Configuring Mac Server DNS

I am diving into configuring a Mac Mini as a home/business server and am having some issues with what I think is DNS.

I would like to verify DNS settings if possible as when I go to create Open Directory Master I am given a message about Kerberos Single Sign-On not working if I continue.

Server Name: SERVER01
FQDN: SERVER.company.local
IP: 192.168.200.10
Gateway: 192.168.200.1

During setup I believe DNS was setup, but I have tweaked slightly according to video from Lynda.com on setting up DNS.

Help!
LVL 6
FlippAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

schapsCommented:
FQDN: SERVER.company.local

did you mean FQDN: SERVER01.company.local ?
0
FlippAuthor Commented:
Yes I did - sorry.

I have done a few tests like:
sudo changeip -checkhostname
hostname

Both are successful - below is actual message I get.

ScreenShot of Error
0
schapsCommented:
this procedure has worked for some:

In the terminal:

sudo sso_util remove –k –d –a <directoryadministratorsshortname> -p <directoryadministratorspassword> -r <KERBEROS.REALM.ALL.CAPS>

Open in new window

<enter>
sudo rm /etc/krb5.keytab

Open in new window

<enter>

Then rebuild the kerberos database: launch Server Admin and go to
ServerAdmin->OpenDirectory-> Settings and there should be a "kerberize button" in Server Admin->Open Directory->Settings->General at the bottom on the right.

Good luck
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

FlippAuthor Commented:
I did try this one but was not 100% on <KERBEROS.REALM.ALL.CAPS> value. How do I figure this one out?
0
FlippAuthor Commented:
hmmm, even after completing above I still get this same error.

Any ideas on restarting over DNS?
0
schapsCommented:
It would be COMPANY.LOCAL -
but before you get too far, are you married to the idea of using a ".local" domain? If not, it's best in a Mac network to use something else (I like ".lan"), because Apple's Bonjour use the .local top-level domain to advertise services on the LAN.
See:
http://labs.hoffmanlabs.com/node/1603
0
FlippAuthor Commented:
I did see that recently ... like today after I had built server.

Definitely not married to it, so happy to change but is this a re-build?
0
schapsCommented:
should not have to rebuild, but my mind is getting too groggy, and I need to go to bed. You should be able to change it to a standalone server and then go from there with the changed domain name. Worth a try, anyway, before rebuilding.
Good night, and good luck.
0
FlippAuthor Commented:
Cheers schaps ..... I think a rebuild is fine as this is a brand newy so no migration/restore.

Will let you know how I go.
0
lloydforth1Commented:
Isn't this something as simple as making sure in the network settings of your server the DNS entry is pointing to your server not the router or elsewhere?

either 127.0.0.1 or 192.168.200.10
0
FlippAuthor Commented:
I am referring more to the DNS Service rather than adaptor settings.
0
lloydforth1Commented:
Exactly, even if you set up a perfect DNS service then the server's network settings should be pointing to itself to resolve DNS queries,  otherwise when you run any DNS request the OS will look to get it's information from whatever is entered as the DNS service in System Preferences / Network.

You could have DNS set up perfectly but if your network settings are pointing to say google's DNS server's at 8.8.8.8 then your server's OS will refer to that entry for its information regardless if its from a browser or terminal etc
0
lloydforth1Commented:
to make it easier answer this question: what IP do you have entered in System Preferences / Network / DNS
0
gmbaxterCommented:
My interpretation of the error:

is the mac server looking at itself for dns
if so is the dns service running
if yes, do you have a forward dns zone such as yourdomain.lan containing an A record for your server and its IP
do you have a reverse dns zone such as 200.168.192.in-addr.arpa containing a PTR record for your server and its IP
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
FlippAuthor Commented:
OK, so I have rebuilt Server so can not confirm what my settings were, but my new settings are:

System Preferences > Network > DNS Server: 127.0.0.1
DNS > Accept recursive queries from the following networks: localnets
DNS > Forwarder IP Addresses: 203.129.32.147, 202.55.145.2 (ISP DNS)

See below for DNS Zones.
 DNS
I simply let the Setup Wizard set this up - the only thing I changed during setup is DNS was set to ISP Servers, and changed to 127.0.0.1.

Open Directory I decided to setup during setup and looks good now.

Any comments?
0
lloydforth1Commented:
If Open DIrectory looks good are you still getting the kerberos error? In the grand scheme of things do you need to Kerberise the server? What are you trying to acheive?

0
schapsCommented:
If it's all working, I'd simply comment 'congrats.'
:)
0
FlippAuthor Commented:
Yeah I think we are all good now - I had been following some training videos on Lynda.com which led me to the original issue. As much as I hate rebuilding to resolve an issue, in this case I am happy to not dig too deep to find the root cause.

Cheers for your comments.

What am I trying to achieve ....... setting up a Mac Server for Home Business Use. Deal with Windows Servers everyday, so trying to expand the skillset but also provide some functionality in a VPN to share files and perhaps host my own Mail and a Wiki for keeping documentation on each of my clients.

Any recommendations?
0
lloydforth1Commented:
Of course indeed - well done.
0
FlippAuthor Commented:
Thank you all for your input.

Root cause not found, but a rebuild of Server and used Setup Wizard to configure.
0
gmbaxterCommented:
I'd argue that your DNS is wrong - the snow leopard installer will create it wrong for you.

If the server name is CBRDC01.RBDSOLUTIONS.LAN  then the zone should just be RBDSOLUTIONS.LAN you will then have an A record in that zone for CBRDC01

Likewise, the reverse zone should just be 200.168.192.in-addr.arpa with a PTR record in that zone of 10 for your server.

Does that make sense?

You must correct this now - dns is the foundation of all services.
0
FlippAuthor Commented:
gmbaxter - This is what the videos had also said.

So I have adjusted the for RBDSOLUTIONS.LAN, but after Removing record from Reverse Zone, how do I add correct PTR?
0
schapsCommented:
In Server Admin, Server--> Export all your settings and preferences, back them up elsewhere. Wouldn't hurt to use SuperDuper or CCC to make a complete image.
It sounds like it will be exposed to the Internet, so be sure to check security often "Shields up!" at http://www.grc.com/default.htm is good.
Have fun.
0
gmbaxterCommented:
You should be able to simply select your reverse zone, then select add record, input its name and IP address.
0
FlippAuthor Commented:
Nope - Add Record is greyed out:
 Screen Shot
0
schapsCommented:
You should be able to simply select your reverse zone, then select add record, input its name and IP address.

I believe OS X Server manages the reverse zone for you. Not as flexible, but in some ways more reliable. Dare I say "Goof proof"?
0
FlippAuthor Commented:
Well not so goof proof if I can remove a record but not add one. hmmmmm I feel another rebuild coming on.
0
schapsCommented:
No, just redo the zone at most...
0
FlippAuthor Commented:
So how to create a Reverse Zone ..... Creating a Primary Zone seems straight forward, but re-creating a Reverse Zone is a small mystery to me.

Rebuild started .... I will backup Server Settings first then look at modifying Reverse Zone.
0
schapsCommented:
Create zone, add a record, reverse zone is not created?
0
FlippAuthor Commented:
Zone Type states 'Primary Zone' and not sure where I would change to Reverse Zone.

I know I missing something really simple here, but have not woken up yet :)

You available on IM at all?
0
schapsCommented:
You just create the primary zone first. Adding a host creates the reverse zone. Try it with the 'example.com.' Domain it defaults to, don't change anything, just add imaginary ip for the nameserver field (it will tell you if you missed something).
When primary example.com is created,then add first host, reverse should appear. Then do same thing with real domain, and if reverse zone is NOT auto-created, the something is goofed up. Try a restart before anything drastic.
0
FlippAuthor Commented:
Ok, so back to a fresh build.

Now I have exported Server Settings and updated Primary Zone from CBRDC01.RBDSOLUTIONS.LAN. to RBDSOLUTIONS.LAN. but wanted to confirm the change I should be making in Reverse Zone .... attached is current state which seems correct in my inexperienced-DNS mind.

 ReverseZone
0
schapsCommented:
looks good, but does it work?
0
FlippAuthor Commented:
How can I test DNS to be 200% sure as I know it is critical core service?
0
schapsCommented:
You have another computer on the network pointing to your new server for DNS? Then lots of tips here:
http://labs.hoffmanlabs.com/node/1347
The article is written regarding OpenVMS, but it's also applicable to OS X Server.
Important is that the network clients only point to the OS X server for DNS, they do not have external DNS referenced. Only the server should have the ISP's DNS Server IPs as forwarders.


0
gmbaxterCommented:
Yes that picture looks correct now.
0
FlippAuthor Commented:
Are there any DNS tests that you are aware of that I should do?
0
schapsCommented:
Are there any DNS tests that you are aware of that I should do?

Not sure whom you were addressing, but the link I posted last lists a bunch of ways to test DNS.

0
FlippAuthor Commented:
Less caffeine and some sleep may help me read all posts :)

Cheers schaps!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.