search for: autoritive

Is there a specific way to set a name server so that clients are always *forced* to use an autoritative name server? UltraDNS and some others have mentioned little features they have, but it only hints at the possibility that somewhere in the DNS spec. -karlski

Hi all, I am having the same issue that is described in an older thread here: https://lists.samba.org/archive/samba/2018-February/213656.html The problem I am facing is that the machine accounts are not trusted in the domain (this is true for all Win 10 Systems). The issue with the computer is from my pov: Folgende herausgefilterte Gruppenrichtlinien werden nicht angewendet.

Hi Rowland, On 20.10.19 19:16, Rowland penny wrote: > On 20/10/2019 16:52, Martin Tessun via samba wrote: >> Hi all, >> >> I am having the same issue that is described in an older thread here: >> https://lists.samba.org/archive/samba/2018-February/213656.html >> >> The problem I am facing is that the machine accounts are not trusted >> in the domain

...dentials have been revoked .. Means the Active Directory account to which the keytab is related has been disabled, locked, expired, or deleted. Thats the first thing that needs to be verified. Also the bind config. If its an DC, in global options add: auth-nxdomain yes; Your DC = the Autoritive server of your domain.. ( a quick look ) Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Rowland penny via samba > Verzonden: donderdag 28 november 2019 11:27 > Aan: sambalist > Onderwerp: Re: [Samba] secur...

On 20/10/2019 16:52, Martin Tessun via samba wrote: > Hi all, > > I am having the same issue that is described in an older thread here: > https://lists.samba.org/archive/samba/2018-February/213656.html > > The problem I am facing is that the machine accounts are not trusted > in the domain (this is true for all Win 10 Systems). The issue with > the computer is from my

On 10/20/19 11:52 AM, Martin Tessun via samba wrote: > Hi all, > > I am having the same issue that is described in an older thread here: > https://lists.samba.org/archive/samba/2018-February/213656.html The description of that link, says it is running Samba AD with MIT Kerberos. the MIT backend is experimental and this is one of the problems it has, machine GPOs don't work.

Hi, I set up a webserver with Apache on one of the machines on the local network. There's a DNS configured for the LAN, with a dummy domain name (presbytere.local), and every machine is pingable by its hostname. The webserver runs on the machine 'buildbox'. The webserver actually has two (static) websites on it, for testing and fiddling purposes. Each site's pages are stored

Hi all, On 21.10.19 17:38, Martin Tessun wrote: > Hi Rowland, > > On 20.10.19 19:16, Rowland penny wrote: >> On 20/10/2019 16:52, Martin Tessun via samba wrote: >>> Hi all, >>> >>> I am having the same issue that is described in an older thread >>> here: https://lists.samba.org/archive/samba/2018-February/213656.html >>> >>>

...o stop this in the logs: "resolver: info: resolver priming query complete log messages." // Which worked in the end :-) for the config. //forwarders { 62.212.131.101; 62.212.128.130; 8.8.8.8; //}; auth-nxdomain yes; // Default is no, but this server IS the autoritive server if you zones. listen-on-v6 { "none"; }; // i dont use ipv6 on my AD-DC. listen-on port 53 { "thisserverip"; 127.0.0.1; }; notify no; // After upgrade from stretch to buster, i've added. minimal-responses yes; // In attem...

...vice ticket lifetime = 24 kdc:user ticket lifetime = 24 kdc:renewal lifetime = 168 Are beter if set in krb5.conf And AD-DC domain server, with guest ok = yes ? By default no guest is allowed. Shares with to long names might give problems. Bind9 auth-nxdomain yes; # because this server is autoritive for this dnsdomain name. tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab"; Verify if bind still has access to that file. # packages. Still Lenny and Squeeze left overs. All and all.. Hmm, well, thats a lot of time to fix this. Next DC2. Debian 9.5 , out dated, should be 9....

Hi all, I have an old dc (4.0.9). Let's call it dc1. I also have a new one (4.5.16) which I'm planning to switch to. Let's call it dc2. After initial set up of dc2 I initialised replication and things looked ok for a couple of weeks. Recently I've managed to mess it up. Possibly by editing users and DNS records. Or copying Kerberos cache and trying to use it elsewhere for

...e > https://www.isc.org/bind-keys > > //============================================================ > ============ > dnssec-validation auto; > tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab"; > auth-nxdomain no; # conform to RFC1035 your AD DC is the AUTORITIVE server of the primary zone so.. auth-nxdomain yes; > listen-on-v6 { any; }; Add : empty-zones-enable no; That avoids possible conficts with configured zones. > }; > > ----------- > > Checking file: /etc/bind/named.conf.local > > // > // Do any local conf...

...ys > > > > //============================================================ > > ============ > > dnssec-validation auto; > > tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab"; > > auth-nxdomain no; # conform to RFC1035 > your AD DC is the AUTORITIVE server of the primary zone so.. > auth-nxdomain yes; > > listen-on-v6 { any; }; > > Add : empty-zones-enable no; > That avoids possible conficts with configured zones. > > > }; > > > > ----------- > > > > Checking file: /etc/bind/n...

Hi, We have some issue with the reverse DNS in Samba AD. We're running Bind9_DLZ on Ubuntu 18.04. The DHCP server(Ubuntu 16.04) is different to the AD server and not in the same AD domain. The DHCP scope points to the Samba AD server as the DNS server When a machine with DHCP assigned address tries to update the DNS record, it is able to update the forward zone but not the reverse zone. The

...ys > > > > //============================================================ > > ============ > > dnssec-validation auto; > > tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab"; > > auth-nxdomain no; # conform to RFC1035 > your AD DC is the AUTORITIVE server of the primary zone so.. > auth-nxdomain yes; > > listen-on-v6 { any; }; > > Add : empty-zones-enable no; > That avoids possible conficts with configured zones. > > > }; > > > > ----------- > > > > Checking file: /etc/bind/n...