14 comments

  1. salam Mas Bro,

    Saya menggunakan Bind sbb:
    Installed Packages
    Name : bind
    Arch : i686
    Epoch : 32
    Version : 9.8.2
    Release : 0.17.rc1.el6_4.4
    Size : 7.2 M
    Repo : installed
    From repo : updates
    Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
    URL : http://www.isc.org/products/BIND/
    License : ISC
    Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS
    : (Domain Name System) protocols. BIND includes a DNS server (named),
    : which resolves host names to IP addresses; a resolver library
    : (routines for applications to use when interfacing with DNS); and
    : tools for verifying that the DNS server is operating properly.

    pada file : /usr/local/samba/private/named.conf

    # This DNS configuration is for BIND 9.8.0 or later with dlz_dlopen support.
    #
    # This file should be included in your main BIND configuration file
    #
    # For example with
    # include “/usr/local/samba/private/named.conf”;

    #
    # This configures dynamically loadable zones (DLZ) from AD schema
    # Uncomment only single database line, depending on your BIND version
    #
    dlz “AD DNS Zone” {
    # For BIND 9.8.0
    database “dlopen /usr/local/samba/lib/bind9/dlz_bind9.so”;

    # For BIND 9.9.0
    # database “dlopen /usr/local/samba/lib/bind9/dlz_bind9_9.so”;
    };

    Saya coba implementasi artikel ini, ketika
    service named restart
    terjadi failed

    error yang saya dapat pada /var/log/message
    ad named: dns_master_load: dynamic/emi.inet:15: unknown $ directive ‘${NTDSGUID}._msdcs’

    apakah syntaxnya berbeda dengan bind versi 9.9.0

    atas pencerahannya saya ucapkan terima kasih.

    regards
    Yogi

    Reply

  2. @Yogi : Sudah lakukan hal yang ini belum “Ganti ${NTDSGUID} dengan angka+huruf yang dihasilkan dengan perintah berikut :” dan “Lihat tulisan yang diberi warna
    dan ganti ${DOMAINGUID} dengan angka+huruf yang dihasilkan dengan perintah berikut :”

    Reply

    1. Maaf Mas Bro, belum.
      Setelah saya ubah sesuai saran Mas Bro, named tetap tidak dapat start
      error lognya :
      Jun 18 13:23:07 ad named-sdb[21675]: samba_dlz: Failed to configure zone ’emi.inet’
      Jun 18 13:23:07 ad named-sdb[21675]: loading configuration: already exists
      Jun 18 13:23:07 ad named-sdb[21675]: exiting (due to fatal error)
      berikut konfigurasinya :
      /etc/named.conf
      options {
      tkey-gssapi-keytab “/usr/local/samba/private/dns.keytab”;
      listen-on port 53 { 127.0.0.1; 192.168.0.7; };
      listen-on-v6 port 53 { ::1; };
      directory “/var/named”;
      dump-file “/var/named/data/cache_dump.db”;
      statistics-file “/var/named/data/named_stats.txt”;
      memstatistics-file “/var/named/data/named_mem_stats.txt”;
      allow-query { localhost; any; };
      recursion yes;

      dnssec-enable yes;
      dnssec-validation yes;
      dnssec-lookaside auto;

      /* Path to ISC DLV key */
      bindkeys-file “/etc/named.iscdlv.key”;

      managed-keys-directory “/var/named/dynamic”;
      };

      logging {
      channel default_debug {
      file “data/named.run”;
      severity dynamic;
      };
      };

      zone “.” IN {
      type hint;
      file “named.ca”;
      };

      zone “emi.inet” {
      type master;
      file “dynamic/emi.inet”;
      };

      include “/etc/named.rfc1912.zones”;
      include “/usr/local/samba/private/named.conf”;

      DAN /var/named/dynamic/emi.inet
      $TTL 1W
      @ IN SOA ad.emi.inet. root.emi.inet. (
      01 ; serial
      2D ; refresh
      4H ; retry
      6W ; expiry
      1W ) ; minimum

      @ IN NS ns1
      ns1 IN A 192.168.0.7
      @ IN A 192.168.0.7
      ad IN A 192.168.0.7

      gc._msdcs IN CNAME ad
      1e2e73f8-ae83-4d5a-8d8d-4a054a7703c0._msdcs IN CNAME ad

      _gc._tcp IN SRV 0 100 3268 ad
      _gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 ad
      _ldap._tcp.gc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 389 ad

      _ldap._tcp IN SRV 0 100 389 ad
      _ldap._tcp.dc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.pdc._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.3e9ee78b-7979-4995-9c5d-8434e9a5971a IN SRV 0 100 389 ad
      _ldap._tcp.3e9ee78b-7979-4995-9c5d-8434e9a5971a.domains._msdcs IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 ad
      _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 ad

      _kerberos._tcp IN SRV 0 100 88 ad
      _kerberos._tcp.dc._msdcs IN SRV 0 100 88 ad
      _kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 ad
      _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 ad
      _kerberos._udp IN SRV 0 100 88 ad

      _kerberos-master._tcp IN SRV 0 100 88 ad
      _kerberos-master._udp IN SRV 0 100 88 ad

      _kpasswd._tcp IN SRV 0 100 464 ad
      _kpasswd._udp IN SRV 0 100 464 ad

      _kerberos IN TXT EMI.INET

      Reply

    1. Salam,
      service named restart hasilnya “OK” (Jalan Mas Bro..Siiipp)
      tapi ketika saya check apakah ada update terbaru mengenai dynamic DNS updates dengan /usr/local/samba/sbin/samba_dnsupdate –verbose
      hasilnya
      Calling nsupdate for SRV _ldap._tcp.gc._msdcs.emi.inet ad.emi.inet 3268
      Outgoing update query:
      ;; ->>HEADER<>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
      ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
      ;; UPDATE SECTION:
      _ldap._tcp.default-first-site-name._sites.gc._msdcs.emi.inet. 0 NONE SRV 0 100 3 89 ad.emi.inet.
      _ldap._tcp.default-first-site-name._sites.gc._msdcs.emi.inet. 900 IN SRV 0 100 3 268 ad.emi.inet.

      update failed: REFUSED
      Failed nsupdate: 2
      Failed update of 2 entries

      Reply

  5. Salam mas,

    Saya mau tanya : jika PC client yang sudah join ke domain windows server yang lama dan lalu kita migrasi ke samba4 … apakah setelah login PC client akan buat profile baru atau tetap ke profile yang sama (meskipun nama username login windows sama)….

    Reply

  6. Salam mas,

    Saya berhasil migrasi tp ada kendala :
    Mengapa file ” /usr/local/samba/private/dns.keytab ” tidak ada ya? repot juga kalau harus input manual, clientnya buanyakk mas.. 🙂

    Ketahuannya saat mau lakukan chgrp
    ini errornya :
    [root@lab-pdc ~]# chgrp named /usr/local/samba/private/dns.keytab
    chgrp: cannot access `/usr/local/samba/private/dns.keytab’: No such file or directory

    Kalau sy baca di wikinya samba, file dns.keytab itu otomatis ada setelah kita lakukan provisioning… piye mas?

    Trimakasih

    salam

    Reply

  7. kang akhmad;
    saya mengikuti semua step2 untuk migrasi,cuma pada tahap Konfigurasi kerberos DNS dynamic updates (Optional) ada erorr sehingga bind9 failed jadi saya tidak melakukan step tersebut.

    dan setelah test PC windwos join domain tidak bisa ya.
    erorrnya sbb:
    an active directory domain controler (AD DC) for domain “psg.com” couldnot be contacted.
    ensure that domain name is typed corectly
    if the name is correct,click detail troubleshooting.

    Apakah di samba server perlu dibuat DNS sendiri?

    terimakasih

    Reply

  8. kang,sudah saya buatkan dns tapi pc client tetap gak bisa join ya,errornya sam dgn yg atas.

    kalau lihat lognya dimana ya

    Reply

  9. mas Ahmad,
    saya sdg coba migrasi dari Windows AD ke linux AD, utk proses awal semua berjalan lancar. (https://imanudin.com/2013/05/22/tips-samba-migrating-from-windows-server-to-samba-4-part-1/)
    Pada tutorial ke dua ini, pada bagian transfer roles FSMO, prosesnya succes, hanya pada bagian akhir muncul pesan error:
    ERROR: Failed to delete role ‘domaindns’: LDAP error 50 LDAP_INSUFFICIENT_ACCESS_RIGHTS –
    Apakah maksud error ini?
    Terimakasih sebelumnya

    regards

    Reply

      1. Mas Ahmad,
        Saya sudah coba lagi, tetapi pada saat menjalankan proses trannsfer FSMO muncul pesan berikut:
        [root@addc-svr002 ~]# /usr/local/samba/bin/samba-tool fsmo seize –role=all
        This DC already has the ‘rid’ FSMO role
        This DC already has the ‘pdc’ FSMO role
        This DC already has the ‘naming’ FSMO role
        This DC already has the ‘infrastructure’ FSMO role
        This DC already has the ‘schema’ FSMO role
        Attempting transfer…
        ERROR: Failed to delete role ‘domaindns’: LDAP error 50 LDAP_INSUFFICIENT_ACCESS_RIGHTS –

        Terimakasih sebelumnya

        regards

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.