1

I try to register my DHCP Clients to my Samba 4 based domain controller (DC). For this I followed the guide Configure DHCP to update DNS records with BIND9.

I've searched around the internet without success. But there ist an issue with the Generic Security Service Application Program Interface (GSSAPI) I don't know how to solve.

So can someone help me with the following GSSAPI Error?

start_gssrequest
tkey query failed: GSSAPI error: Major = Unspecified GSS failure.  Minor code may provide more information, Minor = No credentials found with supported encryption types (filename: /tmp/dhcp-dyndns.cc).

Here is my keytab file:

ktutil -k /etc/dhcpduser.keytab list
/etc/dhcpduser.keytab:

Vno  Type                     Principal                Aliases
  2  aes256-cts-hmac-sha1-96  dhcpduser@PROD.CORP.INT
  2  aes128-cts-hmac-sha1-96  dhcpduser@PROD.CORP.INT
  2  arcfour-hmac-md5         dhcpduser@PROD.CORP.INT
  2  des-cbc-md5              dhcpduser@PROD.CORP.INT
  2  des-cbc-crc              dhcpduser@PROD.CORP.INT

System Information

  • Raspberry Pi 3 Model B
  • Raspian Stretch
  • Samba Version 4.7.4
  • BIND Version 9.11.2
  • BIND9 built by

    make '--prefix' '/usr/local/bind9' '--enable-shared'
       '--enable-static' '--with-openssl=/usr'
       '--with-gssapi=/usr/include/gssapi' '--with-libtool'
       '--with-dlopen=yes' '--enable-threads' '--enable-largefile'
       '--with-gnu-ld' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing'
       'CFLAGS=-DDIG_SIGCHASE' 'CFLAGS=-O2'
    

Config Files

If more information needed, feel free and ask me, I'll do my best to provide them.

Greetings Ronny

  • As far as I understand the error message tkey query failed corresponds to the Domain Name System (DNS), i.e. , record updates, PTR records, server not found, etc.. The part Minor = No credentials found with supported encryption types (filename: /tmp/dhcp-dyndns.cc) references another file, can you share this too? – U880D Apr 24 '18 at 5:57
  • After some research in DDNS with Samba4, BIND9 this seems to be the krbcc ticket cache and checking for valid kerberos ticket as mentioned there could be helpful. – U880D Apr 24 '18 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.