Rowland Penny
2022-Mar-13 14:56 UTC
[Samba] samba_dlz: add another A record for domain (@ record)
On Sun, 2022-03-13 at 13:51 +0100, Dario Lesca via samba wrote:> Il giorno sab, 12/03/2022 alle 14.48 +0000, Rowland Penny via samba > ha > scritto: > > Is there some reason that you are not using a subdomain for your > > Samba > > AD domain ? > > I didn't know I was must to use a subdomain for my Samba AD domain. > So, several years ago i set up a fancy local domain like > "domain.loc". > Is this limitation written into some how to that I am lost?Try reading this: https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ It explains the situation.> > So, after several years that the AD worked without problems, last > week > I had to set up an new intranet web server and on AD I have add the > corresponding A record for "domain.loc" pointed to this server IP.Yes, but where was it pointing from ? Your AD DC's or your non AD dns server that appears to be using the same dns domain as your AD.> > > Your Samba AD DC's should be masters for the AD dns domain, > > My Samba AD DC is master for the AD dns domain, record NS point to > it, > I want change only the record A of @, not SOA or NS or MXThe '@' is the SOA> > > so you should be pointing your AD clients at your main dns server > > My all clients are already pointed to my main dns server, the AD > > > and this should forward anything to do with the AD dns domain to > > the > > DC's. > My DNS server is AD, then it does not need forward anything to other > server.>From my understanding of what you posted, you have at least one SambaAD DC (which should be the dns server for the AD ) and another dns server that is also using the same domain. If this is the case, you shouldn't be doing this.> > Question: > > a) It's possible point the A record of @, like I do on a Windows DC > server, to another server different dal DC, without after few minutes > the DC change it to itself?No, mainly because of two things, a Samba DC is setup to create any missing dns records and the '@' record should show each DC as being the dns domain master (it is known as multi-master). I suggest you turn off the non-AD dns server.> > b) why DC has to change this record?see above.> > > There is also another potential problem, are your DC's running on > > Fedora 35 with the OS Samba packages ? If so, are you aware that > > the > > Fedora packages use MIT and are classed as experimental. > > This is another thing and it is relevant only if my problem occurs > only > in this scenario.Are you using Fedora as an AD DC ? I know it has nothing to do with this problem, but you shouldn't be using it in production, that is why I mentioned it.> > Do you mean that the samba Debian version "not MIT" does NOT have > this > A record substitution for @ and it's possible change it?No, it is Samba acting correctly. Rowland
Dario Lesca
2022-Mar-13 18:43 UTC
[Samba] samba_dlz: add another A record for domain (@ record)
First of all, thank you Rowland for your detailed answers and spend some time for reply to me. Il giorno dom, 13/03/2022 alle 14.56 +0000, Rowland Penny via samba ha scritto:> Try reading this: > https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ > > It explains the situation.Ok, thanks I will do it as soon as possible, but now I want to clarify a few things.> Yes, but where was it pointing from ? Your AD DC's or your non AD dns > server that appears to be using the same dns domain as your AD.My AD DC server is also my DNS server of my network. There is not a "not AD dns server", one server, 192.168.1.100, which does both jobs: AD DC and DNS (and also DHCP) $ host -tNS domain.loc domain.loc name server s-addc.domain.loc. $ host -tA s-addc.domain.loc s-addc.domain.loc has address 192.168.1.100 Another server is the web server (192.168.1.20) and I want point to it the record A named "domani.loc", without use other name like "www.domain.loc" or "intanet.domain.loc"> The '@' is the SOAOk, I was wrong, let's not call it @, let's call it "domain.loc" $ host -tSOA domain.loc domain.loc has SOA record s-addc.domain.loc. hostmaster.domain.loc. 25102 900 600 86400 3600 I want to change the A record of "domain.loc" value, as I have already done in another network with a Microsoft AD DC.> From my understanding of what you posted, you have at least one Samba > AD DC (which should be the dns server for the AD ) and another dns > server that is also using the same domain. If this is the case, you > shouldn't be doing this.there is no other dns, only a AD DC + DNS for my network.> No, mainly because of two things, a Samba DC is setup to create any > missing dns records and the '@' record should show each DC as being > the dns domain master (it is known as multi-master).Ok, leave aside @ I mean the A record of the "domain.loc", not the SOA record, SOA recod point to my AD DC server and is correct.> I suggest you turn off the non-AD dns server.See above> No, it is Samba acting correctly.Ok, that's all Otherwise an Microsoft AD DC, with Samba AD DC it's not possible to change the value for the domain A record ( "domain.loc" ) and point it to another server. But for this network, I should make "domain.loc" resolution point to 192.168.1.20, web server, rather than 192.168.1.100, AD DC server. If I run sudo samba-tool dns update s-addc.domain.loc domain.loc domain.loc A 192.168.1.100 192.168.1.20 Work, the resolver of "host domain.loc" return the new IP. But after few minutes it return to point to 192.168.1.100, the AD DC server. There is some other solution to do that? Many thanks>