Bug 13066 - DNS update using BIND9_DLZ fail using MIT KRB5 with "Request is a replay"
DNS update using BIND9_DLZ fail using MIT KRB5 with "Request is a replay"
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DNS server
4.7.0
All Linux
: P5 major
: ---
Assigned To: Kai Blin
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-10-02 00:23 UTC by Engel, Johannes
Modified: 2018-01-02 14:51 UTC (History)
3 users (show)

See Also:


Attachments
samba_dnsupdate log (2.34 KB, text/x-log)
2017-10-02 00:23 UTC, Engel, Johannes
no flags Details
BIND 9.9.10 named log (3.61 KB, text/x-log)
2017-10-02 00:23 UTC, Engel, Johannes
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Engel, Johannes 2017-10-02 00:23:15 UTC
Created attachment 13643 [details]
samba_dnsupdate log

Configuring Samba 4.7.0 as a DC with BIND9_DLZ (Bind 9.9.10) yields an error trying to run samba_dnsupdate.
samba_dnsupdate shows refused update (see attached log), named shows "Request is a replay" (see attached log).
Comment 1 Engel, Johannes 2017-10-02 00:23:45 UTC
Created attachment 13644 [details]
BIND 9.9.10 named log
Comment 2 Dario Lesca 2017-12-24 17:48:19 UTC
I have solved this problem with this work around:

# echo 'KRB5RCACHETYPE="none"' >> /etc/sysconfig/named
# systemctl restart named

Now the "# samba_dnsupdate --all-names --fail-immediately" and the dhcp client hostname update via script work fine and the "samba_dlz: spnego update failed" is gone

Thanks 

Dario
Comment 3 Andreas Schneider 2018-01-02 13:51:45 UTC
The bind_dlz module should be removed. It opens too many bugs. We should try to use ldap to for dns updates. Maybe try to get

https://pagure.io/bind-dyndb-ldap

working.
Comment 4 Dario Lesca 2018-01-02 14:51:05 UTC
Ok, no problem to use another zone resolver into bind, instead of BIND9_DLZ.

There is some how to configure bind-dyndb-ldap with samba AD-DC?

I'm sorry, but I'm  not a samba/ldap expert.

Please, provide some suggest.

Thanks
Dario