[Samba] dhcp errors - Re: dhcp example

Robert Moskowitz rgm at htt-consult.com
Thu Sep 3 23:47:22 UTC 2015


First I am having a couple challenges with your script here:

On 09/03/2015 02:43 PM, Rowland Penny wrote:
>
> I thought that might be your next question, I wrote it, based on what 
> I found here:
>
> http://blog.michael.kuron-germany.de/2011/02/isc-dhcpd-dynamic-dns-updates-against-secure-microsoft-dns/ 
>
>
> #!/bin/bash
>
> # /usr/local/sbin/dhcp-dyndns.sh
> # This script is for secure DDNS updates using GSS/TSIG on Samba 4
> # Version: 0.8.3 (includes TXTRR records)
> # Updated with suggestions from L. v. Belle   louis at van-belle.nl
> # method to check for valid kerberos ticket changed
>
> LOG="/var/log/dyndns.log"

> if [ -f /var/log/dyndns.log ]; then
>     :
> else
>     touch /var/log/dyndns.log
> fi

Of course this file did not exist, and the 'touch' command failed on 
permissions.

I assume dhcpd is running this script as user dhcpd, group dhcpd, so I 
don't see how it can create the file.  I have to create it and set the 
owner to root:dhcpd


>
> exec >> $LOG 2>&1

Then this line fails and soforth.

>
> ## CONFIGURATION ##
>
> # Samba 4 realm, change this to YOUR realm.
> SETREALM=EXAMPLE.COM
> ## define the dhcp user that will be used for the Dynamic updates to 
> samba4
> ## this will create a Principal like : user at realm
> SETDHCPUSER=dhcpduser
> # DNS domain, change this to YOUR dns domain
> domain=example.com
> # TXT RRs (rfc4701)
> # Set to YES to use TXT RRs
> TXTRRS="NO"
> # Additional nsupdate flags (-g already applied), e.g. "-d" for debug
> #NSUPDFLAGS="-d"
> # DNS nameserver
> ns=127.0.0.1
> #
> ## Do not change anything below here
> # Kerberos principal
> SETPRINCIPAL=$SETDHCPUSER@$SETREALM
> # Kerberos keytab
> SETDHCPKEYTAB=/etc/$SETDHCPUSER.keytab
> # Default DNS resource records TTL
> RRTTL="3600"
>
> # krbcc ticket cache
> export KRB5CCNAME="/tmp/dhcp-dyndns.cc"
>
> ## Command locations, with full paths it speeds up processing.
> ## ( tested on Ubuntu 14.04, Debian 7.5 )
> CMDSORT="$(which sort)"
> CMDAWK="$(which awk)"
> CMDHEAD="$(which head)"
> CMDECHO="$(which echo)"
> CMDDATE="$(which date)"
> CMDKINIT="$(which kinit)"
> CMDKLIST="$(which klist)"
> CMDGREP="$(which grep)"
> CMDGETENT="$(which getent)"
> CMDSAMBATOOL="$(which samba-tool)"
> CMDCHOWN="$(which chown)"
> CMDCHMOD="$(which chmod)"
> CMDHOST="$(which host)"
> CMDNSUPDATE="$(which nsupdate)"
>
> TESTUSER=$(${CMDGETENT} passwd | ${CMDGREP} "${SETDHCPUSER}")

Sep  3 19:27:08 homebase dhcpd: /usr/local/sbin/dhcp-dyndns.sh: line 64: 
dhcpduser: command not found
Sep  3 19:27:09 homebase dhcpd: (current) UNIX password: passwd: 
Authentication token manipulation error
Sep  3 19:27:09 homebase dhcpd: No dhcp user exists, need to create it 
first.. exiting.
Sep  3 19:27:09 homebase dhcpd: you can do this by typing the following 
commands
Sep  3 19:27:09 homebase dhcpd: Administrator at EXAMPLE.COM
Sep  3 19:27:09 homebase dhcpd: user create dhcpduser 
--description="Unprivileged user for DNS updates via ISC DHCP server"
Sep  3 19:27:09 homebase dhcpd: user setexpiry dhcpduser --noexpiry
Sep  3 19:27:09 homebase dhcpd: group addmembers DnsAdmins dhcpduser
Sep  3 19:27:09 homebase dhcpd: execute: /usr/local/sbin/dhcp-dyndns.sh 
exit status 256

Is this what I need to do.  That is create the dhcpduser?  There is no 
'user' command.  Is this 'adduser'?

> if [ -z "${TESTUSER}" ]; then
>     echo "No dhcp user exists, need to create it first.. exiting."
>     echo "you can do this by typing the following commands"
>     echo "${CMDKINIT} Administrator@${SETREALM}"
>     echo "${CMDSAMBATOOL} user create ${SETDHCPUSER} 
> --description=\"Unprivileged user for DNS updates via ISC DHCP server\""
>     echo "${CMDSAMBATOOL} user setexpiry ${SETDHCPUSER} --noexpiry"
>     echo "${CMDSAMBATOOL} group addmembers DnsAdmins ${SETDHCPUSER}"
>     exit 1
> fi
>
> # Check for Kerberos keytab
> if [ -f "${SETDHCPKEYTAB}" ]; then
>     :
> else
>     echo "Required keytab ${SETDHCPKEYTAB} not found, it needs to be 
> created."
>     echo "Use the following commands as root"
>     echo "${CMDSAMBATOOL} domain exportkeytab 
> --principal=${SETPRINCIPAL} ${SETDHCPKEYTAB}"
>     testos=$(uname -a | grep 'Debian')
>     if [ -z "$testos" ]; then
>         echo "${CMDCHOWN} dhcpd:dhcpd ${SETDHCPKEYTAB}"
>         echo "${CMDCHMOD} 400 ${SETDHCPKEYTAB}"
>     fi
>     exit 1
> fi
>
> ## VARIABLES ##
>
> # Variables supplied by dhcpd.conf
> action=$1
> ip=$2
> DHCID=$3
> name=${4%%.*}
>
> usage()
> {
> echo "USAGE:"
> echo "  `basename $0` add ip-address dhcid|mac-address hostname"
> echo "  `basename $0` delete ip-address dhcid|mac-address"
> }
>
> _KERBEROS () {
> # get current time as a number
> test=$(${CMDDATE} +%d'-'%m'-'%y' '%H':'%M':'%S)
>
> # Check for valid kerberos ticket
> echo "$test [dyndns] : Running check for valid kerberos ticket"
> klist -c "$KRB5CCNAME" -s
> if [ "$?" != "0" ]; then
>     echo "$test [dyndns] : Getting new ticket, old one has expired"
>     kinit -F -k -t "${SETDHCPKEYTAB}" -c "$KRB5CCNAME" "${SETPRINCIPAL}"
>     if [ "$?" != "0" ]; then
>         echo "$test [dyndns] : dhcpd kinit for dynamic DNS failed"
>         exit 1;
>     fi
> else
>     echo "$test [dyndns] : New ticket not required, old one still valid"
> fi
>
> }
>
> # Exit if no ip address or mac-address
> if [ -z "$ip" ] || [ -z "$DHCID" ]; then
>     usage
>     exit 1
> fi
>
> # Exit if no computer name supplied, unless the action is 'delete'
> if [ "$name" = "" ]; then
>     if [ "$action" = "delete" ]; then
>         name=$(${CMDHOST} -t PTR "$ip" | ${CMDAWK} '{print $NF}' | 
> ${CMDAWK} -F '.' '{print $1}')
>     else
>         usage
>         exit 1;
>     fi
> fi
>
> # Set PTR address
> ptr=$(${CMDECHO} $ip | ${CMDAWK} -F '.' '{print 
> $4"."$3"."$2"."$1".in-addr.arpa"}')
>
> # Create RRTXT record
> RRTXT=$(${CMDECHO} "$DHCID$name.$domain" | sha256sum)
> RRTXT="000101${RRTXT%% *}"
> # extract txt record, if there is one
> RRTXTOLD=$(${CMDHOST} -t txt "$name.$domain" | sed -n '/descriptive 
> text/s/^.*[[:space:]]descriptive text[[:space:]]*"\(.*\)"$/\1/p')
>
> ## ${CMDNSUPDATE} ##
>
> case "$action" in
> add)
>     if [ "$TXTRRS" = "YES" ]; then
>         TXTRRS=""
>         # if string is not null
>         if [ -n "$RRTXTOLD" ]; then
>             # if old RRTXT is not the same as $RRTXT then exit
>             if [ "$RRTXT" != "$RRTXTOLD" ]; then
>                 echo "DHCP-DNS: adding records for $ip ($name.$domain) 
> FAILED: has A record but DHCID is wrong"
>                 exit 1
>             fi
>         fi
>     else
>         TXTRRS=";"
>     fi
>
>     _KERBEROS
>
> ${CMDNSUPDATE} -g $NSUPDFLAGS << UPDATE
> server $ns
> realm ${SETREALM}
> update delete $name.$domain $RRTTL A
> ${TXTRRS}update delete $name.$domain $RRTTL TXT
> ${TXTRRS}update add $name.$domain $RRTTL TXT $RRTXT
> update add $name.$domain $RRTTL A $ip
> send
> UPDATE
> result1=$?
>
> ${CMDNSUPDATE} -g $NSUPDFLAGS << UPDATE
> server $ns
> realm ${SETREALM}
> zone 0.168.192.in-addr.arpa
> update delete $ptr $RRTTL PTR
> update add $ptr $RRTTL PTR $name.$domain
> send
> UPDATE
> result2=$?
> ;;
> delete)
>      if [ "$TXTRRS" = "YES" ]; then
>         TXTRRS=""
>         if [ -n "$RRTXTOLD" ]; then
>             if [ "$RRTXT" != "$RRTXTOLD" ]; then
>                 echo "DHCP-DNS: removing records for $ip 
> ($name.$domain) FAILED: has A record but DHCID is wrong"
>                 exit 1
>             fi
>         else
>             TXTRRS=";"
>         fi
>      else
>        TXTRRS=";"
>      fi
>
>      _KERBEROS
>
> ${CMDNSUPDATE} -g $NSUPDFLAGS << UPDATE
> server $ns
> realm ${SETREALM}
> update delete $name.$domain $RRTTL A
> ${TXTRRS}update delete $name.$domain $RRTTL TXT
> send
> UPDATE
> result1=$?
> ${CMDNSUPDATE} -g $NSUPDFLAGS << UPDATE
> server $ns
> realm ${SETREALM}
> update delete $ptr $RRTTL PTR
> send
> UPDATE
> result2=$?
> ;;
> *)
> echo "Invalid action specified"
> exit 103
> ;;
> esac
>
> result="$result1$result2"
>
> if [ "$result" != "00" ]; then
>     echo "DHCP-DNS Update failed: $result"
>     logger "DHCP-DNS Update failed: $result"
> else
>    echo "DHCP-DNS Update succeeded"
>    logger "DHCP-DNS Update succeeded"
> fi
>
> exit $result

Sep  3 19:27:09 homebase dhcpd: DHCPREQUEST for 192.168.192.21 
(192.168.192.2) from 02:97:09:02:23:a2 (cubieboard2) via eth0
Sep  3 19:27:09 homebase dhcpd: DHCPACK on 192.168.192.21 to 
02:97:09:02:23:a2 (cubieboard2) via eth0
Sep  3 19:27:12 homebase named[22720]: client 192.168.192.21#36919 
(0.centos.pool.ntp.org): query (cache) '0.centos.pool.ntp.org/A/IN' denied

Oops, Looks like I have acl problems in named.  That I know how to fix...





More information about the samba mailing list