[Samba] I want to use CNAMES for my SAMBA server, how?

[Daniel Huntley]

netbios aliases =  in your smb.conf
 
Then setup the cname in DNS and point it to the correct A record.
 
Dan

________________________________

From: Don Meyer
Sent: Tue 11/07/2006 9:35 AM
To: Gerald (Jerry) Carter; samba at lists.samba.org
Subject: Re: [Samba] I want to use CNAMES for my SAMBA server, how?


At 03:00 PM 7/10/2006, Gerald (Jerry) Carter wrote:
>Mann, Roy (RGMR) wrote:
> >  I have a RedHat Enterprise 3 server running SAMBA 3.0.10.   The server
> > has been joined to the Active Directory forest using its fully qualified
> > domain name.
> >  Windows clients can successfully map drives using that fully qualified
> > name,  However, services have a tendency to be moved or need failover
> > during maintenance
> >  so I would prefer to tell customers to use a service alias like
> > smbserver3.rest.ofthe.domain.com.  When clients use that alias, I can
> > see attempts at kerberos
> >  authentication in the logs on the SAMBA server using the canonical FQDN
> > so Windows is getting the right address, talking to the right smbd, but
> > authentication fails.
>
>If you are using CNAMES, add the appropriate servicePrincipalName
>to the machine's object in AD.  Something like adsiedit works well.

Interesting... I never would have gotten here in a month or 
three.   I've been seeing this problem sporadically of late, as 
well.   Months ago, things worked fine without this.

My question though is what are the ramifications of a similar 
situation:   Where the CNAME might be dynamically moved to point to 
another system's base IP address in the case of a transfer of 
service/fail-over.   Does this servicePrincipalName for the FQDN need 
to be deleted and added to the new host's object, or can the same 
servicePrincipalName be added to each machine's object?  -- each 
machine that might be used to host that service address, that is...

The answer to this has ramifications for the way we are implementing 
many other services, and are trying to use the same paradigm under 
Samba.   We define a role IP name (FQDN) for a given service and tie 
it to a particular IP address.   Then pass the IP address around as 
necessary -- the server serving as primary for a given service picks 
up the role address for that service in addition to its configured 
base IP address.   Realistically, client requests are configured to 
employ the defined role FQDN.

I assume the adsiedit utility mentioned is a windows executable and 
must be run at the DC.   If these commands/utilities need to be run 
at the DC each time a service fails over, then this will be a major 
problem.  Is there any functionality that would allow these changes 
to be effected from a Samba-based system, in order to avoid the need 
for commands run at the DC?   (I suppose if the setting(s) could be 
safely preloaded for each server/object that might host a particular 
service address, then this remote capability might not be quite so 
necessary...)

I look forward to any/all input on this scenario...

Cheers,
-D



Don Meyer                                           <dlmeyer at uiuc.edu>
Network Manager, ACES Academic Computing Facility
Technical System Manager, ACES TeleNet System
UIUC College of ACES, Information Technology and Communication Services

   "They that can give up essential liberty to obtain a little 
temporary safety,
         deserve neither liberty or safety."     -- Benjamin Franklin, 1759 

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba