Solved

Stumped - Need help mixing Linux DNS server and AD DNS server

Posted on 2006-11-14
7
204 Views
Last Modified: 2010-03-17
Using current version of BIND and Win2K3 AD with DNS.

Question: Is there more to delegating than just adding the 6 subzone records?

We are setting up AD using Win2K3.  We have an existing Linux DNS server.  We will delegate

all DDNS for SRV records from the Linux DNS server to the Win2K3 DNS server.

According to various sources all we need to do is create the delelgation records on the

Linux server.

These are the records we have entered into the Linux DNS server.

_msdcs.domain.org IN                NS      WinDNS.domain.org.
_sites.domain.org IN                NS      WinDNS.domain.org.
_tcp.domain.org IN                  NS      WinDNS.domain.org.
_udp.domain.org IN                  NS      WinDNS.domain.org.
DomainDnsZones.domain.org IN        NS      WinDNS.domain.org.
ForestDnsZones.domain.org IN        NS      WinDNS.domain.org.


In addition, the Linux DNS server will have the A and PTR records which point to

WinDNS.domain.org.

According to the various sources, we can test this first step by performing the following on

 any host.

nslookup

>set type=ns
>_msdcs.domain.org

The response back should be something like

Server: WinDNS.domain.org
Address: 10.10.120.60

But instead we are gettting the response back
*** LinuxDNS.domain.org can't find _msdcs.domain.org: Non-existent domain

Same results when using the other sub-domains.

Question repeated: Is there more to delegating than just adding the above records?

We understand that by the time this project is complete we will have created these new zones

on the Win2K3 server but is it reasonable to assume this first step can be tested as shown

before the zones are installed.

Is the underscore in the sub-domain creating a problem in BIND?

Stumped
0
Comment
Question by:dalva
  • 2
  • 2
  • 2
7 Comments
 
LVL 39

Assisted Solution

by:noci
noci earned 100 total points
ID: 17945309
originaly the _ was allowed (Bind 4) but is was by mistake,
according to RFC's it's forbidden..., MS used it, so it's back....

Yes, _ can cause trouble.

the check-names setting can be an issue here..
(either global or per zone).

Also for tracing DNS queries use dig.
It's more versatile than nslookup (which also uses
the /etc/hosts file if needed).

'dig -x for reverse' lookup
'dig -t ns _msdcs.domain.org' to get the ns records on example.com.

0
 
LVL 26

Expert Comment

by:jar3817
ID: 17946289
You're in a good position to save yourself some big headaches later down the road. I'm sure some people won't agree with me, but I think you should use a subdomain for your AD domain name. Meaning instead of AD domain being "domain.org" it would be "ad.domain.org", "corp.domain.org" or something at the third level.

This will allow you to completely delegate all aspects of the dns to the domain controllers (whatever.domain.com  IN NS  windns.domain.org). This will eliminate possible _ problems with bind and will also enable to you separate your network. Think about your website, you'll have http://www.domain.org AND http://domain.org (for the lazy people). www.domain.org might point to your linux webserver, but if you make domain.org your AD domain, http://domain.org will point to your domain controllers instead of your other webserver. Even if this is just internal to your lan, it will still get annoying.

Just my $0.02
0
 
LVL 39

Expert Comment

by:noci
ID: 17947365
I do agree with jar3817 about adding subdomains.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 1

Author Comment

by:dalva
ID: 17948618
Thanks for the tips but I'm still not clear on the actual steps to delegate a sub zone.  With respect to the original Linux DNS server, is it just adding the NS records as I did or do I need to also add zone records in the .conf file?
0
 
LVL 26

Accepted Solution

by:
jar3817 earned 100 total points
ID: 17948705
All you need to do to delegate a zone to another nameserver is to create the NS record for it:

sub.domain.com.   IN    NS   othernameserver.domain.com.

But you'll need to make sure that othernameserver.domain.com is setup for the sub.domain.com zone. I'm not entirely sure, but I would think you need to allow recursive lookups on the linux server to resolve names delegated to other servers. You can include a "recursion yes;" in the view that the internal clients use, or if you only have internal clients, you can stick that in the options section.
0
 
LVL 1

Author Comment

by:dalva
ID: 18286744
I've been off this project and just got back on it this week.  I'm not completely done with the setup but it appears I am making some headway using the above suggestions.

When I get it working as I want, I will post the detailed method.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now