[samba-jp:22353] samba-tool domain classicupgrade を行ったsamba4で 「Failed DNS update - NT_STATUS_IO_TIMEOUT」

[Akiyama Masahiro]

はじめまして。akiyamaと申します。


下の環境でsamba4を起動すると、
../source4/dsdb/dns/dns_update.c:294: Failed DNS update -
NT_STATUS_IO_TIMEOUT
が発生しています。

実行環境
    ・CentOS 7.0 on CentOS7.0 ( KVM)
    ・samba 4.13 (コンパイルしてインストール)
    ・bind9 (yumからインストール)
    ・ntp(yumからインストール)

これまでは Centos 5.3にyumでインストールしたsamba3.5を利用していた
PDCを samba4へ移行を考えています。samba3.5でのドメイン名は「EXAMPLE」です。


移行するときに実行したコマンドは下の通りです。
/usr/local/samba/bin/samba-tool domain classicupgrade \
  --dbdir=/usr/local/src/samba3-to-samba4/var/lib/samba/private \
  --use-xattrs=yes --realm=example.co.jp --dns-backend=BIND9_DLZ \
  --use-ntvfs /usr/local/src/samba3-to-samba4/etc/samba/smb.conf

移行後の環境で
/usr/local/samba/bin/smbclient //localhost/netlogon -UAdministrator -c 'ls'
や
kinit administrator ＠ EXAMPLE.CO.JP
は正常に動作しています。

DNSへのアクセスが失敗しているのかと思ったのですが、dig の正引きは行えます。
また、tcpdumpで見ていると bindは通信していそうです。
11:56:12.075508 IP ad.example.co.jp.43245 > ad.example.co.jp.domain: 19613+
SRV? _ldap._tcp.example.co.jp. (43)
11:56:12.075718 IP ad.example.co.jp.domain > ad.example.co.jp.43245: 19613
0/1/0 (93)

「Failed DNS update - NT_STATUS_IO_TIMEOUT」となる原因を教えて
たいだけませんか。

■/usr/local/samba/etc/smb.conf
-- 
--------------------------------------------------------------------------
# Global parameters
[global]
        workgroup = EXAMPLE
        realm = EXAMPLE.CO.JP
        netbios name = AD
        server role = active directory domain controller
        # server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
winbind, ntp_signd, kcc, dnsupdate, dns, smb
        server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl,
winbind, ntp_signd, kcc, dnsupdate, smb
        dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr,
netlogon, lsarpc, spoolss, drsuapi, dssetup, unixinfo, browser, eventlog6,
backupkey, dnsserver, winreg, srvsvc
        idmap_ldb:use rfc2307 = yes

[netlogon]
        path = /usr/local/samba/var/locks/sysvol/example/scripts
        read only = No

[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No


■named.conf
-- 
--------------------------------------------------------------------------
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        # listen-on port 53 { 127.0.0.1; };
        # listen-on-v6 port 53 { ::1; };
        listen-on-v6 port 53 { none; };
        directory       "/var/named";
        dump-file       "data/cache_dump.db";
        statistics-file "data/named_stats.txt";
        memstatistics-file "data/named_mem_stats.txt";
        #allow-query     { localhost; };
        allow-query     { localhost; 192.168.0.0/16; };

        allow-transfer { localhost; 192.168.0.0/16; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable
recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need
to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST
enable access
           control to limit queries to your legitimate users. Failing to do
so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";

        /* */
        tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
                #severity debug;
                print-time yes;
                print-severity yes;
                print-category yes;
        };

        category update {
               "default_debug";
        };
};

#zone "." IN {
#       type hint;
#       file "named.ca";
#};
#
#include "/etc/named.rfc1912.zones";
#include "/etc/named.root.key";
view "internal" {
        match-clients {
                localhost;
                192.168.0.0/16;
        };
        zone "." IN {
                type hint;
                file "named.ca";
        };
        zone "11.168.192.in-addr.arpa" IN {
                type master;
                file "11.168.192.rev";
                allow-update { 192.168.0.0/16; };
        };
#    zone "example.co.jp" {
#            type master;
#            file "example.co.jp.hosts";
#            allow-update { 192.168.0.0/16; };
#    };
    include "/etc/named.rfc1912.zones";
    include "/etc/named.root.key";

    include "/usr/local/samba/private/named.conf";
};