[Samba] samba_dnsupdate options: --use-samba-tool vs. --use-nsupdate, and dhcpd dynamic updates

Billy Bob billysbobs at yahoo.com
Thu Jan 10 19:09:01 UTC 2019


 PRIOR THREAD: https://lists.samba.org/archive/samba/2019-January/220292.html

In the  referenced prior thread, I had an issue of samba_dnsupdate --verbose --all-names causing a dns_tkey_gssnegotiate: TKEY is unacceptable error.

Ultimately, the solution kindly provided by Rowland was to insert dns update command = /usr/local/samba/sbin/samba_dnsupdate --use-samba-tool into the [global] section of the smb.conf file.

I am now having a similar issue with dhcpd dynamic updates, though. In addition to solving that problem, however, and at least suspecting some relationship between the two, I am first curious about the prior solution.

Why was it necessary to select the --use-samba-tool vs. --use-nsupdate option, and what is happening as a result of this selection? (I looked at the dns-update script, but promise that I am too dense to figure this all out in the time I have left to get these servers running -- yes, the secondary DC is right behind this mess.)

As to the current issue, I am attemting to configure DHCP to update DNS records with BIND9, as outlined in the Samba Wiki (with correction of a couple errors in the "on release" and "on expiry" sections of the example dhcpd.conf file).

As some background, the following script and configuration was working fine in the prior incarnation of the DC. In that version, however, the Kerberos enablement of the nambed.conf file wrongly included:

tkey-gssapi-keytab "/usr/local/samba/bind-dns/dns.keytab";

as opposed to:

tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";

This change precipitated the prior issue, and I would guess should be considered, in addition to the smb.conf change, in addressing the current issue.===================================
  CURRENT SMB.CONF
  /usr/local/samba/etc/smb.conf
===================================
[global]
        bind interfaces only = Yes
        interfaces = lo eno1
        netbios name = DC01
        realm = CORP.<DOMAIN>.COM
        server role = active directory domain controller
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
        workgroup = CORP
        idmap_ldb:use rfc2307 = yes
        dns update command = /usr/local/samba/sbin/samba_dnsupdate --use-samba-tool
[netlogon]
        path = /usr/local/samba/var/locks/sysvol/corp.<DOMAIN>.com/scripts
        read only = No
[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No

===================================
  CURRENT DHCPD.CONF
  /etc/dhcp/dhcpd.conf
===================================
authoritative;
ddns-update-style none;
option domain-name "corp.<DOMAIN>.com";
option domain-name-servers 172.20.10.130;
option ntp-servers 172.20.10.130;
option broadcast-address 172.20.10.255;
option routers 172.20.10.129;
option netbios-name-servers 172.20.10.130;
option time-offset 0;

subnet 172.20.10.128 netmask 255.255.255.128 {
  option subnet-mask 255.255.255.128;
  pool {
    range 172.20.10.165 172.20.10.229;
    default-lease-time 43200;
    max-lease-time 86400;
  }
}
on commit {
set noname = concat("dhcp-", binary-to-ascii(10, 8, "-", leased-address));
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
set ClientDHCID = binary-to-ascii(16, 8, ":", hardware);
set ClientName = pick-first-value(option host-name, config-option-host-name, client-name, noname);
log(concat("Commit: IP: ", ClientIP, " DHCID: ", ClientDHCID, " Name: ", ClientName));
execute("/usr/local/bin/dhcp-dyndns.sh", "add", ClientIP, ClientDHCID, ClientName);
}
on release {
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
set ClientDHCID = binary-to-ascii(16, 8, ":", hardware);
log(concat("Release: IP: ", ClientIP));
execute("/usr/local/bin/dhcp-dyndns.sh", "delete", ClientIP, ClientDHCID, "");
}
on expiry {
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
log(concat("Expired: IP: ", ClientIP));
execute("/usr/local/bin/dhcp-dyndns.sh", "delete", ClientIP, "0", "");
}
===================================
  CURRENT DHCP-DYNDNS.SH
  /usr/local/bin/dhcp-dyndns.sh
===================================
#!/bin/bash
# /usr/local/bin/dhcp-dyndns.sh
# Additional nsupdate flags (-g already applied), e.g. "-d" for debug
NSUPDFLAGS="-d"
# krbcc ticket cache
export KRB5CCNAME="/tmp/dhcp-dyndns.cc"
# Variables supplied by dhcpd.conf
action=$1
ip=$2
DHCID=$3
name=${4%%.*}
# Check for valid kerberos ticket

_KERBEROS () {

klist -c /tmp/dhcp-dyndns.cc -s
if [ "$?" != "0" ]; then
    kinit -F -k -t /etc/dhcpduser.keytab -c /tmp/dhcp-dyndns.cc "dhcpduser at CORP.<DOMAIN>.COM"
    if [ "$?" != "0" ]; then
        exit 1;
    fi
fi
}
# Exit if no ip address or mac-address
if [ -z "${ip}" ] || [ -z "${DHCID}" ]; then
    exit 1;
fi
# Exit if no computer name supplied, unless the action is 'delete'
if [ "${name}" = "" ]; then
    if [ "${action}" = "delete" ]; then
        name=$(host -t PTR "${ip}" | awk '{print $NF}' | awk -F '.' '{print $1}')
    else
        exit 1;
    fi
fi
# Set PTR address
ptr=$(echo ${ip} | awk -F '.' '{print $4"."$3"."$2"."$1".in-addr.arpa"}')
## nsupdate ##

case "${action}" in
add)
_KERBEROS
nsupdate -g ${NSUPDFLAGS} << UPDATE
server 127.0.0.1
realm CORP.<DOMAIN>.COM
update delete ${name}.corp.<DOMAIN>.com 3600 A
update add ${name}.corp.<DOMAIN>.com 3600 A ${ip}
send
UPDATE
nsupdate -g ${NSUPDFLAGS} << UPDATE
server 127.0.0.1
realm CORP.<DOMAIN>.COM
update delete ${ptr} 3600 PTR
update add ${ptr} 3600 PTR ${name}.corp.<DOMAIN>.com
send
UPDATE
;;
delete)
_KERBEROS
nsupdate -g ${NSUPDFLAGS} << UPDATE
server 127.0.0.1
realm CORP.<DOMAIN>.COM
update delete ${name}.corp.<DOMAIN>.com 3600 A
send
UPDATE
nsupdate -g ${NSUPDFLAGS} << UPDATE
server 127.0.0.1
realm CORP.<DOMAIN>.COM
update delete ${ptr} 3600 PTR
send
UPDATE
;;
*)

exit 1

;;
esac
exit 0
===================================
  THE DCHP DNS UPDATE USER
===================================
Create update user
  $ sudo samba-tool user create dhcpduser --description="Unprivileged user for TSIG-GSSAPI DNS updates via ISC DHCP server" --random-password
    User 'dhcpduser' created successfully
Set dhcpduser account to never expire:
  $ sudo samba-tool user setexpiry --noexpiry dhcpduser
    Expiry for user 'dhcpduser' disabled.
Add dhcpduser user to the DnsAdmins group
  $ sudo samba-tool group addmembers DnsAdmins dhcpduser
    Added members to group DnsAdmins
Export the required keytab
  Determine dhcpd user and group
    $ ps aux | grep dhcpd
      USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
      dhcpd     1280  0.0  0.0  45148 15612 ?        Ss   16:16   0:00 dhcpd -user dhcpd -group dhcpd -f -4 -pf /run/dhcp-server/dhcpd.pid -cf /etc/dhcp/dhcpd.conf
  Export keytab
    $ sudo samba-tool domain exportkeytab --principal=dhcpduser at CORP.<DOMAIN>.COM /etc/dhcpduser.keytab
      Export one principal to /etc/dhcpduser.keytab
  Set permissions
    $ sudo chown dhcpd:dhcpd  /etc/dhcpduser.keytab
    $ sudo chmod 400 /etc/dhcpduser.keytab    $ sudo ls -la /etc/dhcpduser.keytab      -r-------- 1 dhcpd dhcpd 347 Jan  9 16:20 /etc/dhcpduser.keytab
===================================
  ERRORS
===================================
Jan 10 12:41:45 dc01 dhcpd[5099]: Commit: IP: 172.20.10.165 DHCID: 1:d4:be:d9:22:9f:7d Name: mgmt01
Jan 10 12:41:45 dc01 dhcpd[5099]: execute_statement argv[0] = /usr/local/bin/dhcp-dyndns.sh
Jan 10 12:41:45 dc01 dhcpd[5099]: execute_statement argv[1] = add
Jan 10 12:41:45 dc01 dhcpd[5099]: execute_statement argv[2] = 172.20.10.165
Jan 10 12:41:45 dc01 dhcpd[5099]: execute_statement argv[3] = 1:d4:be:d9:22:9f:7d
Jan 10 12:41:45 dc01 dhcpd[5099]: execute_statement argv[4] = mgmt01
Jan 10 12:41:45 dc01 sh[5099]: Reply from SOA query:
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:  14904
Jan 10 12:41:45 dc01 sh[5099]: ;; flags: qr aa ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;mgmt01.corp.<DOMAIN>.com.                IN        SOA
Jan 10 12:41:45 dc01 sh[5099]: ;; AUTHORITY SECTION:
Jan 10 12:41:45 dc01 sh[5099]: corp.<DOMAIN>.com.                0        IN        SOA        dc01.corp.<DOMAIN>.com. hostmaster.corp.<DOMAIN>.com. 38 900 600 86400 3600
Jan 10 12:41:45 dc01 sh[5099]: Found zone name: corp.<DOMAIN>.com
Jan 10 12:41:45 dc01 sh[5099]: The master is: dc01.corp.<DOMAIN>.com
Jan 10 12:41:45 dc01 sh[5099]: start_gssrequest
Jan 10 12:41:45 dc01 sh[5099]: send_gssrequest
Jan 10 12:41:45 dc01 sh[5099]: Outgoing update query:
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  37508
Jan 10 12:41:45 dc01 sh[5099]: ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;2880862545.sig-dc01.corp.<DOMAIN>.com. ANY        TKEY
Jan 10 12:41:45 dc01 sh[5099]: ;; ADDITIONAL SECTION:
Jan 10 12:41:45 dc01 sh[5099]: 2880862545.sig-dc01.corp.<DOMAIN>.com. 0 ANY TKEY        gss-tsig. 1547145705 1547145705 3 NOERROR 1397 YIIFcQYGKwYBBQUCoIIFZTCCBWGgDTALBgkqhkiG9xIBAgKiggVOBIIF SmCCBUYGCSqGSIb3EgECAgEAboIFNTCCBTGgAwIBBaEDAgEOo
Jan 10 12:41:45 dc01 sh[5099]: recvmsg reply from GSS-TSIG query
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  37508
Jan 10 12:41:45 dc01 sh[5099]: ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;2880862545.sig-dc01.corp.<DOMAIN>.com. ANY        TKEY
Jan 10 12:41:45 dc01 sh[5099]: ;; ANSWER SECTION:
Jan 10 12:41:45 dc01 sh[5099]: 2880862545.sig-dc01.corp.<DOMAIN>.com. 0 ANY TKEY        gss-tsig. 0 0 3 BADKEY 0  0
Jan 10 12:41:45 dc01 sh[5099]: dns_tkey_gssnegotiate: TKEY is unacceptable
Jan 10 12:41:45 dc01 sh[5099]: Reply from SOA query:
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:  48142
Jan 10 12:41:45 dc01 sh[5099]: ;; flags: qr aa ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;165.10.20.172.in-addr.arpa.        IN        SOA
Jan 10 12:41:45 dc01 sh[5099]: ;; AUTHORITY SECTION:
Jan 10 12:41:45 dc01 sh[5099]: 10.20.172.in-addr.arpa.        0        IN        SOA        dc01.corp.<DOMAIN>.com. hostmaster.corp.<DOMAIN>.com. 2 900 600 86400 3600
Jan 10 12:41:45 dc01 sh[5099]: Found zone name: 10.20.172.in-addr.arpa
Jan 10 12:41:45 dc01 sh[5099]: The master is: dc01.corp.<DOMAIN>.com
Jan 10 12:41:45 dc01 sh[5099]: start_gssrequest
Jan 10 12:41:45 dc01 sh[5099]: send_gssrequest
Jan 10 12:41:45 dc01 sh[5099]: Outgoing update query:
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  39103
Jan 10 12:41:45 dc01 sh[5099]: ;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;3162717331.sig-dc01.corp.<DOMAIN>.com. ANY        TKEY
Jan 10 12:41:45 dc01 sh[5099]: ;; ADDITIONAL SECTION:
Jan 10 12:41:45 dc01 sh[5099]: 3162717331.sig-dc01.corp.<DOMAIN>.com. 0 ANY TKEY        gss-tsig. 1547145705 1547145705 3 NOERROR 1397 YIIFcQYGKwYBBQUCoIIFZTCCBWGgDTALBgkqhkiG9xIBAgKiggVOBIIF SmCCBUYGCSqGSIb3EgECAgEAboIFNTCCBTGgAwIBBaEDAgEOo
Jan 10 12:41:45 dc01 sh[5099]: recvmsg reply from GSS-TSIG query
Jan 10 12:41:45 dc01 sh[5099]: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:  39103
Jan 10 12:41:45 dc01 sh[5099]: ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
Jan 10 12:41:45 dc01 sh[5099]: ;; QUESTION SECTION:
Jan 10 12:41:45 dc01 sh[5099]: ;3162717331.sig-dc01.corp.<DOMAIN>.com. ANY        TKEY
Jan 10 12:41:45 dc01 sh[5099]: ;; ANSWER SECTION:
Jan 10 12:41:45 dc01 sh[5099]: 3162717331.sig-dc01.corp.<DOMAIN>.com. 0 ANY TKEY        gss-tsig. 0 0 3 BADKEY 0  0
Jan 10 12:41:45 dc01 sh[5099]: dns_tkey_gssnegotiate: TKEY is unacceptable
Jan 10 12:41:45 dc01 dhcpd[5099]: DHCPREQUEST for 172.20.10.165 from d4:be:d9:22:9f:7d via eno1
Jan 10 12:41:45 dc01 dhcpd[5099]: DHCPACK on 172.20.10.165 to d4:be:d9:22:9f:7d (mgmt01) via eno1



More information about the samba mailing list