Bug 13066 - DNS update using BIND9_DLZ fail using MIT KRB5 with "Request is a replay"
Summary: DNS update using BIND9_DLZ fail using MIT KRB5 with "Request is a replay"
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DNS plugin (BIND DLZ) (show other bugs)
Version: 4.7.0
Hardware: All Linux
: P5 major (vote)
Target Milestone: ---
Assignee: Amitay Isaacs
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-02 00:23 UTC by Engel, Johannes
Modified: 2020-09-12 00:04 UTC (History)
3 users (show)

See Also:

Attachments
samba_dnsupdate log (2.34 KB, text/x-log)
2017-10-02 00:23 UTC, Engel, Johannes 		no flags Details
BIND 9.9.10 named log (3.61 KB, text/x-log)
2017-10-02 00:23 UTC, Engel, Johannes 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Engel, Johannes 2017-10-02 00:23:15 UTC 
Created attachment 13643 [details]
samba_dnsupdate log

Configuring Samba 4.7.0 as a DC with BIND9_DLZ (Bind 9.9.10) yields an error trying to run samba_dnsupdate.
samba_dnsupdate shows refused update (see attached log), named shows "Request is a replay" (see attached log).
Comment 1 Engel, Johannes 2017-10-02 00:23:45 UTC 
Created attachment 13644 [details]
BIND 9.9.10 named log
Comment 2 Dario Lesca 2017-12-24 17:48:19 UTC 
I have solved this problem with this work around:

# echo 'KRB5RCACHETYPE="none"' >> /etc/sysconfig/named
# systemctl restart named

Now the "# samba_dnsupdate --all-names --fail-immediately" and the dhcp client hostname update via script work fine and the "samba_dlz: spnego update failed" is gone

Thanks 

Dario
Comment 3 Andreas Schneider 2018-01-02 13:51:45 UTC 
The bind_dlz module should be removed. It opens too many bugs. We should try to use ldap to for dns updates. Maybe try to get

https://pagure.io/bind-dyndb-ldap

working.
Comment 4 Dario Lesca 2018-01-02 14:51:05 UTC 
Ok, no problem to use another zone resolver into bind, instead of BIND9_DLZ.

There is some how to configure bind-dyndb-ldap with samba AD-DC?

I'm sorry, but I'm  not a samba/ldap expert.

Please, provide some suggest.

Thanks
Dario