win2k server AD using Bind

XOR != OR

[H]F Junkie
Joined
Jun 17, 2003
Messages
11,547
HI all. After fighting with this for the past couple weeks, I am finally tossing in the towel and asking for help.

I have a bind server running on a FC2 box ( note to FC people: Don't call it a release if you've fucked bind up. It's not a release ), and I want to use that machien for my AD dns server. It can be done, I've done it on another box that this one is replacing. I *copied* the files over.

Anyway.

I setup dhcp and named to do dynamic name registration. Here is my dhcpd.conf file:
Code:
authorative;
   
   ddns-update-style interim;
   ddns-domainname "boca";
   ddns-updates on;
   
   option domain-name "boca";
   option domain-name-servers 192.168.1.1;
   option routers 192.168.1.1;
   option time-offset -8;
   log-facility local5;
   
   option netbios-node-type 8;
   option netbios-name-servers 192.168.1.3;
   
   subnet 192.168.1.0 netmask 255.255.255.0 {
   		authoritative;
   		range 192.168.1.50 192.168.1.100;
   		option subnet-mask 255.255.255.0;
   		option broadcast-address 192.168.1.255;
   		host phaser {
 				hardware ethernet 08:00:11:14:20:b7;
   				fixed-address 192.168.1.105;
   		}
   		host hplj2200 {
 				hardware ethernet 00:30:C1:CE:B2:01;
   				fixed-address 192.168.1.250;
   		}
   		host moya {
 				hardware ethernet 00:04:75:C1:F2:DF;
   				fixed-address 192.168.1.3;
   		}
   		host sql {
 				hardware ethernet 00:04:75:C0:1E:8c;
   				fixed-address 192.168.1.2;
   		}
   		host nook-1 {
 				hardware ethernet 00:10:dc:a5:78:01;
   				fixed-address 192.168.1.201;
   		}
   		host nook-2 {
 				hardware ethernet 00:0b:db:c6:82:90;
   				fixed-address 192.168.1.202;
   		}
   		host nook-3 {
 				hardware ethernet 00:40:95:30:70:0f;
   				fixed-address 192.168.1.203;
   		}
   }
   
   zone boca. {
   		primary 192.168.1.1;
   }
   
   zone 1.168.192.in-addr.arpa. {
   		primary 192.168.1.1;
   }

And here is my named.conf:
Code:
// generated by named-bootconf.pl
   
   options {
   		directory "/var/named/";
   		/*
   		 * If there is a firewall between you and nameservers you want
   		 * to talk to, you might need to uncomment the query-source
   		 * directive below.  Previous versions of BIND always asked
   		 * questions using port 53, but BIND 8.1 uses an unprivileged
   		 * port by default.
   		 */
   		// query-source address * port 53;
   };
   
   acl "updates" {
   		localhost;
   		192.168.1.1;
   		192.168.1.2;
   		192.168.1.3;
   };
   
   //
   // a caching only nameserver config
   //
   controls {
   		inet 127.0.0.1 allow { updates; } keys { rndckey; };
   };
   zone "." IN {
   		type hint;
   		file "named.ca";
   };
   
   zone "localhost" IN {
   		type master;
   		file "localhost.zone";
   		allow-update { none; };
   };
   
   zone "0.0.127.in-addr.arpa" IN {
   		type master;
   		file "named.local";
   		allow-update { none; };
   };
   
   zone "1.168.192.in-addr.arpa" {
   		type master;
   		file "db.1.168.192.in-addr.arpa";
   		allow-update { updates; };
   };
   
   zone "boca" IN {
   		type master;
   		file "db.boca";
   		allow-update { "updates"; };
   };

So far, so good. Right now, the machines will update their reverse address, but not their forward address. And I can't figure out why. The only clue I have is when I tell one of the DCs to /registerdns, I get this in my logs ( querylog turned on ):
Code:
Sep 24 21:55:23 firewall named[15983]: client 192.168.1.1#32800: updating zone '1.168.192.in-addr.arpa/IN': deleting an rrset
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.1#32800: updating zone '1.168.192.in-addr.arpa/IN': adding an RR
   Sep 24 21:55:23 firewall dhcpd: added reverse map from 2.1.168.192.in-addr.arpa. to sql.boca
   Sep 24 21:55:23 firewall dhcpd: DHCPREQUEST for 192.168.1.2 from 00:04:75:c0:1e:8c via eth1
   Sep 24 21:55:23 firewall dhcpd: DHCPACK on 192.168.1.2 to 00:04:75:c0:1e:8c via eth1
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4766: query: sql.boca\007 IN SOA
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4767: query: 1.168.192.in-addr.arpa IN SOA
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4768: updating zone '1.168.192.in-addr.arpa/IN': deleting an rrset
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4768: updating zone '1.168.192.in-addr.arpa/IN': adding an RR
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4768: updating zone '1.168.192.in-addr.arpa/IN': adding an RR
   Sep 24 21:55:23 firewall named[15983]: client 192.168.1.2#4769: query: sql.boca IN SOA

As you can see, it does a lookup for sql.boca\007 ( which I am assuming is a control code of some sort ), but it doesn't even try to update the forward zone. I suspect that, somewhere, the window systems are getting boca\007 as the domain name, which will not work.

Does anybody have any other ideas? I'm completely at a loss here. This setup works just fine in three other places, and I have copied those files directly to this network and just made the simple change of the domain name. I've combed through my config files and zone files for the extra character at the end of the domain name, but I simply am out of ideas.

Thank you in advance!
 
Just curious.. I do this exact setup as well (minus the ddns part.. why do you do that?). Can I get a paste of any BIND messages when you first start BIND?
 
shade91 said:
Just curious.. I do this exact setup as well (minus the ddns part.. why do you do that?).
As I understand it, that's needed to make dhcpd do the dynamic updates, instead of the clients. I don't trust win2k clients to keep their zone data straight, I've had too many problems with them, so I leave it to the dhcpd client to keep things up and running. However, as far as I can see, neither one is really trying to hit the dns server to update forward zone data.
Can I get a paste of any BIND messages when you first start BIND?
Code:
Sep 26 13:33:39 firewall named[17900]: starting BIND 9.2.3 -u named
    Sep 26 13:33:39 firewall named[17900]: using 1 CPU
    Sep 26 13:33:39 firewall named[17900]: loading configuration from '/etc/named.conf'
    Sep 26 13:33:39 firewall named: named startup succeeded
    Sep 26 13:33:39 firewall named[17900]: no IPv6 interfaces found
    Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface lo, 127.0.0.1#53
  Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface eth1, 192.168.1.1#53
    Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface tun0, 10.5.0.1#53
    Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface tun1, 10.2.0.1#53
    Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface tun2, 10.0.0.1#53
    Sep 26 13:33:39 firewall named[17900]: listening on IPv4 interface tun3, 10.3.0.1#53
    Sep 26 13:33:39 firewall named[17900]: zone '1.168.192.in-addr.arpa' allows updates by IP address, which is insecure
    Sep 26 13:33:39 firewall named[17900]: zone 'boca' allows updates by IP address, which is insecure
    Sep 26 13:33:39 firewall named[17900]: command channel listening on 127.0.0.1#953
    Sep 26 13:33:39 firewall named[17900]: zone 1.168.192.in-addr.arpa/IN: loaded serial 20041741
    Sep 26 13:33:39 firewall named[17900]: zone boca/IN: loaded serial 20046338
    Sep 26 13:33:39 firewall named[17900]: zone localhost/IN: loaded serial 42
    Sep 26 13:33:39 firewall named[17900]: running
    Sep 26 13:33:46 firewall openvpn[1856]: Adaptive compression state ON
    Sep 26 13:33:48 firewall openvpn[1856]: Adaptive compression state OFF
 
Back
Top