Dynamic DNS – Bind9 and BIND_DLZ Cannot Start Troubleshooting

active-directorybinddynamic-dnssamba

I have a device running Samba as an Active Directory Domain Controller using BIND_DLZ as a backend.

On top of that I am running a secondary device also configured as an Active Directory Domain Controller also with BIND_DLZ as backend for redundancy purpose.

IP addresses are assigned by ISC DHCP server which are able to update DNS ressource records using an ecryption key (TSIG).

Anyway: Onto my problem.

Here is my current setup

named.conf.options:

options 
{
     directory "/var/cache/bind";

     forwarders {
            2001:4860:4860::8888;
            2001:4860:4860::8844;
            8.8.8.8;
            8.8.4.4;
     };

     auth-nxdomain no;    # conform to RFC1035
     listen-on-v6 { any; };

     listen-on port 53 { 192.168.1.240; };
     listen-on port 5353 { 127.0.0.1; }; <-- Used for Netflix IPv6 filter only.

     tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
     minimal-responses yes;
     recursion yes;
};

acl "home-net"
{
    127.0.0.1;
    192.168.1.0/24;
    2001:db8:cafe:beef::/56; # <-- I am using a IPv6 range from Tunnelbroker in real life.
};

view "normal"
{
    include "/etc/bind/named.conf.default-zones";
    include "/etc/bind/named.conf.internal";

    # Netflix really dislike Tunnelbroker IPv6, so I am dropping any Netflix AAAA ressources records.
    include "/etc/bind/netflix-ipv6-blackhole.conf";  

    match-clients
    {
        home-net; # <-- Only respond to queries originating from my own network.
    };

    dnssec-enable yes;
    dnssec-validation auto;

    allow-query { any; };
    allow-query-cache { home-net; };
    allow-recursion { home-net; };

    forwarders {
      8.8.8.8;
      8.8.4.4;
      2001:4860:4860::8888;
      2001:4860:4860::8844;
   };
};

named.conf.internal:

zone "1.168.192.in-addr.arpa"
{
    type master;
    file "/etc/bind/db.192.168.1.rev";
    notify yes;

    allow-query { any; };
    allow-transfer { xfer; };

    # If allow-update is enabled instead of the include named.conf.update line, 
    # then Dynamic DNS works fine due to ISC DHCP can update the ressource records. 
    #
    # Sadly you can't have both lines enabled. It is either / or.

    // allow-update { key ddns-key; };

    include "/var/lib/samba/bind-dns/named.conf.update"; # <-- Having issues with THIS line only.
};

include "/var/lib/samba/bind-dns/named.conf";

/var/lib/samba/bind-dns/named.conf:

dlz "AD DNS Zone" {
    # For BIND 9.11.x
    database "dlopen /usr/lib/arm-linux-gnueabihf/samba/bind9/dlz_bind9_11.so";
};

/var/lib/samba/bind-dns/named.conf.update:

/* this file is auto-generated - do not edit */
update-policy {
        grant EXAMPLE.COM ms-self * A AAAA;
        grant Administrator@EXAMPLE.COM wildcard * A AAAA SRV CNAME;

        # Main Active Directory Domain Controller
        grant HARDY$@example.com wildcard * A AAAA SRV CNAME;

        # Backup Active Directory Domain Controller
        grant LAUREL$@example.com wildcard * A AAAA SRV CNAME;
};

If I try to start bind with this configuration I will get a rather odd error that I cannot figure out:

/var/lib/samba/bind-dns/named.conf.update:3: name field not set to placeholder value '.'

Is there anyone who can clue me into what is wrong with named.conf.update?

Best Answer

OK, you have two Samba AD DC's using Bind9 for the dns server and you are having problems with dns, I wonder if it could have anything to do with your your incorrect bind files ?

One major problem is that you have the reverse zone in a flat file, this is not allowed, you need to create it AD, you can use samba-tool to do this. You also cannot use 'views'

Try these bind9 conf files:

/etc/bind/named.conf

include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones";

/etc/bind/named.conf.options

options {

directory "/var/cache/bind";
notify no;
empty-zones-enable no;
allow-query { 127.0.0.1; 192.168.1.0/24; };
allow-recursion { 192.168.1.0/24; 127.0.0.1/32; };
forwarders {
        2001:4860:4860::8888;
        2001:4860:4860::8844;
        8.8.8.8;
        8.8.4.4;
};
allow-transfer { none; };
dnssec-validation no;
dnssec-enable no;
dnssec-lookaside no;
listen-on-v6 { any; };
listen-on port 53 { 192.168.1.240; };
listen-on port 53 { 192.168.1.240; 127.0.0.1; };
listen-on port 5353 { 127.0.0.1; }; <-- Used for Netflix IPv6 filter only.

tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
minimal-responses yes;

};

/etc/bind/named.conf.local

include "/var/lib/samba/bind-dns/named.conf";

// Netflix really dislike Tunnelbroker IPv6, so I am dropping any Netflix AAAA ressources records.

include "/etc/bind/netflix-ipv6-blackhole.conf";

If you backed up /var/lib/samba/bind-dns/named.conf.update Then reinstate from the backup. If not, then change it to this:

/* this file is auto-generated - do not edit */ update-policy {

grant EXAMPLE.COM ms-self * A AAAA;
grant Administrator@EXAMPLE.COM wildcard * A AAAA SRV CNAME;
grant HARDY$@example.com wildcard * A AAAA SRV CNAME;
grant LAUREL$@example.com wildcard * A AAAA SRV CNAME;

};

Related Topic