[Samba] Samba4 with external bind

Discussion:

[Samba] Samba4 with external bind - best practices?

Elias Pereira

2016-07-25 19:12:50 UTC

Hello guys,

For those who already have an external DNS server on a separate machine,
how the best way to work with Samba4 ?

How to integrate this bind server with Samba configuration ways in relation
to dns (samba_internal/bind_dlz)

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

mathias dufresne

2016-07-26 08:31:00 UTC

Permalink

Hi Elias,

Separating DNS and AD services:
It should be possible to have AD DNS server hosted on a non-DC server.
Samba Wiki explain we just have to include
"/var/lib/samba/private/named.conf" in Bind configuration. This library can
be replaced be one of those shipped with Bind, this library will need
configuration for it can deal with remote DC(s).
Please note I never tried that, 'cause I'm a lazy guy, but that should be
possible: Bind+DLZ seems to me to be meant for that kind of job.

One (or more) non-DC DNS server dealing with AD DNS servers:
That is more simple to achieve:
- just configure AD DNS service as you want (please note that few weeks ago
Samba's internal DNS server was still not able to work as multi-masters
which is needed to avoid SPOF in AD, so IMHO the only valid DNS backend is
bind+DLZ if you want high availability)
- add a new zone to your existing DNS server (the one which is not AD DC)
like that one:
----------------------------------------------------------------------------------------------
zone "ad.domain.tld" IN {
type forward;
forward only;
forwarders {
<ip of 1st DC>;
<ip of 2nd DC>;
....
<ip of Nth DC>;
};
};
----------------------------------------------------------------------------------------------
Restart your external non-DC Bind service and it should be able to resolve
one more zone: the one from your AD.
What is nice in that is you don't need to take in account _msdcs zone as it
is a sub zone of "ad.domain.tld", your external Bind will also forward
requests regarding _msdcs to AD servers.

I did not played with that for a relatively long time and I'm just coming
back from vacations, so I'm not sure if you would need to allow forwarding
and recursion on that non-DC DNS server. It could be necessary... Anyway as
this DNS should be meant to resolve Internet addresses in addition of your
local domain(s) recursion and forwarding should be accepted already...

Hoping this clarify DNS management a little bit and that helps you,

Mathias

Post by Elias Pereira
Hello guys,
For those who already have an external DNS server on a separate machine,
how the best way to work with Samba4 ?
How to integrate this bind server with Samba configuration ways in relation
to dns (samba_internal/bind_dlz)
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Elias Pereira

2016-07-26 18:42:05 UTC

Permalink

Thanks Mathias and Rowland for the answers.

Rowland,

You said: “Use the sub domain for your AD domain and forward anything
outside the sub domain to your main DNS servers.”

This forward I do on the settings of the bind in Samba4?

Something like:

acl goodclients {
192.168.1.0/24;
localhost;
localnets;
};

options {
directory "/var/cache/bind";

recursion yes;
allow-query { goodclients; };

forwarders {
192.168.1.15; # EXTERNAL DNS SERVER
};
forward only;

dnssec-validation auto;

auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};

Post by mathias dufresne
Hi Elias,
It should be possible to have AD DNS server hosted on a non-DC server.
Samba Wiki explain we just have to include
"/var/lib/samba/private/named.conf" in Bind configuration. This library can
be replaced be one of those shipped with Bind, this library will need
configuration for it can deal with remote DC(s).
Please note I never tried that, 'cause I'm a lazy guy, but that should be
possible: Bind+DLZ seems to me to be meant for that kind of job.
- just configure AD DNS service as you want (please note that few weeks ago
Samba's internal DNS server was still not able to work as multi-masters
which is needed to avoid SPOF in AD, so IMHO the only valid DNS backend is
bind+DLZ if you want high availability)
- add a new zone to your existing DNS server (the one which is not AD DC)
----------------------------------------------------------------------------------------------
zone "ad.domain.tld" IN {
type forward;
forward only;
forwarders {
<ip of 1st DC>;
<ip of 2nd DC>;
....
<ip of Nth DC>;
};
};
----------------------------------------------------------------------------------------------
Restart your external non-DC Bind service and it should be able to resolve
one more zone: the one from your AD.
What is nice in that is you don't need to take in account _msdcs zone as it
is a sub zone of "ad.domain.tld", your external Bind will also forward
requests regarding _msdcs to AD servers.
I did not played with that for a relatively long time and I'm just coming
back from vacations, so I'm not sure if you would need to allow forwarding
and recursion on that non-DC DNS server. It could be necessary... Anyway as
this DNS should be meant to resolve Internet addresses in addition of your
local domain(s) recursion and forwarding should be accepted already...
Hoping this clarify DNS management a little bit and that helps you,
Mathias

https://wiki.samba.org/index.php/Configure_BIND_as_backend_for_Samba_AD
* Since the BIND DLZ module accesses the AD database directly, BIND
for AD zones must be on the same machine.
* Because the BIND DLZ module uses the information already stored in
AD, you do not need to create any extra databases.
Or to put it another way, if you want to use bind_dlz, you must run Bind9
on the DC and you do not need to create any zones (except the reverse zone
and you have to do this anyway)
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
Elias Pereira
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

mathias dufresne

2016-07-27 12:34:10 UTC

Permalink

https://wiki.samba.org/index.php/Configure_BIND_as_backend_for_Samba_AD
* Since the BIND DLZ module accesses the AD database directly, BIND
for AD zones must be on the same machine.

This, for me, means: as long as we use the BIND DLZ module provided by
Samba, Bind must run on same host as Samba AD DC".
In other words, you should be able to move Bind to another host if, as I
said yesterday, you accept to use standard module (so not Samba's Bind
module) and configure it correctly. Of course this is more complicated to
achieve, especially compared to the forward zone I described also yesterday.

* Because the BIND DLZ module uses the information already stored in
AD, you do not need to create any extra databases.
Or to put it another way, if you want to use bind_dlz, you must run Bind9
on the DC and you do not need to create any zones (except the reverse zone
and you have to do this anyway)
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Elias Pereira

2016-07-27 15:32:34 UTC

Permalink

I found this article about separate samba4 and bind.
https://quercerjanath.wordpress.com/samba-active-directory-with-bind9-on-separate-machines-ubuntu-14-04/

Post by mathias dufresne

Post by mathias dufresne
possible: Bind+DLZ seems to me to be meant for that kind of job.
- just configure AD DNS service as you want (please note that few weeks ago
Samba's internal DNS server was still not able to work as multi-masters
which is needed to avoid SPOF in AD, so IMHO the only valid DNS backend

Post by mathias dufresne
bind+DLZ if you want high availability)
- add a new zone to your existing DNS server (the one which is not AD

DC)
----------------------------------------------------------------------------------------------

Post by mathias dufresne
zone "ad.domain.tld" IN {
type forward;
forward only;
forwarders {
<ip of 1st DC>;
<ip of 2nd DC>;
....
<ip of Nth DC>;
};
};

----------------------------------------------------------------------------------------------

Post by mathias dufresne
Restart your external non-DC Bind service and it should be able to

resolve

Post by mathias dufresne
one more zone: the one from your AD.
What is nice in that is you don't need to take in account _msdcs zone as it
is a sub zone of "ad.domain.tld", your external Bind will also forward
requests regarding _msdcs to AD servers.
I did not played with that for a relatively long time and I'm just

coming

Post by mathias dufresne
back from vacations, so I'm not sure if you would need to allow

forwarding

Post by mathias dufresne
and recursion on that non-DC DNS server. It could be necessary... Anyway as
this DNS should be meant to resolve Internet addresses in addition of

your

Post by mathias dufresne
local domain(s) recursion and forwarding should be accepted already...
Hoping this clarify DNS management a little bit and that helps you,
Mathias

https://wiki.samba.org/index.php/Configure_BIND_as_backend_for_Samba_AD
* Since the BIND DLZ module accesses the AD database directly, BIND
for AD zones must be on the same machine.

zone

and you have to do this anyway)
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Jeff Sadowski

2016-07-27 19:02:54 UTC

Permalink

Looking over this thread it got me thinking of multiple domains and then
thinking maybe it would be better to setup the external DNS as a slave to
the AD domain?

Then you could have it resolve from the external DNS for multiple AD
domains.

Post by Elias Pereira
I found this article about separate samba4 and bind.
https://quercerjanath.wordpress.com/samba-active-directory-with-bind9-on-separate-machines-ubuntu-14-04/

Post by mathias dufresne

library

Post by mathias dufresne

Post by mathias dufresne
can
be replaced be one of those shipped with Bind, this library will need
configuration for it can deal with remote DC(s).
Please note I never tried that, 'cause I'm a lazy guy, but that should

Post by mathias dufresne
possible: Bind+DLZ seems to me to be meant for that kind of job.
- just configure AD DNS service as you want (please note that few

weeks

Post by mathias dufresne

Post by mathias dufresne
ago
Samba's internal DNS server was still not able to work as

multi-masters

Post by mathias dufresne

Post by mathias dufresne
which is needed to avoid SPOF in AD, so IMHO the only valid DNS

backend

Post by mathias dufresne
is

Post by mathias dufresne
bind+DLZ if you want high availability)
- add a new zone to your existing DNS server (the one which is not AD

DC)

----------------------------------------------------------------------------------------------

Post by mathias dufresne

Post by mathias dufresne
zone "ad.domain.tld" IN {
type forward;
forward only;
forwarders {
<ip of 1st DC>;
<ip of 2nd DC>;
....
<ip of Nth DC>;
};
};

----------------------------------------------------------------------------------------------

Post by mathias dufresne

Post by mathias dufresne
Restart your external non-DC Bind service and it should be able to

resolve

Post by mathias dufresne
one more zone: the one from your AD.
What is nice in that is you don't need to take in account _msdcs zone

Post by mathias dufresne

Post by mathias dufresne
it
is a sub zone of "ad.domain.tld", your external Bind will also forward
requests regarding _msdcs to AD servers.
I did not played with that for a relatively long time and I'm just

coming

Post by mathias dufresne
back from vacations, so I'm not sure if you would need to allow

forwarding

Post by mathias dufresne
and recursion on that non-DC DNS server. It could be necessary...

Anyway

Post by mathias dufresne

Post by mathias dufresne
as
this DNS should be meant to resolve Internet addresses in addition of

your

Post by mathias dufresne
local domain(s) recursion and forwarding should be accepted already...
Hoping this clarify DNS management a little bit and that helps you,
Mathias

https://wiki.samba.org/index.php/Configure_BIND_as_backend_for_Samba_AD

Post by mathias dufresne

* Since the BIND DLZ module accesses the AD database directly, BIND
for AD zones must be on the same machine.

* Because the BIND DLZ module uses the information already stored in
AD, you do not need to create any extra databases.
Or to put it another way, if you want to use bind_dlz, you must run

Bind9

Post by mathias dufresne

on the DC and you do not need to create any zones (except the reverse

zone

and you have to do this anyway)
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

mathias dufresne

2016-07-28 08:57:00 UTC

Permalink

Here we (the DNS team of our company, not me ;) chose the zone type forward
as it is the way DNS works (one resolver on client system, this resolver
will forward requests to others DNS server to get answer) and also because
that seemed to them the strongest against failure: there is no data stored
on the client resolver, there can't be corrupted data on this DNS server
when with masters / slaves slaves have to wait for synchronization, they
host data, these data can be corrupted... in addition of the very same
problems on any masters...
And we can declare as much zone with type forward as we want so it works
also with multiple domains, AD or not.

Post by Jeff Sadowski
Looking over this thread it got me thinking of multiple domains and then
thinking maybe it would be better to setup the external DNS as a slave to
the AD domain?
Then you could have it resolve from the external DNS for multiple AD
domains.

Post by Elias Pereira
I found this article about separate samba4 and bind.

https://quercerjanath.wordpress.com/samba-active-directory-with-bind9-on-separate-machines-ubuntu-14-04/