Bug 34908 - samba_dnsupdate should use localhost as KDC.
samba_dnsupdate should use localhost as KDC.
Product: UCS
Classification: Unclassified
Component: Samba4
UCS 4.1
Other Linux
: P5 normal (vote)
: UCS 4.1-2-errata
Assigned To: Arvid Requate
Felix Botner
Depends on:
Blocks: 40290
  Show dependency treegraph
Reported: 2014-05-21 17:48 CEST by Arvid Requate
Modified: 2016-06-08 14:28 CEST (History)
2 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

re-join.log (2.10 MB, application/text)
2016-05-30 18:26 CEST, Arvid Requate

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2014-05-21 17:48:18 CEST
samba_dnsupdate uses a private /var/lib/samba/private/krb5.conf with minman content. This file is created during provision from the template found in /usr/share/samba/setup/krb5.conf

This template doesn't specify some useful realm configuration options which we have in /etc/krb5.conf like:

        kdc =    # ucr get kerberos/kdc

To make the samba_dnsupdate run during samba join more deterministic and less error prone, I think it would be good to turn this file into an UCR template to at least set the kdc to localhost.
Comment 1 Arvid Requate univentionstaff 2014-05-21 18:37:24 CEST
In the univention-join wrapper script for Bug #32187 I just do this:

dpkg-divert --quiet --rename --local \
   --divert "${samba_krb5conf_template}.debian"\
   --add "${samba_krb5conf_template}"
cp "${samba_krb5conf_template}.debian" "${samba_krb5conf_template}"
cat >> "${samba_krb5conf_template}" <<%EOF

\${REALM} = {
        kdc =

During provision/join samba replaces ${REALM} (in provision/__init__.py).
Comment 2 Michael Grandjean univentionstaff 2015-12-15 15:46:04 CET
Hit me again in a UCS@school workshop today.

UCS 4.1-0 errata 29, Non-Edu School-Slave
Comment 3 Michael Grandjean univentionstaff 2015-12-17 11:02:18 CET
Other customer, same problem: 2015121721000236

UCS 4.0-4, Edu School-Slave
Comment 4 Michael Grandjean univentionstaff 2015-12-17 13:27:17 CET
Some more information on my last two comments:

In both cases, the (re-)join of a UCS@school Slave failed with:

> RUNNING 98univention-samba4slavepdc-dns.inst
> 2015-12-17 09:34:14.000435465+01:00 (in joinscript_init)
> WARNING: No path in service IPC$ - making it unavailable!
> NOTE: Service IPC$ is flagged unavailable.
> Traceback (most recent call last):
>   File "/usr/sbin/samba_dnsupdate", line 619, in <module>
>     get_credentials(lp)
>   File "/usr/sbin/samba_dnsupdate", line 130, in get_credentials
>     raise e
> RuntimeError: kinit for UCS-1138$@EXAMPLE.ORG failed (KDC has no support for encryption type)

In both cases, replacing "dns_lookup_kdc = true" with "kdc =" in /var/lib/samba/private/krb5.conf helped.
Comment 5 Arvid Requate univentionstaff 2016-05-30 18:07:24 CEST
Hmm, the change caused this problem during re-join of a UCS@school slave:

root@ls-gsmitte:~# samba_dnsupdate 
Traceback (most recent call last):
  File "/usr/sbin/samba_dnsupdate", line 651, in <module>
  File "/usr/sbin/samba_dnsupdate", line 155, in get_credentials
    raise e
RuntimeError: kinit for LS-GSMITTE$@UNI.DTR failed (Cannot contact any KDC for requested realm)

reverting the change fixed the problem.
Comment 6 Arvid Requate univentionstaff 2016-05-30 18:26:21 CEST
Created attachment 7699 [details]

This was due to a format error in krb5.conf.

root@ls-gsmitte:~# KRB5_CONFIG=/var/lib/samba/private/krb5.conf kinit -t /var/lib/samba/private/dns.keytab 'dns-ls-gsmitte'
kinit: krb5_get_init_creds: unable to reach any KDC in realm UNI.DTR

Fixed now.
Comment 7 Arvid Requate univentionstaff 2016-05-30 18:31:03 CEST
Advisory: univention-samba4.yaml
Comment 8 Felix Botner univentionstaff 2016-06-01 15:12:11 CEST
OK - /var/lib/samba/private/krb5.conf is now a template
OK - no more dns, is used as kdc
OK - installation/update on UCS

OK - univention-samba4.yaml
Comment 9 Janek Walkenhorst univentionstaff 2016-06-08 14:28:30 CEST