Kritisch: Überprüfe Kerberos authentifizierte DNS Updates

[pixel]

Hi@all,

I have the error on a UCS master (connected to ADS) in the system diagnosis:

Critical: Check kerberos authenticated DNS updates
Fehler traten auf bei der Ausführung von `kinit` oder `nsupdate`.
`nsupdate` Prüfung für die Domänne stedry.local ist fehlgeschlagen (tux.stedry.local).
`kinit` für den Principal dns-tux mit der Password Tabelle /var/lib/samba/private/dns.keytab ist fehlgeschlagen.

Ein Lösung habe ich hier gefunden:

Problem: Check kerberos authenticated DNS updates

Problem In the System Diagnosis you see a critical warning saying [Critical%20-%20Check%20Kerberos%20authenticated%20DNS%20updates] Environment First check the situation a bit further. check if the keytab and password match kinit --keytab=/var/lib/samba/private/dns.keytab "dns-$(hostname)" && klist; kdestroy if this fails with a line like kinit: krb5_init_creds_set_keytab: Failed to find dns-master@DOMAIN.TLD in keytab FILE:/var/lib/samba/private/dns.keytab (unknown enctype) Check the curr…

I have copied the two commands 1:1 into the console:

root@tux:/var/log# tar -cjvf /var/lib/samba/private/dns.keytab.tar.bz2 /var/lib/samba/private/dns.keytab --remove-files
tar: Entferne führende „/“ von Elementnamen
/var/lib/samba/private/dns.keytab

and:

root@tux:/var/log# ldbmodify -H /var/lib/samba/private/secrets.ldb <<-%EOR
> dn: samAccountName=dns-$(hostname),CN=Principals
> changetype: modify
> replace: secret
> secret: $(ldbsearch -H /var/lib/samba/private/secrets.ldb sAMAccountName=dns-$(hostname) secret | sed -ne 's/^secret: //p')
> %EOR
Modified 1 records successfully

However, the error in the system diagnostics has not disappeared. What am I doing wrong?

with best
sven

[neobiker]

I run this script (from KnowledgeBase) when the error appears: dns_error_repair.sh

#!/bin/sh
keytab=/var/lib/samba/private/dns.keytab
mv $keytab $keytab.$(date '+%Y%m%d%H%M%S')
samba-tool domain exportkeytab $keytab --principal DNS/$(hostname).$(ucr get domainname)
samba-tool domain exportkeytab $keytab "--principal=dns-$(hostname)@$(ucr get kerberos/realm)"
kinit -t /var/lib/samba/private/dns.keytab dns-$(hostname)

Hope this helps
Regards
Neobiker

[pixel]

Sorry for the late feedback. It worked. The error has disappeared
However, there are other warnings. But here I will first search myself and create a new post if necessary.