Web lists-archives.com

Re: [Samba] Upgrading BIND DNS Backend




Hi,

After upgrading to BIND9_DLZ, BIND service is properly starting. However, DNS updates are failing. When I try to force the DNS update, I get the following error.

Even kinit command returns "kinit: Cannot find KDC for realm "EXZA.LOCAL" while getting initial credentials"

---------------------------------------

[root@dc ~]# samba_dnsupdate --verbose --all-names
IPs: ['192.168.100.17']
force update: A dc.exza.local 192.168.100.17
force update: NS exza.local dc.exza.local
force update: NS _msdcs.exza.local dc.exza.local
force update: A exza.local 192.168.100.17
force update: SRV _ldap._tcp.exza.local dc.exza.local 389
force update: SRV _ldap._tcp.dc._msdcs.exza.local dc.exza.local 389
force update: SRV _ldap._tcp.af5a4fc4-5880-4fd3-a904-e023bc3d2a53.domains._msdcs.exza.local dc.exza.local 389
force update: SRV _kerberos._tcp.exza.local dc.exza.local 88
force update: SRV _kerberos._udp.exza.local dc.exza.local 88
force update: SRV _kerberos._tcp.dc._msdcs.exza.local dc.exza.local 88
force update: SRV _kpasswd._tcp.exza.local dc.exza.local 464
force update: SRV _kpasswd._udp.exza.local dc.exza.local 464
force update: CNAME cfbc189a-c9a4-4f48-8bce-7f7fb52634b9._msdcs.exza.local dc.exza.local force update: SRV _ldap._tcp.Default-First-Site-Name._sites.exza.local dc.exza.local 389 force update: SRV _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.exza.local dc.exza.local 389 force update: SRV _kerberos._tcp.Default-First-Site-Name._sites.exza.local dc.exza.local 88 force update: SRV _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.exza.local dc.exza.local 88
force update: SRV _ldap._tcp.pdc._msdcs.exza.local dc.exza.local 389
force update: A gc._msdcs.exza.local 192.168.100.17
force update: SRV _gc._tcp.exza.local dc.exza.local 3268
force update: SRV _ldap._tcp.gc._msdcs.exza.local dc.exza.local 3268
force update: SRV _gc._tcp.Default-First-Site-Name._sites.exza.local dc.exza.local 3268 force update: SRV _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.exza.local dc.exza.local 3268
force update: A DomainDnsZones.exza.local 192.168.100.17
force update: SRV _ldap._tcp.DomainDnsZones.exza.local dc.exza.local 389
force update: SRV _ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.exza.local dc.exza.local 389
force update: A ForestDnsZones.exza.local 192.168.100.17
force update: SRV _ldap._tcp.ForestDnsZones.exza.local dc.exza.local 389
force update: SRV _ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.exza.local dc.exza.local 389
29 DNS updates and 0 DNS deletes needed
Failed to get Kerberos credentials, falling back to samba-tool: kinit for DC$@EXZA.LOCAL failed (Cannot contact any KDC for requested realm)

update (samba-tool): A dc.exza.local 192.168.100.17
Calling samba-tool dns for A dc.exza.local 192.168.100.17 (add)
Calling samba-tool dns add -k no -P ['192.168.100.17', 'exza.local', 'dc', 'A', '192.168.100.17'] ERROR(runtime): uncaught exception - (9711, 'WERR_DNS_ERROR_RECORD_ALREADY_EXISTS') File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line 176, in _run
    return self.run(*args, **kwargs)
File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/dns.py", line 1098, in run
    raise e
Failed 'samba-tool dns' based update: A dc.exza.local 192.168.100.17 : local variable 'estr' referenced before assignment
Traceback (most recent call last):
  File "/usr/local/samba/sbin/samba_dnsupdate", line 835, in <module>
    call_samba_tool(d, zone=d.zone)
File "/usr/local/samba/sbin/samba_dnsupdate", line 564, in call_samba_tool
    print("Failed 'samba-tool dns' based update: %s : %s" % (str(d), estr))
UnboundLocalError: local variable 'estr' referenced before assignment

-------------------------------

How to fix this issue?

--

Thanks & Regards,


Anantha Raghava


DISCLAIMER:

This e-mail communication and any attachments may be privileged and confidential to eXza Technology Consulting & Services, and are intended only for the use of the recipients named above If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.


Do not print this e-mail unless required. Save Paper & trees.

On Thursday 11 May 2017 08:35 PM, Anantha Raghava wrote:

Hi,

Problem solved. It was related to SELINUX.

The moment it is disabled, BIND service started properly.

--

Thanks & Regards,


Anantha Raghava


DISCLAIMER:
This e-mail communication and any attachments may be privileged and confidential to eXza Technology Consulting & Services, and are intended only for the use of the recipients named above If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.


Do not print this e-mail unless required. Save Paper & trees.

On Thursday 11 May 2017 08:10 PM, Anantha Raghava wrote:

Hi,

I am trying to upgrade frm INTERNAL DNS to BIND_DLZ.

I followed the procedure given in https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_AD_DC and https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End.

When I start the BIND Service, it fails with an error. In journalctl -xe we come to know that named service is unbale to open dlz_bind9_9.so file.

Full error message is as below.

--------------------------------------------------

[root@dc private]# systemctl start named
Job for named.service failed because the control process exited with error code. See "systemctl status named.service" and "journalctl -xe" for details.
[root@dc private]# journalctl -xe
May 11 20:03:41 dc.exza.local named[2506]: ---------------------------------------------------- May 11 20:03:41 dc.exza.local named[2506]: adjusted limit on open files from 4096 to 1048576 May 11 20:03:41 dc.exza.local named[2506]: found 2 CPUs, using 2 worker threads May 11 20:03:41 dc.exza.local named[2506]: using 2 UDP listeners per interface
May 11 20:03:41 dc.exza.local named[2506]: using up to 4096 sockets
May 11 20:03:41 dc.exza.local named[2506]: loading configuration from '/etc/named.conf' May 11 20:03:41 dc.exza.local named[2506]: reading built-in trusted keys from file '/etc/named.iscdlv.key' May 11 20:03:41 dc.exza.local named[2506]: initializing GeoIP Country (IPv4) (type 1) DB May 11 20:03:41 dc.exza.local named[2506]: GEO-106FREE 20160607 Build 1 Copyright (c) 2016 MaxMind May 11 20:03:41 dc.exza.local named[2506]: initializing GeoIP Country (IPv6) (type 12) DB May 11 20:03:41 dc.exza.local named[2506]: GEO-106FREE 20160607 Build 1 Copy May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv4) (type 2) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv4) (type 6) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv6) (type 30) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP City (IPv6) (type 31) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP Region (type 3) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP Region (type 7) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP ISP (type 4) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP Org (type 5) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP AS (type 9) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP Domain (type 11) DB not available May 11 20:03:41 dc.exza.local named[2506]: GeoIP NetSpeed (type 10) DB not available May 11 20:03:41 dc.exza.local named[2506]: using default UDP/IPv4 port range: [1024, 65535] May 11 20:03:41 dc.exza.local named[2506]: using default UDP/IPv6 port range: [1024, 65535] May 11 20:03:41 dc.exza.local named[2506]: listening on IPv4 interface lo, 127.0.0.1#53 May 11 20:03:41 dc.exza.local named[2506]: listening on IPv6 interface lo, ::1#53 May 11 20:03:41 dc.exza.local named[2506]: generating session key for dynamic DNS May 11 20:03:41 dc.exza.local named[2506]: sizing zone task pool based on 6 zones May 11 20:03:41 dc.exza.local named[2506]: Loading 'AD DNS Zone' using driver dlopen May 11 20:03:41 dc.exza.local named[2506]: dlz_dlopen failed to open library '/usr/local/samba/lib/bind9/dlz_bind9_9.so' - /usr/local/samba/lib/bind9/dlz_bind9_9.so: fail May 11 20:03:41 dc.exza.local named[2506]: dlz_dlopen of 'AD DNS Zone' failed May 11 20:03:41 dc.exza.local kernel: named[2508]: segfault at a8 ip 00007f1d03a7d1d9 sp 00007f1cfee7b320 error 4 in named[7f1d03a0e000+87000] May 11 20:03:41 dc.exza.local systemd[1]: named.service: control process exited, code=exited status=1 May 11 20:03:41 dc.exza.local systemd[1]: Failed to start Berkeley Internet Name Domain (DNS).
-- Subject: Unit named.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit named.service has failed.
--
-- The result is failed.
-----------------------------------------------

Any suggestions to start BIND9_DLZ properly?

--

Thanks & Regards,


Anantha Raghava


DISCLAIMER:
This e-mail communication and any attachments may be privileged and confidential to eXza Technology Consulting & Services, and are intended only for the use of the recipients named above If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.


Do not print this e-mail unless required. Save Paper & trees.



--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba