[SOLVED] sendmail, where is darkstar coming from?

mfoley · 03-27-2016, 02:26 PM

I am using sendmail 8.14.9 on Slackware64 14.1, kernel 3.10.17. I just re-installed the OS, and upgraded all.

This host's IP is 192.68.0.3. It relays to a smart host. The maillog on the smart host has:

Code:

Mar 27 15:04:25 mail sm-mta[25371]: u2RJ4PuL025371: from=<root@webserver.hprs.local>, size=7921, class=0, nrcpts=20, msgid=<008301d185be$9a8ae790$cfa0b6b0$@ohprs.org>, proto=ESMTP, daemon=MTA, relay=darkstar.hprs.local [192.168.0.3]

You can see that the "relay" is shown as darkstar. Where is this coming from? That is the default hostname for a fresh install, but that name is not in my current /etc/hosts, etc/HOSTNAME, or /etc/mail/sendmail.cf. I've rebooted that computer several times.

bathory · 03-28-2016, 02:00 AM

Hi,

Take a look at this
Or run pkgtool -> setup -> netconfig

Regards

oldtechaa · 03-28-2016, 06:34 AM

Darkstar is set as the Slackware kernel's default hostname at compile time.

mfoley · 04-01-2016, 10:55 AM

On the actual host, the name is not darkstar. It is the assigned name:

$ hostname
webserver

I think the darkstar name is somehow "stuck" in the dns:

$ host 192.168.0.3
3.0.168.192.in-addr.arpa domain name pointer darkstar.hprs.local.

It's been well over a week since I set this computer up and the name is still darkstar. My zonefile is:

Code:

$ORIGIN .
$TTL 14400      ; 4 hours
hprs.local              IN SOA  mail.hprs.local. hostmaster.hprs.local. (
                                2014123827 ; serial
                                10800      ; refresh (3 hours)
                                3600       ; retry (1 hour)
                                28800      ; expire (8 hours)
                                3600       ; minimum (1 hour)
                                )
                        NS      mail.hprs.local.
                        A       192.168.0.2
$ORIGIN hprs.local.
$TTL 3600       ; 1 hour
37L4247F27-25           A       192.168.0.52
                        TXT     "31e495ab9beab3bba63ae1165feab6d82f"
$TTL 14400      ; 4 hours

All timeouts are less than a week.

Any ideas on how to fix this? Can I refresh the dns? Why is this name persisting after a week?

bathory · 04-01-2016, 03:30 PM

Quote:

I think the darkstar name is somehow "stuck" in the dns:
$ host 192.168.0.3
3.0.168.192.in-addr.arpa domain name pointer darkstar.hprs.local.

In this case you need to edit the zonefile of the 0.168.192.in-addr.arpa zone (the reverse zone).
BTW in the forward zone you've posted there is no A RR for webserver.hprs.local.

mfoley · 04-02-2016, 11:36 AM

Quote:

Originally Posted by bathory

In this case you need to edit the zonefile of the 0.168.192.in-addr.arpa zone (the reverse zone).
BTW in the forward zone you've posted there is no A RR for webserver.hprs.local.

The webserver host is not defined in the zone file explicitly. It is in /etc/dhcpd.conf:

Code:

host webserver {
    hardware ethernet 60:A4:4C:61:9C:FE;
    fixed-address 192.168.0.3;
}

probably this means not editing the zonefile, but something else?

Here is the 0.168.192.in-addr.arpa zone:

Code:

$ORIGIN .
$TTL 14400      ; 4 hours
0.168.192.in-addr.arpa  IN SOA  mail.hprs.local. sysadmin.mail.ohprs.org. (
                                334        ; serial
                                10800      ; refresh (3 hours)
                                3600       ; retry (1 hour)
                                28800      ; expire (8 hours)
                                3600       ; minimum (1 hour)
                                )
                        NS      mail.hprs.local.
$ORIGIN 0.168.192.in-addr.arpa.
$TTL 3600       ; 1 hour
102                     PTR     vaio.hprs.local.
103                     PTR     dbserver.hprs.local.
125                     PTR     labrat.hprs.local.
$TTL 14400      ; 4 hours
2                       PTR     mail.hprs.local.
$TTL 3600       ; 1 hour
20                      PTR     RNP0026735563AB.hprs.local.
21                      PTR     FPHX.hprs.local.
$TTL 28800      ; 8 hours
24                      PTR     security.hprs.local.
                        PTR     LocalHost.hprs.local.
$TTL 3600       ; 1 hour
3                       PTR     darkstar.hprs.local.
$TTL 1200       ; 20 minutes
4                       PTR     server.hprs.local.
$TTL 3600       ; 1 hour
5                       PTR     OHPRSstorage.hprs.local.

Should these get refreshed automatically w/o editing? Interestingly, the journal file only has entried for host that haven't existed for nearly a year.

Maybe I have bigger problems that I realize ...

bathory · 04-02-2016, 04:56 PM

Quote:

Should these get refreshed automatically w/o editing?

Yes if you've configured your dhcp and dns servers for automatic (dynamic) updates.
If not, but you want to do so, have a look here
Otherwise edit the 0.168.192.in-addr.arpa zonefile and use:

Code:

3                       PTR     webserver.hprs.local.

Increase the serial and reload the dns server

mfoley · 04-09-2016, 05:19 PM

This is driving me nuts! It's now been about 20 days since installing the new host and I am still getting "darkstar" in response to `host 192.168.0.3`. darkstar is still in my zone file (with a $TTL of 1 hour!). Yes, I know I could edit it out of the zonefile, but this stuff is supposed to be automatic, so I want to track down the problem.

Here is the germane part of my dhcpd.conf:

Code:

 1
 2      authoritative;
 3
 4      ddns-updates on;
 5      update-static-leases on;
 6      allow unknown-clients;  # default, deprecated (man dhcpd.conf)
 7      ignore client-updates;  # see https://www.centos.org/forums/viewtopic.php?t=29256, man dhcpd.conf: igno
re client-updates
 8      ddns-update-style interim;
 9      default-lease-time 86400;
10
11      log-facility local7;
12
13      zone hprs.local. { primary 192.168.0.2; }
14      zone 0.168.192.in-addr.arpa. { primary 192.168.0.2; }
15
16      subnet 192.168.0.0 netmask 255.255.255.0 {
17          option routers 192.168.0.2;
18          range 192.168.0.100 192.168.0.254;
19          option domain-name-servers 192.168.0.2;
20          option domain-name "hprs.local";
21          ddns-domainname = "hprs.local.";
22          ddns-rev-domainname = "in-addr.arpa.";
23      }
24
25      host webserver {
26          hardware ethernet 60:A4:4C:61:9C:FE;
27          fixed-address 192.168.0.3;
28      }

It is configured for updates (line 4). This dhcpd assigned IP and hostname are in 25-28.

I need ideas!

bathory · 04-10-2016, 08:35 AM

Quote:

It is configured for updates (line 4)

I don't see the key, that dhcpd should use in order to dynamically update dns.
And you also need to configure the dns server to allow updates from dhcpd.
Have a look again at the link in my previous post.

mfoley · 04-12-2016, 12:20 AM

Quote:

Originally Posted by bathory

I don't see the key, that dhcpd should use in order to dynamically update dns.
And you also need to configure the dns server to allow updates from dhcpd.
Have a look again at the link in my previous post.

Yes, I did look at that link. My understanding was that a "key" in not required. Rather than using the key as shown in that link:

allow-update { key dhcpupdate; };

I'm specifying the permitted IP range. The zone configs in my named.conf are shown below.

Code:

zone "hprs.local." IN {
        type master;
        allow-update { 192.168.0.0/24; 127.0.0.1; };           // local DHCP server
        file "/etc/samba/private/dns/hprs.local.zone";

        /* we need to use check-names ignore so _msdcs A records can be created */
        check-names ignore;
};

zone "0.168.192.in-addr.arpa" in {
    type master;
    allow-update { 192.168.0.0/24; 127.0.0.1; };           // local DHCP server
    file "/etc/samba/private/dns/db.192.168.0";
};

Another interesting bit ... I am logging dhcpd activity. I have DHCP[REQUEST|ACK]s from other of the hosts, but not for 192.168.0.3:

Code:

Apr 12 01:11:29 mail dhcpd: DHCPINFORM from 192.168.0.4 via eth1
Apr 12 01:11:29 mail dhcpd: DHCPACK to 192.168.0.4 (3c:1e:04:47:16:b0) via eth1

There are 15 such hosts ... excepting 192.168.0.3. Yes, 192.168.0.3 does have the nameserver host (192.168.0.2) configured in /etc/resolv.conf:

Code:

search hprs.local
nameserver 192.168.0.2
nameserver 209.18.47.61

Interestingly, and confusingly, the bogus "darkstar" hostname and the correct hostname are in the journal file:

Code:

$ named-checkzone -Dj hprs.local /etc/samba/private/dns/hprs.local.zone
# (stuff deleted)
darkstar.hprs.local.                          3600 IN A         192.168.0.3
darkstar.hprs.local.                          3600 IN TXT       "31fc87cb127f955a2bc6cef5d75f195260"
webserver.hprs.local.                         3600 IN A         192.168.0.3
webserver.hprs.local.                         3600 IN TXT       "00a72c84d5da5a7047247078f738268ec3"

So, it looks like the update is working for all other hosts, just not 192.168.0.3. Short of the key-thing, other ideas?

bathory · 04-12-2016, 03:03 AM

Quote:

So, it looks like the update is working for all other hosts, just not 192.168.0.3. Short of the key-thing, other ideas?

Well, I guess that since you assign always the ip 192.168.0.3 to the same host, you actually use a static ip for that host, so it doesn't get updated by dchp.
You could edit the zone file by hand and change the hostname from darkstar to webserver

mfoley · 04-12-2016, 01:18 PM

Quote:

Originally Posted by bathory

Well, I guess that since you assign always the ip 192.168.0.3 to the same host, you actually use a static ip for that host, so it doesn't get updated by dchp.
You could edit the zone file by hand and change the hostname from darkstar to webserver

I may end up resorting to the edit option, but in drilling-down on this problem I've uncovered others. It seems that webserver/darkstar is not the only IP with issues. I have this same problem with other hosts, but it doesn't show up since the bad hostname sorts later than the good name, unlike darkstar sorting before webserver.

I've posted another question on this issue which manifests itself in the DNS journal file

http://www.linuxquestions.org/questi...le-4175577276/ (though that may not be the source of the problem)

bathory · 04-12-2016, 04:24 PM

Quote:

I may end up resorting to the edit option, but in drilling-down on this problem I've uncovered others. It seems that webserver/darkstar is not the only IP with issues. I have this same problem with other hosts, but it doesn't show up since the bad hostname sorts later than the good name, unlike darkstar sorting before webserver.

Not recommended, but you may edit manually the dhcpd.leases file (after stopping dhcpd) to correct the static hostnames and remove the stalled hosts.
Then start dhcpd.

Quote:

I've posted another question on this issue which manifests itself in the DNS journal file

http://www.linuxquestions.org/questi...le-4175577276/ (though that may not be the source of the problem)

If the method above didn't work, edit manually the zone file:

Code:

rndc freeze hprs.local
<edit the zonefile>
rndc thaw hprs.local

mfoley · 04-21-2016, 12:42 PM

Problem solved. I did have to edit the zone files. According to other experts, old DNS entries don't necessarily get removed automatically. I used nsupdate to edit the files. See http://www.linuxquestions.org/questi...le-4175577276/ for details on the solution.