samba - May 2020 - Error changing server IP address: ERROR: Connecting to DNS RPC server

Samba Version 4.12.1

I'm trying to change server IP address from 10.0.0.69 to .3 on a single AD
DC running also as fileserver (very small situation). I'm following this [1]
guide, I have no interface restrictions in samba or in bind. I stop samba,
change IP address, restart bind, start samba, but when I run samba_dnsupdate I
get some messages until:


5 DNS updates and 5 DNS deletes needed
Failed to get Kerberos credentials, falling back to samba-tool: kinit for
FILESERVER$@WDC.MYDOMAIN.IT failed (Cannot contact any KDC for requested realm)

update (samba-tool): A fileserver.wdc.MYDOMAIN.it 10.0.0.69
Calling samba-tool dns for A fileserver.wdc.MYDOMAIN.it 10.0.0.69 (delete)
Calling samba-tool dns delete -k no -P ['10.0.0.3',
'wdc.MYDOMAIN.it', 'fileserver', 'A',
'10.0.0.69']
ERROR: Connecting to DNS RPC server 10.0.0.3 failed with (3221225653,
'{Device Timeout} The specified I/O operation on %hs was not completed
before the time-out period expired.')
Failed 'samba-tool dns' based update of A fileserver.wdc.MYDOMAIN.it
10.0.0.69
update (samba-tool): A wdc.MYDOMAIN.it 10.0.0.69
Calling samba-tool dns for A wdc.MYDOMAIN.it 10.0.0.69 (delete)
Calling samba-tool dns delete -k no -P ['10.0.0.3',
'wdc.MYDOMAIN.it', '@', 'A', '10.0.0.69']

And here starts looping between different records update, failing with the same
timeout error.


/etc/resolv.conf:
nameserver 127.0.0.1
search wdc.mydomain.it

/etc/krb5.conf
[libdefaults]
        default_realm = WDC.MYDOMAIN.IT
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]
WDC.MYDOMAIN.IT = {
        default_domain = wdc.mydomain.it
}

[domain_realm]
        fileserver = WDC.MYDOMAIN.IT


/usr/local/samba/var/log.samba
[2020/05/08 18:30:05.360609,  0]
../../source4/dsdb/dns/dns_update.c:86(dnsupdate_nameupdate_done)
  dnsupdate_nameupdate_done: Failed DNS update with exit code 110


What am I doing wrong? thanks

[1]?https://wiki.samba.org/index.php/Changing_the_IP_Address_of_a_Samba_AD_DC#Changing_the_IP_Address_of_an_AD_DC_in_a_Single-domain_Environment
-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.it

YetOpen S.r.l. - https://www.yetopen.it/
Via Salerno 18 - 23900 Lecco - ITALY -
Tel +39 0341 220 205 - Fax +39 178 6070 222

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.

On 08/05/2020 17:38, Lorenzo Milesi via samba wrote:
> Samba Version 4.12.1
>
> I'm trying to change server IP address from 10.0.0.69 to .3 on a single
AD DC running also as fileserver (very small situation). I'm following this
[1] guide, I have no interface restrictions in samba or in bind. I stop samba,
change IP address, restart bind, start samba, but when I run samba_dnsupdate I
get some messages until:
Double check that you do not have the old ipaddress
anywhere.
> 5 DNS updates and 5 DNS deletes needed
> Failed to get Kerberos credentials, falling back to samba-tool: kinit for
FILESERVER$@WDC.MYDOMAIN.IT failed (Cannot contact any KDC for requested realm)
>
> update (samba-tool): A fileserver.wdc.MYDOMAIN.it 10.0.0.69
> Calling samba-tool dns for A fileserver.wdc.MYDOMAIN.it 10.0.0.69 (delete)
> Calling samba-tool dns delete -k no -P ['10.0.0.3',
'wdc.MYDOMAIN.it', 'fileserver', 'A',
'10.0.0.69']
> ERROR: Connecting to DNS RPC server 10.0.0.3 failed with (3221225653,
'{Device Timeout} The specified I/O operation on %hs was not completed
before the time-out period expired.')
> Failed 'samba-tool dns' based update of A
fileserver.wdc.MYDOMAIN.it 10.0.0.69
> update (samba-tool): A wdc.MYDOMAIN.it 10.0.0.69
> Calling samba-tool dns for A wdc.MYDOMAIN.it 10.0.0.69 (delete)
> Calling samba-tool dns delete -k no -P ['10.0.0.3',
'wdc.MYDOMAIN.it', '@', 'A', '10.0.0.69']
>
> And here starts looping between different records update, failing with the
same timeout error.
>
>
> /etc/resolv.conf:
> nameserver 127.0.0.1
> search wdc.mydomain.it
Change '127.0.0.1' to 10.0.0.3
>
> /etc/krb5.conf
> [libdefaults]
>          default_realm = WDC.MYDOMAIN.IT
>          dns_lookup_realm = false
>          dns_lookup_kdc = true
You only need the above in /etc/krb5.conf
> /usr/local/samba/var/log.samba
> [2020/05/08 18:30:05.360609,  0]
../../source4/dsdb/dns/dns_update.c:86(dnsupdate_nameupdate_done)
>    dnsupdate_nameupdate_done: Failed DNS update with exit code 110
That is a timeout

If all else fails try running the 'samba-tool dns' commands manually for
the DC.

Rowland

> Change '127.0.0.1' to 10.0.0.3
I probably still had systemd-resolved hanging around, when removed and by adding
this as suggested worked! Thank you!

I still had the old IP records in DNS, but I dug in the DNS tree and removed all
the instances

-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.it

YetOpen S.r.l. - https://www.yetopen.it/
Via Salerno 18 - 23900 Lecco - ITALY -
Tel +39 0341 220 205 - Fax +39 178 6070 222

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.