Re: FreeBSD-14.3 nsupdate krb5 failure (beyond issue 4436)
Petr Špaček <[email protected]>
| Newsgroups | gmane.network.dns.bind9.user |
|---|---|
| Message-ID | <abc97af3-9748-43cd-811d-e09ea8858b5f__13516.2698965118$1756209785$gmane$org@isc.org> |
On 26. 08. 25 13:24, Petr Špaček wrote: > On 26. 08. 25 12:31, Peter 'PMc' Much wrote: >> Out of recvsoa >> recvgss() >> recvgss creating rcvmsg >> show_message() >> recvmsg reply from GSS-TSIG query >> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41256 >> ;; flags: qr ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 >> ;; QUESTION SECTION: >> ;546671530.sig-conr-e.intra.daemon.contact. ANY TKEY >> >> ;; ANSWER SECTION: >> 546671530.sig-conr-e.intra.daemon.contact. 0 ANY TKEY gss-tsig. 0 0 3 >> BADKEY 0 0 >> >> dns_tkey_gssnegotiate: TKEY is unacceptable > > TL;DR the _response_ is somehow wrong. > > I would add -L99 to nsupdate command line. > > Secondly I would add > KRB5_TRACE=/dev/stderr > to nsupdate invocation as well to see what krb5 library thinks of this. Sorry, it was pointed out to me I misread the log and that the error has happened on server side. I would run `KRB5_TRACE=/dev/stderr named -g -d 99` and check logs on that side. Hard to tell if krb5 will spit anything in the log, but it might be worth a try. In any case, have you checked system time? :-) -- Petr Špaček -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list [email protected] https://lists.isc.org/mailman/listinfo/bind-users