Samba4 DNS Updates - Linux Clients - Is it possible?

[Amitay Isaacs]

Hi Daniele,

On Fri, Jan 20, 2012 at 9:15 PM, Daniele Dario <d.dario76 at gmail.com> wrote:
> Hi Amitay,
>
> On Thu, 2012-01-19 at 11:36 +1100, Amitay Isaacs wrote:
>> Hi Daniele,
>>
>>
>> On Thu, Jan 19, 2012 at 1:13 AM, Daniele Dario <d.dario76 at gmail.com> wrote:
>> > Hi,
>> >
>> >
>> > I'm running samba Version 4.0.0alpha18-GIT-90f06d6 with bind 9.9.0b1
>> > from PPA on an ubuntu server 11.04 x86 (on XenServer 5.6 fp1).
>> >
>> > Looking on named logs I found something similar
>> > 18-Jan-2012 14:41:35.027 database: info: samba_dlz: starting transaction
>> > on zone saitelitalia.local
>> > 18-Jan-2012 14:41:35.029 database: error: samba_dlz: failed to create
>> > session info
>> > 18-Jan-2012 14:41:35.030 update: info: client 192.168.12.12#53508/key
>> > activity\$\@SAITELITALIA.LOCAL: updating zone 'saitelitalia.local/NONE':
>> > update failed: rejected by secure update (REFUSED)
>> > 18-Jan-2012 14:41:35.030 database: info: samba_dlz: cancelling
>> > transaction on zone saitelitalia.local
>> >
>> > from /usr/local/samba/var/log.samba at same time I have
>> > [2012/01/18 14:41:34,
>> > 3] ../lib/ldb-samba/ldb_wrap.c:316(ldb_wrap_connect)
>> >  ldb_wrap open of secrets.ldb
>> > [2012/01/18 14:41:34,
>> > 3] ../source4/smb_server/smb/negprot.c:390(reply_nt1)
>> >  using SPNEGO
>> > [2012/01/18 14:41:34,
>> > 3] ../source4/smb_server/smb/negprot.c:519(smbsrv_reply_negprot)
>> >  Selected protocol [5][NT LM 0.12]
>> > [2012/01/18 14:41:35,
>> > 3] ../source4/smbd/service_stream.c:63(stream_terminate_connection)
>> >  Terminating connection - 'ldapsrv_call_loop:
>> > tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
>> > [2012/01/18 14:41:35,
>> > 3] ../source4/smbd/process_single.c:104(single_terminate)
>> >  single_terminate: reason[ldapsrv_call_loop:
>> > tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
>> >
>> > where activity is a WinXP SP3 x86 machine
>> >
>> > Running samba-tool dns query kdc01 saitelitalia.local @ A -U
>> > administrator I read that activity has no records and no children
>> > ...
>> > Name=activity, Records=0, Children=0
>> > ...
>> >
>> > could this be the cause of the failure to update?
>> >
>> > BTW, if I try samba-tool dns delete kdc01 saitelitalia.local activity A
>> > '' -U administrator I get ERROR: Record does not exist
>> > but trying to add the record it fails saying
>> > ERROR(runtime): uncaught exception - (9711,
>> > 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
>> >  File
>> > "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
>> > line 167, in _run
>> >    return self.run(*args, **kwargs)
>> >  File
>> > "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/dns.py", line
>> > 863, in run
>> >    None)
>> >
>> > nslookup seems to work correctly
>> > [root at kdc01:~]# nslookup activity
>> > Server:         192.168.12.5
>> > Address:        192.168.12.5#53
>> >
>> > Name:   activity.saitelitalia.local
>> > Address: 192.168.12.12
>> >
>> > [root at kdc01:~]# nslookup 192.168.12.12
>> > Server:         192.168.12.5
>> > Address:        192.168.12.5#53
>> >
>> > 12.12.168.192.in-addr.arpa      name = activity.saitelitalia.local.
>> >
>> > The same happens for another host which is an ubuntu server 10.04
>> > running samba 3.4.7 and joined to the domain.
>> >
>> > How can I remove the dummy records?
>> >
>> > Thanks, Daniele.
>> >
>>
>> Since version 4.0.0alpha18-GIT-90f06d6 there has been a patch
>> (6a1201a67b36bc1bb3214ee911b130c4affb8dec) that
>> fixes the problem in creating session info after changes in the
>> authentication layer in samba.
>>
>> Can you check if the problem persists with the latest git master?
>>
>> Amitay.
>
> with latest git master it seems OK for some machines.
>
> 20-Jan-2012 11:05:59.456 database: info: samba_dlz: starting transaction
> on zone saitelitalia.local
> 20-Jan-2012 11:05:59.457 update-security: error: client
> 192.168.12.209#64878: update 'saitelitalia.local/IN' denied
> 20-Jan-2012 11:05:59.457 database: info: samba_dlz: cancelling
> transaction on zone saitelitalia.local
> 20-Jan-2012 11:05:59.495 database: info: samba_dlz: starting transaction
> on zone saitelitalia.local
> 20-Jan-2012 11:05:59.500 database: info: samba_dlz: allowing update of
> signer=antoniodm\$\@SAITELITALIA.LOCAL name=antoniodm.saitelitalia.local
> tcpaddr= type=A
> key=1244-ms-7.82-1f3024ac.ab22022c-401d-11e1-afb1-1c4bd67a8de5/160/0
> 20-Jan-2012 11:05:59.503 database: info: samba_dlz: allowing update of
> signer=antoniodm\$\@SAITELITALIA.LOCAL name=antoniodm.saitelitalia.local
> tcpaddr= type=A
> key=1244-ms-7.82-1f3024ac.ab22022c-401d-11e1-afb1-1c4bd67a8de5/160/0
> 20-Jan-2012 11:05:59.504 update: info: client 192.168.12.209#60619/key
> antoniodm\$\@SAITELITALIA.LOCAL: updating zone
> 'saitelitalia.local/NONE': deleting rrset at
> 'antoniodm.saitelitalia.local' A
> 20-Jan-2012 11:05:59.519 database: info: samba_dlz: subtracted rdataset
> antoniodm.saitelitalia.local 'antoniodm.saitelitalia.local.     1200    IN      A
> 192.168.12.209'
> 20-Jan-2012 11:05:59.521 update: info: client 192.168.12.209#60619/key
> antoniodm\$\@SAITELITALIA.LOCAL: updating zone
> 'saitelitalia.local/NONE': adding an RR at
> 'antoniodm.saitelitalia.local' A
> 20-Jan-2012 11:05:59.527 database: info: samba_dlz: cancelling
> transaction on zone saitelitalia.local
>
> antoniodm is an XP box.
> For other XP boxes the update still fails
>
> 20-Jan-2012 11:10:03.080 database: info: samba_dlz: starting transaction
> on zone saitelitalia.local
> 20-Jan-2012 11:10:03.081 update-security: error: client
> 192.168.12.56#60235: update 'saitelitalia.local/IN' denied
> 20-Jan-2012 11:10:03.081 database: info: samba_dlz: cancelling
> transaction on zone saitelitalia.local
> 20-Jan-2012 11:10:03.110 database: info: samba_dlz: starting transaction
> on zone saitelitalia.local
> 20-Jan-2012 11:10:03.114 database: info: samba_dlz: disallowing update
> of signer=ua01\$\@SAITELITALIA.LOCAL name=ua01.saitelitalia.local type=A
> error=insufficient access rights
> 20-Jan-2012 11:10:03.114 update: info: client 192.168.12.56#60543/key
> ua01\$\@SAITELITALIA.LOCAL: updating zone 'saitelitalia.local/NONE':
> update failed: rejected by secure update (REFUSED)
> 20-Jan-2012 11:10:03.115 database: info: samba_dlz: cancelling
> transaction on zone saitelitalia.local
>
> but it says that signer has insufficient access rights: what rights
> should I change or look for?
>
> Daniele.
>

The fix for DNS updates failing is in the master.

Amitay.