[Samba] Upgrading BIND DNS Backend

Anantha Raghava raghav at exzatechconsulting.com
Thu May 11 15:28:43 UTC 2017


Hi,

After upgrading to BIND9_DLZ, BIND service is properly starting. 
However, DNS updates are failing. When I try to force the DNS update, I 
get the following error.

Even kinit command returns "kinit: Cannot find KDC for realm 
"EXZA.LOCAL" while getting initial credentials"

---------------------------------------

[root at dc ~]# samba_dnsupdate --verbose --all-names
IPs: ['192.168.100.17']
force update: A dc.exza.local 192.168.100.17
force update: NS exza.local dc.exza.local
force update: NS _msdcs.exza.local dc.exza.local
force update: A exza.local 192.168.100.17
force update: SRV _ldap._tcp.exza.local dc.exza.local 389
force update: SRV _ldap._tcp.dc._msdcs.exza.local dc.exza.local 389
force update: SRV 
_ldap._tcp.af5a4fc4-5880-4fd3-a904-e023bc3d2a53.domains._msdcs.exza.local 
dc.exza.local 389
force update: SRV _kerberos._tcp.exza.local dc.exza.local 88
force update: SRV _kerberos._udp.exza.local dc.exza.local 88
force update: SRV _kerberos._tcp.dc._msdcs.exza.local dc.exza.local 88
force update: SRV _kpasswd._tcp.exza.local dc.exza.local 464
force update: SRV _kpasswd._udp.exza.local dc.exza.local 464
force update: CNAME 
cfbc189a-c9a4-4f48-8bce-7f7fb52634b9._msdcs.exza.local dc.exza.local
force update: SRV _ldap._tcp.Default-First-Site-Name._sites.exza.local 
dc.exza.local 389
force update: SRV 
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.exza.local 
dc.exza.local 389
force update: SRV 
_kerberos._tcp.Default-First-Site-Name._sites.exza.local dc.exza.local 88
force update: SRV 
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.exza.local 
dc.exza.local 88
force update: SRV _ldap._tcp.pdc._msdcs.exza.local dc.exza.local 389
force update: A gc._msdcs.exza.local 192.168.100.17
force update: SRV _gc._tcp.exza.local dc.exza.local 3268
force update: SRV _ldap._tcp.gc._msdcs.exza.local dc.exza.local 3268
force update: SRV _gc._tcp.Default-First-Site-Name._sites.exza.local 
dc.exza.local 3268
force update: SRV 
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.exza.local 
dc.exza.local 3268
force update: A DomainDnsZones.exza.local 192.168.100.17
force update: SRV _ldap._tcp.DomainDnsZones.exza.local dc.exza.local 389
force update: SRV 
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.exza.local 
dc.exza.local 389
force update: A ForestDnsZones.exza.local 192.168.100.17
force update: SRV _ldap._tcp.ForestDnsZones.exza.local dc.exza.local 389
force update: SRV 
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.exza.local 
dc.exza.local 389
29 DNS updates and 0 DNS deletes needed
Failed to get Kerberos credentials, falling back to samba-tool: kinit 
for DC$@EXZA.LOCAL failed (Cannot contact any KDC for requested realm)

update (samba-tool): A dc.exza.local 192.168.100.17
Calling samba-tool dns for A dc.exza.local 192.168.100.17 (add)
Calling samba-tool dns add -k no -P ['192.168.100.17', 'exza.local', 
'dc', 'A', '192.168.100.17']
ERROR(runtime): uncaught exception - (9711, 
'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS')
   File 
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py", 
line 176, in _run
     return self.run(*args, **kwargs)
   File 
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/dns.py", 
line 1098, in run
     raise e
Failed 'samba-tool dns' based update: A dc.exza.local 192.168.100.17 : 
local variable 'estr' referenced before assignment
Traceback (most recent call last):
   File "/usr/local/samba/sbin/samba_dnsupdate", line 835, in <module>
     call_samba_tool(d, zone=d.zone)
   File "/usr/local/samba/sbin/samba_dnsupdate", line 564, in 
call_samba_tool
     print("Failed 'samba-tool dns' based update: %s : %s" % (str(d), estr))
UnboundLocalError: local variable 'estr' referenced before assignment

-------------------------------

How to fix this issue?

-- 

Thanks & Regards,


Anantha Raghava


DISCLAIMER:

This e-mail communication and any attachments may be privileged and 
confidential to eXza Technology Consulting & Services, and are intended 
only for the use of the recipients named above If you are not the 
addressee you may not copy, forward, disclose or use any part of it. If 
you have received this message in error, please delete it and all copies 
from your system and notify the sender immediately by return e-mail. 
Internet communications cannot be guaranteed to be timely, secure, error 
or virus-free. The sender does not accept liability for any errors or 
omissions.


Do not print this e-mail unless required. Save Paper & trees.

On Thursday 11 May 2017 08:35 PM, Anantha Raghava wrote:
>
> Hi,
>
> Problem solved. It was related to SELINUX.
>
> The moment it is disabled, BIND service started properly.
>
> -- 
>
> Thanks & Regards,
>
>
> Anantha Raghava
>
>
> DISCLAIMER:
> This e-mail communication and any attachments may be privileged and 
> confidential to eXza Technology Consulting & Services, and are 
> intended only for the use of the recipients named above If you are not 
> the addressee you may not copy, forward, disclose or use any part of 
> it. If you have received this message in error, please delete it and 
> all copies from your system and notify the sender immediately by 
> return e-mail. Internet communications cannot be guaranteed to be 
> timely, secure, error or virus-free. The sender does not accept 
> liability for any errors or omissions.
>
>
> Do not print this e-mail unless required. Save Paper & trees.
>
> On Thursday 11 May 2017 08:10 PM, Anantha Raghava wrote:
>>
>> Hi,
>>
>> I am trying to upgrade frm INTERNAL DNS to BIND_DLZ.
>>
>> I followed the procedure given in 
>> https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_AD_DC 
>> and https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End.
>>
>> When I start the BIND Service, it fails with an error. In journalctl 
>> -xe we come to know that named service is unbale to open 
>> dlz_bind9_9.so file.
>>
>> Full error message is as below.
>>
>> --------------------------------------------------
>>
>> [root at dc private]# systemctl start named
>> Job for named.service failed because the control process exited with 
>> error code. See "systemctl status named.service" and "journalctl -xe" 
>> for details.
>> [root at dc private]# journalctl -xe
>> May 11 20:03:41 dc.exza.local named[2506]: 
>> ----------------------------------------------------
>> May 11 20:03:41 dc.exza.local named[2506]: adjusted limit on open 
>> files from 4096 to 1048576
>> May 11 20:03:41 dc.exza.local named[2506]: found 2 CPUs, using 2 
>> worker threads
>> May 11 20:03:41 dc.exza.local named[2506]: using 2 UDP listeners per 
>> interface
>> May 11 20:03:41 dc.exza.local named[2506]: using up to 4096 sockets
>> May 11 20:03:41 dc.exza.local named[2506]: loading configuration from 
>> '/etc/named.conf'
>> May 11 20:03:41 dc.exza.local named[2506]: reading built-in trusted 
>> keys from file '/etc/named.iscdlv.key'
>> May 11 20:03:41 dc.exza.local named[2506]: initializing GeoIP Country 
>> (IPv4) (type 1) DB
>> May 11 20:03:41 dc.exza.local named[2506]: GEO-106FREE 20160607 Build 
>> 1 Copyright (c) 2016 MaxMind
>> May 11 20:03:41 dc.exza.local named[2506]: initializing GeoIP Country 
>> (IPv6) (type 12) DB
>> May 11 20:03:41 dc.exza.local named[2506]: GEO-106FREE 20160607 Build 
>> 1 Copy
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv4) (type 2) 
>> DB not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv4) (type 6) 
>> DB not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv6) (type 
>> 30) DB not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv6) (type 
>> 31) DB not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP Region (type 3) DB 
>> not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP Region (type 7) DB 
>> not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP ISP (type 4) DB not 
>> available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP Org (type 5) DB not 
>> available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP AS (type 9) DB not 
>> available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP Domain (type 11) DB 
>> not available
>> May 11 20:03:41 dc.exza.local named[2506]: GeoIP NetSpeed (type 10) 
>> DB not available
>> May 11 20:03:41 dc.exza.local named[2506]: using default UDP/IPv4 
>> port range: [1024, 65535]
>> May 11 20:03:41 dc.exza.local named[2506]: using default UDP/IPv6 
>> port range: [1024, 65535]
>> May 11 20:03:41 dc.exza.local named[2506]: listening on IPv4 
>> interface lo, 127.0.0.1#53
>> May 11 20:03:41 dc.exza.local named[2506]: listening on IPv6 
>> interface lo, ::1#53
>> May 11 20:03:41 dc.exza.local named[2506]: generating session key for 
>> dynamic DNS
>> May 11 20:03:41 dc.exza.local named[2506]: sizing zone task pool 
>> based on 6 zones
>> May 11 20:03:41 dc.exza.local named[2506]: Loading 'AD DNS Zone' 
>> using driver dlopen
>> May 11 20:03:41 dc.exza.local named[2506]: dlz_dlopen failed to open 
>> library '/usr/local/samba/lib/bind9/dlz_bind9_9.so' - 
>> /usr/local/samba/lib/bind9/dlz_bind9_9.so: fail
>> May 11 20:03:41 dc.exza.local named[2506]: dlz_dlopen of 'AD DNS 
>> Zone' failed
>> May 11 20:03:41 dc.exza.local kernel: named[2508]: segfault at a8 ip 
>> 00007f1d03a7d1d9 sp 00007f1cfee7b320 error 4 in named[7f1d03a0e000+87000]
>> May 11 20:03:41 dc.exza.local systemd[1]: named.service: control 
>> process exited, code=exited status=1
>> May 11 20:03:41 dc.exza.local systemd[1]: Failed to start Berkeley 
>> Internet Name Domain (DNS).
>> -- Subject: Unit named.service has failed
>> -- Defined-By: systemd
>> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
>> -- 
>> -- Unit named.service has failed.
>> -- 
>> -- The result is failed.
>> -----------------------------------------------
>>
>> Any suggestions to start BIND9_DLZ properly?
>>
>> -- 
>>
>> Thanks & Regards,
>>
>>
>> Anantha Raghava
>>
>>
>> DISCLAIMER:
>> This e-mail communication and any attachments may be privileged and 
>> confidential to eXza Technology Consulting & Services, and are 
>> intended only for the use of the recipients named above If you are 
>> not the addressee you may not copy, forward, disclose or use any part 
>> of it. If you have received this message in error, please delete it 
>> and all copies from your system and notify the sender immediately by 
>> return e-mail. Internet communications cannot be guaranteed to be 
>> timely, secure, error or virus-free. The sender does not accept 
>> liability for any errors or omissions.
>>
>>
>> Do not print this e-mail unless required. Save Paper & trees.
>>
>



More information about the samba mailing list