Patrick Goetz
2021-Nov-04 10:14 UTC
[Samba] Confirmed inconsistency between `samba-tool domain join` and `net ads join`
OK, was able to confirm that samba-tool at best inconsistently updates DNS when a machine joins the domain: root at atomsmasher:~# samba-tool domain join ea.linuxcs.com MEMBER -U administrator Password for [EA\administrator]: Joined domain ea.linuxcs.com (S-1-5-21-2398640129-655337111-1434392923) root at samba-dc:~# host atomsmasher root at samba-dc:~# root at atomsmasher:~# net ads leave -U Administrator Password for [EA\Administrator]: Deleted account for 'ATOMSMASHER' in realm 'EA.LINUXCS.COM' root at atomsmasher:~# samba-tool domain join ea.linuxcs.com MEMBER -U administrator Password for [EA\administrator]: Joined domain ea.linuxcs.com (S-1-5-21-2398640129-655337111-1434392923) root at samba-dc:~# host atomsmasher root at samba-dc:~# root at atomsmasher:~# net ads leave -U Administrator Password for [EA\Administrator]: Deleted account for 'ATOMSMASHER' in realm 'EA.LINUXCS.COM' root at atomsmasher:~# net ads join -U administrator Password for [EA\administrator]: Using short domain name -- EA Joined 'ATOMSMASHER' to dns domain 'ea.linuxcs.com' root at samba-dc:~# host atomsmasher atomsmasher.ea.linuxcs.com has address 192.168.1.82 Also confirmed that the DNS entry is not removed when the machine leaves the domain. As mentioned previously, if the DNS entry is created automatically, then it also needs to be removed automatically. Since it's automatic, it's not inconvenient to the admin who takes a machine out of the domain and adds it back soon thereafter. Also, consequences: root at atomsmasher:~# net ads join -U administrator Password for [EA\administrator]: Using short domain name -- EA Joined 'ATOMSMASHER' to dns domain 'ea.linuxcs.com' DNS Update for atomsmasher.ea.linuxcs.com failed: ERROR_DNS_UPDATE_FAILED DNS update failed: NT_STATUS_UNSUCCESSFUL The PTR record is not added automatically: root at samba-dc:~# samba-tool dns query samba-dc ea.linuxcs.com atomsmasher PTR -UAdministrator Password for [EA\Administrator]: Name=, Records=0, Children=0 If the A record is added automatically, the PTR record probably should be too. This would be consistent with Windows servers' behavior.