thr3ads.net - samba - [Samba] samba_dns

If this information is useful, please help other people find it:
Share via:

L. van Belle

2019-Jan-22 15:16 UTC

[Samba] samba_dns_question

Hai Rowland, 

I think you are mixing a few settings. 

http://www.zytrax.com/books/dns/ch7/queries.html#additional-from-auth
 additional-from-auth yes | no ;
 additional-from-cache yes | no ; 

And

www.zytrax.com/books/dns/ch7/queries.html#auth-nxdomain
auth-nxdomain yes | no;

If auth-nxdomain is 'yes' allows the server to answer authoritatively
(the
AA bit is set) 
	when returning NXDOMAIN (domain does not exist) answers, 
if 'no' (the default) the server will not answer authoritatively. 

And

http://www.zytrax.com/books/dns/ch7/queries.html#empty-zones-enable
empty-zones-enable yes | no ;

By default empty-zones-enable is set to yes which means that reverse queries
for IPv4 and IPv6 addresses 
covered by RFCs 1918, 4193, 5737 and 6598 (as well as IPv6 local address
(locally assigned), 
IPv6 link local addresses, the IPv6 loopback address and the IPv6 unknown
address) 
but which is not not covered by a locally defined zone clause will
automatically return an NXDOMAIN response from the local name server. 
This prevents reverse map queries to such addresses escaping to the DNS
hierarchy where 
they are simply noise and increase the already high level of query pollution
caused by mis-configuration.

auth-nxdomain yes;
empty-zones-enable no; 
additional-from-auth yes ;
additional-from-cache no ; 
Would be my settings, if i did read above correctly. ( for the DC's ) 
If i forward this to my other 2 bind servers, then they would have. 

auth-nxdomain no;
empty-zones-enable yes;
additional-from-auth yes ;
additional-from-cache yes ; 

If the zone you are using in samba and is in the same as the empty-zones.
And an empty zone contains only an SOA and a single NS RR.
What will happen... 

But i'll read this again in dutch.. Maybe reading things wrong, dont think
so but possible. 


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: dinsdag 22 januari 2019 15:24
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] samba_dns_question
> 
> On Tue, 22 Jan 2019 14:27:12 +0100
> "L.P.H. van Belle via samba" <samba at lists.samba.org>
wrote:
> 
> > Hai, 
> > 
> > > -----Oorspronkelijk bericht-----
> > > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > > Rowland Penny via samba
> > > Verzonden: dinsdag 22 januari 2019 14:12
> > > Aan: samba at lists.samba.org
> > > Onderwerp: Re: [Samba] samba_dns_question
> > > 
> > > On Tue, 22 Jan 2019 13:54:00 +0100
> > > "L.P.H. van Belle via samba" <samba at
lists.samba.org> wrote:
> > > 
> > > > I really suggest that you change this. 
> > > > 
> > > > Disable : 
> > > > > include "/etc/bind/named.conf.default-zones";
> > > 
> > > I have this and have never had the OP's problem
> > > 
> > > > And this supports it : 
> > > > >      empty-zones-enable no; 
> > > 
> > > Again, I have this.
> > 
> > Then you are using a zone that is not in the default zone.
> > The problem occurs only when you bind-DLZ is trying to load a zone
> > defined in the default. Same for the empty-zones-enable 
> > 
> > > 
> > > > 
> > > > These to my cause your problem. 
> > > > Might load zones that bind9_DLZ is trying to load also. 
> > > > 
> > > > Set to yes:
> > > > >      auth-nxdomain no;    # conform to RFC1035
> > > > The AD is the AUTHORITIVE Server.  
> > > > For that  you need : auth-nxdomain yes;
> > > 
> > > Sorry, but no you don't, well I don't
> > > 
> 
> I seemed to remember there was a reason why I didn't have
> 'auth-nxdomain = yes;' set, so I have been searching my records and
> found it!
> 
> All that setting 'auth-nxdomain = yes' does, it sets the nameserver
to
> be authoritative for non existing domains, it has nothing to do with
> being authoritative for a dns domain.
> It used to default to 'yes' for compatibility with Bind8, it now
> defaults to no.
> 
> Rowland
>    
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Rowland Penny

2019-Jan-22 15:34 UTC

head link

[Samba] samba_dns_question

On Tue, 22 Jan 2019 16:16:15 +0100
"L. van Belle via samba" <samba at lists.samba.org> wrote:
> Hai Rowland, 
> 
> I think you are mixing a few settings. 
> 
> http://www.zytrax.com/books/dns/ch7/queries.html#additional-from-auth
>  additional-from-auth yes | no ;
>  additional-from-cache yes | no ; 
> 
I have never set those options
> And
> 
> www.zytrax.com/books/dns/ch7/queries.html#auth-nxdomain
> auth-nxdomain yes | no;
> 
> If auth-nxdomain is 'yes' allows the server to answer
authoritatively
> (the AA bit is set) 
> 	when returning NXDOMAIN (domain does not exist) answers, 
> if 'no' (the default) the server will not answer authoritatively. 
> 
> And
I don't set that and so it defaults to 'no' and does it matter
whether
the AD is Authoritative for a non existing domain or not ?

> 
> http://www.zytrax.com/books/dns/ch7/queries.html#empty-zones-enable
> empty-zones-enable yes | no ;
> 
> By default empty-zones-enable is set to yes which means that reverse
> queries for IPv4 and IPv6 addresses 
> covered by RFCs 1918, 4193, 5737 and 6598 (as well as IPv6 local
> address (locally assigned), 
> IPv6 link local addresses, the IPv6 loopback address and the IPv6
> unknown address) 
> but which is not not covered by a locally defined zone clause will
> automatically return an NXDOMAIN response from the local name server. 
> This prevents reverse map queries to such addresses escaping to the
> DNS hierarchy where 
> they are simply noise and increase the already high level of query
> pollution caused by mis-configuration.
> 
OK, I will give you that one, it probably would be better if it was set
to yes, which really means not having the line.

L.P.H. van Belle

2019-Jan-22 16:18 UTC

head link

[Samba] samba_dns_question

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: dinsdag 22 januari 2019 16:35
> Aan: L. van Belle via samba
> Onderwerp: Re: [Samba] samba_dns_question
> 
> On Tue, 22 Jan 2019 16:16:15 +0100
> "L. van Belle via samba" <samba at lists.samba.org> wrote:
> 
> > Hai Rowland, 
> > 
> > I think you are mixing a few settings. 
> > 
> > 
> http://www.zytrax.com/books/dns/ch7/queries.html#additional-from-auth
> >  additional-from-auth yes | no ;
> >  additional-from-cache yes | no ; 
> > 
> 
> I have never set those optionsCorrect but they default to yes. 
But these might help understand what im trying to say here. 
Yes:yes
BIND will follow out of zone records e.g. it will follow the MX record
specifying mail.example.net for zone example.com
for which it is authoritative (master or slave). Default behaviour.

Yes no Cache disabled. 
BIND will follow out-of-zone records but since this requires the cache (which is
disabled) the net result is the same -
BIND will return REFUSED for the out-of-zone record.

Note REFUSED and NXDOMAIN. 

> 
> > And
> > 
> > www.zytrax.com/books/dns/ch7/queries.html#auth-nxdomain
> > auth-nxdomain yes | no;
> > 
> > If auth-nxdomain is 'yes' allows the server to answer
authoritatively (the AA bit is set)
> > 	when returning NXDOMAIN (domain does not exist) answers, 
> > if 'no' (the default) the server will not answer
authoritatively.
> > 
> > And
> 
> I don't set that and so it defaults to 'no' and does it matter
whether
> the AD is Authoritative for a non existing domain or not ?
For a non existing domain not, its never authoritive. 
But the AD-DC DNS is the dns root for the zone. 
> 
> 
> > 
> > http://www.zytrax.com/books/dns/ch7/queries.html#empty-zones-enable
> > empty-zones-enable yes | no ;
> > 
> > By default empty-zones-enable is set to yes which means that reverse
> > queries for IPv4 and IPv6 addresses 
> > covered by RFCs 1918, 4193, 5737 and 6598 (as well as IPv6 local
> > address (locally assigned), 
> > IPv6 link local addresses, the IPv6 loopback address and the IPv6
> > unknown address) 
> > but which is not not covered by a locally defined zone clause will
> > automatically return an NXDOMAIN response from the local 
> name server. 
> > This prevents reverse map queries to such addresses escaping to the
> > DNS hierarchy where 
> > they are simply noise and increase the already high level of query
> > pollution caused by mis-configuration.
> > 
> 
> OK, I will give you that one, it probably would be better if 
> it was set to yes, which really means not having the line.
> 
No, argg.. How can i explain this.. 
Hmm very short version, it might block queries to 10.0.0.0/8  172.16.0.0/12 
192.168.0.0/16


Greetz, 

Louis

Rowland Penny

2019-Jan-22 16:30 UTC

head link

[Samba] samba_dns_question

On Tue, 22 Jan 2019 17:18:16 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > Rowland Penny via samba
> > Verzonden: dinsdag 22 januari 2019 16:35
> > Aan: L. van Belle via samba
> > Onderwerp: Re: [Samba] samba_dns_question
> > 
> > On Tue, 22 Jan 2019 16:16:15 +0100
> > "L. van Belle via samba" <samba at lists.samba.org>
wrote:
> > 
> > > Hai Rowland, 
> > > 
> > > I think you are mixing a few settings. 
> > > 
> > > 
> > http://www.zytrax.com/books/dns/ch7/queries.html#additional-from-auth
> > >  additional-from-auth yes | no ;
> > >  additional-from-cache yes | no ; 
> > > 
> > 
> > I have never set those options
> Correct but they default to yes. 
So, there is no need to discuss them ;-)
> > > 
> > > www.zytrax.com/books/dns/ch7/queries.html#auth-nxdomain
> > > auth-nxdomain yes | no;
> > > 
> > > If auth-nxdomain is 'yes' allows the server to answer
> > > authoritatively (the AA bit is set) when returning NXDOMAIN
> > > (domain does not exist) answers, if 'no' (the default)
the server
> > > will not answer authoritatively. 
> > > 
> > > And
> > 
> > I don't set that and so it defaults to 'no' and does it
matter
> > whether the AD is Authoritative for a non existing domain or not ?
> 
> For a non existing domain not, its never authoritive. 
> But the AD-DC DNS is the dns root for the zone.
Yes, but 'auth-nxdomain' has nothing to do with a server being
authoritative for a domain, it is the SOA records that set this.
> 
> > 
> > 
> > > 
> > >
http://www.zytrax.com/books/dns/ch7/queries.html#empty-zones-enable
> > > empty-zones-enable yes | no ;
> > > 
> > > By default empty-zones-enable is set to yes which means that
> > > reverse queries for IPv4 and IPv6 addresses 
> > > covered by RFCs 1918, 4193, 5737 and 6598 (as well as IPv6 local
> > > address (locally assigned), 
> > > IPv6 link local addresses, the IPv6 loopback address and the IPv6
> > > unknown address) 
> > > but which is not not covered by a locally defined zone clause
will
> > > automatically return an NXDOMAIN response from the local 
> > name server. 
> > > This prevents reverse map queries to such addresses escaping to
> > > the DNS hierarchy where 
> > > they are simply noise and increase the already high level of
query
> > > pollution caused by mis-configuration.
> > > 
> > 
> > OK, I will give you that one, it probably would be better if 
> > it was set to yes, which really means not having the line.
> > 
> 
> No, argg.. How can i explain this.. 
> Hmm very short version, it might block queries to 10.0.0.0/8
> 172.16.0.0/12  192.168.0.0/16 
> 
If they are not AD reverse zones then the AD DNS server shouldn't
really know anything about them, any queries for them should be
forwarded to another dns server that does know about them.

Rowland

Possibly Parallel Threads

Search for more seemingly similar threads

samba - Jan 2019 - samba_dns_question

[Samba] samba_dns_question

[Samba] samba_dns_question

[Samba] samba_dns_question

[Samba] samba_dns_question

Possibly Parallel Threads