<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Hi folks,<br><br></div>I'm trying to get our AD domain controllers to update our BIND 9.8.2 servers--specifically for the zone<br><br></div>_<a href="http://msdcs.lab.brandeis.edu" target="_blank">msdcs.lab.brandeis.edu</a>.<br>
<br></div>I've got updates working in general: I can run kinit <username>@REALM (<a href="mailto:johnmill-dns-test@lab.brandeis.edu" target="_blank">johnmill-dns-test@lab.brandeis.edu</a> in this case), then successfully run nsupdate -g from my desktop:<br>
<br></div>server <a href="http://dns-ext-dev1.lab.brandeis.edu" target="_blank">dns-ext-dev1.lab.brandeis.edu</a><br>zone _<a href="http://msdcs.lab.brandeis.edu" target="_blank">msdcs.lab.brandeis.edu</a>.<br></div>update add yourmom._<a href="http://msdcs.lab.brandeis.edu" target="_blank">msdcs.lab.brandeis.edu</a>. 300 IN A 127.0.0.1<br>
send<br><br></div>This works fine--I grab the necessary tickets from our domain controllers, and BIND accepts my update.<br><br></div>My update-policy {} directive for the zone looks like:<br><br></div>update-policy {<br>
</div> grant <a href="mailto:johnmill-dnstest@LAB.BRANDEIS.EDU" target="_blank">johnmill-dnstest@LAB.BRANDEIS.EDU</a> zonesub ANY;<br></div> grant * zonesub ANY;<br><div><div>}<br><div><div><br></div><div>This is uber-lenient--I don't plan to leave things this way. but the wildcard should allow anything with a pulse to update.<br>
</div><div><br>When I try to use Windows (the domain controller itself) to send updates, the update first gets sent insecurely (which fails), then Windows attempts secure authentication (and succeeds), but doesn't actually send a secured update:<br>
<br>named[13861]: client 129.64.102.112#64501: UDP request<br>named[13861]: client 129.64.102.112#64501: using view '_default'<br>named[13861]: client 129.64.102.112#64501: request is not signed<br>named[13861]: client 129.64.102.112#64501: recursion not available<br>
named[13861]: client 129.64.102.112#64501: update<br>named[13861]: client 129.64.102.112#64501: update '_<a href="http://msdcs.lab.brandeis.edu/IN" target="_blank">msdcs.lab.brandeis.edu/IN</a>' denied<br>named[13861]: client 129.64.102.112#64501: send<br>
named[13861]: client 129.64.102.112#64501: sendto<br>named[13861]: client 129.64.102.112#64501: senddone<br>named[13861]: client 129.64.102.112#64501: next<br>named[13861]: client 129.64.102.112#64501: endrequest<br>named[13861]: client @0x7f75640f6980: udprecv<br>
named[13861]: client 129.64.102.112#52448: new TCP connection<br>named[13861]: client 129.64.102.112#52448: replace<br>named[13861]: clientmgr @0x7f7564003f98: createclients<br>named[13861]: clientmgr @0x7f7564003f98: recycle<br>
named[13861]: client 129.64.102.112#52448: read<br>named[13861]: client 129.64.102.112#52448: TCP request<br>named[13861]: client 129.64.102.112#52448: using view '_default'<br>named[13861]: client 129.64.102.112#52448: request is not signed<br>
named[13861]: client 129.64.102.112#52448: recursion not available<br>named[13861]: client 129.64.102.112#52448: query<br>named[13861]: failed gss_inquire_cred: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Success.<br>
named[13861]: gss-api source name (accept) is AD-2K8-DEV1$@<a href="http://LAB.BRANDEIS.EDU" target="_blank">LAB.BRANDEIS.EDU</a><br>named[13861]: process_gsstkey(): dns_tsigerror_noerror<br>named[13861]: client 129.64.102.112#52448: send<br>
named[13861]: client 129.64.102.112#52448: sendto<br>named[13861]: client 129.64.102.112#52448: senddone<br>named[13861]: client 129.64.102.112#52448: next<br>named[13861]: client 129.64.102.112#52448: endrequest<br>named[13861]: client 129.64.102.112#52448: read<br>
named[13861]: client @0x7f7564104b70: accept<br>named[13861]: client 129.64.102.112#52448: next<br>named[13861]: client 129.64.102.112#52448: request failed: end of file<br>named[13861]: client 129.64.102.112#52448: endrequest<br>
named[13861]: client 129.64.102.112#52448: closetcp<br>named[13861]: client 129.64.102.112#64230: UDP request<br>named[13861]: client 129.64.102.112#64230: using view '_default'<br>named[13861]: client 129.64.102.112#64230: request is not signed<br>
named[13861]: client 129.64.102.112#64230: recursion not available<br>named[13861]: client 129.64.102.112#64230: query<br>named[13861]: client 129.64.102.112#64230: query '_<a href="http://msdcs.lab.brandeis.edu/SOA/IN" target="_blank">msdcs.lab.brandeis.edu/SOA/IN</a>' approved<br>
named[13861]: client 129.64.102.112#64230: send<br>named[13861]: client 129.64.102.112#64230: sendto<br>named[13861]: client 129.64.102.112#64230: senddone<br>named[13861]: client 129.64.102.112#64230: next<br>
named[13861]: client 129.64.102.112#64230: endrequest<br>named[13861]: client @0x7f75640f6980: udprecv<br>named[13861]: client 129.64.102.112#63381: UDP request<br>
named[13861]: client 129.64.102.112#63381: using view '_default'<br>named[13861]: client 129.64.102.112#63381: request is not signed<br>named[13861]: client 129.64.102.112#63381: recursion not available<br>named[13861]: client 129.64.102.112#63381: query<br>
named[13861]: client 129.64.102.112#63381: query (cache) '<a href="http://dns-ext-dev1.lab.brandeis.edu/A/IN" target="_blank">dns-ext-dev1.lab.brandeis.edu/A/IN</a>' denied<br>named[13861]: client 129.64.102.112#63381: error<br>
named[13861]: client 129.64.102.112#63381: send<br>named[13861]: client 129.64.102.112#63381: sendto<br>named[13861]: client 129.64.102.112#63381: senddone<br>named[13861]: client 129.64.102.112#63381: next<br>named[13861]: client 129.64.102.112#63381: endrequest<br>
named[13861]: client @0x7f75640f6980: udprecv<br>named[13861]: client 129.64.99.24#21999: UDP request<br>named[13861]: client 129.64.99.24#21999: using view '_default'<br>named[13861]: client 129.64.99.24#21999: request is not signed<br>
named[13861]: client 129.64.99.24#21999: recursion not available<br>named[13861]: client 129.64.99.24#21999: query<br>named[13861]: client 129.64.99.24#21999: query '_kerberos._tcp.dc._<a href="http://msdcs.lab.brandeis.edu/SOA/IN" target="_blank">msdcs.lab.brandeis.edu/SOA/IN</a>' approved<br>
named[13861]: client 129.64.99.24#21999: send<br>named[13861]: client 129.64.99.24#21999: sendto<br>named[13861]: client 129.64.99.24#21999: senddone<br>named[13861]: client 129.64.99.24#21999: next<br>named[13861]: client 129.64.99.24#21999: endrequest<br>
named[13861]: client @0x7f75640f6980: udprecv<br>named[13861]: client 129.64.102.112#63504: UDP request<br>named[13861]: client 129.64.102.112#63504: using view '_default'<br>named[13861]: client 129.64.102.112#63504: request is not signed<br>
named[13861]: client 129.64.102.112#63504: recursion not available<br>named[13861]: client 129.64.102.112#63504: update<br>named[13861]: client 129.64.102.112#63504: update '_<a href="http://msdcs.lab.brandeis.edu/IN" target="_blank">msdcs.lab.brandeis.edu/IN</a>' denied<br>
named[13861]: client 129.64.102.112#63504: send<br>named[13861]: client 129.64.102.112#63504: sendto<br>named[13861]: client 129.64.102.112#63504: senddone<br>named[13861]: client 129.64.102.112#63504: next<br>
named[13861]: client 129.64.102.112#63504: endrequest<br><br></div><div>Contrast this with logs from a successful update (from my desktop):<br><br>named[12766]: client 129.64.8.232#56297: UDP request<br>named[12766]: client 129.64.8.232#56297: using view '_default'<br>
named[12766]: client 129.64.8.232#56297: request is not signed<br>named[12766]: client 129.64.8.232#56297: recursion not available<br>named[12766]: client 129.64.8.232#56297: query<br>named[12766]: client 129.64.8.232#56297: query '_<a href="http://msdcs.lab.brandeis.edu/SOA/IN">msdcs.lab.brandeis.edu/SOA/IN</a>' approved<br>
named[12766]: client 129.64.8.232#56297: send<br>named[12766]: client 129.64.8.232#56297: sendto<br>named[12766]: client 129.64.8.232#56297: senddone<br>named[12766]: client 129.64.8.232#56297: next<br>named[12766]: client 129.64.8.232#56297: endrequest<br>
named[12766]: client @0x7f51a80f6980: udprecv<br>named[12766]: client 129.64.8.232#34226: new TCP connection<br>named[12766]: client 129.64.8.232#34226: replace<br>named[12766]: clientmgr @0x7f51a8004f98: createclients<br>
named[12766]: clientmgr @0x7f51a8004f98: recycle<br>named[12766]: client 129.64.8.232#34226: read<br>named[12766]: client 129.64.8.232#34226: TCP request<br>named[12766]: client 129.64.8.232#34226: using view '_default'<br>
named[12766]: client 129.64.8.232#34226: request is not signed<br>named[12766]: client 129.64.8.232#34226: recursion not available<br>named[12766]: client 129.64.8.232#34226: query<br>named[12766]: failed gss_inquire_cred: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, <br>
Minor = Success.<br>named[12766]: gss-api source name (accept) is <a href="mailto:johnmill-dnstest@LAB.BRANDEIS.EDU">johnmill-dnstest@LAB.BRANDEIS.EDU</a><br>named[12766]: process_gsstkey(): dns_tsigerror_noerror<br>named[12766]: client 129.64.8.232#34226: send<br>
named[12766]: client 129.64.8.232#34226: sendto<br>named[12766]: client 129.64.8.232#34226: senddone<br>named[12766]: client 129.64.8.232#34226: next<br>named[12766]: client 129.64.8.232#34226: endrequest<br>named[12766]: client 129.64.8.232#34226: read<br>
named[12766]: client @0x7f51a847c120: accept<br>named[12766]: client 129.64.8.232#34226: next<br>named[12766]: client 129.64.8.232#34226: request failed: end of file<br>named[12766]: client 129.64.8.232#34226: endrequest<br>
named[12766]: client 129.64.8.232#34226: closetcp<br>named[12766]: client 129.64.8.232#49802: new TCP connection<br>named[12766]: client 129.64.8.232#49802: replace<br>named[12766]: clientmgr @0x7f51a8004f98: createclients<br>
named[12766]: clientmgr @0x7f51a8004f98: recycle<br>named[12766]: client 129.64.8.232#49802: read<br>named[12766]: client 129.64.8.232#49802: TCP request<br>named[12766]: client 129.64.8.232#49802: using view '_default'<br>
named[12766]: client 129.64.8.232#49802: request has valid signature: johnmill-dnstest\@<a href="http://LAB.BRANDEIS.EDU">LAB.BRANDEIS.EDU</a><br>named[12766]: client 129.64.8.232#49802: recursion not available<br>named[12766]: client 129.64.8.232#49802: update<br>
named[12766]: client @0x7f51a8104b70: accept<br>named[12766]: client 129.64.8.232#49802: updating zone '_<a href="http://msdcs.lab.brandeis.edu/IN">msdcs.lab.brandeis.edu/IN</a>': adding an RR at 'yourmom._<a href="http://msdcs.lab.brandeis.edu">msdcs.lab.brandeis.edu</a>' A<br>
named[12766]: client 129.64.8.232#49802: send<br>named[12766]: client 129.64.8.232#49802: sendto<br>named[12766]: client 129.64.8.232#49802: senddone<br>named[12766]: client 129.64.8.232#49802: next<br><br clear="all"></div>
<div><div><div><div><div><div><div><div><div>
<div><div>Even though it sends valid TKEY credentials, why doesn't Windows actually sign its updates or use a TCP connection for them? Any way to actually get the Windows side of things to send signed updates?<br></div>
<div><br></div><div>John<br></div><div><br>-- <br>John Miller<br>Systems Engineer<br>Brandeis University<br><a href="mailto:johnmill@brandeis.edu" target="_blank">johnmill@brandeis.edu</a><br><br>
</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>