Bug 44902 - New check `kerberos_ddns_update.py`
New check `kerberos_ddns_update.py`
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: UMC - System diagnostic
UCS 4.2
Other Linux
: P5 enhancement (vote)
: UCS 4.2-2-errata
Assigned To: Lukas Oyen
Arvid Requate
:
Depends on:
Blocks: 47216 45418 45584
  Show dependency treegraph
 
Reported: 2017-06-29 16:41 CEST by Lukas Oyen
Modified: 2018-06-20 11:51 CEST (History)
3 users (show)

See Also:
What kind of report is it?: Feature Request
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score:
oyen: Patch_Available+


Attachments
nt-diagnostic-nsupdate-421.patch (13.47 KB, patch)
2017-06-29 16:41 CEST, Lukas Oyen
Details | Diff
qa_bug_44902.patch (2.05 KB, patch)
2017-08-10 18:45 CEST, Arvid Requate
Details | Diff
nsupdate_check.patch (1.75 KB, patch)
2017-08-24 21:26 CEST, Arvid Requate
Details | Diff
bug44902_proposal.diff (1.57 KB, patch)
2017-09-14 14:12 CEST, Arvid Requate
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Lukas Oyen univentionstaff 2017-06-29 16:41:34 CEST
Created attachment 8988 [details]
nt-diagnostic-nsupdate-421.patch

Adds a new check `kerberos_ddns_update.py` which acquires a kerberos ticket for `$hostname$` and `dns-$hostname` and performs a `nsupdate` with a prerequisite check for `$domainname`.
Comment 1 Lukas Oyen univentionstaff 2017-08-01 16:37:10 CEST
Committed in r81644 - r81646 (advisory r81649).
Comment 2 Arvid Requate univentionstaff 2017-08-10 18:45:13 CEST
Created attachment 9111 [details]
qa_bug_44902.patch

Ok, looks good, I'd like to include the direction and the estring, see attached patch.
Comment 3 Arvid Requate univentionstaff 2017-08-10 18:46:09 CEST
Wrong bug, that should have gone to Bug 44881..
Comment 4 Arvid Requate univentionstaff 2017-08-24 21:26:11 CEST
Created attachment 9144 [details]
nsupdate_check.patch
Comment 5 Arvid Requate univentionstaff 2017-08-24 21:27:06 CEST
The nsupdate check doesn't actually send the command, see patch attached to previous comment
Comment 6 Lukas Oyen univentionstaff 2017-09-04 15:49:53 CEST
(In reply to Arvid Requate from comment #5)
> The nsupdate check doesn't actually send the command, see patch attached to
> previous comment

Fixed:

4.2-1: r82619, YAML: r82626
4.2-2: r82628, YAML: r82635
Comment 7 Arvid Requate univentionstaff 2017-09-04 18:21:56 CEST
Ok.

I've also reverted unreleased errata4.2-1 changes (r81147:82625) since Erratum 98 from the ucs-4.2-1 SVN branch and merged the unpublished errata4.2-1 advisory into the errata4.2-2 advisory. So everything's up to date in the ucs-4.2-2 branch.
Comment 8 Stefan Gohmann univentionstaff 2017-09-08 16:31:07 CEST
The tests fail in Jenkins in a Samba 3 environment:

http://jenkins.knut.univention.de:8080/job/UCS-4.2/job/UCS-4.2-2/job/AutotestJoin/7/SambaVersion=s3,Systemrolle=master/testReport/00_checks/81_diagnostic_checks/test/

Maybe the whole test should be skipped in S3 environments?
Comment 9 Stefan Gohmann univentionstaff 2017-09-08 19:56:42 CEST
The plugin is now skipped in ucs-test. Please revert it once the issue is fixed:

0987b829
by Stefan Gohmann at 2017-09-08T19:47:41+02:00
00_checks/81_diagnostic_checks.py: skip 46_kerberos_ddns_update since it doesn't work in S3 environments (Bug #44902)
Comment 10 Lukas Oyen univentionstaff 2017-09-11 18:05:12 CEST
(In reply to Stefan Gohmann from comment #9)
> The plugin is now skipped in ucs-test. Please revert it once the issue is
> fixed:
> 
> 0987b829
> by Stefan Gohmann at 2017-09-08T19:47:41+02:00
> 00_checks/81_diagnostic_checks.py: skip 46_kerberos_ddns_update since it
> doesn't work in S3 environments (Bug #44902)

Fixed in 1484bf36, YAML dc706e39, Test enabled 6ea5ac94.
Comment 11 Arvid Requate univentionstaff 2017-09-14 14:12:46 CEST
Created attachment 9202 [details]
bug44902_proposal.diff

One final thing:

* Servers that migrated from "Samba 3" to "Samba 4" usually have both services registered. Yeah, not good, but that's how it is.

* Memberservers have "Samba 3" and should be able to do ddns updates in a "Samba 4" domain.

See attached patch for a proposal.
Comment 12 Lukas Oyen univentionstaff 2017-09-14 16:04:55 CEST
(In reply to Arvid Requate from comment #11)
> * Servers that migrated from "Samba 3" to "Samba 4" usually have both
> services registered. Yeah, not good, but that's how it is.
> 
> * Memberservers have "Samba 3" and should be able to do ddns updates in a
> "Samba 4" domain.


Reworked and applied (with some modifications) in 6464f49b.
Comment 13 Arvid Requate univentionstaff 2017-09-19 16:56:46 CEST
Ok, works. I've split of Bug #45418 to add support for special setups.
Comment 14 Erik Damrose univentionstaff 2017-09-20 15:04:02 CEST
<http://errata.software-univention.de/ucs/4.2/166.html>