[Samba] samba4 internal dns Server ddns for the reverse lookup Zone

[Markus Roth]

Hi Steve,

update. I think nobody can say that i'm not creative :-) I've tried now
./samba-tool domain exportkeytab /etc/krb5.keytab without the --principal
and change my sssd.conf back to:

[sssd]
services = nss, pam
config_file_version = 2
domains = winnet.local
[nss]
[pam]
[domain/winnet.local]
id_provider = ad
access_provider = ad

Now i get also the denied messages, but the logs now seems to be different:

Aug 16 15:40:03 server1 named[14419]: samba_dlz: starting transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: allowing update of
signer=SERVER1\$\@WINNET.LOCAL name=server1.winnet.local
tcpaddr=192.168.178.130 type=A key=2171273687.sig-server1.winnet.local/160/0
Aug 16 15:40:03 server1 named[14419]: client 192.168.178.130#49475/key
SERVER1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': deleting rrset
at 'server1.winnet.local' A
Aug 16 15:40:03 server1 named[14419]: samba_dlz: subtracted rdataset
server1.winnet.local 'server1.winnet.local.	3600	IN	A
192.168.178.130'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: subtracted rdataset
winnet.local 'winnet.local.	3600	IN	SOA
server1.winnet.local. hostmaster.winnet.local. 4 900 600 86400 0'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: added rdataset winnet.local
'winnet.local.	3600	IN	SOA	server1.winnet.local.
hostmaster.winnet.local. 5 900 600 86400 0'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: committed transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: starting transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: allowing update of
signer=SERVER1\$\@WINNET.LOCAL name=server1.winnet.local
tcpaddr=192.168.178.130 type=AAAA
key=1458088344.sig-server1.winnet.local/160/0
Aug 16 15:40:03 server1 named[14419]: client 192.168.178.130#60843/key
SERVER1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': deleting rrset
at 'server1.winnet.local' AAAA
Aug 16 15:40:03 server1 named[14419]: samba_dlz: committed transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: starting transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: allowing update of
signer=SERVER1\$\@WINNET.LOCAL name=server1.winnet.local
tcpaddr=192.168.178.130 type=A key=2571247347.sig-server1.winnet.local/160/0
Aug 16 15:40:03 server1 named[14419]: client 192.168.178.130#60497/key
SERVER1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': adding an RR at
'server1.winnet.local' A
Aug 16 15:40:03 server1 named[14419]: samba_dlz: added rdataset
server1.winnet.local 'server1.winnet.local.	3600	IN	A
192.168.178.130'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: subtracted rdataset
winnet.local 'winnet.local.	3600	IN	SOA
server1.winnet.local. hostmaster.winnet.local. 5 900 600 86400 0'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: added rdataset winnet.local
'winnet.local.	3600	IN	SOA	server1.winnet.local.
hostmaster.winnet.local. 6 900 600 86400 0'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: committed transaction on
zone winnet.local
Aug 16 15:40:03 server1 named[14419]: samba_dlz: starting transaction on
zone 178.168.192.in-addr.arpa
Aug 16 15:40:03 server1 named[14419]: samba_dlz: allowing update of
signer=SERVER1\$\@WINNET.LOCAL name=130.178.168.192.in-addr.arpa
tcpaddr=192.168.178.130 type=PTR
key=1615781577.sig-server1.winnet.local/160/0
Aug 16 15:40:03 server1 named[14419]: samba_dlz: allowing update of
signer=SERVER1\$\@WINNET.LOCAL name=130.178.168.192.in-addr.arpa
tcpaddr=192.168.178.130 type=PTR
key=1615781577.sig-server1.winnet.local/160/0
Aug 16 15:40:03 server1 named[14419]: client 192.168.178.130#56401/key
SERVER1\$\@WINNET.LOCAL: updating zone '178.168.192.in-addr.arpa/NONE':
deleting rrset at '130.178.168.192.in-addr.arpa' PTR
Aug 16 15:40:03 server1 named[14419]: samba_dlz: subtracted rdataset
130.178.168.192.in-addr.arpa '130.178.168.192.in-addr.arpa.	3600	IN
PTR	server1.winnet.local.'
Aug 16 15:40:03 server1 named[14419]: client 192.168.178.130#56401/key
SERVER1\$\@WINNET.LOCAL: updating zone '178.168.192.in-addr.arpa/NONE':
adding an RR at '130.178.168.192.in-addr.arpa' PTR
Aug 16 15:40:03 server1 named[14419]: samba_dlz: added rdataset
130.178.168.192.in-addr.arpa '130.178.168.192.in-addr.arpa.	3600	IN
PTR	server1.winnet.local.'
Aug 16 15:40:03 server1 named[14419]: samba_dlz: committed transaction on
zone 178.168.192.in-addr.arpa
Aug 16 15:40:19 server1 chronyd[831]: NTP packet received from unauthorised
host 192.168.178.200 port 123
Aug 16 15:40:20 server1 named[14419]: samba_dlz: starting transaction on
zone winnet.local
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#53494: update
'winnet.local/IN' denied
Aug 16 15:40:20 server1 named[14419]: samba_dlz: cancelling transaction on
zone winnet.local
Aug 16 15:40:20 server1 named[14419]: samba_dlz: starting transaction on
zone winnet.local
Aug 16 15:40:20 server1 named[14419]: samba_dlz: allowing update of
signer=client1\$\@WINNET.LOCAL name=client1.winnet.local tcpaddr= type=AAAA
key=1084-ms-7.1-6f73.dd303850-254a-11e4-439a-000c29a4b410/160/0
Aug 16 15:40:20 server1 named[14419]: samba_dlz: allowing update of
signer=client1\$\@WINNET.LOCAL name=client1.winnet.local tcpaddr= type=A
key=1084-ms-7.1-6f73.dd303850-254a-11e4-439a-000c29a4b410/160/0
Aug 16 15:40:20 server1 named[14419]: samba_dlz: allowing update of
signer=client1\$\@WINNET.LOCAL name=client1.winnet.local tcpaddr= type=A
key=1084-ms-7.1-6f73.dd303850-254a-11e4-439a-000c29a4b410/160/0
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#59384/key
client1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': deleting rrset
at 'client1.winnet.local' AAAA
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#59384/key
client1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': deleting rrset
at 'client1.winnet.local' A
Aug 16 15:40:20 server1 named[14419]: samba_dlz: subtracted rdataset
client1.winnet.local 'client1.winnet.local.	1200	IN	A
192.168.178.200'
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#59384/key
client1\$\@WINNET.LOCAL: updating zone 'winnet.local/NONE': adding an RR at
'client1.winnet.local' A
Aug 16 15:40:20 server1 named[14419]: samba_dlz: added rdataset
client1.winnet.local 'client1.winnet.local.	1200	IN	A
192.168.178.200'
Aug 16 15:40:20 server1 named[14419]: samba_dlz: committed transaction on
zone winnet.local
Aug 16 15:40:20 server1 named[14419]: samba_dlz: starting transaction on
zone 178.168.192.in-addr.arpa
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#61402: update
'178.168.192.in-addr.arpa/IN' denied
Aug 16 15:40:20 server1 named[14419]: samba_dlz: cancelling transaction on
zone 178.168.192.in-addr.arpa
Aug 16 15:40:20 server1 named[14419]: samba_dlz: starting transaction on
zone 178.168.192.in-addr.arpa
Aug 16 15:40:20 server1 named[14419]: samba_dlz: allowing update of
signer=client1\$\@WINNET.LOCAL name=200.178.168.192.in-addr.arpa tcpaddr=
type=PTR key=1084-ms-7.1-6f73.dd303850-254a-11e4-439a-000c29a4b410/160/0
Aug 16 15:40:20 server1 named[14419]: samba_dlz: allowing update of
signer=client1\$\@WINNET.LOCAL name=200.178.168.192.in-addr.arpa tcpaddr=
type=PTR key=1084-ms-7.1-6f73.dd303850-254a-11e4-439a-000c29a4b410/160/0
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#54396/key
client1\$\@WINNET.LOCAL: updating zone '178.168.192.in-addr.arpa/NONE':
deleting rrset at '200.178.168.192.in-addr.arpa' PTR
Aug 16 15:40:20 server1 named[14419]: samba_dlz: subtracted rdataset
200.178.168.192.in-addr.arpa '200.178.168.192.in-addr.arpa.	1200	IN
PTR	client1.winnet.local.'
Aug 16 15:40:20 server1 named[14419]: client 192.168.178.200#54396/key
client1\$\@WINNET.LOCAL: updating zone '178.168.192.in-addr.arpa/NONE':
adding an RR at '200.178.168.192.in-addr.arpa' PTR
Aug 16 15:40:20 server1 named[14419]: samba_dlz: added rdataset
200.178.168.192.in-addr.arpa '200.178.168.192.in-addr.arpa.	1200	IN
PTR	client1.winnet.local.'
Aug 16 15:40:20 server1 named[14419]: samba_dlz: committed transaction on
zone 178.168.192.in-addr.arpa

-----Ursprüngliche Nachricht-----
Von: Markus Roth [mailto:markusroth1983 at gmx.net] 
Gesendet: Samstag, 16. August 2014 15:13
An: 'steve'
Cc: 'samba at lists.samba.org'
Betreff: AW: [Samba] samba4 internal dns Server ddns for the reverse lookup
Zone

Hi Steve,

I've tried the below domain exportkeytab, but when i do samba-tool domain
exportkeytab /etc/krb5.keytab --principal=WINNET$ the log says:

./samba-tool domain exportkeytab /etc/krb5.keytab --principal=WINNET$
ERROR(runtime): uncaught exception - Key table entry not found
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
    return self.run(*args, **kwargs)
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/domain.py",
line 103, in run
    net.export_keytab(keytab=keytab, principal=principal)

When i do the same with --principal=server1$ it does an export, but i get
also the beginning denied messages. I also tried winnet$ or winnet.local$
but it gets the same erros above.


>Hi
>This is not using the sssd ad backend at all. It will not do ddns updates,
neither will it pull the correct id info from AD.

>You were nearly there. Did you see my other post?

>Just issue:
>samba-tool domain exportkeytab /etc/krb5.keytab --principal=WINNET$ and try
with your original ad sssd config.

>--
>To unsubscribe from this list go to the following URL and read the
>Instructions:  https://lists.samba.org/mailman/options/samba