samba - Dec 2017 - [Curiosity] 'netbios aliases' works in AD mode?

On Tue, 2017-12-05 at 16:14 +0100, mj via samba wrote:
> We haved used it on a domain member server, yes.
> 
> Only one thing: when you have a compteraccount memberserver$ in your AD, 
> you cannot use "memberserver" as an alias on another machine)
And you should register any such alias as a servicePrincpalName.

Andrew Bartlett
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Mandi! Andrew Bartlett via samba
  In chel di` si favelave...
> > We haved used it on a domain member server, yes.
> > Only one thing: when you have a compteraccount memberserver$ in your
AD,
> > you cannot use "memberserver" as an alias on another
machine)
> And you should register any such alias as a servicePrincpalName.
Ahem, looking at the wiki ad google does not help me.


Supposing to have a DM like 'vdmsv1.ad.fvg.lnf.it', and i need to
create an alias 'file', i need to add 'file' to 'netbios
aliases' and
also do something like:

	samba-tool spn add host/vdmsv1.ad.fvg.lnf.it file.ad.fvg.lnf.it


This lead me to another question: in this way, aliases are ''domain
wide'' right? Eg, i cannot have a DM aliased 'file' in a LAN and
another DM aliased 'file' in another LAN, as was used before with NT
like domains (two different domains).

Right?

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

On Wed, 2017-12-06 at 11:19 +0100, Marco Gaiarin via samba
wrote:
> Mandi! Andrew Bartlett via samba
>   In chel di` si favelave...
> 
> > > We haved used it on a domain member server, yes.
> > > Only one thing: when you have a compteraccount memberserver$ in
your AD,
> > > you cannot use "memberserver" as an alias on another
machine)
> > 
> > And you should register any such alias as a servicePrincpalName.
> 
> Ahem, looking at the wiki ad google does not help me.
> 
> 
> Supposing to have a DM like 'vdmsv1.ad.fvg.lnf.it', and i need to
> create an alias 'file', i need to add 'file' to
'netbios aliases' and
> also do something like:
> 
> 	samba-tool spn add host/vdmsv1.ad.fvg.lnf.it file.ad.fvg.lnf.it
> 
> 
> This lead me to another question: in this way, aliases are ''domain
> wide'' right? Eg, i cannot have a DM aliased 'file' in a
LAN and
> another DM aliased 'file' in another LAN, as was used before with
NT
> like domains (two different domains).
Correct, you can't use the different netbios namespaces to do that. 
Not that real NT4 allowed different netbios namespaces either, but all
sorts of games were possible (I've done that myself back in the day
with Samba).  

You can't even use DNS search paths on the clients and then fully
qualfied aliases as the client will ask for a ticket for exactly the
name stated, not the FQDN as this avoids in-secure DNS being an attack
point. 

I hope this clarifies things,

Andrew Bartlett
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba