samba - Dec 2013 - Samba4 DNS question

Hi,

This is my first Samba4 installation, so I'm a rookie in this topic. Sorry
if I ask trivial questions.

I have a virtual server with 2 network interfaces. The first one is in the
server network, the second one is in the storage network (the samba shares are
on an NFS volume). If I start the sernet-samba-ad service with both interfaces
are up I got both IPs in the A record.

[root at samba ~]# samba-tool dns query 127.0.0.1 user.test samba A 
Password for [administrator at USER.TEST]:
  Name=, Records=2, Children=0
    A: 10.0.2.6 (flags=f0, serial=1, ttl=900)
    A: 10.0.0.106 (flags=f0, serial=110, ttl=900)

This is bad. The clients can't reach the second IP, just the first one. If I
delete it with hand (samba-tool dns delete), it dissapears until I restart the
service. Is there a method to disable this IP forever?

Another question about DNS. Can I use my BIND server as a secondary for the
zones in the Samba server?

[root at samba ~]# samba-tool dns zoneinfo 127.0.0.1 user.test
...
  aipSecondaries              : []
  aipNotify                   : []
...

Can I set the values above somehow? Do they allow the BIND to AXFR the zone?

Sorry for my bad English.

Thanks,

?rp?d Kunszt

Hello ?rp?d,

Am 19.12.2013 14:40, schrieb Kunszt ?rp?d:
> I have a virtual server with 2 network interfaces. The first one
 > is in the server network, the second one is in the storage network
 > (the samba shares are on an NFS volume). If I start the
 > sernet-samba-ad service with both interfaces are up I got both IPs
 > in the A record.

Can you try binding Samba to your none-storage-network-NIC (plus localhost):

bind interfaces only = yes
interfaces = lo ethX

And make sure, that you removed all DNS entries pointing to the other 
NIC from all zones.



> Another question about DNS. Can I use my BIND server as a
 > secondary for the zones in the Samba server?

Currently, if you use BIND DLZ on your Samba DC, then you can do zone 
transfers (regardless, what is configured in AD). This is a bug 
(https://bugzilla.samba.org/show_bug.cgi?id=9634). If you use the 
internal DNS of Samba on your DC, then you can't 
(https://bugzilla.samba.org/show_bug.cgi?id=9634#c11).

As long as the DNS backend isn't fully fixed, you can maybe use the bug 
with BIND DLZ to do zone transfers. :-) How you can switch from internal 
to BIND DLZ, I've described in the Wiki.

But it would be better if you have an additional DC. This would bring 
you reliability - not just for DNS. And in your Bind server, you can add 
a forward zone:

zone "samdom.example.com" {
          type forward;
          forwarders { 192.168.1.1; 192.168.1.2; };
  };



> [root at samba ~]# samba-tool dns zoneinfo 127.0.0.1 user.test
> ...
>    aipSecondaries              : []
>    aipNotify                   : []
> ...
>
> Can I set the values above somehow? Do they allow the BIND to AXFR the
zone?
The zone transfer/DNS stuff isn't currently fully implemented. See 
above. Depending on what kind of backend you use (internal/BIND), zone 
transfers are currently possible or not (regardless what is configured).


Regards,
Marc