[Samba] setting up a new ADS infrastructure
abartlet at samba.org
Mon Jun 24 06:59:35 UTC 2019
On Sun, 2019-06-23 at 15:18 +0100, Rowland penny via samba wrote:
> On 23/06/2019 14:34, Stefan Froehlich via samba wrote:
> > No need to be sorry - most likely I'll the whole setup from
> > scratch.
> > But just to be sure and to avoid new mistakes, after re-reading the
> > samba wiki:
> > I understand that they use the same SAMDOM.EXAMPLE.COM as DNS *and*
> > Windows domain which is (for legacy reasons and for a smoother
> > transition) something I'd rather like to avoid.
> 'SAMDOM.EXAMPLE.COM' is an example Realm name, you can use whatever
> like. However, whatever you use for the DNS domain, MUST be used for
> Realm name, but the Realm name must be in uppercase.
> > There is the existing DNS domain synth.intern (driven by bind and
> > generally in a rather good shape) and I want to create the new AD
> > domain SYNTHESIS *below* and independent from that.
> So far, this was a good idea.
> > That's why I created an NS record for synthesis.synth.intern
> > delegating it to the
> > DC and proceeded from there following the wiki with my AD DNS
> > domain
> > being SYNTHESIS.SYNTH.INTERN.
> That is where you went wrong ;-)
No, that should be fine. We normally suggest just setting up a zone
type of 'forward' in BIND but glue records should work.
> You should have used the subdomain 'synthesis.synth.intern' for
> AD, totally unconnected to your other DNS server. Your AD DC's are
> authoritative for the DNS domain and your AD clients must use the
> as their nameservers, anything the DC's do not know (anything
> the AD domain) should be forwarded to another DNS server.
We actually suggest the reverse, due to issues with the forwarding
capacity of both of our DNS options. We suggest a 'normal' DNS server
that delegates the Samba zone (only) to Samba:
In the past this wasn't possible, but that was due to bugs now fixed in
how we script nsupdate.
I hope this helps clarify things.
Andrew Bartlett https://samba.org/~abartlet/
Authentication Developer, Samba Team https://samba.org
Samba Developer, Catalyst IT
More information about the samba