[Samba] Strange DNS issue...

[Rowland penny]

On 15/06/2021 13:32, Marco Gaiarin via samba wrote:
> Mandi! L.P.H. van Belle via samba
>    In chel di` si favelave...
>
> Sorry, i come back on this.
>
>> You really should do this differenly..
>> Because..
>> A working DNS domain should be established with forward and
>> reverse mappings to at least the Kerberos KDC (Samba-DC's)
>> and application servers you intend to Kerberize.
> OK. But why in AD reverse zone get not created automatically, and need
> to be created by hand?


Because it isn't strictly required, but it works better with it.

> Why forward zone get prpulated automatically directly by joined
> clients, while reverse need DHCP?


No, you don't need dhcp for reverse records on Windows clients, you just 
need to configure them to update their reverse records.

>
>
>> If you use bind_DLZ as your doing and you want other zones sync to
>> an other domain and you have bind running, as your have..
>> Why not use master/slave setup of bind9 todo that.
>> So that keeps the question, why is "suddenly" differently.
> But i've clerly master/slave setup, all DC have a 'standard' conf using
> bind_DLZ, as wiki suggest.


No you haven't, all AD DC's running a dns server are masters, it is 
known as multimaster, there are no 'slaves'.

>
> For now, i'm simply asking a rather simple question.
>
> 1) client boot and register itself on 'VDCSV1'; i see no error on logs:
>
>   Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=AAAA key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
>   Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=A key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
>   Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: allowing update of signer=GAUNT\$\@AD.FVG.LNF.IT name=gaunt.ad.fvg.lnf.it tcpaddr= type=A key=1680-ms-7.3-de501.7ad51d36-cdc7-11eb-b81d-0068ebb3f3ef/160/0
>   Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': deleting rrset at 'gaunt.ad.fvg.lnf.it' AAAA
>   Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': deleting rrset at 'gaunt.ad.fvg.lnf.it' A
>   Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: subtracted rdataset gaunt.ad.fvg.lnf.it 'gaunt.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.6'
>   Jun 15 13:00:13 vdcsv1 named[679]: client 10.5.2.6#49344/key GAUNT\$\@AD.FVG.LNF.IT: updating zone 'ad.fvg.lnf.it/NONE': adding an RR at 'gaunt.ad.fvg.lnf.it' A 10.5.2.6
>   Jun 15 13:00:13 vdcsv1 named[679]: samba_dlz: added rdataset gaunt.ad.fvg.lnf.it 'gaunt.ad.fvg.lnf.it.#0111200#011IN#011A#01110.5.2.6'
>
> if i query that DC DNS, i got the correct result:
>
>   gaio at hermione:~/conf/samba/manage$ dig a gaunt.ad.fvg.lnf.it @vdcsv1.ad.fvg.lnf.it | grep ^gaunt
>   gaunt.ad.fvg.lnf.it.	1200	IN	A	10.5.2.6
>
> if i query the other DC DNS in the same site, i got:
>
>   gaio at hermione:~/conf/samba/manage$ dig a gaunt.ad.fvg.lnf.it @vdcsv2.ad.fvg.lnf.it | grep ^gaunt
>   gaunt.ad.fvg.lnf.it.	1200	IN	A	10.5.2.33
>
> a different result.


You appear to have replication errors

>
> Because DNS data are in AD/LDAP, i suppose that a 'samba-tool drs
> showrepl' or a 'samba-tool ldapcmp' will return some differences, but
> data seems replicated correctly around all DCs.
>
>
> Why domains seamsd healty but does not replicate DNS data?!


No idea, but you do seem to have replication problems, my DC's always 
produce the same result.

>
>
>> My "guess" is, latest change "security fix" of bind fixed something,
>> Which now is your problem.
>> See Debian LTS: DLA-2647-1: bind9
> Mmmhh... interesting... I've land to:
>
> 	https://kb.isc.org/docs/cve-2021-25216
>
> that stated:
>
> 	In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options.
>
> effectively as suggested by samda docs, i've adedd:
>
> 	tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";


Aha, wrong path, it is now '/var/lib/samba/bind-dns/dns.keytab'

Can you provide a link to where it says to use the 'old' path ?

>
> I've tried to lookup at debian patch for 9.10, but i've not found that.
>
>
> Setting:
> 	dns update command = /usr/sbin/samba_dnsupdate --use-samba-tool
>
> in smb,conf could be a useful workaround?


That only works for the default dns records, not the client records.

Rowland