thr3ads.net - samba - [Samba] Strange DNS issue... [Jun 2021]

If this information is useful, please help other people find it:
Share via:

L.P.H. van Belle

2021-Jun-10 09:18 UTC

[Samba] Strange DNS issue...

You really should do this differenly.. 

Because.. 

A working DNS domain should be established with forward and 
reverse mappings to at least the Kerberos KDC (Samba-DC's)
and application servers you intend to Kerberize.

If you use bind_DLZ as your doing and you want other zones sync to 
an other domain and you have bind running, as your have.. 

Why not use master/slave setup of bind9 todo that. 

So that keeps the question, why is "suddenly" differently. 
My "guess" is, latest change "security fix" of bind fixed
something,
Which now is your problem.

See Debian LTS: DLA-2647-1: bind9 


Greetz, 

Louis
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Marco Gaiarin via samba
> Verzonden: woensdag 9 juni 2021 16:19
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Strange DNS issue...
> 
> 
> Samba 4.9.18+dfsg-0.1stretch1, Louis package, i know i need 
> to upgrade.
> A domain, 6 DC.
> 
> I've still a separate DNS/DHCP setup, so client get DHCP and DNS
> addesses from another servers, in a different domain.
> Clearly, they have also a (forward) domain DNS name.
> 
> Suddenly, by some days, i've some strange DNS issue. An example:
> 
> Machine 'wilkie' boot and get addresses from primary DNS/DHCP
setup:
> 
>  Jun  9 08:31:10 vdmsv1 dhcpd[23742]: DHCPOFFER on 10.5.2.220 
> to 34:64:a9:1c:1e:4a (WILKIE) via eth0
>  Jun  9 08:31:10 vdmsv1 named[10040]: client 
> 127.0.0.1#31176/key sanvito: updating zone 
> 'dyn.sv.lnf.it/IN': adding an RR at 'WILKIE.dyn.sv.lnf.it'
A
> 10.5.2.220
>  Jun  9 08:31:10 vdmsv1 named[10040]: client 
> 127.0.0.1#31176/key sanvito: updating zone 
> 'dyn.sv.lnf.it/IN': adding an RR at 'WILKIE.dyn.sv.lnf.it' 
> TXT "318a9edb2b4f1eac9e8b7e1d6e41f75b84"
>  Jun  9 08:31:10 vdmsv1 dhcpd[23742]: DHCPREQUEST for 
> 10.5.2.220 (10.5.1.3) from 34:64:a9:1c:1e:4a (WILKIE) via eth0
>  Jun  9 08:31:10 vdmsv1 dhcpd[23742]: DHCPACK on 10.5.2.220 
> to 34:64:a9:1c:1e:4a (WILKIE) via eth0
>  Jun  9 08:31:10 vdmsv1 dhcpd[23742]: Added new forward map 
> from WILKIE.dyn.sv.lnf.it to 10.5.2.220
>  Jun  9 08:31:10 vdmsv1 named[10040]: client 
> 127.0.0.1#31176/key sanvito: updating zone 
> '2.5.10.in-addr.arpa/IN': adding an RR at 
> '220.2.5.10.in-addr.arpa' PTR WILKIE.dyn.sv.lnf.it.
>  Jun  9 08:31:11 vdmsv1 dhcpd[23742]: Added reverse map from 
> 220.2.5.10.in-addr.arpa. to WILKIE.dyn.sv.lnf.it
>  Jun  9 08:36:11 vdmsv1 dhcpd[23742]: DHCPREQUEST for 
> 10.5.2.220 from 34:64:a9:1c:1e:4a (WILKIE) via eth0
>  Jun  9 08:36:11 vdmsv1 dhcpd[23742]: DHCPACK on 10.5.2.220 
> to 34:64:a9:1c:1e:4a (WILKIE) via eth0
>  [...]
> 
> At the same time, client register itself in domain DNS, on site
'SV',
> indeed with correct IP:
> 
>  Jun  9 08:31:13 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.1-4114.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:13 vdcsv1 named[664]: client 
> 10.5.2.220#52285/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting an RR at WILKIE.ad.fvg.lnf.it A
>  Jun  9 08:31:13 vdcsv1 named[664]: samba_dlz: subtracted 
> rdataset WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.103'
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=AAAA 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#50264/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' AAAA
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#50264/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' A
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#50264/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': adding an RR at
'WILKIE.ad.fvg.lnf.it'
> A 10.5.2.220
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: added rdataset 
> WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.220'
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=AAAA 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#53932/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' AAAA
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#53932/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' A
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: subtracted 
> rdataset WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.220'
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#53932/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': adding an RR at
'WILKIE.ad.fvg.lnf.it'
> A 10.5.2.220
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: added rdataset 
> WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.220'
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=AAAA 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: allowing 
> update of signer=WILKIE\$\@AD.FVG.LNF.IT 
> name=WILKIE.ad.fvg.lnf.it tcpaddr= type=A 
> key=1688-ms-7.2-42f8.28c7707f-c8ec-11eb-64ab-3464a91c1e4a/160/0
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#63100/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' AAAA
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#63100/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': deleting rrset at
'WILKIE.ad.fvg.lnf.it' A
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: subtracted 
> rdataset WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.220'
>  Jun  9 08:31:14 vdcsv1 named[664]: client 
> 10.5.2.220#63100/key WILKIE\$\@AD.FVG.LNF.IT: updating zone 
> 'ad.fvg.lnf.it/NONE': adding an RR at
'WILKIE.ad.fvg.lnf.it'
> A 10.5.2.220
>  Jun  9 08:31:14 vdcsv1 named[664]: samba_dlz: added rdataset 
> WILKIE.ad.fvg.lnf.it 
> 'WILKIE.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.220'
> 
> 
> If now i query DNS in their site, i get correct result:
> 
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdcsv1.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.220
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdcsv2.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.220
> 
> but if i query DNS for other site DCs, i get incorrect result:
> 
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdcpp1.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.57
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdcpp2.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.171
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdc3t1.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.57
>  gaio at hermione:~$ dig a wilkie.ad.fvg.lnf.it 
> @vdctms1.ad.fvg.lnf.it | grep ^wilkie
>  wilkie.ad.fvg.lnf.it.	1200	IN	A	10.5.2.57
> 
> 
> Note that basic things like 'samba-tool drs showrepl' and
> 'samba-tool ldapcmp ldap://vdcsv1 ldap://vdcpp2 -U Administrator'
show
> no replication differences or errors.
> 
> 
> What happens?! Thanks.
> 
> -- 
> dott. Marco Gaiarin				        GNUPG 
> Key ID: 240A3D66
>   Associazione ``La Nostra Famiglia''          
> http://www.lanostrafamiglia.it/
>   Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al 
> Tagliamento (PN)
>   marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   
> f +39-0434-842797
> 
> 		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
>       http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
> 	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Marco Gaiarin

2021-Jun-15 12:32 UTC

head link

[Samba] Strange DNS issue...

Mandi! L.P.H. van Belle via samba
  In chel di` si favelave...

Sorry, i come back on this.
> You really should do this differenly.. 
> Because.. 
> A working DNS domain should be established with forward and 
> reverse mappings to at least the Kerberos KDC (Samba-DC's)
> and application servers you intend to Kerberize.
OK. But why in AD reverse zone get not created automatically, and need
to be created by hand?
Why forward zone get prpulated automatically directly by joined
clients, while reverse need DHCP?

> If you use bind_DLZ as your doing and you want other zones sync to 
> an other domain and you have bind running, as your have.. 
> Why not use master/slave setup of bind9 todo that. 
> So that keeps the question, why is "suddenly" differently. 
But i've clerly master/slave setup, all DC have a 'standard' conf
using
bind_DLZ, as wiki suggest.

For now, i'm simply asking a rather simple question.

1) client boot and register itself on 'VDCSV1'; i see no error on logs:

 Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of
signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=AAAA
key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
 Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of
signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=A
key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
 Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of
signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=A
key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
 Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key
GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': deleting
rrset at 'gaunt.ad.fvg.lnf.it' AAAA
 Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key
GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': deleting
rrset at 'gaunt.ad.fvg.lnf.it' A
 Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: subtracted rdataset
gaunt.ad.fvg.lnf.it
'gaunt.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.6'
 Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key
GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': adding an RR
at 'gaunt.ad.fvg.lnf.it' A 10.5.2.6
 Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: added rdataset
gaunt.ad.fvg.lnf.it
'gaunt.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.6'

if i query that DC DNS, i got the correct result:

 gaio at hermione:~/conf/samba/manage$ dig a gaunt.ad.fvg.lnf.it
@vdcsv1.ad.fvg.lnf.it | grep ^gaunt
 gaunt.ad.fvg.lnf.it.	1200	IN	A	10.5.2.6

if i query the other DC DNS in the same site, i got:

 gaio at hermione:~/conf/samba/manage$ dig a gaunt.ad.fvg.lnf.it
@vdcsv2.ad.fvg.lnf.it | grep ^gaunt
 gaunt.ad.fvg.lnf.it.	1200	IN	A	10.5.2.33

a different result.

Because DNS data are in AD/LDAP, i suppose that a 'samba-tool drs
showrepl' or a 'samba-tool ldapcmp' will return some differences,
but
data seems replicated correctly around all DCs.


Why domains seamsd healty but does not replicate DNS data?!

> My "guess" is, latest change "security fix" of bind
fixed something,
> Which now is your problem.
> See Debian LTS: DLA-2647-1: bind9 
Mmmhh... interesting... I've land to:

	https://kb.isc.org/docs/cve-2021-25216

that stated:

	In a configuration which uses BIND's default settings the vulnerable code
path is not exposed, but a server can be rendered vulnerable by explicitly
setting values for the tkey-gssapi-keytab or tkey-gssapi-credential
configuration options.

effectively as suggested by samda docs, i've adedd:

	tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

I've tried to lookup at debian patch for 9.10, but i've not found that.


Setting:
	dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool

in smb,conf could be a useful workaround?


Thanks.

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

samba - Jun 2021 - Strange DNS issue...

[Samba] Strange DNS issue...

[Samba] Strange DNS issue...