[Samba] Secondary Nameserver not working

[Rowland Penny]

On Tue, 31 Oct 2017 02:51:00 -0400
Mark Foley via samba <samba at lists.samba.org> wrote:

> I've configured a secondary slave nameserver based on what I consider
> rather expert advice, but it's not working as expected. I'm trying to
> determine if I've done something wrong with basic configuration or if
> there are AD/DC nuances afoot.
> 
> The main nameserver is the domain Active Directory/Domain Controller
> running Samba 4.4.16 on Slackware64 14.2. This has been running for a
> few years w/o problem. It's domain IP is 192.168.0.2.
> 
> I've attempted to configure a DNS slave on another Linux Slackware64
> 14.2 system, IP 192.168.0.3. This host is on the domain LAN, but is
> not a domain member.
> 
> When bind is running on the slave, the zone files are updated as
> expected. Both Windows and Linux domain members show both 192.168.0.2
> and 192.168.0.3 as nameservers. However, when 192.168.0.2 goes
> offline, the domain members can no longer access the Internet. That
> condition persists until 192.168.0.2 comes back on line. So, the
> slave DNS server is not working correctly.
> 
> In 192.168.0.2 has "allow-transfer { 192.168.0.3; };" set in
> named.conf options, and in zone and reverse zone files.
> 
> Below is the named.conf on the slave. Am I doing something wrong
> AD/DC-wise?
> 
> options {
>         directory "/var/named";
> 
>         forwarders {            // These are the ISP provided name
> servers 209.18.47.61;
>            209.18.47.62;
>         };
> 
>         allow-query { any; };
>         allow-recursion {192.168.0.0/24;};
> };
> 
> logging{
>   channel marks_log {
>     syslog local7;
>     severity info;
>   };
>   category default {
>     marks_log;
>   };
> };
> 
> zone "hprs.local" IN {
>         type slave;
>         masters { 192.168.0.2; };
>         file "/var/named/db.hprs.local";
> };
> 
> zone "0.168.192.in-addr.arpa" IN {
>     type slave;
>     masters { 192.168.0.2; };
>     file "/var/named/db.192.168.0";
> };
> 
> 

Yes, you are doing two things incorrectly ;-)

One) you have put the zones into the named.conf files, you just turned
off bind_dlz.

Two) you don't run Bind as a slave, all AD DC dns servers have to
be authoritative. Just set the Bind dns server up as you did the first.

Rowland