On Thu, Sep 28, 2017 at 08:54:15PM +0000, Francis Dupont via RT wrote: > => it looks like it uses a system wide krb5.conf. There is no > muks@ISC.ORG in the system test. I was kinit'd as muks@ISC.ORG, so I used kdestroy to forget it. The second part of log messagees in the previous message is from when muks@ISC.ORG is no longer there. > BTW how did you get these messages? Did you run the system test > tests.sh? master branch: cd bin/tests/system sh ./run.sh tsiggss [muks@ponyo system]$ sh ./run.sh tsiggss S:tsiggss:Fri Sep 29 02:46:32 IST 2017 T:tsiggss:1:A A:System test tsiggss I:testing updates as administrator I:testing update for testdc1.example.nil. A 86400 A 10.53.0.10 I:update failed for testdc1.example.nil. A 86400 A 10.53.0.10 I:Reply from SOA query: I:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64052 I:;; flags: qr aa; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;testdc1.example.nil. IN SOA I: I:;; AUTHORITY SECTION: I:example.nil. 0 IN SOA blu.example.nil. hostmaster.example.nil. 2010113027 172800 14400 3628800 604800 I: I:Found zone name: example.nil I:The master is: blu.example.nil I:start_gssrequest I:Found realm from ticket: EXAMPLE.NIL I:send_gssrequest I:recvmsg reply from GSS-TSIG query I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8734 I:;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;2145557875.sig-blu.example.nil. ANY TKEY I: I:;; ANSWER SECTION: I:2145557875.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 0 0 3 BADKEY 0 0 I: I:dns_tkey_gssnegotiate: TKEY is unacceptable I:Outgoing update query: I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8734 I:;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 I:;; QUESTION SECTION: I:;2145557875.sig-blu.example.nil. ANY TKEY I: I:;; ADDITIONAL SECTION: I:2145557875.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 1506633392 1506633392 3 NOERROR 1321 YIIFJQYGKwYBBQUCoIIFGTCCBRWgDTALBgkqhkiG9xIBAgKiggUCBIIE /mCCBPoGCSqGSIb3EgECAgEAboIE6TCCBOWgAwIBBaEDAgEOogcDBQAg AAAAo4ID2GGCA9QwggPQoAMCAQWhDRsLRVhBTVBMRS5OSUyiITAfoAMC AQGhGDAWGwNETlMbD2JsdS5leGFtcGxlLm5pbKOCA5UwggORoAMCAReh AwIBAaKCA4MEggN/8vU9EgEjUL8Mp1I6zgbLg9V73u71FN0/Q01OKOve PDQot0QM2QH1scDk91jEtmjnamcIbZ8aXlm+wj3jJU+WZsOxw/KiEljo xbTkP05fnx8LNPX5Sr+KR8Id1D87bRzPVxKRDEmIrs7jnBLQoKLjrGhU UGqYK1CkHNfBd3VWj3viR50jnYTT8rU97N1FSgJ8Cx21AffPS0vaUHgF SVU8DIfvXoLkNlRCT/O3qPF/utVcKhnUb2QInxQq4DXVWISwIhVYt65e R0ajp46pcjCV1rTtJGKhyopdxhGGfBetyxn+wQaMRuQKGYgHKi3UQY5D 397Vc9FlQVc5x5pGSVX42OWeyg3KzSGgcBtylo/+Xdlid8b6P5BkcTiS +jWIX0HUpx9c4CCTIZ8mWjoMowEP9TrTNCDgXyaT19N/TPQ2kC4CLnX5 MsYg6MBZ1F/hhmmtUpQ9VXcKZXBP7CDxY7528da3+EeVJZWyT/6w940C x1XincAfpWqOMDQsjDTXroeYp9fxtgtzTxAXS3k3wManDf/WW3f2eBeY BV4DGg/zARBiIibf24ElYEb8EaBpj2fFR35PO8RhMmDIw/vfWWQm2d49 /KuxSRyBOAWwKd2xDJXlUuS8SZnerZC0XGv3LitLBUDsnd3y0VwsHanO 2NjyUiqR/Wmyf+gKiKVEM08931DFwUOwdSh9V2pwGpUI07MnGhVJrcmQ 1UbRlTDPmpPWLD/SEqqkxDLcL401gkYk79EuePvQJbRsN/5gYd3hDCKX 0J+tjNjpN74QMknU529IUYu63QnWPw1Lvgl6TMqgugGCTy07HJa4IfGS t6NMakMON0/D06PDwaCwvPQLyPJKC81CekqMfjaS6DXj67cFKOyNWeQI JvUv24fxrmoLJKhA7MLwlUBNAaKLS4EMdp+uQbZ9Zxrh3Lfm1lO4JEWp YJ4Yrf8gC+OFzz5Iho7PcEI7BkDcHgChDFp1F4uDKW2tIkfBohceoeWS k/e5+aL8ccMlex7BnBMb+5ip1BX0EnimPwET66Xxnc96H/QftFypp3AD o2u2Bqu6EK0IKO1eBQHTrC6Y9Fv5J5Bc/tRyeTMkYoyzr7DWr3/32e0e CfyGtKFby3CRtJ74nW1X4P15xekp3whHfkZq1hfGXMrDEkFH3It8F2o2 IWvMoQkuuaBHhekkWVrAW3TD1+qcYflEt6SB8zCB8KADAgEXooHoBIHl QOPfWBrUx0Uz8g1zLxfHjvqrubwdK4Oe0RB4GPCspDHzSl732SfsvG1W V5w8LXcxTaVvnBO0pQPupqrPb+VStdFXnXk8npquzE0ynAmaia/6SiRg YhWVdDMy5Uxi52vjAkEoOToPlDYdc7tcaIY+yZBBzAXXdb7v7ocvDlfp Izz5GlE/BoZ98ksZM6dDmqrcW0mRJmFG8CbS9dix+mOCd046pdIqdgBN I/LSk2olbm33vXYkE/ATqoruOOKFi2CyTWWbnilk/oIPRbBTc3QzrMy3 /1fdFba47smSDgGk9CkvGtY4pg== 0 I: I:testing update for testdc2.example.nil. A 86400 A 10.53.0.11 I:update failed for testdc2.example.nil. A 86400 A 10.53.0.11 I:Reply from SOA query: I:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24209 I:;; flags: qr aa; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;testdc2.example.nil. IN SOA I: I:;; AUTHORITY SECTION: I:example.nil. 0 IN SOA blu.example.nil. hostmaster.example.nil. 2010113027 172800 14400 3628800 604800 I: I:Found zone name: example.nil I:The master is: blu.example.nil I:start_gssrequest I:Found realm from ticket: EXAMPLE.NIL I:send_gssrequest I:recvmsg reply from GSS-TSIG query I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33251 I:;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;2657258321.sig-blu.example.nil. ANY TKEY I: I:;; ANSWER SECTION: I:2657258321.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 0 0 3 BADKEY 0 0 I: I:dns_tkey_gssnegotiate: TKEY is unacceptable I:Outgoing update query: I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33251 I:;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 I:;; QUESTION SECTION: I:;2657258321.sig-blu.example.nil. ANY TKEY I: I:;; ADDITIONAL SECTION: I:2657258321.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 1506633392 1506633392 3 NOERROR 1321 YIIFJQYGKwYBBQUCoIIFGTCCBRWgDTALBgkqhkiG9xIBAgKiggUCBIIE /mCCBPoGCSqGSIb3EgECAgEAboIE6TCCBOWgAwIBBaEDAgEOogcDBQAg AAAAo4ID2GGCA9QwggPQoAMCAQWhDRsLRVhBTVBMRS5OSUyiITAfoAMC AQGhGDAWGwNETlMbD2JsdS5leGFtcGxlLm5pbKOCA5UwggORoAMCAReh AwIBAaKCA4MEggN/8vU9EgEjUL8Mp1I6zgbLg9V73u71FN0/Q01OKOve PDQot0QM2QH1scDk91jEtmjnamcIbZ8aXlm+wj3jJU+WZsOxw/KiEljo xbTkP05fnx8LNPX5Sr+KR8Id1D87bRzPVxKRDEmIrs7jnBLQoKLjrGhU UGqYK1CkHNfBd3VWj3viR50jnYTT8rU97N1FSgJ8Cx21AffPS0vaUHgF SVU8DIfvXoLkNlRCT/O3qPF/utVcKhnUb2QInxQq4DXVWISwIhVYt65e R0ajp46pcjCV1rTtJGKhyopdxhGGfBetyxn+wQaMRuQKGYgHKi3UQY5D 397Vc9FlQVc5x5pGSVX42OWeyg3KzSGgcBtylo/+Xdlid8b6P5BkcTiS +jWIX0HUpx9c4CCTIZ8mWjoMowEP9TrTNCDgXyaT19N/TPQ2kC4CLnX5 MsYg6MBZ1F/hhmmtUpQ9VXcKZXBP7CDxY7528da3+EeVJZWyT/6w940C x1XincAfpWqOMDQsjDTXroeYp9fxtgtzTxAXS3k3wManDf/WW3f2eBeY BV4DGg/zARBiIibf24ElYEb8EaBpj2fFR35PO8RhMmDIw/vfWWQm2d49 /KuxSRyBOAWwKd2xDJXlUuS8SZnerZC0XGv3LitLBUDsnd3y0VwsHanO 2NjyUiqR/Wmyf+gKiKVEM08931DFwUOwdSh9V2pwGpUI07MnGhVJrcmQ 1UbRlTDPmpPWLD/SEqqkxDLcL401gkYk79EuePvQJbRsN/5gYd3hDCKX 0J+tjNjpN74QMknU529IUYu63QnWPw1Lvgl6TMqgugGCTy07HJa4IfGS t6NMakMON0/D06PDwaCwvPQLyPJKC81CekqMfjaS6DXj67cFKOyNWeQI JvUv24fxrmoLJKhA7MLwlUBNAaKLS4EMdp+uQbZ9Zxrh3Lfm1lO4JEWp YJ4Yrf8gC+OFzz5Iho7PcEI7BkDcHgChDFp1F4uDKW2tIkfBohceoeWS k/e5+aL8ccMlex7BnBMb+5ip1BX0EnimPwET66Xxnc96H/QftFypp3AD o2u2Bqu6EK0IKO1eBQHTrC6Y9Fv5J5Bc/tRyeTMkYoyzr7DWr3/32e0e CfyGtKFby3CRtJ74nW1X4P15xekp3whHfkZq1hfGXMrDEkFH3It8F2o2 IWvMoQkuuaBHhekkWVrAW3TD1+qcYflEt6SB8zCB8KADAgEXooHoBIHl GbE/zadTJEAiX5W142Y5S4CVCGQab/gZ7/OHQRxjRyGye4cBEo1xWHmM fTrkfWZm2r/BzuQYqkktgPFSnyxNZ5wQFegLORROQEaUZgcvLcBJaooA nQFLLlMhaed98oqWdGv3Zso56z2LWtyPo3z4NZiO/EIjOcnEtpXeWLV4 8PBAgqc9SM3wduBKSJeVsroC1xMdw3lLUB3B2XQH6+U7n4Ezj9uRAvDy utHaV2IpvXY8st2F2uBiym6a37YCAtWcGFwWHZxUsA8yR8OZxp4VHZQE dzEwQD0oDYZgCKiO0ViqE0Melg== 0 I: I:testing updates as a user I:testing update for testdenied.example.nil. TXT 86400 TXT helloworld I:update failed for testdenied.example.nil. TXT 86400 TXT helloworld I:Reply from SOA query: I:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55486 I:;; flags: qr aa; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;testdenied.example.nil. IN SOA I: I:;; AUTHORITY SECTION: I:example.nil. 0 IN SOA blu.example.nil. hostmaster.example.nil. 2010113027 172800 14400 3628800 604800 I: I:Found zone name: example.nil I:The master is: blu.example.nil I:start_gssrequest I:Found realm from ticket: EXAMPLE.NIL I:send_gssrequest I:recvmsg reply from GSS-TSIG query I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52424 I:;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;786568219.sig-blu.example.nil. ANY TKEY I: I:;; ANSWER SECTION: I:786568219.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 0 0 3 BADKEY 0 0 I: I:dns_tkey_gssnegotiate: TKEY is unacceptable I:Outgoing update query: I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52424 I:;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 I:;; QUESTION SECTION: I:;786568219.sig-blu.example.nil. ANY TKEY I: I:;; ADDITIONAL SECTION: I:786568219.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 1506633392 1506633392 3 NOERROR 1259 YIIE5wYGKwYBBQUCoIIE2zCCBNegDTALBgkqhkiG9xIBAgKiggTEBIIE wGCCBLwGCSqGSIb3EgECAgEAboIEqzCCBKegAwIBBaEDAgEOogcDBQAg AAAAo4IDnWGCA5kwggOVoAMCAQWhDRsLRVhBTVBMRS5OSUyiITAfoAMC AQGhGDAWGwNETlMbD2JsdS5leGFtcGxlLm5pbKOCA1owggNWoAMCAReh AwIBAaKCA0gEggNEXrVGXH+CQCmXTmcw3qYaIiXDltiPCi20gnWRpKTW CyZJhiCZNfzIW4gBL8bYYfZ7SiVO+Hb7AbsPmtyAw9puT2PNEBayHEjw hkfFJuehjfDb4OuRshrSjjPq/FZr8LE50OGUMiBpywYAKNh5lktzjA/N ZHTAqpqmA1M+1TH5hKS13J+iymLati4arXkhHK9gHw3PwtyqII1WfeSR 1fI6sp1UlxGqF6C8VgBcGJHpn6ajQxXEV95ZTg6UHHjERUEJT3ZYVtKd Q2j7BoUf5L/VpjbJKDxJE3liMCQ+m/qchkugN2Lr2fHpeCir0llsXKLA 3I6eLrl4fmgXrDKTqhBcC4jfT4q8iKxYdMLgWA2g7WA9+xUXgYCEQXlS 5MxFlbC/YOkPOb/pBMU8fvJ1kCpeMuvLmIk/25UE6pusM9UoCUG3Rd7t TfuR50FY9+uwiNWpzZ+MTk5Vc/pHucAIjSGa1zrwew8rjmuE1dfzBWZh hCiesm7YWzeZ+BRNgin7FuiAM5fBsQyjF7weMo5HR99H2fqXq5SAYsnz 2wl5YLaRnwNNQFonNhFdgS2wDnz7MONXThHxhBzJDs/sRNl1HlH4ldzh 50ZI+z2hSnRH8ma/FY+G2bwSElCPB3sgXNg5hD1mchamrL+CxD5s70v+ h+eydtyXLFq3l2hNyntWFpFPe5UnRh8NpRZS9ZsxsiWhOe6m1CuLBuom FJXIXsB8kMMWgfpdbhEmN9+CXy+BNaENETUyBh8OldivHXX4sYL2T0Ub c/1K9oxCpCGBOcs3esPl2ucbCCLf/20kf+j8iyVVDdT0DN7dS7ReMtch pYCqJjVJNcD4WlwusorpE5ZtVtzhBa2v2lr4/bE5tVEqogkYi6tbBDTK j3CSJDckwxxzo1bCG7JoD25KJbUrN+F0JzO9jameENaWAA9HGa7D69FL gQDAamDrWg8dWP1BB2leUXoy3fcpxXawicGB2B2CTuIT8Xc43XFee8GW lKbGNt0TVWe1agI/TqnoNXut7kXwodCTkezrX7DRo0XM7iOmeUmAeXqh CF1nmm9p1CKq8UoK1g9VTCpvBMg9Io6I9LLEcop+8n7ZHwQLe7qSwSoe dQU/XbLyfgGkgfAwge2gAwIBF6KB5QSB4qd2lWfogmh15XLYINTPaEIi ntzBH4ge9WBztjOzbUfEhNPulHSAJX9g9czCu6B8AJzsEn2Ov6KxNt08 zFqf9vBZQ5NmrxGF3b4HnDwzQ70U3oAsGd/vmOG8ZznhfMGGOWLrcd9F QG0RK3ggkwkbFPzOxPbCYZEYJaXsICHwqHwP4NBHr7Ga4kcuDSi6peGw lElzQo3m1dkIOmt72Vba/oOwEQvjdFqTcHbf4LKghbi87ISqoqSerGzm h2b2yAnGQDGBwSEyy+zdh5qy1Hc3NljUeN1+euH7fE9k6/rBxh1bXIA= 0 I: I:testing external update policy I:testing update for testcname.example.nil. TXT 86400 CNAME testdenied.example.nil I:update failed for testcname.example.nil. TXT 86400 CNAME testdenied.example.nil I:Reply from SOA query: I:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43138 I:;; flags: qr aa; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;testcname.example.nil. IN SOA I: I:;; AUTHORITY SECTION: I:example.nil. 0 IN SOA blu.example.nil. hostmaster.example.nil. 2010113027 172800 14400 3628800 604800 I: I:Found zone name: example.nil I:The master is: blu.example.nil I:start_gssrequest I:Found realm from ticket: EXAMPLE.NIL I:send_gssrequest I:recvmsg reply from GSS-TSIG query I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30350 I:;; flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 I:;; QUESTION SECTION: I:;4057323384.sig-blu.example.nil. ANY TKEY I: I:;; ANSWER SECTION: I:4057323384.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 0 0 3 BADKEY 0 0 I: I:dns_tkey_gssnegotiate: TKEY is unacceptable I:Outgoing update query: I:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30350 I:;; flags:; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 I:;; QUESTION SECTION: I:;4057323384.sig-blu.example.nil. ANY TKEY I: I:;; ADDITIONAL SECTION: I:4057323384.sig-blu.example.nil. 0 ANY TKEY gss-tsig. 1506633393 1506633393 3 NOERROR 1259 YIIE5wYGKwYBBQUCoIIE2zCCBNegDTALBgkqhkiG9xIBAgKiggTEBIIE wGCCBLwGCSqGSIb3EgECAgEAboIEqzCCBKegAwIBBaEDAgEOogcDBQAg AAAAo4IDnWGCA5kwggOVoAMCAQWhDRsLRVhBTVBMRS5OSUyiITAfoAMC AQGhGDAWGwNETlMbD2JsdS5leGFtcGxlLm5pbKOCA1owggNWoAMCAReh AwIBAaKCA0gEggNEXrVGXH+CQCmXTmcw3qYaIiXDltiPCi20gnWRpKTW CyZJhiCZNfzIW4gBL8bYYfZ7SiVO+Hb7AbsPmtyAw9puT2PNEBayHEjw hkfFJuehjfDb4OuRshrSjjPq/FZr8LE50OGUMiBpywYAKNh5lktzjA/N ZHTAqpqmA1M+1TH5hKS13J+iymLati4arXkhHK9gHw3PwtyqII1WfeSR 1fI6sp1UlxGqF6C8VgBcGJHpn6ajQxXEV95ZTg6UHHjERUEJT3ZYVtKd Q2j7BoUf5L/VpjbJKDxJE3liMCQ+m/qchkugN2Lr2fHpeCir0llsXKLA 3I6eLrl4fmgXrDKTqhBcC4jfT4q8iKxYdMLgWA2g7WA9+xUXgYCEQXlS 5MxFlbC/YOkPOb/pBMU8fvJ1kCpeMuvLmIk/25UE6pusM9UoCUG3Rd7t TfuR50FY9+uwiNWpzZ+MTk5Vc/pHucAIjSGa1zrwew8rjmuE1dfzBWZh hCiesm7YWzeZ+BRNgin7FuiAM5fBsQyjF7weMo5HR99H2fqXq5SAYsnz 2wl5YLaRnwNNQFonNhFdgS2wDnz7MONXThHxhBzJDs/sRNl1HlH4ldzh 50ZI+z2hSnRH8ma/FY+G2bwSElCPB3sgXNg5hD1mchamrL+CxD5s70v+ h+eydtyXLFq3l2hNyntWFpFPe5UnRh8NpRZS9ZsxsiWhOe6m1CuLBuom FJXIXsB8kMMWgfpdbhEmN9+CXy+BNaENETUyBh8OldivHXX4sYL2T0Ub c/1K9oxCpCGBOcs3esPl2ucbCCLf/20kf+j8iyVVDdT0DN7dS7ReMtch pYCqJjVJNcD4WlwusorpE5ZtVtzhBa2v2lr4/bE5tVEqogkYi6tbBDTK j3CSJDckwxxzo1bCG7JoD25KJbUrN+F0JzO9jameENaWAA9HGa7D69FL gQDAamDrWg8dWP1BB2leUXoy3fcpxXawicGB2B2CTuIT8Xc43XFee8GW lKbGNt0TVWe1agI/TqnoNXut7kXwodCTkezrX7DRo0XM7iOmeUmAeXqh CF1nmm9p1CKq8UoK1g9VTCpvBMg9Io6I9LLEcop+8n7ZHwQLe7qSwSoe dQU/XbLyfgGkgfAwge2gAwIBF6KB5QSB4nlbsdOMQgItDkP0tk1rc2cc xcUqDQ278D9PfvMOYhautOrO0heWt2TXKJduK1U5vGKtyIIE9OmJDvCa HxJzXAYuKPGtGSN4+MiTOfrWQ4YtjIEHQj4Polvp5zaQ+yWijItro5XH KT+nzFyY5DJq8mC/6ao1cgQSSYdJ0ZtH1DViELntWKlD8EeXCwjbYpGP Q5OndoMJrcSOUCIUWo5Rz0dgl/xOesfH6dlm54497z6S31nzoRTNXffk g3xzHJnknYNNQA1/dhNkewQj8prY+G4sHpdqiQ6GqrMXhuqRk5wztVk= 0 I: I:testing external policy with SIG(0) key I:ensure too long realm name is fatal in non-interactive mode I:ensure too long realm name is not fatal in interactive mode I:exit status: 1 R:FAIL E:tsiggss:Fri Sep 29 02:46:34 IST 2017 [muks@ponyo system]$ Mukund