samba_dnsupdate dns_tkey_negotiategss: TKEY is unacceptable

Question

I'm trying to configurate dinamic update to bind

I have samba4.0.0rc5 running with bind 9.8 on Ubuntu 12.04.

by default the provision command dont create necesary dns.keytab. i've tested with the folloewing

# samba-tool domain exportkeytab /usr/local/samba/private/dns.keytab --realm=domain.com --principal DNS/ad.domain.com

but when i try the command samba_dnsupdate always i get dns_tkey_negotiategss: TKEY is unacceptable

the second method is create the dns.keytab file with this guide but i get the same result

Answer 1

Samba 4.1.9 + Ubuntu 14.04 (with BIND9_FLATFILE backend for DNS) but same issue here. The problem is access to the private directory of Samba (in my case /var/lib/samba/private/) and to the file dns.keytab.

My solution is:

chgrp bind /var/lib/samba/private/
chmod 750 /var/lib/samba/private/
chgrp bind /var/lib/samba/private/dns.keytab
chmod 640 /var/lib/samba/private/dns.keytab