4 ms·

Samba isn't "dealing with" them, it's just dropping them because it doesn't know anything about them.

marcosdumay 8y ago
Dropping them is dealing with them. DNS is an opaque key-value registry, you get a record from upstream, you store it and repeat to everybody that asks.
- amaccuish 8y ago
  The problem is that Samba 4 has to deal with them, since it will look them up in ldb, and if they're not there, forward them. I guess it doesn't blindly pass records through that it can't look up in LDAP. As a side note, although I love AD DNS, MS are so slow to add new record support. I still can't add SSHFP records to Samba. :(
  - gerdesj 8y ago
    You don't have to use the built in DNS server in Samba. You can use BIND - https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End and https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_AD_DC https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_o...
    - amaccuish 8y ago
      Ye, I find the inbuilt one more reliable, and i've seen a ppt which says bind_dlz is a horrible hack and they'll stop it at some point. Also that doesn't affect what record types can be stored and manipulated in AD.
      - gerdesj 8y ago
        I've seen a similar thing ("and they'll stop it at some point"). If you need DNS functionality beyond the Samba implementation then I would suggest having a separate BIND or PDNS server that all clients point at and that collates the DNS view that you wish them to have. A GPO will get them to update records on your Samba DNS and your PDNS or BIND or whatever can do the rest.
        amaccuish 8y ago
        Nice thinking. I'll give that a think, thanks!
  - marcosdumay 8y ago
    That makes sense. In theory LDAP is also an opaque key-value registry, but in practice Windows AD is so perverted that one has to interpret everything there. I can understand how Samba had no other option. Still, it's hard to blame this one on DNS complexity.
    - amaccuish 8y ago
      Ye I guess from their point of view, they don't want to start diverging from Microsoft, which means they're frequently restricted to what Microsoft does.

Dropping them is dealing with them. DNS is an opaque key-value registry, you get a record from upstream, you store it and repeat to everybody that asks.

amaccuish 8y ago
The problem is that Samba 4 has to deal with them, since it will look them up in ldb, and if they're not there, forward them. I guess it doesn't blindly pass records through that it can't look up in LDAP. As a side note, although I love AD DNS, MS are so slow to add new record support. I still can't add SSHFP records to Samba. :(
- gerdesj 8y ago
  You don't have to use the built in DNS server in Samba. You can use BIND - https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End and https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_AD_DC https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_o...
  - amaccuish 8y ago
    Ye, I find the inbuilt one more reliable, and i've seen a ppt which says bind_dlz is a horrible hack and they'll stop it at some point. Also that doesn't affect what record types can be stored and manipulated in AD.
    - gerdesj 8y ago
      I've seen a similar thing ("and they'll stop it at some point"). If you need DNS functionality beyond the Samba implementation then I would suggest having a separate BIND or PDNS server that all clients point at and that collates the DNS view that you wish them to have. A GPO will get them to update records on your Samba DNS and your PDNS or BIND or whatever can do the rest.
      - amaccuish 8y ago
        Nice thinking. I'll give that a think, thanks!
- marcosdumay 8y ago
  That makes sense. In theory LDAP is also an opaque key-value registry, but in practice Windows AD is so perverted that one has to interpret everything there. I can understand how Samba had no other option. Still, it's hard to blame this one on DNS complexity.
  - amaccuish 8y ago
    Ye I guess from their point of view, they don't want to start diverging from Microsoft, which means they're frequently restricted to what Microsoft does.