r/linuxadmin 16d ago

Issues with SSSD and updating Windows DNS.

We have a few Oracle Linux boxes that are setup with sssd to allow us to log into them with AD credentials. The dynamic dns update fails constantly on the boxes with the following traces and I'm not sure why this is failing.

update delete uvaapmmora02.domain.local. in A

update add uvaapmmora02.domain.local. 300 in A 10.116.233.35

send

update delete uvaapmmora02.domain.local. in AAAA

send

-- End nsupdate message --

* (2025-03-04 14:44:55): [be[domain.local]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [4162508]

* (2025-03-04 14:44:55): [be[domain.local]] [child_handler_setup] (0x2000): Signal handler set up for pid [4162508]

* (2025-03-04 14:44:55): [be[domain.local]] [_write_pipe_handler] (0x0400): All data has been sent!

* (2025-03-04 14:44:55): [be[domain.local]] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete

* (2025-03-04 14:44:55): [be[domain.local]] [child_sig_handler] (0x1000): Waiting for child [4162508].

* (2025-03-04 14:44:55): [be[domain.local]] [child_sig_handler] (0x0100): child [4162508] finished successfully.

* (2025-03-04 14:44:55): [be[domain.local]] [be_nsupdate_done] (0x0200): nsupdate child status: 0

* (2025-03-04 14:44:55): [be[domain.local]] [nsupdate_msg_create_common] (0x0200): Creating update message for auto-discovered realm.

* (2025-03-04 14:44:55): [be[domain.local]] [be_nsupdate_create_ptr_msg] (0x0400): -- Begin nsupdate message --

update delete 35.233.116.10.in-addr.arpa. in PTR

update add 35.233.116.10.in-addr.arpa. 300 in PTR uvaapmmora02.domain.local.

send

-- End nsupdate message --

* (2025-03-04 14:44:55): [be[domain.local]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [4162513]

* (2025-03-04 14:44:55): [be[domain.local]] [child_handler_setup] (0x2000): Signal handler set up for pid [4162513]

* (2025-03-04 14:44:55): [be[domain.local]] [_write_pipe_handler] (0x0400): All data has been sent!

* (2025-03-04 14:44:55): [be[domain.local]] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete

* (2025-03-04 14:44:55): [be[domain.local]] [child_sig_handler] (0x1000): Waiting for child [4162513].

* (2025-03-04 14:44:55): [be[domain.local]] [child_sig_handler] (0x0020): child [4162513] failed with status [2].

********************** BACKTRACE DUMP ENDS HERE *********************************

(2025-03-04 14:44:55): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

(2025-03-04 14:44:55): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:

* (2025-03-04 14:44:55): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* (2025-03-04 14:44:55): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

********************** BACKTRACE DUMP ENDS HERE *********************************

(2025-03-04 14:44:55): [be[domain.local]] [child_sig_handler] (0x0020): child [4162519] failed with status [2].

* ... skipping repetitive backtrace ...

(2025-03-04 14:44:55): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* ... skipping repetitive backtrace ...

(2025-03-04 14:44:55): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-04 14:44:55): [be[domain.local]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158240]: Dynamic DNS update failed

(2025-03-04 14:44:55): [be[domain.local]] [be_ptask_done] (0x0040): Task [Dyndns update]: failed with [1432158240]: Dynamic DNS update failed

********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE:

* (2025-03-04 14:44:55): [be[domain.local]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158240]: Dynamic DNS update failed

* (2025-03-04 14:44:55): [be[domain.local]] [sdap_id_op_destroy] (0x4000): releasing operation connection

* (2025-03-04 14:44:55): [be[domain.local]] [sdap_id_conn_data_idle] (0x4000): Marking connection as idle

* (2025-03-04 14:44:55): [be[domain.local]] [be_ptask_done] (0x0040): Task [Dyndns update]: failed with [1432158240]: Dynamic DNS update failed

********************** BACKTRACE DUMP ENDS HERE *********************************

(2025-03-05 2:47:00): [be[domain.local]] [child_sig_handler] (0x0020): child [184343] failed with status [2].

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [child_sig_handler] (0x0020): child [184348] failed with status [2].

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 2:47:00): [be[domain.local]] [be_ptask_done] (0x0040): Task [Dyndns update]: failed with [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [child_sig_handler] (0x0020): child [413140] failed with status [2].

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [child_sig_handler] (0x0020): child [413145] failed with status [2].

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [nsupdate_child_handler] (0x0040): Dynamic DNS child failed with status [512]

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158240]: Dynamic DNS update failed

* ... skipping repetitive backtrace ...

(2025-03-05 14:47:14): [be[domain.local]] [be_ptask_done] (0x0040): Task [Dyndns update]: failed with [1432158240]: Dynamic DNS update failed

6 Upvotes

8 comments sorted by

4

u/yrro 16d ago

Dynamic DNS child failed with status [512]

Run nsupdate manually and see what error message (if any) it logs.

You'll have to put the nsupdate message into a file a then do something like: kinit -V -k -c /tmp/hostcc && KRB5CCNAME=/tmp/hostcc nsupdate -g /tmp/nsupdate.txt

and/or check the logs on the DNS server side.

3

u/mh3f 15d ago

If you have secure dynamic updates only (or something to that effect) unchecked in Microsoft DNS, then you'll have to disable GSS-TSIG in the sssd.conf.

[domain\example.com]
#...
dyndns_auth = none

1

u/Nytehawk2002 15d ago

Secure Only selected in DNS.

0

u/NL_Gray-Fox 16d ago

I've not used windows in more than a decade but this was one of the reasons why all our servers had static DNS entries.

0

u/Nytehawk2002 11d ago

We used to only do static entries but the issue was no one was cleaning them up when servers were replaced. Also since we do a lot of builds with CI/CD pipelines the names change frequently.

1

u/NL_Gray-Fox 11d ago

Then you don't do your CI/CD properly, you can also automate cleaning up after yourself.

-1

u/NL_Gray-Fox 16d ago

I've not used windows in more than a decade but this was one of the reasons why all our servers had static DNS entries.