Hi folks,
we experience sporadic failures in DNS updates with nsupdate 9.11.6
against Active Directory with GSS-TSIG.
The input is:
$ less /usr/local/etc/register-hostnames.in
zone ad001.siemens.net
update add deblndw011x1j.ad001.siemens.net 3600 A 147.54.64.149
send
update add sitex-ldadw.ad001.siemens.net 3600 A 147.54.64.149
send
The update runs a crontab with @daily on FreeBSD 12.0-RELEASE:
in a negative case we see:
;; UPDATE SECTION:
deblndw011x1j.ad001.siemens.net. 3600 IN A 147.54.64.149
;; TSIG PSEUDOSECTION:
2194433436.sig-demchadc02a.ad001.siemens.net. 0 ANY TSIG gss-tsig. 1554588001 300 28 BAQE//////8AAAAAH1sNRDyJ/ysz/YCKzFftFw== 45424 NOERROR 0
07-Apr-2019 00:00:01.897 dns_request_destroy: request 0x8010d3bc0
07-Apr-2019 00:00:01.897 req_destroy: request 0x8010d3bc0
07-Apr-2019 00:00:01.897 requestmgr_detach: 0x8010c7a40: eref 1 iref 1
07-Apr-2019 00:00:01.913 req_connected: request 0x8010d3a40
07-Apr-2019 00:00:01.913 req_send: request 0x8010d3a40
07-Apr-2019 00:00:01.913 req_senddone: request 0x8010d3a40
07-Apr-2019 00:00:01.930 req_response: request 0x8010d3a40: success
07-Apr-2019 00:00:01.930 req_cancel: request 0x8010d3a40
07-Apr-2019 00:00:01.930 req_sendevent: request 0x8010d3a40
07-Apr-2019 00:00:01.930 dns_request_getresponse: request 0x8010d3a40
07-Apr-2019 00:00:01.930 GSS verify error: GSSAPI error: Major = A token had an
invalid Message Integrity Check (MIC), Minor = Unknown code 0.
07-Apr-2019 00:00:01.930 tsig key '2194433436.sig-demchadc02a.ad001.siemens.net'
(<null>): signature failed to verify(1)
; TSIG error with server: tsig verify failure
If necessary, I can provide both (positive and negative) output from
cron and pcap files.
Is there anything I can do to solve this issue or is this another
Microsoft DNS quirk (domain name compression or alike) I have to live
with? Is issue #45854 back in the game?
Regards,
Michael
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
