Difference between revisions of "The Samba AD DNS Back Ends"

m (remove word)
(Remove the 'Fix DNS dynamic updates with updated Samba versions' section to a separate page, to keep this one small.)
Line 46: Line 46:
= Troubleshooting =
= Troubleshooting =
== Fix DNS dynamic updates with updated Samba versions ==
If you are running Samba 4.0.7 or later the bug https://bugzilla.samba.org/show_bug.cgi?id=9559 is already fixed.
But if your samba was updated from old releases and it´s not a fresh installation you may have problems with dynamic DNS updates with Windows XP sp3 and Windows 7.
To fix the problem you need to follow this steps:
* first of all, update your samba version if it is not the latest.
* you may want to do a kinit to avoid samba-tool asking you for a password
kinit administrator
Search for all the registry entries that contain the broken records using:
samba-tool dns query SERVER DOMAIN @ ALL
You´ll find registries like this:
Name=WORKSTATION, Records=0, Children=0
For every registry entry found like the one above you´ll need to issue the following commands
/usr/local/samba/bin/samba-tool dns add SERVER DOMAIN WORKSTATION A IP -k yes
/usr/local/samba/bin/samba-tool dns delete SERVER DOMAIN WORKSTATION A IP -k yes
On windows workstations you can run
ipconfig /registerdns
And dynamic updates should work ok.

Revision as of 17:58, 3 January 2015

Why DNS is essential for a working Active Directory

Operation of Active Directory requires several special entries in DNS. They are usually automatically added whenever the domain is provisioned, or a server or client joins the domain, or changes its name or IP address.

AD not only requires the normal entries that list the names and IP addresses of all servers and clients, but also an entry for the domain itself (i.e. domain.company.com, not just server.domain.company.com).

This domain entry contains several infos about the domain, for example a list of Domain Controllers that can be used to log on to the domain.

Without this info from the DNS server, the clients cannot find the Domain.

For this reason you absolutely must configure all servers and clients of the domain such that they query a DNS server that does have these special entries.

You can use either the internal DNS server that is built into the samba4 binary, or an external bind DNS server. Default is to use the internal server, and it is highly recommended that when you start using Samba4 as AD-DC for the first time, you install it this way. You can later switch between the two variants if needed. If you do use an external bind DNS server, it must use the DLZ backend and run on the Samba AD DC.

Whichever DNS server you use, you must configure the AD DC so that it uses or its own IP address as DNS server, and all clients must be configured to use the IP address of the AD DC as DNS. This server will usually only be able to answer queries regarding servers and clients that are members of the domain. If you want your server and clients to be able to also see the rest of the world, you must configure the DNS server to forward all queries that it cannot answer itself, to another DNS server which can resolve the rest of the world.

Which DNS backend should I choose?

You should choose the DNS backend based on the requirements of your network or existing DNS installations.

The internal DNS is a new implementation, that allows you to quickly and easily setup the DNS backend that is required for every AD installation. No further work is required to set it up. Currently it covers the important and required parts for AD.

If you already having BIND running, plan complex DNS setups or you require special functions (zone transfers only from defined hosts, etc.) that are currently not supported by the internal DNS, BIND should be the preferred backend.

Your choice of a DNS backend during provisioning/upgrading is not final. If you find that your choice doesn't fit your requirements, you can flip over and change the DNS backend.

Samba Internal DNS

The internal DNS server is built into Samba and uses AD as backend. Also it is the default DNS solution when provisioning a new Samba AD DC or upgrade from a Samba NT4 domain to Samba AD. See the documentation about the Samba Internal DNS for further information.

DNS backend BIND_DLZ

BIND 9.8 and 9.9 can be setup to provide DNS resolving for zones managed in AD. They are accessable from BIND through the DLZ (dynamically loadable zones) plug-in. Please note that BIND server must run on the same machine as the Samba AD DC! See the Bind as DNS backend HowTo for further documentation.


using ISC BIND backend with secured / signed dns updates

In the default configuration of Distributed ISC Bind in many Distributions you will find that the secured updates do not work with Samba 4. You will receive errors in /var/log/messages indicating update '<name of client>' denied i.e. This is because the rpm/deb/pkg has been compiled with the 'disable-isc-spnego' flag or/and without bind-dlz support at all . In order to fix this you will need to recompile/rebuild the distribution rpm / deb / pkg .

common Bind9 Compile flags for BIND DLZ for bind 9.9

Samba4 and up require for BIND DLZ at least --with-dlz-ldap , --with-dlz-filesystem=yes,

Common used configure flags for BIND9.8.6 and up :

--with-openssl \
--enable-threads \
--with-gssapi=yes \
--with-libtool \
--with-libxml2 \
--with-dlopen=yes \
--with-dlz-mysql \
--with-dlz-bdb \
--with-dlz-ldap \
--with-dlz-filesystem=yes \
--with-dlz-bdb=yes \
--enable-filter-aaaa \
--enable-rrl \
--with-ecdsa \
--enable-threads \
--with-idnlib='-L/usr/lib -R/usr/lib -lidn -lidn2' \

The parameters for "-L" "-R" can differ from Distribution needs.

... we ask herein  i386 / x64_64 and  Child Distribution Maintainers Members to update the package specs 
for Bind 9.8.5 and up to cover this for Samba4 in permanent.

RHEL / CENTOS / FC + clones - ReBuild Distributed ISC Bind RPM

First make sure you have your RPM build environment setup and then install the source rpm for bind. The instructions that follow are . For CENTOS 6.4 with 9.8.2-0.17.rc1.el6_4.6 being the latest version at the time of writing:

 rpm -i http://vault.centos.org/6.4/updates/Source/SPackages/bind-9.8.2-0.17.rc1.el6_4.6.src.rpm

Then locate and edit SPEC file, if your rpm build directory is ~/rpmbuild then it will be ~/rpmbuild/SPECS/bind.spec

now locate and remove the line that reads


On the example rpm provided it is line 361

now recompile your rpm

 rpmbuild -bb ~/rpmbuild/SPECS/bind.spec

Once finished you should find the replacement rpms in the RPMS/{arch} path of your build root. Replace {arch} with the relevant architecture of your machine (e.g. x86_64 or i686). Install them over the top of your existing rpms and updates should all be working again. Remember if you update with yum it may replace your copy of bind so you will either want to exclude bind* in your yum configuration or use priorities and add these rpms to a local repository.

OpenSuSE using ISC BIND backend

In the default configuration of Bind in the OpenSuSE distribution you will find that the secured updates do not work with Samba 4.1 and up . In order to fix this you will need to recompile the https://build.opensuse.org/package/show/openSUSE:Factory/bind .

User:Remsnet Published  https://github.com/remsnet/OpenSuSE-Samba-DC/blob/master/bind-9.9.4-P1.spec
 with Build Instructions at https://github.com/remsnet/OpenSuSE-Samba-DC/blob/master/Samba4-DC-DLZ.Readme

RHEL/CENTOS/FC + clones - RPM Build New ISC Bind 9.9 / 9.10

Benjamin Kraft publishes on his [1]  Bind9 Security Fixes Page.
Cleanly Patching Bind9 has almost been a task for experts ...
User:Remsnet Published https://github.com/remsnet/CentOS-Bind-DLZ SPEC File for SRPMS to Build a Clean and updated Bind9 with DLZ .

Debian / Ubuntu + clones - Build New ISC Bind 9.9 / 9.10

While following the official Samba4 HOWTO I found out that bind would not start giving me the following error (taken from my syslog):

Loading ‘AD DNS Zone’ using driver dlopen
unsupported DLZ database driver ‘dlopen’.  AD DNS Zone not loaded.

If you want some technical background as to what dlopen is read this blog post, but in short, Samba4 needs some features only available in Bind 9.8 and above. If you are getting the error I described above, you either have an earlier version or your binary version of Bind 9.8.3 or above was not compiled with support for dlz drivers.

  • To fix it I backported Bind9 from SID on i386/x86_64 .
  • To Fix it in debian RPi , you need to rebuild / recompile
Note: whenever Bing 9.8 gets backported it will become much easier to install, you will only have to follow the steps described here. For now, follow the instructions below.

Let’s remove the old version of bind first:

$ sudo apt-get remove bind9

Install required packages(wheezy):

$ apt-get update
$ sudo apt-get install devscripts build-essential libkrb5-dev debhelper libssl-dev libtool bison libdb-dev libldap2-dev libxml2-dev libpcap2-dev hardening-wrapper libgeoip-dev dpkg-dev

Download bind9 .dsc file (check here for the latest link to the .dsc file):

$ mkdir -p /usr/src/BUILD/bind9
$ cd /usr/src/BUILD/bind9
$ dget -x http://ftp.de.debian.org/debian/pool/main/b/bind9/bind9_9.9.5.dfsg-7.dsc

Now unpack bind, Configure and then compile Bind9 source code::

$ tar xvzf bind9_9.9.5.dfsg.orig.tar.gz
$ cd bind9_9.9.5.dfsg
$ fakeroot ./configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info \
        --sysconfdir=/etc/bind --localstatedir=/var --enable-threads --enable-largefile --with-libtool \
        --enable-shared --enable-static --with-openssl=/usr --with-gssapi=/usr --with-gnu-ld \
        --with-dlz-postgres=no --with-dlz-mysql=no --with-dlz-bdb=yes --with-dlz-filesystem=yes \
        --with-dlz-ldap=yes  --with-dlz-stub=yes --with-dlz-dlopen=yes \
         --with-geoip=/usr --enable-ipv6 CFLAGS=-fno-strict-aliasing 
Note: If you are using bind9 9.8.1 and below, you may find a compilation error. which can be fixed with the patch described here. You can apply the patch manually, all you have to do is edit the file contrib/dlz/drivers/sdlz_helper.c and remove the “#ifdef DLZ” line and the “#endif” line at the end of the file.

Now let’s compile and install bind9:

$ make install

Last step, we need to manually create the /var/cache/bind directory:

$ sudo mkdir /var/cache/bind

Verify Bind Compile Options with :

$ named -V

Start the service bind (weezy ) : /etc/init.d bind9 start  
Start the service bind (jessy ) : service bind9 start
  • make shure you NOT run bind with chroot while use with samba-ad and given the correct priviliges ..
  • make sure you run the provisioning steps again with bind9 running.
  • bind9 shuold start just fine - at server/bind logs it shuold show you loaded the samba-dlz zones.