Source
r/sysadmin•
MRAndy_MC

Is it possible to connect a Linux BIND DNS server to an active directory DNS server?

A little context on this problem: In one of our networks we have multiple windows and Linux machines that interact. We have an Active Directory domain controller server with its own DNS server that all of the windows machines are connected to and a Linux BIND DNS Server that the Linux machines are all connected to.

As you can probably guess this occasionally causes some problems, such as the Linux machines not being able to talk to active directory on the windows machines. So what I'm trying to figure out is if there is any way I can get our two DNS Servers (AD and BIND) to sort of talk to each other and share their machines with each other. (Sorry if this is something simple, but I wasn't able to find anything about this particular scenario from some google searches)

Thanks for any help!

Posted Sep 10, 2021, 7:48 PM UTC

214
ntengineer•

Yes! You can have them do DNS replication between the two. We have it set up where I work. I don't know the whole process because BIND is a Linux thing and I'm not a Linux guy, but I worked with one of the Linux engineers and did the steps documented I found on MS's web site, and it worked like a charm.

Now for that zone my Windows DNS servers replicate with Linux DNS.

8
ender-_•

Yes, it's very simple: in AD DNS add the BIND server to the Name Servers tab for your.domain and _msdcs.your.domain, and enable Zone Transfers to servers listed on the Name Servers tab, then in BIND simply add your.domain and _msdcs.your.domain as slave zones, and set the AD DNS servers as masters.

masters "ad" {
	192.168.0.3; //assuming 192.168.0.3 and .4 are your AD DNS servers
	192.168.0.4;
};

acl "ad" {
	192.168.0.3;
	192.168.0.4;
};

zone "your.domain" {
	type slave;
	file "sec/your.domain";
	masters { ad; };
	allow-query { any; };
	allow-notify { ad; };
	notify no;
};

zone "_msdcs.your.domain" {
	type slave;
	file "sec/_msdcs.your.domain";
	masters { ad; };
	allow-query { any; };
	allow-notify { ad; };
	notify no;
};
4
nroach44•

This is how I've done it - just need to make sure the Windows servers allow transfers to the linux box.

You don't even need the _msdcs zone since the parent zone will have NS records for it.

1
St0nywallSr. Sysadmin•

Sorry, I don't know Linux all that well, so please forgive me if this is rudimentary.

Why don't you just make the Linux servers use the AD DNS servers running on Windows?
That's what we have in our environment and so far no issues I am aware of.

3
MRAndy_MCOP•

I've actually considered that, mainly the problem is that a lot of this network was designed by others that came before me and I'm trying to keep the network design as close as possible to the current design to avoid unseen problems resulting from assumptions that depend on the current state of the network. Essentially due to the size and scope of our network, I am somewhat hesitant to change something that will end up breaking the way things work.

That said, I am seriously considering attempting this as there is no reason that I can see so far that we actually need a Linux DNS and an Active Directory DNS. I need to do more research on the correct way to integrate all of our Linux systems into the AD DNS and hopefully I'll be able to give this a shot.

2
St0nywallSr. Sysadmin•

I feel for you bud.

I'd also be wary of syncing the BIND and AD DNS servers, as there's no telling what may get overwritten if there are differences between the two.

Perhaps starting with a zone export and comparison? The differences may shed some light on.

2
ntrlsur•

Basically what you would do is export the dns entries from the linux dns and import them into windows. Then take the linux dns box and make it a secondary dns box if you want and replicate dns from windows AD.

2
stumppc•

I can’t think of a good reason for you to have to support two types of DNS servers in your environment. I’d just get rid of the BIND dns server(s) and use the AD ones. You’ll obviously have to do some reconfiguring. The easiest thing would be to add the same IP addresses you used for BIND to the AD dns servers. Otherwise you reconfigure any DHCP scopes and change any servers with manual/static DNS server entries.

If for some reason you think you need to keep BIND, just re-create any unique zones and/or records in BIND on the AD dns. Remove all zones from BIND. Setup the BIND servers as secondary dns servers from AD (Primary servers) and sync the zones from AD to BIND. AD dns is the primary servers and BIND would be the secondary servers in a one-way sync relationship. That would be the easiest and safest way to setup a sync.

2
Ssakaa•

I can’t think of a good reason for you to have to support two types of DNS servers in your environment

CALs, possibly? I've never seen a clear cut "yes or no" for DHCP and DNS.

1
stumppc•

You are probably right on the licensing. Why else setup additional servers when you already have a couple of perfectly good DNS servers deployed with AD.

I took a boot camp on licensing last year. I think you technically need a license for all clients that connect to any Windows service. But I would say that almost no one adheres to that for dns and dhcp. It’s probably only an issue if a Microsoft auditor was gunning for you anyway on other violations.

1
_E8_•

The easiest way is to assign them sub-domains and make them authoritative for it. Now each can forward request to the respective sub-domains directly to the authoritative server for it and upward otherwise.
Worst-case scenario you have to add a third server for the common parent domain.

1
alarmologistComputer Janitor•

I don't usually mess with DNS and our network is small, but IIRC there is a setting in AD that lets the clients update their own DNS. We do that and Linux clients make their own entries.

1
AxisNL•

How are your namespaces/domain layed out? If everything is in a single domain, please just use one dns zone to rule them all. Making a guess about your level of dns knowledge based on your post, I would advise you to just keep the windows dns servers and dns servers, and point all Linux servers to the windows dns servers. Yes, bind is more flexible and more secure (if configured right), and troubleshooting will be way easier as well, but you will want MS DNS for AD anyway. Might as well use it for everything.

1
washapoo•

You can just setup the AD DNS servers as forwarders in the Bind config. Basically, next hop for DNS is IP address of the AD DNS server, the AD DNS server does the lookup and responds to the Linux DNS server.

1