[Samba] Bind9 doesn't updated - TSIG error with server: tsig verify failure

[Rowland penny]

On 07/08/2019 23:17, Igor Sousa via samba wrote:
> Hello everybody,
>
> I've had a samba environment with the following "brief" description:
>
>     - There are 2 DC (*samba4 *and *samba4bkp*) running samba version 4.1.6
Ouch, using seriously old and EOL Samba versions is not a good idea. I 
would suggest you upgrade at regular intervals.
>     on my domain (*SMB*). DNS back end is Samba Internal DNS;
>     - I've added a new DC (*king*) running samba version 4.10.2 and  as DC
>     to *SMB *domain with BIND9 DNS Back End;
>     - *king* has updated dns zones and I've checked it;
>     - *king *has got resolve *SMB* domain names;
>     - *samba4bkp* has broken and I've lost its disks. Then I've followed
>     steps described on
>     https://blogs.technet.microsoft.com/canitpro/2016/02/17/step-by-step-removing-a-domain-controller-server-manually/
> to
>     remove *samba4bkp* manually.
What a lot of work you didn't need to do, 'samba-tool domain demote 
--remove-other-dead-server=samba4bkp' would have done it for you ;-)
>
> After remove *samba4bkp, *I've checked *samba4* dns zones and they are ok,
> but *king *still has maintained *samba4bkp* registers. Then I've tried to
> update dns entries running *samba_dnsupdate --verbose --all-names* and it
> has returned that all 28 entries failed to updated, as shown below.
>
> I've searched about similar error "; TSIG error with server: tsig verify
> failure", but I've been unsuccessful.
>
> Regards!
> --
> Igor Sousa
>
>
>
> ; TSIG error with server: tsig verify failure
> Failed nsupdate: 2
> update(nsupdate): NS smb king.smb
> Calling nsupdate for NS smb king.smb (add)
> Successfully obtained Kerberos ticket to DNS/samba4.smb as KING$
> Outgoing update query:
> ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0
> ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
> ;; UPDATE SECTION:
> smb. 900 IN NS king.smb.
>
Is 'king' using itself for its nameserver ?

It looks like it isn't: 'Successfully obtained Kerberos ticket to 
DNS/samba4.smb as KING$'

Rowland