[Samba] dns update failt (kerberos)

Thomas Zeitinger thomas.zeitinger at it2.at
Wed Sep 4 03:13:43 MDT 2013

Hi there,

I am struggling with samba4 and the internal dns and kerberos.

It seems that DNS is the problem.

When I aske for kerberos dns entrys on my workstation, I get this
( is the samba4 server):

root at lit2:~# dig _kerberos._udp.DOMAIN.LOCAL @

; <<>> DiG 9.7.3 <<>> _kerberos._udp.DOMAIN.LOCAL @
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3733
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;_kerberos._udp.DOMAIN.LOCAL. IN A

;; Query time: 1 msec
;; WHEN: Wed Sep 4 10:10:33 2013
;; MSG SIZE rcvd: 48

But if I ask the samba directly:

root at linsrv:~# samba-tool dns query DOMAIN.LOCAL
_kerberos._udp ALL
Password for [Administrator at DOMAIN.LOCAL]:
Name=, Records=1, Children=0
SRV: linsrv.domain.local. (88, 0, 100) (flags=f0, serial=110, ttl=900)

root at linsrv:~# samba-tool dns query DOMAIN.LOCAL linsrv ALL
Password for [Administrator at DOMAIN.LOCAL]:
Name=, Records=1, Children=0
A: (flags=f0, serial=110, ttl=900)

It seems that the entries from the dns database don't get "propagated"
to the dns server and I tried a "samba_dnsupdate --verbose --all-names".

This is the result (with 'debug level = 10'):

root at linsrv:/usr/local/samba# samba_dnsupdate --verbose --all-names
INFO: Current debug levels:
  all: 10
  tdb: 10
  printdrivers: 10
  lanman: 10
  smb: 10
  rpc_parse: 10
  rpc_srv: 10
  rpc_cli: 10
  passdb: 10
  sam: 10
  auth: 10
  winbind: 10
  vfs: 10
  idmap: 10
  quota: 10
  acls: 10
  locking: 10
  msdfs: 10
  dmapi: 10
  registry: 10
  scavenger: 10
  dns: 10
  ldb: 10
Processing section "[netlogon]"
Processing section "[sysvol]"
Processing section "[profiles]"
Processing section "[homes]"
Processing section "[daten]"
Processing section "[install]"
Processing section "[winupdate]"
pm_process() returned Yes
added interface eth0 ip= bcast=
IPs: ['']
Security token SIDs (1):
  SID[  0]: S-1-5-18
  Privilege[  0]: SeMachineAccountPrivilege
  Privilege[  1]: SeTakeOwnershipPrivilege
  Privilege[  2]: SeBackupPrivilege
  Privilege[  3]: SeRestorePrivilege
  Privilege[  4]: SeRemoteShutdownPrivilege
  Privilege[  5]: SePrintOperatorPrivilege
  Privilege[  6]: SeAddUsersPrivilege
  Privilege[  7]: SeDiskOperatorPrivilege
  Privilege[  8]: SeSecurityPrivilege
  Privilege[  9]: SeSystemtimePrivilege
  Privilege[ 10]: SeShutdownPrivilege
  Privilege[ 11]: SeDebugPrivilege
  Privilege[ 12]: SeSystemEnvironmentPrivilege
  Privilege[ 13]: SeSystemProfilePrivilege
  Privilege[ 14]: SeProfileSingleProcessPrivilege
  Privilege[ 15]: SeIncreaseBasePriorityPrivilege
  Privilege[ 16]: SeLoadDriverPrivilege
  Privilege[ 17]: SeCreatePagefilePrivilege
  Privilege[ 18]: SeIncreaseQuotaPrivilege
  Privilege[ 19]: SeChangeNotifyPrivilege
  Privilege[ 20]: SeUndockPrivilege
  Privilege[ 21]: SeManageVolumePrivilege
  Privilege[ 22]: SeImpersonatePrivilege
  Privilege[ 23]: SeCreateGlobalPrivilege
  Privilege[ 24]: SeEnableDelegationPrivilege
 Rights (0x               0):
lpcfg_servicenumber: couldn't find ldb
schema_fsmo_init: we are master[yes] updates allowed[yes]
ldb: ldb_trace_request: SEARCH
 scope: base
 expr: (@LIST=*)
 attr: @LIST
 control: <NONE>

ldb: ldb_trace_request: (tdb)->search
ldb: Added timed event "ltdb_callback": 0x1bc3540

ldb: Added timed event "ltdb_timeout": 0x26e86f0

ldb: Running timer event 0x1bc3540 "ltdb_callback"

ldb: ldb_trace_response: ENTRY
@LIST: samba_secrets

ldb: Destroying timer event 0x26e86f0 "ltdb_timeout"

ldb: Ending timer event 0x1bc3540 "ltdb_callback"

ldb: ldb_trace_request: REGISTER_CONTROL
 control: <NONE>

ldb: ldb_asprintf/set_errstring: unable to find module or backend to
handle operation: request
ldb: ldb_trace_request: SEARCH
 dn: <rootDSE>
 scope: base
 expr: (objectClass=*)
 attr: rootDomainNamingContext
 attr: configurationNamingContext
 attr: schemaNamingContext
 attr: defaultNamingContext
 control: <NONE>

ldb: ldb_trace_request: (rdn_name)->search
ldb: ldb_trace_next_request: (tdb)->search
ldb: Added timed event "ltdb_callback": 0x2b4a450

ldb: Added timed event "ltdb_timeout": 0x1fc5d10

ldb: Running timer event 0x2b4a450 "ltdb_callback"

ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search
ldb: Destroying timer event 0x1fc5d10 "ltdb_timeout"

ldb: Ending timer event 0x2b4a450 "ltdb_callback"

ldb_wrap open of secrets.ldb
ldb: ldb_trace_request: SEARCH
 dn: cn=Primary Domains
 scope: sub
 expr: (&(flatname=DOMAIN)(objectclass=primaryDomain))
 attr: <ALL>
 control: <NONE>

ldb: ldb_trace_request: (rdn_name)->search
ldb: ldb_trace_next_request: (tdb)->search
ldb: Added timed event "ltdb_callback": 0x238f910

ldb: Added timed event "ltdb_timeout": 0x2948fe0

ldb: Running timer event 0x238f910 "ltdb_callback"

ldb: ldb_trace_response: ENTRY
dn: flatname=DOMAIN,cn=Primary Domains
msDS-KeyVersionNumber: 1
objectClass: top
objectClass: primaryDomain
objectClass: kerberosSecret
objectSid: S-1-5-21-1406441594-952197255-810364793
privateKeytab: secrets.keytab
saltPrincipal: host/linsrv.domain.local at DOMAIN.LOCAL
samAccountName: LINSRV$
 BW=+3wZ>Lra&mBWCZBiUzBQwsBVE]O&XK:X)<JX~OTZwkIRU4j?h]Pj3CND;T at 9q$!WDbyew+HTAm
 k%F?o at P7GPAj&QnhNKBhK$r
secureChannelType: 6
servicePrincipalName: HOST/linsrv
servicePrincipalName: HOST/linsrv.domain.local
objectGUID: c4f058db-ed80-466a-9b08-1ceb78957aa7
whenCreated: 20130816104951.0Z
whenChanged: 20130816104951.0Z
uSNCreated: 7
uSNChanged: 7
name: DOMAIN
flatname: DOMAIN
distinguishedName: flatname=DOMAIN,cn=Primary Domains

ldb: Destroying timer event 0x2948fe0 "ltdb_timeout"

ldb: Ending timer event 0x238f910 "ltdb_callback"

Traceback (most recent call last):
  File "/usr/local/samba/sbin/samba_dnsupdate", line 506, in <module>
  File "/usr/local/samba/sbin/samba_dnsupdate", line 119, in get_credentials
    creds.get_named_ccache(lp, ccachename)
RuntimeError: kinit for LINSRV$@DOMAIN.LOCAL failed (Cannot contact any
KDC for requested realm)

But Kerberos ist working:

root at linsrv:/usr/local/samba# kinit administrator at DOMAIN.LOCAL
Password for administrator at DOMAIN.LOCAL:
Warning: Your password will expire in 980 days on Wed May 11 12:49:49 2016
root at linsrv:/usr/local/samba# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator at DOMAIN.LOCAL

Valid starting       Expires              Service principal
2013-09-04 11:08:51  2013-09-04 21:08:51  krbtgt/DOMAIN.LOCAL at DOMAIN.LOCAL
        renew until 2013-09-05 11:08:47, Etype (skey, tkt):
arcfour-hmac, arcfour-hmac

I have no idea how to fix it and would be very glad if someone may help.

root at linsrv:/usr/local/samba# samba --version
Version 4.0.9
root at linsrv:/usr/local/samba# cat /etc/debian_version
root at linsrv:/usr/local/samba# uname -a
Linux linsrv 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux

Best regards!

Thomas Zeitinger

IT-Quadrat   EDV Dienstleistungs- und Handels GmbH
Krongasse 8/2 A-1050 Wien
Tel: +43 (1) 311 44 00 - 10
Fax: +43 (1) 311 44 00 - 90
Thomas.Zeitinger at it2.at

FN 287345t
UID ATU63123113

More information about the samba mailing list