Back in September 2010 I posted an article on creating your own DNS server (using BIND9) and linked to DHCP. There was probably one element of that setup that was missing – Microsoft’s Active Directory.<\/p>\n
Active Directory uses DNS as its domain controller location mechanism and leverages the namespace design of DNS in the design of Active Directory domain names. As a result, DNS is positioned within the discoverability and logical structure components of Active Directory technology components. If you’re running your own AD server, it’s a fair bet that the install wanted you to install DNS as well (you’re actively prompted by the 2008 R2 install).<\/p>\n
So what do you do if you don’t want a proliferation of DNS servers across your network – or (like me) you prefer to farm out processes like DNS and DHCP to “helper” servers without having to blow your budget on Microsoft licences?<\/p>\n
Simple: Add the AD DNS functionality into your BIND9 server by utilising the SRV record type.<\/p>\n
A Service record (SRV record<\/a>) is a specification of data in the Domain Name System defining the location, i.e. the hostname and port number, of servers for specified services. We leverage off this to provide the relevant answer to a client or servers quering for AD service, protocol and location information.<\/p>\n For more information on how DNS Support for Active Directory works, you can read this Microsoft Technet article<\/a>.<\/p>\n Some of the SRV<\/strong> records will refer to this value so it’s a good opportunity to note it down. I’m still using Windows Server 2003 R2 in my environment, so these instructions my vary dependant on build and version.<\/p>\n From the “Administrative Tools<\/strong>“, launch “Active Directory Sites and Services<\/strong>“. Once the MMC (Microsoft Management Console) has started up, expand the following items:<\/p>\n Right click on “NTDS Settings<\/strong>” and select “Properties<\/strong>“. Under the “General<\/strong>” tab look for the value next to DNS alias<\/em>. The alpha-numeric GUID<\/strong> that preceeds the ._msdcs.[<\/em><\/strong>dnsDomainName<\/em><\/span>]<\/em><\/strong> is the value you need to note down.<\/p>\n Next we’ll need to freeze the zone file of our primary name server so we can make changes to it.<\/p>\n … where zone<\/strong> <\/em><\/span>is the name of the DNS zone you’re editing. This will disable dynamic updates to the zone while you’re editing it. Now we add the records to the zone file.<\/p>\n For the purposes of this HOWTO we’ll assume the following values:<\/p>\n Remember<\/strong>:<\/span><\/p>\n Take note to be carefull to include the trailing “.<\/strong>” on the FQDN when adding\/editing records in the zone file!<\/span><\/p>\n<\/blockquote>\n First add an A<\/strong> record for the AD server’s hostname, as well a CNAME<\/strong> for the AD server’s GUID<\/strong> – this will be used for RPC lookups…<\/p>\n Note<\/strong>:<\/span><\/p>\n _msdcs<\/strong> is the Microsoft-specific subdomain that enables the location of domain controllers that have specific roles in the Active Directory domain or forest.<\/span><\/p><\/blockquote>\n To facilitate locating Windows Server 2003+ based domain controllers, in addition to the standard _Service._Protocol.DnsDomainName<\/em> format, the Net Logon service registers SRV<\/strong> records that identify the well-known server-type pseudonyms “dc<\/strong>” (domain controller), “gc<\/strong>” (global catalog), “pdc<\/strong>” (primary domain controller), and “domains<\/strong>” (globally unique identifier, or GUID<\/strong>) as prefixes in the _msdcs<\/strong> subdomain.<\/p>\n To accommodate locating domain controllers by server type or by GUID<\/strong> (abbreviated “dctype<\/strong>“), Windows Server 2003 and later based domain controllers register SRV<\/strong> records in the following form:<\/p>\n For a complete list of definitions of the names associated with registered SRV records, refer to the “SRV Records Registered by Net Logon” in this Technet article<\/a>.<\/p>\n Rather than showing the entries bit-by-bit, with an explaination of each, I’ve opted to display all of them with the relevant values that you need to change to suit your organisation (highlighted<\/strong><\/span>). If you want to know what each one does, refer to the article above.<\/p>\n Once you’ve added the records to the zone file, you can unfreeze it, then restart the relevent services…<\/p>\n SRV<\/strong> records may be queried with standard network administration tools, such as the DIG<\/strong> or nslookup<\/strong>.<\/p>\n Taking DNS a step further Back in September 2010 I posted an article on creating your own DNS server (using BIND9) and linked to DHCP. There was probably one element of that setup that was missing – Microsoft’s Active Directory. Active Directory uses DNS as its domain controller location mechanism and leverages the namespace design… Read more »<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[91,96,94,90,92,100,99,98,93,97,89,95],"class_list":["post-102","post","type-post","status-publish","format-standard","hentry","category-technical-resource","tag-_msdcs","tag-active-directory","tag-bind9","tag-cname","tag-dig","tag-domain","tag-guid","tag-ntds","tag-rndc","tag-server","tag-srv","tag-windows"],"_links":{"self":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=102"}],"version-history":[{"count":6,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions"}],"predecessor-version":[{"id":171,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions\/171"}],"wp:attachment":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}An alias by any other name…<\/h2>\n
Finding the DNS Alias for your AD server<\/h3>\n
\u2192 Sites\r\n \u2192 Default-First-Site-Name\r\n \u2192 Servers\r\n \u2192 [server name]<\/em><\/strong> (this will be the name of your AD server)<\/span>\r\n \u2192 NTDS Settings<\/pre>\nFreeze the zone record<\/h3>\n
cd \/var\/lib\/bind\r\nsudo rndc freeze zone<\/strong><\/em><\/span><\/pre>\nAdding the relevent SRV records<\/h3>\n
\n
\n
$ORIGIN example.com.<\/strong><\/span>\r\nadserver<\/strong> A 192.168.1.1<\/span>\r\n$ORIGIN _msdcs.example.com.<\/strong><\/span>\r\ndc41138f-f32e-22ff-9e10-9893dc599536<\/strong> CNAME adserver.example.com.<\/strong><\/span><\/pre>\n_Service._Protocol.DcType._msdcs<\/strong>.DnsDomainName<\/span><\/pre>\n$ORIGIN _tcp.dc._msdcs.example.com.<\/strong><\/span>\r\n_kerberos SRV 0 0 88 adserver.example.com.<\/strong><\/span>\r\n_ldap SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n\r\n$ORIGIN _udp.example.com.<\/strong><\/span>\r\n_kerberos SRV 0 0 88 adserver.example.com.<\/strong><\/span>\r\n_kpasswd SRV 0 0 464 adserver.example.com.<\/strong><\/span>\r\n\r\n$ORIGIN _tcp.Default-First-Site-Name._sites.example.com.<\/strong><\/span>\r\n_kerberos SRV 0 0 88 adserver.example.com.<\/strong><\/span>\r\n_ldap SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_gc SRV 0 0 3268 adserver.example.com.<\/strong><\/span>\r\n\r\n$ORIGIN _tcp.Default-First-Site-Name._sites.dc._msdcs.example.com.<\/strong><\/span>\r\n_kerberos SRV 0 0 88 adserver.example.com.<\/strong><\/span>\r\n_ldap SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n\r\n$ORIGIN _tcp.Default-First-Site-Name._sites.adserver.example.com.<\/span><\/strong>\r\n_ldap SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_gc SRV 0 0 3268 adserver.example.com.<\/strong><\/span>\r\n\r\n$ORIGIN _tcp.example.com.<\/strong><\/span>\r\n_kerberos SRV 0 0 88 adserver.example.com.<\/strong><\/span>\r\n_ldap SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_kpasswd SRV 0 0 464 adserver.example.com.<\/strong><\/span>\r\n_gc SRV 0 0 3268 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.gc._msdcs SRV 0 0 3268 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.pdc._msdcs SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.adserver.example.com<\/strong><\/span> SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs SRV 0 0 3268 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.dc41138f-f32e-22ff-9e10-9893dc599536.domains._msdcs SRV 0 0 389 adserver.example.com.<\/strong><\/span>\r\n_ldap._tcp.Default-First-Site-Name._sites.adserver.example.com<\/strong><\/span> SRV 0 0 389 adserver.example.com.<\/strong><\/span><\/span><\/pre>\nsudo rndc unfreeze zone\r\nsudo \/etc\/init.d\/bind9 restart\r\nsudo \/etc\/init.d\/dhcp3-server restart<\/pre>\n
Testing the changes<\/h2>\n
dig SRV _ldap._tcp.dc._msdcs.Domain_Name<\/strong><\/em><\/span>\r\nhost -t SRV _ldap._tcp.dc._msdcs.Domain_Name<\/strong><\/em><\/span>\r\nnslookup -type=SRV _ldap._tcp.dc._msdcs.Domain_Name<\/strong><\/em><\/span>\r\nnslookup\r\n\r\n> set type=all<\/strong><\/span>\r\n> _ldap._tcp.dc._msdcs.Domain_Name<\/em><\/span><\/strong><\/span><\/pre>\n","protected":false},"excerpt":{"rendered":"