> > unacceptable' error and all entries have had their dns update
failed.
> > I've read
> >
>
https://wiki.samba.org/index.php/Dns_tkey_negotiategss:_TKEY_is_unacceptable
> > but I think my case doesn't match with described cases.
> >
> > I've thought for a time to demote 'king' from
'SMB' and create a new
> > DC to join 'SMB'. I haven't done it because I've had
no guarantees
> > that this will work.
> >
> > OBS: I've used Cent OS7 with firewalld and SElinux disabled.
>
> Do not use '127.0.0.1' in /etc/resolv.conf, use the DC's
ipaddress.
>
> Stop running 'samba_dnsupdate' directly, but if you must, add
> '--use-samba-tool'
>
> By using '--use-samba-tool' you are doing the updates over RPC
instead
> of kerberos.
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On 12/08/2019 17:57, Igor Sousa wrote:
> Hi Rowland,
>
> I've done how you have said and I've set nameserver on 
> '/etc/resolv.conf' file as 'king' IP (10.41.20.67) and add
'dns update
> command = /usr/sbin/samba_dnsupdate --use-samba-tool' on 
> '/usr/local/samba/etc/smb.conf' file. I've still seen
samba_dnsupdate
> fails on 'systemctl status samba-ad-dc'. Is there other way to
check
> if dns entries are update correctly instead of use 'samba_dnsupdate 
> --verbose --all-names --use-samba-tool'?
>
> [root at king ~]# cat /usr/local/samba/etc/smb.conf
> dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool
OOOOOPPPPSSSS

You have compiled Samba yourself, so samba_dnsupdate will not be in 
/usr/sbin, it will be in /usr/local/samba/sbin

so change the line in smb.conf to:

dns update command = /usr/local/samba/sbin/samba_dnsupdate --use-samba-tool

Rowland

Em seg, 12 de ago de 2019 ?s 14:36, Rowland penny via samba <
samba at lists.samba.org> escreveu:
> > OOOOOPPPPSSSS
> >
> > You have compiled Samba yourself, so samba_dnsupdate will not be in
> > /usr/sbin, it will be in /usr/local/samba/sbin
> >
> > so change the line in smb.conf to:
> >
> > dns update command = /usr/local/samba/sbin/samba_dnsupdate
> --use-samba-tool
>
My bad! I haven't paid attention to samba_dnsupdate directory. ;-D

I've corrected it and the dnsupdate errors has disappeared from
'systemctl
status samba-ad-dc'. I don't know to check if really works though.

Thanks a lot for your help!