samba - Nov 2018 - samba AD - bind - deleted DNS entries are not removed completely

Hello,

I've posted about this issue some time ago, but I maybe didn't explain 
myself enough and/or didn't supply enough information.

My setup is centos 7.5 samba 4.8.4 AD DCwith BIND as dns backend.

I noticed that some windows clients stopped doing secure dns dynamic 
updates because of insufficient rights error.

Upon further digging I realized that all of the entries, that were not 
able to be updated, are entries that existed some time in the past (used 
by other hosts - in forward or IP's  -in reverse and later on were for 
whatever reason deleted.

That doesn't seem right to me, that deleted DNS entry is - somewhere 
(where?) kept back and blocks new entry to be added, even though with 
same A record or PTR IP addr.

Example:

i added windows host to domain with hostname "PC-1", it created
dynamic
dns A record (PC-1 - <some-ip-address>).

I deleted this entry (using windows dns management console), removed 
"PC-1" from domain, added another host with same name (PC-1).
Obviously
it was a new member so new SID was generated.

Even though DNS entry was deleted, new "PC-1" host was nable to 
dynamically add entry, because - even though deleted - samba still 
"knew" about the deleted entry, which still had as owner previous 
"pc-1". How do I know this?

I manually then re-added "PC-1 <-whatever IP> A record to forward
zone.
And upon inspecting security TAB it had as owner unresolved sid number - 
the exact SID of the deleted original PC-1 host. That completely blocked 
new host with PC-1 hostname to dynamically update it's DNS entry

All DNS managing was done via windows DNS mmc - maybe it's the culprit?

That overall doesn't sound right. Shouldn't removed DNS entries be just 
that - removed? I restarted named, samba, did tombstone expunge with 
lifetime =0 etc.. I'm not sure how to treat this? Is this a bug? 
Expected behaviour? How can I then fix this? I'd rather not have to add 
manually records and change owners. It's not the biggest deal in forward 
zone, but it's much worse for reverse zone. E.g. recently I replaced a 
lot of PC's, all of them got new host names, but they kept IP's that 
belong to old, so now my reverse zone is mostly empty, unless I start 
manually adding entries - which I'd rather not to.

Regards,

Kacper

Hello,

Since noone answered, I'll add some more information - maybe I'm unclear
about the nature of the issue?

I re-read samba wiki, especially about DNS management and I didn't find 
any information pointing to such behaviour. I was deleting all entries 
using windows DNS management console (which is in the sama wiki, so I 
suppose it's supported)

I don't have unfortunately another  AD environment  to see if it's a bug
related to bind/samba or expected behaviour (a feature) and I'm really 
hoping, that someone could share if they ever ran into the same 
behaviour when using BIND as backend (deleted dns records not being 
fully deleted, retaining all windows ACL, including original entry-owner 
and therefore disallowing any dynamic updates for this record - throwing 
"insufficient rights" error).

Regards,

Kacper

W dniu 20.11.2018 o 23:56, Kacper Wirski via samba
pisze:
> Hello,
>
> I've posted about this issue some time ago, but I maybe didn't
explain
> myself enough and/or didn't supply enough information.
>
> My setup is centos 7.5 samba 4.8.4 AD DCwith BIND as dns backend.
>
> I noticed that some windows clients stopped doing secure dns dynamic 
> updates because of insufficient rights error.
>
> Upon further digging I realized that all of the entries, that were not 
> able to be updated, are entries that existed some time in the past 
> (used by other hosts - in forward or IP's  -in reverse and later on 
> were for whatever reason deleted.
>
> That doesn't seem right to me, that deleted DNS entry is - somewhere 
> (where?) kept back and blocks new entry to be added, even though with 
> same A record or PTR IP addr.
>
> Example:
>
> i added windows host to domain with hostname "PC-1", it created 
> dynamic dns A record (PC-1 - <some-ip-address>).
>
> I deleted this entry (using windows dns management console), removed 
> "PC-1" from domain, added another host with same name (PC-1). 
> Obviously it was a new member so new SID was generated.
>
> Even though DNS entry was deleted, new "PC-1" host was nable to 
> dynamically add entry, because - even though deleted - samba still 
> "knew" about the deleted entry, which still had as owner previous
> "pc-1". How do I know this?
>
> I manually then re-added "PC-1 <-whatever IP> A record to
forward
> zone. And upon inspecting security TAB it had as owner unresolved sid 
> number - the exact SID of the deleted original PC-1 host. That 
> completely blocked new host with PC-1 hostname to dynamically update 
> it's DNS entry
>
> All DNS managing was done via windows DNS mmc - maybe it's the culprit?
>
> That overall doesn't sound right. Shouldn't removed DNS entries be 
> just that - removed? I restarted named, samba, did tombstone expunge 
> with lifetime =0 etc.. I'm not sure how to treat this? Is this a bug? 
> Expected behaviour? How can I then fix this? I'd rather not have to 
> add manually records and change owners. It's not the biggest deal in 
> forward zone, but it's much worse for reverse zone. E.g. recently I 
> replaced a lot of PC's, all of them got new host names, but they kept 
> IP's that belong to old, so now my reverse zone is mostly empty, 
> unless I start manually adding entries - which I'd rather not to.
>
> Regards,
>
> Kacper
>
>
>

To answer my own question:

Yes, it's seems like a feature.

I ran basic ldbsearch query:

ldbsearch -H /usr/local/samba/private/sam.ldb -b 
"DC=DomainDnsZones,DC=mydomain,DC=com" and saw in output entries with:

dNSTombstoned: TRUE

Overall there are a couple hundred entries with as such. So now my 
question is:

How can I safely remove them, any tips/guideliness? I thought that doing 
tombstone expunge would get rid of them - but apparently not.

W dniu 21.11.2018 o 19:20, Kacper Wirski via samba
pisze:
> Hello,
>
> Since noone answered, I'll add some more information - maybe I'm 
> unclear about the nature of the issue?
>
> I re-read samba wiki, especially about DNS management and I didn't 
> find any information pointing to such behaviour. I was deleting all 
> entries using windows DNS management console (which is in the sama 
> wiki, so I suppose it's supported)
>
> I don't have unfortunately another  AD environment  to see if it's
a
> bug related to bind/samba or expected behaviour (a feature) and I'm 
> really hoping, that someone could share if they ever ran into the same 
> behaviour when using BIND as backend (deleted dns records not being 
> fully deleted, retaining all windows ACL, including original 
> entry-owner and therefore disallowing any dynamic updates for this 
> record - throwing "insufficient rights" error).
>
> Regards,
>
> Kacper
>
> W dniu 20.11.2018 o 23:56, Kacper Wirski via samba pisze:
>> Hello,
>>
>> I've posted about this issue some time ago, but I maybe didn't 
>> explain myself enough and/or didn't supply enough information.
>>
>> My setup is centos 7.5 samba 4.8.4 AD DCwith BIND as dns backend.
>>
>> I noticed that some windows clients stopped doing secure dns dynamic 
>> updates because of insufficient rights error.
>>
>> Upon further digging I realized that all of the entries, that were 
>> not able to be updated, are entries that existed some time in the 
>> past (used by other hosts - in forward or IP's  -in reverse and
later
>> on were for whatever reason deleted.
>>
>> That doesn't seem right to me, that deleted DNS entry is -
somewhere
>> (where?) kept back and blocks new entry to be added, even though with 
>> same A record or PTR IP addr.
>>
>> Example:
>>
>> i added windows host to domain with hostname "PC-1", it
created
>> dynamic dns A record (PC-1 - <some-ip-address>).
>>
>> I deleted this entry (using windows dns management console), removed 
>> "PC-1" from domain, added another host with same name (PC-1).
>> Obviously it was a new member so new SID was generated.
>>
>> Even though DNS entry was deleted, new "PC-1" host was nable
to
>> dynamically add entry, because - even though deleted - samba still 
>> "knew" about the deleted entry, which still had as owner
previous
>> "pc-1". How do I know this?
>>
>> I manually then re-added "PC-1 <-whatever IP> A record to
forward
>> zone. And upon inspecting security TAB it had as owner unresolved sid 
>> number - the exact SID of the deleted original PC-1 host. That 
>> completely blocked new host with PC-1 hostname to dynamically update 
>> it's DNS entry
>>
>> All DNS managing was done via windows DNS mmc - maybe it's the
culprit?
>>
>> That overall doesn't sound right. Shouldn't removed DNS entries
be
>> just that - removed? I restarted named, samba, did tombstone expunge 
>> with lifetime =0 etc.. I'm not sure how to treat this? Is this a
bug?
>> Expected behaviour? How can I then fix this? I'd rather not have to
>> add manually records and change owners. It's not the biggest deal
in
>> forward zone, but it's much worse for reverse zone. E.g. recently I
>> replaced a lot of PC's, all of them got new host names, but they
kept
>> IP's that belong to old, so now my reverse zone is mostly empty, 
>> unless I start manually adding entries - which I'd rather not to.
>>
>> Regards,
>>
>> Kacper
>>
>>
>>
>

To answer my own question:

Yes, it's seems like a feature.

I ran basic ldbsearch query:

ldbsearch -H /usr/local/samba/private/sam.ldb -b 
"DC=DomainDnsZones,DC=mydomain,DC=com" and saw in output entries with:

dNSTombstoned: TRUE

Overall there are a couple hundred entries with as such. So now my 
question is:

How can I safely remove them, any tips/guideliness? I thought that doing 
tombstone expunge would get rid of them - but apparently not.

W dniu 21.11.2018 o 19:20, Kacper Wirski via samba
pisze:
> Hello,
>
> Since noone answered, I'll add some more information - maybe I'm 
> unclear about the nature of the issue?
>
> I re-read samba wiki, especially about DNS management and I didn't 
> find any information pointing to such behaviour. I was deleting all 
> entries using windows DNS management console (which is in the sama 
> wiki, so I suppose it's supported)
>
> I don't have unfortunately another  AD environment  to see if it's
a
> bug related to bind/samba or expected behaviour (a feature) and I'm 
> really hoping, that someone could share if they ever ran into the same 
> behaviour when using BIND as backend (deleted dns records not being 
> fully deleted, retaining all windows ACL, including original 
> entry-owner and therefore disallowing any dynamic updates for this 
> record - throwing "insufficient rights" error).
>
> Regards,
>
> Kacper
>
> W dniu 20.11.2018 o 23:56, Kacper Wirski via samba pisze:
>> Hello,
>>
>> I've posted about this issue some time ago, but I maybe didn't 
>> explain myself enough and/or didn't supply enough information.
>>
>> My setup is centos 7.5 samba 4.8.4 AD DCwith BIND as dns backend.
>>
>> I noticed that some windows clients stopped doing secure dns dynamic 
>> updates because of insufficient rights error.
>>
>> Upon further digging I realized that all of the entries, that were 
>> not able to be updated, are entries that existed some time in the 
>> past (used by other hosts - in forward or IP's  -in reverse and
later
>> on were for whatever reason deleted.
>>
>> That doesn't seem right to me, that deleted DNS entry is -
somewhere
>> (where?) kept back and blocks new entry to be added, even though with 
>> same A record or PTR IP addr.
>>
>> Example:
>>
>> i added windows host to domain with hostname "PC-1", it
created
>> dynamic dns A record (PC-1 - <some-ip-address>).
>>
>> I deleted this entry (using windows dns management console), removed 
>> "PC-1" from domain, added another host with same name (PC-1).
>> Obviously it was a new member so new SID was generated.
>>
>> Even though DNS entry was deleted, new "PC-1" host was nable
to
>> dynamically add entry, because - even though deleted - samba still 
>> "knew" about the deleted entry, which still had as owner
previous
>> "pc-1". How do I know this?
>>
>> I manually then re-added "PC-1 <-whatever IP> A record to
forward
>> zone. And upon inspecting security TAB it had as owner unresolved sid 
>> number - the exact SID of the deleted original PC-1 host. That 
>> completely blocked new host with PC-1 hostname to dynamically update 
>> it's DNS entry
>>
>> All DNS managing was done via windows DNS mmc - maybe it's the
culprit?
>>
>> That overall doesn't sound right. Shouldn't removed DNS entries
be
>> just that - removed? I restarted named, samba, did tombstone expunge 
>> with lifetime =0 etc.. I'm not sure how to treat this? Is this a
bug?
>> Expected behaviour? How can I then fix this? I'd rather not have to
>> add manually records and change owners. It's not the biggest deal
in
>> forward zone, but it's much worse for reverse zone. E.g. recently I
>> replaced a lot of PC's, all of them got new host names, but they
kept
>> IP's that belong to old, so now my reverse zone is mostly empty, 
>> unless I start manually adding entries - which I'd rather not to.
>>
>> Regards,
>>
>> Kacper
>>
>>
>>
>