DNS HELP

[Guest]

Right he is the situation.

 

Currently have an Apache web server with a Joomla install and dev Moodle install. There is a dns entry call intranet that points to the server IP and it works fine.

 

This server can now be accessed from outside the network via intranet.schoolsdomain.sch.uk We cannot access via this address internally.

 

The problem is that the websites dont work due to the live site addresses being intranet/joomla and not intranet.schoolsdomain.sch.uk/joomla.

 

So i decided to create a dns record for intranet.schoolsdomain.sch.uk to point to the server IP like above, so making the live site info the same for both inside / outside access.

 

This seems to be working from both W2k3 servers, but when you try from any XP workstation nothing happens.

 

So what am I missing?

[Dos_Box]

Have you flushed the DNS resolver cache on the workstations?

 

ipconfig /flushdns

ipconfig /registerdns

[Dos_Box]

Or are they resolving their web addresses via a proxy? You may have to add the site to the exclusions list.

[Guest]

Yep done that. Pinging the address brings up the correct ip address. NSLOOKUP on the address bring up the correct ip address. The dns table has the correct info.

 

IE just says opening page and nothing happens.

[Guest]

now thats just wierd, its started working all of a sudden. grrrr damn computers lol

 

Cheers for the quick responce though DB

[Geoff]

Windows DNS services take a little while to make a new hostname work. If you want DNS that works instantly (rather than when it gets round to it) use a real DNS server.

[ChrisH]

I have noticed the same thing when adding cnames for local servers. It seems to take a long time even when it should have already updated all the servers.

[Guest]

Glad its not just me then

[Geoff]

DNSMasq running on Linux works fine as the primary DNS/DHCP for a Windows domain if your interested in an alternative.

 

http://thekelleys.org.uk/dnsmasq/doc.html

[GrumbleDook]

as much as I think every school should have a propoer box doing DNS for the important machines in a school, the extra AD related bits that are put into DNS on a windows box should only be done on a wondows box.

 

If DNS is going pear-shaped I would rather solve the problem than put it onto another box. A scenario I have used before is to have the DNS on the DCs point at a *nix box and telling them to pull info for specific domains from there (eg use domain.school for the AD Domain, and have the records for school.area.sch.uk on the *nix box).

 

Worked fantastically ...

[Geoff]

the extra AD related bits that are put into DNS on a windows box should only be done on a wondows box.

 

It's just a bunch of SRV records. It's not really an issue.

[CyberNerd]

as much as I think every school should have a propoer box doing DNS for the important machines in a school, the extra AD related bits that are put into DNS on a windows box should only be done on a wondows box.

 

since version 8.x BIND fully supports active directory

[Geoff]

BIND is probably a bit OTT for most people here though. That's why I suggested dnsmasq.

[GrumbleDook]

The recent times I have had BIND (on Solaris 8) and AD side by side there have been issues with authenticating updates between DCs (which must have the SVR records for their roles to function properly) and the solaris boxen.

 

Once I got SfU 3.5 happy it was better, but it was a level of obfustication that could easily be ruled out.

 

I still believe in the adage: the more complicated it is the easiest it is to go wrong.

[Geoff]

Um, you do know that the DC's produce a text file in there system32 folder detailing the SRV records they need...?

[GrumbleDook]

Yep, but with both W2K Server and server 2003 if you start forcing manual updates with that it can play merry hell with AD integrated DNS ... and if you are using DHCP to auto update your DNS then I have seen this bugger up the AD.

 

Don't get me wrong ... I think BIND is the dog's ... but I have yet to find a way to make a *nix box the master for all DNS within a school without having to jump through hoops, and then it is not the *nix box that has problems ... far from it ... but the AD DCs ... resulting in GPOs not applying, machines not picking up kerberos tokens and so the cannot authenticate against anything.

 

I had a good search round for possible options (leading to playing a bit more with SfU 3.5) and the best *working* solution (best being easiest to set up and the least administration afterwards) seemed to be having the principal domain of the school looked after by the AD DCs and the main website or important machines being on the *nix box. The AD DNS calls it's requests from the *nix box and everyone is happy.

 

If someone could talk through making a *nix box the master for all DNS info in a mixed platform environment I know I would appreciate it. The chance to have a proper DNS would be lovely.

[CyberNerd]

AFAIK all that needs to be done is configure the SRV records

There is a guide here:

http://www.linuxquestions.org/linux/answers/Networking/Configure_BIND_DNS_to_Answer_Active_Directory_Queries

[GrumbleDook]

Yep ... saw a similar set of instructions to that before ... though that link if far mor descriptive (but it does avoid the issues of weighting records)

 

But it still doesn't point out how I can allow the secure dynamic updating of SVR records, or secure updating of DNS records of workstations that are using DCs as their primary DNS source.

 

I know you could argue that you don't need the DCs as your primary DNS source but then you get into problems with kerberos being pants with authentication (usually a date-time stamp issue).

 

Those are the solutions I am looking for and why I said that I still believe that DCs should do your Primary DNS (but only for windows machines really ...)

[CyberNerd]

I know you could argue that you don't need the DCs as your primary DNS source but then you get into problems with kerberos being pants with authentication (usually a date-time stamp issue)

 

The article was referring to BIND as a replacement, as long as the kerberos SRV records are in place then kerberos issues are usually due to clock skew -set a time server in DHCP.

Bind 8 does support dynamic updates, MS describes configuring Domain Controllers to use BIND DNS servers here:

http://www.microsoft.com/technet/archive/interopmigration/linux/mvc/cfgbind.mspx?mfr=true

[Geoff]

You could always delegate the _tcp_, _ldap_, _kerberos_ sub zones to your Windows DNS server and leave you *nix box running the primary DNS zone.

 

But as I said, you just need to pull that text file out of each DC. Combine the resulting SRV records together and your sorted. You can either do this manually once, or write a script to do it automagically.