samba - Aug 2019 - Bind9 doesn't updated - TSIG error with server: tsig verify failure

Em seg, 12 de ago de 2019 ?s 14:36, Rowland penny via samba <
samba at lists.samba.org> escreveu:
> > OOOOOPPPPSSSS
> >
> > You have compiled Samba yourself, so samba_dnsupdate will not be in
> > /usr/sbin, it will be in /usr/local/samba/sbin
> >
> > so change the line in smb.conf to:
> >
> > dns update command = /usr/local/samba/sbin/samba_dnsupdate
> --use-samba-tool
>
My bad! I haven't paid attention to samba_dnsupdate directory. ;-D

I've corrected it and the dnsupdate errors has disappeared from
'systemctl
status samba-ad-dc'. I don't know to check if really works though.

Thanks a lot for your help!

I've found divergences when I've compared the dns entries on
'king' and
'samba4' servers ('samba4' has the fsmo roles on 'SMB'
domain). There are
some 'samba4bkp' entries on 'king' and theses same entries there
aren't on
'samba4'. I've understood that I've could to demoting
'samba4bkp' using
samba-tool, but master DC 'samba4's version is 4.1.6 and this options
there
isn't on this version. Is possible to force sync between master DC
'samba4'
and the other DCs (as 'king')?

--
Igor Sousa


Em seg, 12 de ago de 2019 ?s 20:27, Igor Sousa <igorvolt at gmail.com>
escreveu:
> Em seg, 12 de ago de 2019 ?s 14:36, Rowland penny via samba <
> samba at lists.samba.org> escreveu:
>
>> > OOOOOPPPPSSSS
>> >
>> > You have compiled Samba yourself, so samba_dnsupdate will not be
in
>> > /usr/sbin, it will be in /usr/local/samba/sbin
>> >
>> > so change the line in smb.conf to:
>> >
>> > dns update command = /usr/local/samba/sbin/samba_dnsupdate
>> --use-samba-tool
>>
>
> My bad! I haven't paid attention to samba_dnsupdate directory. ;-D
>
> I've corrected it and the dnsupdate errors has disappeared from
'systemctl
> status samba-ad-dc'. I don't know to check if really works though.
>
> Thanks a lot for your help!
>

On 13/08/2019 21:28, Igor Sousa wrote:
> I've found divergences when I've compared the dns entries on
'king'
> and 'samba4' servers ('samba4' has the fsmo roles on
'SMB' domain).
> There are some 'samba4bkp' entries on 'king' and theses
same entries
> there aren't on 'samba4'. I've understood that I've
could to demoting
> 'samba4bkp' using samba-tool, but master DC 'samba4's
version is 4.1.6
> and this options there isn't on this version. Is possible to force 
> sync between master DC 'samba4' and the other DCs (as
'king')?
>
> --
If I remember correctly, 'king' is running 4.10.x, so transfer or seize 
the fsmo roles to this. now forcibly demote 'samba4bkp' from
'king'. Now
add another DC using an up to date Samba version, then demote 'samba4'. 
At this point, you should have two current Samba AD DCs, so make a note 
somewhere saying 'I must update Samba regularly' ;-)

Rowland