将绑定9和Samba 4中的inaddr.arpa区域委托作为一个具有DDNS的AD DC

Question

环境与目标

在我的测试KVM实验室中，我有一个虚拟网络172.16.50/24，在这个网络中，我有2个CentOS7VM运行Bind 9和ISC DHCP服务器：

• controller.wsvirt.home (172.16.50.2)：МастерDNS
• 从DNS：controller2.wsvirt.home (172.16.50.3)

网络中的所有客户端都是Linux，它们都从DHCP服务器获得网络配置。此服务器动态更新DNS区域。

Bind 9是wsvirt.home专区的权威服务器。

在实验室环境中，我测试了一个必须在我们的业务办公网络中实现的场景。在商业环境中，我应该创建一个AD域来服务Windows客户端，为此，我们决定使用Samba 4作为DC。我已经为Centos 7构建了一个Samba服务器，并从源代码中获得了Heimdal Kerberos支持。

对于AD，我分配子网络172.16.50.192/26和分配的ad.wsvirt.home域。

and是一个CentOS7VM，运行Samba 4、Bind 9和ISC DHCP服务器。Samba使用BIND_DLZ作为DNS后端。AD控制器具有addc1.ad.wsvirt.home域名和IP 172.16.50.193。

所有Windows客户端都从运行在AD上的DHCP服务器获取IP，该服务器动态更新绑定DLZ区域。

在实际工作的物理环境中，来自这两个网络的所有客户端PC都应该连接到一个广播域。

为了满足需求，我将转发ad.wsvirt.home和反向172.16.50.192/26 DNS区域的权限从controller.wsvirt.home服务器上的绑定委托给AD控制器addc1.ad.wsvirt.home，相应地将其委托给RFC 2317。

问题

除了一件事外，一切都很完美。当我在AD DC上测试revers查找委托反向区域时，结果看起来是OK的，因此Windows客户端可以解析两个域中的所有反向域名。：

$ dig -x 172.16.50.193 @addc1.ad.wsvirt.home

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 172.16.50.193 @addc1.ad.wsvirt.home
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43507
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;193.50.16.172.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
193.50.16.172.in-addr.arpa. 86400 IN    CNAME   193.50.16.172.ddns.
193.50.16.172.ddns.     900     IN      PTR     addc1.ad.wsvirt.home.

;; Query time: 7 msec
;; SERVER: 172.16.50.193#53(172.16.50.193)
;; WHEN: Mon Mar 30 21:05:12 IDT 2020
;; MSG SIZE  rcvd: 121

但是，当我将请求路由到DNS服务器controller.wsvirt.home时，它不会解析来自ad.wsvirt.home域的任何反向名称，因此Linux客户端也无法查找任何反向名称：

$ dig -x 172.16.50.193 @controller.wsvirt.home

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-9.P2.el7 <<>> -x 172.16.50.193 @controller.wsvirt.home
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48825
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;193.50.16.172.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
193.50.16.172.in-addr.arpa. 86400 IN    CNAME   193.50.16.172.ddns.

;; AUTHORITY SECTION:
.                       8133    IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2020033001 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 172.16.50.2#53(172.16.50.2)
;; WHEN: Mon Mar 30 21:49:41 IDT 2020
;; MSG SIZE  rcvd: 162

I需要来自wsvirt.home域的 Linux客户机才能解析ad.wsvirt.home域中的反向域名。有可能吗？

Configurations

更确切地说，我在这里放置了两个服务器的配置文件。

服务器controller.wsvirt.home

/etc/named.conf

acl local { 172.16.50.0/24; 127.0.0.1; };

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/etc/rndc.key";

server 172.16.50.3 {
        keys { "rndc-key"; };
};

...

options {
        listen-on port 53 { local; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { local; };
        allow-transfer { none; };
        notify no; 
        forwarders { 8.8.8.8; 8.8.4.4; };
        forward only;
        recursion yes;
        dnssec-enable yes;
        dnssec-validation yes;
        bindkeys-file "/etc/named.iscdlv.key";
        managed-keys-directory "/var/named/dynamic";
        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};


zone "." IN {
        type hint; 
        file "named.ca";
};

zone "wsvirt.home" IN {
        type master;
        file "wsvirt.home.db";
        allow-update { key "rndc-key"; };
        allow-transfer { key "rndc-key"; };
        notify yes;
        forwarders {};
};

zone "50.16.172.in-addr.arpa" IN {
        type master;
        file "50.16.172.db";
        allow-update { key "rndc-key"; };
        allow-transfer { key "rndc-key"; };
        notify yes;
};

/var/named/50.16.172.db

$ORIGIN .
$TTL 86400      ; 1 day
50.16.172.in-addr.arpa  IN SOA  controller.wsvirt.home. root.wsvirt.home. (
                                153        ; serial
                                3600       ; refresh (1 hour)
                                1800       ; retry (30 minutes)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
                                )
                        NS      controller.wsvirt.home.
                        NS      controller2.wsvirt.home.
$ORIGIN 50.16.172.in-addr.arpa.
2                       PTR     controller.wsvirt.home.
$TTL 86400      ; 1 day
3                       PTR     controller2.wsvirt.home.
...
;
50.16.172.ddns.         IN      NS      addc1.ad.wsvirt.home.
$GENERATE 193-254 $     IN      CNAME   $.50.16.172.ddns.

/etc/dhcp/dhcpd.conf

include "/etc/rndc.key";

default-lease-time 600;
max-lease-time 7200;
authoritative;
ddns-update-style interim;

class "windows" {  
        match if substring (option vendor-class-identifier, 0, 8) = "MSFT 5.0";
}

subnet 172.16.50.0 netmask 255.255.255.0 {
        log (info, concat("Vendor Class ID (60): ", option vendor-class-identifier));
        log (info, concat("DHCP Client ID (61): ", option dhcp-client-identifier));
        log (info, concat("User Class ID (77): ", option user-class));
        option domain-name-servers 172.16.50.2, 172.16.50.3;
        option ntp-servers 172.16.50.2;
        option routers 172.16.50.1;
        option broadcast-address 172.16.50.255;
        default-lease-time 600;
        max-lease-time 7200;
        option ip-forwarding off;
        ignore client-updates;
        option domain-name "wsvirt.home";
        option domain-search "wsvirt.home";
        option netbios-scope "";
        option netbios-node-type 8;
        option netbios-name-servers 172.16.50.2;
        option netbios-dd-server 172.16.50.2;
        ddns-updates on;
        ddns-domainname "wsvirt.home.";
        ddns-rev-domainname "in-addr.arpa.";

        pool {  
                range 172.16.50.21 172.16.50.190;
                deny members of "windows";
        }

        zone wsvirt.home {
                primary 172.16.50.2;
                key "rndc-key";
        }

        zone 50.16.172.in-addr.arpa {
                primary 172.16.50.2;
                key "rndc-key";
        }
}

AD DC addc1.ad.wsvirt.home

/etc/named.conf

options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { ::1; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-query     { any; };
    forwarders  { 172.16.50.2; 172.16.50.3; };
    forward only;
    recursion yes;
    dnssec-enable no;
    dnssec-validation no;
    bindkeys-file "/etc/named.root.key";
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
    tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";
    minimal-responses yes;
};

...

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/rndc.key";
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
include "/var/lib/samba/bind-dns/named.conf";

/etc/dhcp/dhcpd.conf

include "/etc/rndc.key";

default-lease-time 600;
max-lease-time 7200;
min-secs 5;
authoritative;
ddns-update-style none;

class "others" {
    match if substring (option vendor-class-identifier, 0, 8) != "MSFT 5.0";
}

subnet 172.16.50.192 netmask 255.255.255.192 {
    log (info, concat("Vendor Class ID (60): ", option vendor-class-identifier));
    log (info, concat("DHCP Client ID (61): ", option dhcp-client-identifier));
    log (info, concat("User Class ID (77): ", option user-class));
    option routers 172.16.50.1;
    option broadcast-address 172.16.50.255;
    default-lease-time 600;
    max-lease-time 7200;
    option ip-forwarding off;
    ignore client-updates;
    option ntp-servers 172.16.50.193;
    option domain-name-servers 172.16.50.193;
    option domain-name "ad.wsvirt.home";
    option domain-search "ad.wsvirt.home";
    option netbios-name-servers 172.16.50.193;
    option netbios-dd-server 172.16.50.193;
    option netbios-scope "";
    option netbios-node-type 8;
    ddns-rev-domainname "ddns";

    pool {
        range 172.16.50.210 172.16.50.254;
        deny members of "others";
    }
}

on commit {
    set noname = concat("dhcp-", binary-to-ascii(10, 8, "-", leased-address));
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    set ClientDHCID = concat (
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,1,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,2,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,3,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,4,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,5,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,6,1))),2)
    );
    set ClientName = pick-first-value(option host-name, config-option-host-name, client-name, noname);
    log(concat("Commit: IP: ", ClientIP, " DHCID: ", ClientDHCID, " Name: ", ClientName));
    execute("/usr/local/sbin/dhcp-dyndns.sh", "add", ClientIP, ClientDHCID, ClientName);
}

on release {  
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    set ClientDHCID = concat (
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,1,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,2,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,3,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,4,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,5,1))),2), ":",
    suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,6,1))),2)
    );
    log(concat("Release: IP: ", ClientIP));
    execute("/usr/local/sbin/dhcp-dyndns.sh", "delete", ClientIP, ClientDHCID);
}

on expiry {   
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    log(concat("Expired: IP: ", ClientIP));
    execute("/usr/local/sbin/dhcp-dyndns.sh", "delete", ClientIP, "", "0");
}

A DLZ反转AD DC

上的区域50.16.172.ddns

$ samba-tool dns query localhost 50.16.172.ddns @ ALL 
Password for [administrator@AD.WSVIRT.HOME]:
  Name=, Records=2, Children=0
    SOA: serial=3, refresh=900, retry=600, expire=86400, minttl=3600, ns=addc1.ad.wsvirt.home., email=hostmaster.ad.wsvirt.home. (flags=600000f0, serial=3, ttl=3600)
    NS: addc1.ad.wsvirt.home. (flags=600000f0, serial=1, ttl=3600)
  Name=193, Records=1, Children=0
    PTR: addc1.ad.wsvirt.home (flags=f0, serial=3, ttl=900)
  Name=230, Records=1, Children=0
    PTR: winxp-1.ad.wsvirt.home (flags=f0, serial=3, ttl=3600)

Answer 1

最后，我发现了问题的根源。关键是，当Bind 9作为转发器工作时，它会剥离DNSSEC签名。我知道这一点，所以在服务器上的named.conf addc1.ad.wsvirt.home中，我设置了以下选项作为解决办法：

dnssec-enable no; 
dnssec-validation no;

但我忘了在controller.wsvirt.home做同样的事情，现在我已经修正了我的疏忽，一切都很好。显然，50.16.172.ddns的区域部分必须位于addc1.ad.wsvirt.home服务器上的绑定的配置文件中：

zone "50.16.172.ddns." { 
    type forward; 
    forwarders { 172.16.50.193; }; 
};

Answer 2

不让PTR使用相同的答案是正常的，因为controller.wsvirt.home.不是这两个区域的权威名称服务器。flags: aa指出，这是一个权威的答案，但对于193.50.16.172.ddns. IN PTR来说并非如此。因此，不能在这个权威的答案上发送it。

这实际上不是一个问题，因为这只会导致对193.50.16.172.ddns. IN PTR的另一个查询，然后可以递归地回答该查询。客户端应该知道在CNAME回答的情况下自动执行此操作。

关于这一点，存在<#>another问题，因为只有addc1.ad.wsvirt.home.有区域50.16.172.ddns.；您可以在以下方面得到NXDOMAIN答案：

dig 193.50.16.172.ddns. PTR @controller.wsvirt.home

controller.wsvirt.home.被配置为递归(recursion yes;)，但它不知道在addc1.ad.wsvirt.home.上可以找到这些地址。因此，它试图将它们解析为其他所有内容:从forwarders { 8.8.8.8; 8.8.4.4; };.却失败了。

您可以将addc1.ad.wsvirt.home.作为50.16.172.ddns.的转发器添加到controller.wsvirt.home.上：

zone "50.16.172.ddns." { 
    type forward; 
    forwarders { 172.16.50.193; }; 
};

最后，$ORIGIN 50.16.172.in-addr.arpa.的区域只能为它自己的子域委派控件--而不是对一个完全无关的50.16.172.ddns.。

如果您仍然希望在相同的响应上发送PTR，则需要添加一个slave区域(而不是forward区域)，从而使该域对50.16.172.ddns.具有权威性。

zone "50.16.172.ddns." { 
    type slave;
    file "50.16.172.ddns.db";
    masters { 172.16.50.193; }; 
};

主服务器(addc1.ad.wsvirt.home.)需要知道这一点，并允许从controller.wsvirt.home. (和controller2.wsvirt.home，如果应该类似的话)进行区域传输：

options {
    . . .
    allow-transfer { 172.16.50.2; 172.16.50.3; };
}

Answer 3

如果您要使用我的脚本，请正确使用它;-)

在DC上运行Bind9和isc-dhcp，不要在其他地方运行。见这里：

https://wiki.samba.org/index.php/Setting_向上_一个_绑定_DNS_服务器

https://wiki.samba.org/index.php/Configure_DHCP_至_更新_DNS_记录_使用_BIND9

您的主要问题之一是，您试图将反向区域存储在一个“平面文件”中，而bind9_dlz不适用于平面文件。