Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Achim Gottinger]

Am 30.12.2012 02:03, schrieb Andrew Bartlett:

On Sat, 2012-12-29 at 13:38 +0100, Achim Gottinger wrote:

_ldap._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
_kerberos._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
_gc._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.gsg.local SRV 
site1.gsg.local
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
site1.gsg.local
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
site1.gsg.local

So there are no more (visible) entries left in

Default-First-Site-Name._sites.gsg.local
Default-First-Site-Name._sites.gc._msdcs.gsg.local
Default-First-Site-Name._sites.dc._msdcs.gsg.local

But the structure remains an can not be deleted. (things like
_tcp.Default-First-Site-Name._sites.gsg.local). Things still seem to
work at both sites but i'm curious if these leftovers can be completely
removed.
As you have noticed, we are very good at adding DNS records, but never
remove the old ones.  What you have done seems reasonable, if you have
renamed the site, removing the remaining DNS references seems entirely
reasonable.

Please file a bug about the left-behind DNS stuff, we really should
clean that up.

Andrew Bartlett



Well after some time and samba restarts the left over structure elements 
had disappeared.
Had to remove two records with samba-tools because they could not be 
accessed from the MS DNS Snapin.


samba-tool dns delete localhost gsg.local 
"_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.gsg.local" SRV 
"server-site1.gsg.local. 389 0 100"
samba-tool dns delete localhost gsg.local 
"_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.gsg.local" SRV 
"server-site1.gsg.local. 389 0 100"


Afterwards all appearances of Default-First-Site-Name disappeared.

There remains however still an issue with the site dependant SRV records 
on an server. If a server is moved to another site or an site gets 
renamed. The old SRV records for that server/site remain.


Achim Gottinger


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Achim Gottinger]

Am 31.12.2012 18:26, schrieb Rob Townley:




MS ADS utilities would demand restoring from backups for deleting dns
records.

Assuming you are trying to have two different sites in the same domain,
you would not want to delete DNS records at all, but change the dns SRV
record such that the remote site has a lower priority (higher number) and
the local site has a better priority (lower number).   In many computer
systems, higher priority is represented by a lower number.  zero is often
the highest priority.  Weight is different than priority.  More Weight is
represented by a higher number.   You may want to leave weight alone
because rfc2782 says WEIGHT zero is a special case.  rfc2782 is a little
confusing as to what weight zero implies.  It also states the order of
ResourceRecords returned matters in the selection process.  Details are in
the URLs below.  i would recommend reading about PRIORITY and WEIGHT in
2782.



http://en.wikipedia.org/wiki/SRV_record
http://tools.ietf.org/html/rfc2782

Thank you for the explanation.

I redid the site reation and renaming once again, this time i did not 
touch any DNS entry.


1. After the creation of the first DC

LDAP:

dn: DC=gsg,DC=local
fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
msDs-masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
msDS-IsDomainFor: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local 



dn: CN=Infrastructure,DC=gsg,DC=local
fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


dn: CN=RID Manager$,CN=System,DC=gsg,DC=local
fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


dn: CN=SERVER-SITE1,OU=Domain Controllers,DC=gsg,DC=local
serverReferenceBL: 
CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local



DNS: gsg.local

_gc._tcp SRV 0 100 3268 server-site1.gsg.local
_kerberos._tcp SRV 0 100 88 server-site1.gsg.local
_kpasswd._tcp SRV 0 100  464 server-site1.gsg.local
_ldap._tcp SRV 0 100  389 server-site1.gsg.local

_kerberos._udp SRV 0 100   88 server-site1.gsg.local
_kpasswd._udp SRV 0 100  464 server-site1.gsg.local

_ldap._tcp.DomainDnsZones SRV 0 100 389 server-site1.gsg.local
_ldap._tcp.ForestDnsZones SRV 0 100 389 server-site1.gsg.local

_gc._tcp.Default-First-Site-Name._sites SRV 0 100 3268 
server-site1.gsg.local
_kerberos._tcp.Default-First-Site-Name._sites SRV 0 100   88 
server-site1.gsg.local
_ldap._tcp.Default-First-Site-Name._sites SRV 0 100  389 
server-site1.gsg.local


_ldap._tcp.Default-First-Site-Name._site.DomainDnsZones SRV 0 100  389 
server-site1.gsg.local
_ldap._tcp.Default-First-Site-Name._site.ForestDnsZones SRV 0 100  389 
server-site1.gsg.local



DNS: _msdc.gsg.local

_kerberos._tcp.dc SRV 0 100 88 server-site1.gsg.local
_ldap._tcp.dc SRV 0 100 389 server-site1.gsg.local
_ldap._tcp.gc SRV 0 100 3268 server-site1.gsg.local
_ldap._tcp.pdc SRV 0 100  389 server-site1.gsg.local

_ldap._tcp.[DOMAIN ID].domains SRV 0 100  389 server-site1.gsg.local

_kerberos._tcp.Default-First-Site-Name._sites.dc SRV 0 100   88 
server-site1.gsg.local
_ldap._tcp.Default-First-Site-Name._sites.dc SRV 0 100  389 
server-site1.gsg.local


_ldap._tcp.Default-First-Site-Name._sites.gc SRV 0 100 3268 
server-site1.gsg.local



2. Join server-site2 create site2 and move server-site2 into site2, 
assign subnets to both sites.


LDAP:

dn: DC=gsg,DC=local

fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


msDs-masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
msDS-IsDomainFor: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


msDs-masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
msDS-IsDomainFor: CN=NTDS 
Settings,CN=SERVER-SITE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local
masteredBy: CN=NTDS 
Settings,CN=SERVER-SITE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


dn: CN=Infrastructure,DC=gsg,DC=local
fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER-SITE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gsg,DC=local


dn: CN=RID Manager$,CN=System,DC=gsg,DC=local
fSMORoleOwner: CN=NTDS 
Settings,CN=SERVER

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Rob Townley]

On Sun, Dec 30, 2012 at 10:06 PM, Matthieu Patou  wrote:

> On 12/30/2012 07:10 PM, Achim Gottinger wrote:
>
>> As you have noticed, we are very good at adding DNS records, but never
>>> remove the old ones.  What you have done seems reasonable, if you have
>>> renamed the site, removing the remaining DNS references seems entirely
>>> reasonable.
>>>
>>> Please file a bug about the left-behind DNS stuff, we really should
>>> clean that up.
>>>
>>> Andrew Bartlett
>>>
>>
>> There is this menu option "cleanup old resource entries" in the DNS
>> snap-in, guess it's normal AD behaviour.  :-)
>>
> Not it's not, there is KB about DNS server about how to clean old records
> that were set by a client via DDNS
>
>  This does not yet work against an Samba4 AD DC. But I'll file an
>> bugreport.
>>
>>  I'm not 100% sure that we implement everything that is needed for a
>>> client to pickup the correct site, so you might see some issues still.
>>>
>> It had happened in very seldom cases with the samba3/bind/openldap
>> before. In the Samba4 test environment it happened only once after i had
>> removed the mentioned SRV records pointig to site2's dc in site1 folders.
>> I'll report back if it happens on an regular basis.
>>
>>> As an last step i renamed the site "Default-First-Site-Name" into
 "site1". Restarted the samba services at both sites check replication. But
 there are still a few DNS entries left whom i deleted manual.

>>> It's really not a good idea to delete rename the default-First site lots
>>> of Windows admins don't advise to do so, you'd better leave it empty.
>>> Matthieu
>>>
>>
>> So to be on the safe side you recommend i create two new sites and assign
>> the two servers to them, leaving Default-First-Site-Name with on assigned
>> server.
>> I thought it is safer to leave the first server in that default site
>> because i had read the sites thing is a work in progress. Renaming it was
>> somethin i did after abit of online research which mentioned it is safe and
>> not forbidden. Beside that now empty structure elements in dns the test
>> environment is still work functional.
>>
>> http://social.technet.**microsoft.com/Forums/en-US/**
>> winserverNIS/thread/2afc3cf5-**7389-4368-bdeb-887e60c0081f
>>
>> Beside all that for me samba4 is a great step forward an will simplify
>> things alot compared to the previous samba3/bind/openldap solution
>>
> Ok good to know.
>
> Matthieu.
>
>
> --
> Matthieu Patou
> Samba Team
> http://samba.org
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  
> https://lists.samba.org/**mailman/options/samba
>




MS ADS utilities would demand restoring from backups for deleting dns
records.

Assuming you are trying to have two different sites in the same domain,
you would not want to delete DNS records at all, but change the dns SRV
record such that the remote site has a lower priority (higher number) and
the local site has a better priority (lower number).   In many computer
systems, higher priority is represented by a lower number.  zero is often
the highest priority.  Weight is different than priority.  More Weight is
represented by a higher number.   You may want to leave weight alone
because rfc2782 says WEIGHT zero is a special case.  rfc2782 is a little
confusing as to what weight zero implies.  It also states the order of
ResourceRecords returned matters in the selection process.  Details are in
the URLs below.  i would recommend reading about PRIORITY and WEIGHT in
2782.



http://en.wikipedia.org/wiki/SRV_record
http://tools.ietf.org/html/rfc2782
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Matthieu Patou]

On 12/30/2012 07:10 PM, Achim Gottinger wrote:

As you have noticed, we are very good at adding DNS records, but never
remove the old ones.  What you have done seems reasonable, if you have
renamed the site, removing the remaining DNS references seems entirely
reasonable.

Please file a bug about the left-behind DNS stuff, we really should
clean that up.

Andrew Bartlett


There is this menu option "cleanup old resource entries" in the DNS 
snap-in, guess it's normal AD behaviour.  :-)
Not it's not, there is KB about DNS server about how to clean old 
records that were set by a client via DDNS
This does not yet work against an Samba4 AD DC. But I'll file an 
bugreport.


I'm not 100% sure that we implement everything that is needed for a 
client to pickup the correct site, so you might see some issues still. 
It had happened in very seldom cases with the samba3/bind/openldap 
before. In the Samba4 test environment it happened only once after i 
had removed the mentioned SRV records pointig to site2's dc in site1 
folders. I'll report back if it happens on an regular basis.
As an last step i renamed the site "Default-First-Site-Name" into 
"site1". Restarted the samba services at both sites check 
replication. But there are still a few DNS entries left whom i 
deleted manual. 
It's really not a good idea to delete rename the default-First site 
lots of Windows admins don't advise to do so, you'd better leave it 
empty. Matthieu 


So to be on the safe side you recommend i create two new sites and 
assign the two servers to them, leaving Default-First-Site-Name with 
on assigned server.
I thought it is safer to leave the first server in that default site 
because i had read the sites thing is a work in progress. Renaming it 
was somethin i did after abit of online research which mentioned it is 
safe and not forbidden. Beside that now empty structure elements in 
dns the test environment is still work functional.


http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/2afc3cf5-7389-4368-bdeb-887e60c0081f 



Beside all that for me samba4 is a great step forward an will simplify 
things alot compared to the previous samba3/bind/openldap solution

Ok good to know.

Matthieu.

--
Matthieu Patou
Samba Team
http://samba.org

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Achim Gottinger]

As you have noticed, we are very good at adding DNS records, but never
remove the old ones.  What you have done seems reasonable, if you have
renamed the site, removing the remaining DNS references seems entirely
reasonable.

Please file a bug about the left-behind DNS stuff, we really should
clean that up.

Andrew Bartlett


There is this menu option "cleanup old resource entries" in the DNS snap-in, 
guess it's normal AD behaviour.  :-)
This does not yet work against an Samba4 AD DC. But I'll file an bugreport.

I'm not 100% sure that we implement everything that is needed for a 
client to pickup the correct site, so you might see some issues still. 

It had happened in very seldom cases with the samba3/bind/openldap before. In 
the Samba4 test environment it happened only once after i had removed the 
mentioned SRV records pointig to site2's dc in site1 folders. I'll report back 
if it happens on an regular basis.
As an last step i renamed the site "Default-First-Site-Name" into 
"site1". Restarted the samba services at both sites check 
replication. But there are still a few DNS entries left whom i 
deleted manual. 
It's really not a good idea to delete rename the default-First site 
lots of Windows admins don't advise to do so, you'd better leave it 
empty. Matthieu 


So to be on the safe side you recommend i create two new sites and assign the 
two servers to them, leaving Default-First-Site-Name with on assigned server.
I thought it is safer to leave the first server in that default site because i 
had read the sites thing is a work in progress. Renaming it was somethin i did 
after abit of online research which mentioned it is safe and not forbidden. 
Beside that now empty structure elements in dns the test environment is still 
work functional.

http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/2afc3cf5-7389-4368-bdeb-887e60c0081f

Beside all that for me samba4 is a great step forward an will simplify things 
alot compared to the previous samba3/bind/openldap solution

Achim Gottinger

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Matthieu Patou]

On 12/29/2012 04:38 AM, Achim Gottinger wrote:

Hello,

I'm running a  few tests here with two locations.

site1: server-site1.gsg.local subnet 192.168.200.0/24
site2: server-site2.gsg.local subnet 192.168.190.0/24

both are connected via VPN.

I migrated an samba3 domain at server-site1 it gets 
Default-First-Site-Name assigned. Then I joined the new samba4 domain 
withe server-site2. Both servers work and i can join and access them 
with clients at both locations. I created reverse zones for both 
subnets and added the required static entries.
Then I created an new site (name site2) and two subnets with MS AD 
Site Management. I assigned subnet 192.168.200.0/24 to the site 
"Default-First-Site-Name" and subnet 192.168.190.0/24 to the site 
"site2". And moved server-site2 from Default-First-Site-Name to site2.
Machines at site1 randomly picked server-site2 for logins. On site2 
they always picked server-site2.


I'm not 100% sure that we implement everything that is needed for a 
client to pickup the correct site, so you might see some issues still.


As an last step i renamed the site "Default-First-Site-Name" into 
"site1". Restarted the samba services at both sites check replication. 
But there are still a few DNS entries left whom i deleted manual.


It's really not a good idea to delete rename the default-First site lots 
of Windows admins don't advise to do so, you'd better leave it empty.


Matthieu





--
Matthieu Patou
Samba Team
http://samba.org

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

Re: [Samba] Samba4 AD DC Sites / Rename Default-First-Site-Name and internal DNS

[Andrew Bartlett]

On Sat, 2012-12-29 at 13:38 +0100, Achim Gottinger wrote:
> Hello,
> 
> I'm running a  few tests here with two locations.
> 
> site1: server-site1.gsg.local subnet 192.168.200.0/24
> site2: server-site2.gsg.local subnet 192.168.190.0/24
> 
> both are connected via VPN.
> 
> I migrated an samba3 domain at server-site1 it gets 
> Default-First-Site-Name assigned. Then I joined the new samba4 domain 
> withe server-site2. Both servers work and i can join and access them 
> with clients at both locations. I created reverse zones for both subnets 
> and added the required static entries.
> Then I created an new site (name site2) and two subnets with MS AD Site 
> Management. I assigned subnet 192.168.200.0/24 to the site 
> "Default-First-Site-Name" and subnet 192.168.190.0/24 to the site 
> "site2". And moved server-site2 from Default-First-Site-Name to site2.
> Machines at site1 randomly picked server-site2 for logins. On site2 they 
> always picked server-site2.
> 
> So I deleted a few DNS records.
> 
> _ldap._tcp.Default-First-Site-Name._sites.gsg.local SRV site2.gsg.local
> 
> _kerberos._tcp.Default-First-Site-Name._sites.gsg.local SRV site2.gsg.local
> 
> _gc._tcp.Default-First-Site-Name._sites.gsg.local SRV site2.gsg.local
> 
> _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.gsg.local SRV 
> site2.gsg.local
> 
> 
> And after an samba restart also
> 
> _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
> site2.gsg.local
> 
> _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
> site2.gsg.local
> 
> Afterwards machines at site1 also chose server-site1 most of the time. 
> Hope i can optimize the behaviour of logon server choosing abit more but 
> it happened really seldom and it all ran virtualized with 1GB bandwidth 
> for the VPN connection, which will be 1-2MBit once in production.
> 
> As an last step i renamed the site "Default-First-Site-Name" into 
> "site1". Restarted the samba services at both sites check replication. 
> But there are still a few DNS entries left whom i deleted manual.
> 
> _ldap._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
> _kerberos._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
> _gc._tcp.Default-First-Site-Name._sites.gsg.local SRV site1.gsg.local
> _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.gsg.local SRV 
> site1.gsg.local
> _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
> site1.gsg.local
> _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.gsg.local SRV 
> site1.gsg.local
> 
> So there are no more (visible) entries left in
> 
> Default-First-Site-Name._sites.gsg.local
> Default-First-Site-Name._sites.gc._msdcs.gsg.local
> Default-First-Site-Name._sites.dc._msdcs.gsg.local
> 
> But the structure remains an can not be deleted. (things like 
> _tcp.Default-First-Site-Name._sites.gsg.local). Things still seem to 
> work at both sites but i'm curious if these leftovers can be completely 
> removed.

As you have noticed, we are very good at adding DNS records, but never
remove the old ones.  What you have done seems reasonable, if you have
renamed the site, removing the remaining DNS references seems entirely
reasonable.

Please file a bug about the left-behind DNS stuff, we really should
clean that up. 

Andrew Bartlett

-- 
Andrew Bartletthttp://samba.org/~abartlet/
Authentication Developer, Samba Team   http://samba.org


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba