<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.16.3">
</HEAD>
<BODY>
<BR>
You were correct (of course). I had my versions mixed up and was starting an older version without GSSAPI support.<BR>
<BR>
The kerberos authentication seems to be working now but I still can't the updates working. If I understand the output in named.run correctly, I believe the kerberos authentication is accepted ("process_gsstkey(): dns_tsigerror_noerror"), but the update is still refused ("updating zone 'test.net/IN': update failed: rejected by secure update (REFUSED)"). (see excerpt from named.run below)<BR>
<BR>
Most likely I haven't got my named.conf straight. In named.conf I have:<BR>
<BR>
-------------- named.conf -----------------------------------------------------------------------------------------<BR>
[...]<BR>
options {<BR>
[...]<BR>
tkey-gssapi-credential "DNS/dns.test.net";<BR>
tkey-domain "TEST.NET";<BR>
};<BR>
<BR>
view "internal" {<BR>
[...]<BR>
zone "test.net" {<BR>
type master;<BR>
file "test.net.zone";<BR>
// allow-update { internals; };<BR>
update-policy {<BR>
grant update-key krb5-self test.net A;<BR>
};<BR>
};<BR>
}<BR>
-------------- end of named.conf -------------------------------------------------------------------------------- <BR>
<BR>
I can't quite figure out what the update-policy line should look like when using gss.<BR>
<BR>
Again, thanks for all your help!!<BR>
<BR>
Nico<BR>
<BR>
-------------- named.run -------------------------------------------------------------------------------------------<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: using view 'internal'<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: request is not signed<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: recursion available<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: update<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: ns_client_attach: ref = 1<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: updating zone 'test.net/IN': prerequisites are OK<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: update 'test.net/IN' denied<BR>
30-Dec-2008 10:51:08.328 client 10.10.10.101#1051: view internal: updating zone 'test.net/IN': rolling back<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: send<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: sendto<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: senddone<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: next<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: ns_client_detach: ref = 0<BR>
30-Dec-2008 10:51:08.329 client 10.10.10.101#1051: view internal: endrequest<BR>
30-Dec-2008 10:51:08.329 client @0xb604b008: udprecv<BR>
30-Dec-2008 10:51:08.333 socket 0xb7f28588 10.10.10.101#1053: accepted connection, new socket 0xb5f56588<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: new TCP connection<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: replace<BR>
30-Dec-2008 10:51:08.334 clientmgr @0xb7f1f3b8: createclients<BR>
30-Dec-2008 10:51:08.334 clientmgr @0xb7f1f3b8: recycle<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: read<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: TCP request<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: view internal: using view 'internal'<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: view internal: request is not signed<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: view internal: recursion available<BR>
30-Dec-2008 10:51:08.334 client 10.10.10.101#1053: view internal: query<BR>
30-Dec-2008 10:51:08.334 gss cred: "DNS/dns.test.net@TEST.NET", GSS_C_ACCEPT, 4294967146<BR>
30-Dec-2008 10:51:08.369 gss-api source name (accept) is XP3$@TEST.NET<BR>
30-Dec-2008 10:51:08.369 process_gsstkey(): dns_tsigerror_noerror<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: view internal: send<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: view internal: sendto<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: view internal: senddone<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: view internal: next<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: view internal: endrequest<BR>
30-Dec-2008 10:51:08.369 client 10.10.10.101#1053: read<BR>
30-Dec-2008 10:51:08.369 client @0xb600a008: accept<BR>
30-Dec-2008 10:51:08.371 client 10.10.10.101#1053: next<BR>
30-Dec-2008 10:51:08.371 client 10.10.10.101#1053: request failed: end of file<BR>
30-Dec-2008 10:51:08.371 client 10.10.10.101#1053: endrequest<BR>
30-Dec-2008 10:51:08.371 client 10.10.10.101#1053: closetcp<BR>
30-Dec-2008 10:51:08.371 socket 0xb5f56588: destroying<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: UDP request<BR>
30-Dec-2008 10:51:08.373 tsig key '1044-ms-7.1-12594.61c6fec0-d657-11dd-2fa0-000c292d3ce0' (XP3\$\@TEST.NET): tsig expire: generated=1, refs=1, expire=-86401)<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: using view 'internal'<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: request has valid signature<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: recursion available<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: update<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: ns_client_attach: ref = 1<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: updating zone 'test.net/IN': prerequisites are OK<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: updating zone 'test.net/IN': update failed: rejected by secure update (REFUSED)<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: updating zone 'test.net/IN': rolling back<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: send<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: sendto<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: senddone<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: next<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: ns_client_detach: ref = 0<BR>
30-Dec-2008 10:51:08.373 client 10.10.10.101#1054: view internal: endrequest<BR>
30-Dec-2008 10:51:08.373 client @0xb604b008: udprecv<BR>
<BR>
<BR>
<BR>
On Fri, 2008-12-26 at 13:29 -0500, Rob Austein wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">At Fri, 26 Dec 2008 14:28:13 +0100, Nico De Ranter wrote:</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> Dec 26 13:55:33 dns named[8546]: configuring TKEY: not implemented</FONT>
<FONT COLOR="#000000">The error suggests that you don't really have GSSAPI enabled</FONT>
<FONT COLOR="#000000">(dst_gssapi_acquirecred() returns that error when called with GSSAPI</FONT>
<FONT COLOR="#000000">support disabled). Check your build log to make sure that -DGSSAPI</FONT>
<FONT COLOR="#000000">was included on the command line when compiling lib/dns/gssapictx.c.</FONT>
<FONT COLOR="#000000">If not, you've got some kind of autoconf problem or are specifying the</FONT>
<FONT COLOR="#000000">wrong directory for the GSSAPI libraries, so check config.log next to</FONT>
<FONT COLOR="#000000">see what happened.</FONT>
</PRE>
</BLOCKQUOTE>
</BODY>
</HTML>