samba - Dec 2020 - Cloned DC - was :AW: Samba 4 custom ports for DNS in 2020?

Hope you all had a pleasant Christmas time.
Unfortunately I am still struggling with the issue below. Any suggestion?
Thanks, Joachim


-----Urspr?ngliche Nachricht-----
Von: Joachim Lindenberg <samba at lindenberg.one> 
Gesendet: Tuesday, 22 December 2020 21:10
An: 'samba at lists.samba.org' <samba at lists.samba.org>
Betreff: Cloned DC - was :AW: [Samba] Samba 4 custom ports for DNS in 2020?

On one of my clones that I joined as new DCs I encounter
"dns_tkey_gssnegotiate: TKEY is unacceptable" when executing 
samba_dnsupdate --verbose --all-names.
I ran through
https://wiki.samba.org/index.php/Dns_tkey_negotiategss:_TKEY_is_unacceptable and
afaik everything is ok, except that I cannot tell "BIND must be able to
write to the temporary directory. For details, which temporary folder your BIND
installation uses, see the BIND and your operating system's
documentation" - which directory is is using and where is that in bind
documentation?
Thanks, Joachim
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On 28/12/2020 10:45, Joachim Lindenberg via samba wrote:
> Hope you all had a pleasant Christmas time.
> Unfortunately I am still struggling with the issue below. Any suggestion?
> Thanks, Joachim
>
>
I think you may be hitting the 'dns.keytab isn't created in the correct 
place during a join' bug.

When you join a DC to an existing domain, the code to put the dns.keytab 
in the bind-dns directory isn't there, it is created in the private 
directory.

If this is your problem, you need to do one of two things, either copy 
the keytab from the private directory to the bind-dns directory and set 
the required permissions or run 'samba_upgradedns' followed by 
'samba_upgradedns --dns-backend=BIND9_DLZ', the latter method will copy 
the keytab for you.

Rowland