Dns backend

Vagrantfile

@@ -14,21 +14,22 @@ if ARGV[0] == 'up' or ARGV[0] == 'provision'
 end
 
 Vagrant.configure("2") do |config|
+  config.vbguest.auto_update = false
+
   (0..dcs).each_with_index do |n, ndx|
     config.vm.define "dc#{n}" do |dc|
+
       dc.vm.network "private_network", ip: "10.64.6.%s" % [10+n], netmask: 24, virtualbox__intnet: "intnet"
-      dc.vm.box = "BaseALT/alt-server-8.2-x86_64"
+      dc.vm.box = "BaseALT/alt-server-9.2-amd64"
       dc.vm.box_version = "1.0.0"
-      dc.vm.box_download_checksum = "db0d0f26575bafd0bb4989dc00d85539e0fd9272c943b373ebbb6d978a3c15ee"
-      dc.vm.box_download_checksum_type = "sha256"
-      #dc.vm.box_url = "https://vagrantcloud.com/BaseALT/boxes/alt-server-8.2-x86_64/versions/1.0.0/providers/virtualbox.box"
+
     end
   end
 
   (0..cls).each_with_index do |n, ndx|
     config.vm.define "cl#{n}" do |cl|
       cl.vm.network "private_network", ip: "10.64.6.%s" % [100+n], netmask: 24, virtualbox__intnet: "intnet"
-      cl.vm.box = "BaseALT/alt-workstaion-8.2-x86_64"
+      cl.vm.box = "BaseALT/alt-workstation-9.2-amd64"
       cl.vm.box_version = "1.0.0"
 
       if ndx == cls
@@ -59,7 +60,8 @@ Vagrant.configure("2") do |config|
             samba_domain: "domain",
             samba_admin_pass: "peebieY4",
             samba_dns_forward: "8.8.8.8",
-            samba_dns_backend: "SAMBA_INTERNAL",
+            samba_dns_backend: "BIND9_DLZ",
+            samba_backend_store: "tdb",
             samba_master_address: "10.64.6.10",
             samba_network: "10.64.6.0/24",
             samba_generate_domain_config: true,

defaults/main.yml

@@ -10,11 +10,13 @@ samba_dc_required_vars:
 
 samba_dc_master_required_vars:
   - samba_dns_forward
-  - samba_dns_backend # SAMBA_INTERNAL
+  - samba_dns_backend # SAMBA_INTERNAL | BIND9_DLZ
+  - samba_backend_store # tdb | mdb
 
 samba_dc_replica_required_vars: []
 
 samba_dc_common_packages:
+  - bind
   - bind-utils
   - krb5-kinit
   - ldb-tools

group_vars/all.yml.sample

@@ -6,6 +6,7 @@ samba_admin_pass: peebieY4
 samba_network: 192.168.122.0/24
 samba_dns_forward: 192.168.122.1
 samba_dns_backend: SAMBA_INTERNAL
+samba backend_store: tdb
 samba_master_address: "{{ hostvars[groups['samba_master_dc'][0]].ansible_host }}"
 # 192.168.122.68
 samba_master_hostname: "{{ hostvars[groups['samba_master_dc'][0]].inventory_hostname_short }}"

handlers/main.yml

@@ -14,3 +14,8 @@
   service:
     name: network
     state: restarted
+
+- name: restart bind
+  service:
+    name: bind
+    state: restarted

provision.yml

@@ -10,7 +10,8 @@
     samba_domain: domain
     samba_admin_pass: peebieY4
     samba_dns_forward: 8.8.8.8
-    samba_dns_backend: SAMBA_INTERNAL
+    samba_dns_backend: BIND9_DLZ
+    samba_backend_store: tdb
     samba_master_address: 10.64.6.1
   tags: [ "master" ]
 

tasks/bind.yml

@@ -0,0 +1,14 @@
+---
+- name: Disable bind work in chroot
+  shell: control bind-chroot disabled
+
+- name: Disable KRB5RCACHETYPE for bind
+  shell: grep -q KRB5RCACHETYPE /etc/sysconfig/bind || echo 'KRB5RCACHETYPE="none"' >> /etc/sysconfig/bind
+
+- name: Add BIND9_DLZ plugin for bind
+  shell: grep -q 'bind-dns' /etc/bind/named.conf || echo 'include "/var/lib/samba/bind-dns/named.conf";' >> /etc/bind/named.conf
+
+- name: generate options.conf for bind
+  template:
+    src: options.conf.j2
+    dest: /etc/bind/options.conf

tasks/main.yml

@@ -27,6 +27,9 @@
     service: name=altlinux-openresolv state=started
     when: altlinux_openresolv_exists|bool and openresolv_install.changed|bool
 
+  - name: update apt database
+    shell: "apt-get update"
+
   - name: install samba DC common packages
     shell: "apt-get install -y {{ samba_dc_common_packages | join(' ') }}"
     when: (samba_dc_common_packages | length > 0) and samba_flavor != 'client'

tasks/master.yml

@@ -11,6 +11,9 @@
 - name: prepare samba server
   include_tasks: prepare.yml
 
+- name: prepare bind service
+  include_tasks: bind.yml
+
 - name: install samba master packages
   shell: "apt-get install -y {{samba_dc_master_packages | join(' ')}}"
   when: samba_dc_master_packages | length > 0
@@ -48,7 +51,7 @@
         service samba stop
         rm -rf /var/lib/samba
         mkdir /var/lib/samba
-        samba-tool domain provision --realm={{samba_realm|upper}} --domain={{samba_domain|upper}} --adminpass='{{samba_admin_pass}}' --dns-backend={{samba_dns_backend}} --server-role=dc --use-rfc2307 --host-ip={{samba_master_address}}
+        samba-tool domain provision --realm={{samba_realm|upper}} --domain={{samba_domain|upper}} --adminpass='{{samba_admin_pass}}' --dns-backend={{samba_dns_backend}} --backend-store={{samba_backend_store}} --server-role=dc --use-rfc2307 --host-ip={{samba_master_address}}
       notify: restart samba
     - name: set DNS forward
       lineinfile:
@@ -73,6 +76,13 @@
     enabled: true
     state: started
 
+- name: configure bind service
+  service:
+    name: bind
+    enabled: true
+    state: started
+  when: samba_dns_backend != "SAMBA_INTERNAL"
+
 - name: register node in localhost hostvars
   set_fact:
     samba_masters: "{{ hostvars['localhost']['samba_masters'] | default([]) }} + [ '{{ inventory_hostname_short }}' ]"

tasks/replica.yml

@@ -11,6 +11,9 @@
 - name: prepare samba server
   include_tasks: prepare.yml
 
+- name: prepare bind service
+  include_tasks: bind.yml
+
 - name: install samba replica packages
   shell: "apt-get install -y {{samba_dc_replica_packages | join(' ') }}"
   when: samba_dc_replica_packages | length > 0
@@ -47,7 +50,7 @@
         samba-tool dns add {{samba_master_hostname}} {{samba_realm}} {{inventory_hostname_short}} A $SAMBA_ADDRESS -k yes
       fi
       if [[ ! -f /var/lib/samba/private/sam.ldb.d/DC={{(samba_realm|upper).replace('.', ',DC=')}}.ldb ]]; then
-        samba-tool domain join {{samba_realm}} DC -k yes 2>&1 | tee /var/log/samba/join.log
+        samba-tool domain join {{samba_realm}} DC --dns-backend={{samba_dns_backend}} --backend_store={{samba_backend_store}} -k yes 2>&1 | tee /var/log/samba/join.log
         echo replica_changed
       fi
     register: result
@@ -62,6 +65,23 @@
       master_nameserver: '127.0.0.1'
     notify: restart network
 
+  - name: samba upgrade dns
+    shell: samba_upgradedns --dns-backend={{samba_dns_backend}}
+    when: samba_dns_backend != "SAMBA_INTERNAL"
+    notify: restart bind
+
+  - name: enable bind service
+    service:
+      name: bind
+      enabled: true
+    when: samba_dns_backend != "SAMBA_INTERNAL"
+
+  - name: disable bind service
+    service:
+      name: bind
+      enabled: false
+    when: samba_dns_backend == "SAMBA_INTERNAL"
+
 - name: register node in localhost hostvars
   set_fact:
     samba_replicas: "{{ hostvars['localhost']['samba_replicas'] | default([]) }} + [ '{{ inventory_hostname_short }}' ]"

templates/options.conf.j2

@@ -0,0 +1,23 @@
+options {
+		version "unknown";
+		directory "/etc/bind/zone";
+		pid-file "";
+		dump-file "/var/run/named_dump.db";
+		statistics-file "/var/run/named.stats";
+		recursing-file "/var/run/recursing";
+
+		tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
+
+		//listen-on { localnets; {{ samba_network }}; };
+		forwarders { {{ samba_dns_forward }}; };
+		allow-query { localnets; {{ samba_network }}; };
+		//allow-query-cache { localnets; {{ samba_network }}; };
+		allow-recursion { localnets; {{ samba_network }}; };
+
+		max-cache-ttl 86400;
+		//interfaces-interval 0;
+};
+
+logging {
+		category lame-servers {null;};
+};

templates/smb.conf.master.j2

@@ -10,6 +10,10 @@
 	interfaces = lo {{samba_master_address}}
 	kerberos method = dedicated keytab
 	dedicated keytab file = /etc/krb5.keytab
+	{% if samba_dns_backend != "SAMBA_INTERNAL" %}
+	server services = -dns
+	{% endif %}
+
 [netlogon]
 	path = /var/lib/samba/sysvol/{{samba_domain}}/scripts
 	read only = No

templates/smb.conf.replica.j2

@@ -10,6 +10,10 @@
 	interfaces = lo {{samba_address}}
 	kerberos method = dedicated keytab
 	dedicated keytab file = /etc/krb5.keytab
+	{% if samba_dns_backend != "SAMBA_INTERNAL" %}
+	server services = -dns
+	{% endif %}
+
 [netlogon]
 	path = /var/lib/samba/sysvol/{{samba_domain}}/scripts
 	read only = No