[Samba] Access shares from DNS alias

[Valentin Cheche]

Hello,

I have setup a Samba 4 ADDC following the tutorial in the wiki. I
need it to be a DC and a fileserver.
Everything works fine and dandy except that I cannot access the
file shares via a DNS alias, instead of the original hostname/DNS
name. And I need this for various reasons, enough to halt going live
with it if it doesn't work. :-(

When accessing via the machine's fqdn everything works. When using
a DNS alias I can get to list the shares but I get access denied when
trying to get into them.

I did not find any relevant info in the wiki or online for this
usecase with samba4. I may be wrong, but....I did spend hours
debugging this.

I only stumbled upon the same problem when using Ms ADDC servers,
which pointed out 2 necessary configs in order for aliases to work:
1. Add the DisableStrictNameChecking value in the server-side registry
in the LanMan parameters.
2. Set the 2 required SPNs for every alias needed (windows tool syntax).
setspn -a host/aliasname targetserver_netbios_name
setspn -a host/aliasname.domain.ext targetserver_netbios_name

My env details:
Hostname: dc0
Domain: timco.int
OS is Debian 7.4 x64
Samba 4.1.5 compiled from master, domain deployed with Internal_DNS
Network is composed from Win 7 SP1 x64 machines

So, added the necessary SPNs:
samba-tool spn add HOST/file DC0$
samba-tool spn add HOST/file.timco.int DC0$

Then I setup the alias to dc0.timco.int into DNS:
- first as a CNAME (file.timco.int) to dc0.timco.int --> failed
- then as an A record pointing to the same IP as dc0.timco.int. --> failed

Now am I missing something? I even remotely accessed the registry
tree Samba4 exposes and added the DisableStrictNameChecking value from
a Win machine.

If there is a way to make this work, I have another, even more wierd usecase.
I may need to expose the shares under an older DNS domain suffix,
different from the one in Samba4.
Meaning: in an upstream DNS server I have an older suffix
(oldtim.local) that needs to stay around for a while and the old
fileserver was under fileserver.oldtim.local.
Now if I point fileserver.oldtim.local (via A record or CNAME) to
the Samba4 server, is there a way to make it work? So far, it acts
just like file.timco.int. I can list the shares, but get access denied
when trying to dig in.

As a sidenote, for now I am a complete noob in everything Kerberos,
and just learning now the paraphernalia and inner works of it, so
please bear with me. (I have a feeling the problem here lies in krb,
but not sure where to look.)


Thank you,
Val.

[Valentin Cheche]

Post by Valentin Cheche
Hello,
I have setup a Samba 4 ADDC following the tutorial in the wiki. I
need it to be a DC and a fileserver.
Everything works fine and dandy except that I cannot access the
file shares via a DNS alias, instead of the original hostname/DNS
name. And I need this for various reasons, enough to halt going live
with it if it doesn't work. :-(
When accessing via the machine's fqdn everything works. When using
a DNS alias I can get to list the shares but I get access denied when
trying to get into them.
(....)

A one line edit in smb.conf fixed my problem.
If anyone knows if more needs to be done (in the Samba 4 context),
please give me a hint.
By all looks, it works as expected now.

[global]
....
netbios alias = file file.timco.int fileserver fileserver.oldtim.local
....

Got so distracted by the Windows-ish feel and way of management of
Samba4 that I almost forgot about smb.conf. :-)))

Cheers,
Val.

[Chan Min Wai]

Hi Valentin,

I believe it should be a DHCP Server
there is should be a dns default domain/search domain.

That should be Your domain "timco.int"

so when you type file -- it will goto file.timco.int

of course you can also use the netbios alias like below.

Post by Valentin Cheche

Post by Valentin Cheche
Hello,
I have setup a Samba 4 ADDC following the tutorial in the wiki. I
need it to be a DC and a fileserver.
Everything works fine and dandy except that I cannot access the
file shares via a DNS alias, instead of the original hostname/DNS
name. And I need this for various reasons, enough to halt going live
with it if it doesn't work. :-(
When accessing via the machine's fqdn everything works. When using
a DNS alias I can get to list the shares but I get access denied when
trying to get into them.
(....)

A one line edit in smb.conf fixed my problem.
If anyone knows if more needs to be done (in the Samba 4 context),
please give me a hint.
By all looks, it works as expected now.
[global]
....
netbios alias = file file.timco.int fileserver fileserver.oldtim.local
....
Got so distracted by the Windows-ish feel and way of management of
Samba4 that I almost forgot about smb.conf. :-)))
Cheers,
Val.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Christopher Chan]

Just to let you guys that the int root domain does exist. It definitely
should not be used as a short form of internal.

e.g. http://www.un.int/

Unless, of course, you are running an actual domain under .int.

Post by Chan Min Wai
Hi Valentin,
I believe it should be a DHCP Server
there is should be a dns default domain/search domain.
That should be Your domain "timco.int"
so when you type file -- it will goto file.timco.int
of course you can also use the netbios alias like below.

Post by Valentin Cheche

Post by Valentin Cheche
Hello,
I have setup a Samba 4 ADDC following the tutorial in the wiki. I
need it to be a DC and a fileserver.
Everything works fine and dandy except that I cannot access the
file shares via a DNS alias, instead of the original hostname/DNS
name. And I need this for various reasons, enough to halt going live
with it if it doesn't work. :-(
When accessing via the machine's fqdn everything works. When using
a DNS alias I can get to list the shares but I get access denied when
trying to get into them.
(....)

A one line edit in smb.conf fixed my problem.
If anyone knows if more needs to be done (in the Samba 4 context),
please give me a hint.
By all looks, it works as expected now.
[global]
....
netbios alias = file file.timco.int fileserver fileserver.oldtim.local
....
Got so distracted by the Windows-ish feel and way of management of
Samba4 that I almost forgot about smb.conf. :-)))
Cheers,
Val.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Valentin Cheche]

Post by Chan Min Wai
Hi Valentin,
I believe it should be a DHCP Server
there is should be a dns default domain/search domain.
That should be Your domain "timco.int"
so when you type file -- it will goto file.timco.int
of course you can also use the netbios alias like below.

Hi,
As I said, DNS is working, I could access the server and list the
shares, it is the accessing of the shares that was not allowed when
done via a FQDN other than dc0.timco.int.
My current DNS setup is as bellow:
....
^
ISP DNS
^
GW DNS (handles internally the oldtim.local suffix, forwards unknown upstream)
^
DC0 DNS (handles internally the new timco.int domain, forwards unknown upstream)
^
Workstations (DHCP hands DNS servers for WS in the following order: DC0, GW)

While I know the netbios alias is not really the "cleanest" way
of handling my issue, it is the simplest, it fits the purpose and it
works without flaws.
Plus, this is a temporary migration step so I don't mind it for a few
weeks until I homogenize the environment.

I'm curious if there is another way to solve this without the
netbios line. Something like the solution for MS Server here (which I
first tried and didn't work out):
http://homeworksblog.wordpress.com/2010/08/06/connecting-smb-share-with-cname/
http://www.bonusbits.com/main/HowTo:Enable_DNS_Alias_Names_to_Access_Windows_Server_Shares
http://serverfault.com/questions/23823/how-to-configure-windows-machine-to-allow-file-sharing-with-dns-alias

Cheers,
Val.

[Valentin Cheche]

Post by Christopher Chan
Just to let you guys that the int root domain does exist. It definitely
should not be used as a short form of internal.
e.g. http://www.un.int/
Unless, of course, you are running an actual domain under .int.

Hi Christopher,
Yes, I am aware of the .int situation, but it has such a
restrictive registration policy that I feel safe using it for
.int(ernal) purposes. :-)
This, plus choosing a domain name improbable to come up on .int (timco
and oldtim are not really the original domain names ;-) ), plus having
locks in place so that my workstations only interrogate and trust my
internal DNS servers for this domain, and not go out on the Internet
for the queries.

Thank you for the heads up,
Val.

Post by Christopher Chan
Hi Valentin,
I believe it should be a DHCP Server
there is should be a dns default domain/search domain.
That should be Your domain "timco.int"
so when you type file -- it will goto file.timco.int
of course you can also use the netbios alias like below.

Post by Valentin Cheche

Post by Valentin Cheche
Hello,
I have setup a Samba 4 ADDC following the tutorial in the wiki. I
need it to be a DC and a fileserver.
Everything works fine and dandy except that I cannot access the
file shares via a DNS alias, instead of the original hostname/DNS
name. And I need this for various reasons, enough to halt going live
with it if it doesn't work. :-(
When accessing via the machine's fqdn everything works. When using
a DNS alias I can get to list the shares but I get access denied when
trying to get into them.
(....)

A one line edit in smb.conf fixed my problem.
If anyone knows if more needs to be done (in the Samba 4 context),
please give me a hint.
By all looks, it works as expected now.
[global]
....
netbios alias = file file.timco.int fileserver fileserver.oldtim.local
....
Got so distracted by the Windows-ish feel and way of management of
Samba4 that I almost forgot about smb.conf. :-)))
Cheers,
Val.
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Thomas Harold]

Post by Valentin Cheche

Post by Christopher Chan
Just to let you guys that the int root domain does exist. It definitely
should not be used as a short form of internal.
e.g. http://www.un.int/
Unless, of course, you are running an actual domain under .int.

Hi Christopher,
Yes, I am aware of the .int situation, but it has such a
restrictive registration policy that I feel safe using it for
.int(ernal) purposes. :-)
This, plus choosing a domain name improbable to come up on .int (timco
and oldtim are not really the original domain names ;-) ), plus having
locks in place so that my workstations only interrogate and trust my
internal DNS servers for this domain, and not go out on the Internet
for the queries.

A lot of places create a sub-domain under a domain that they control.
The "intra" sub-domain seems to be a popular one.

example.com - your public domain that you own

intra.example.com - what you use for inside

Other choices are to make the subdomain the same as your NT4 domain
name, so if your domain name is EXAMPLEDOM, you would use
exampledom.example.com as your DNS name. Host names would then be
hostname1.exampledom.example.com, etc.

Since you never push the "intra.example.com" domain records to the
outside world, you don't have to worry about your workstations getting
their DNS information from anything other then your internal DNS servers.