Bind9 is interfering with samba

rbees · 01-10-2008, 03:40 PM

Thanks NightHawk

Quote:

Your gateway should be the IP of the wireless USB interface or the machine that it lives on. Or to say it another way, the address of the next hop upstream from you.

It lives on the same machine. So it would be the ip assigned to me by my isp? In which case it will change from time to time. I am not even sure where to find it. That is all taken care of by kppp when I connect.

I haven't had a chance to change any of the settings on the server yet because it shares kvm with my wonderful wife's computer and she is using it.

That script I posted earlier, is that the one that will automate putting the correct ip in the interfaces file?

Is the resolv.conf I posted correct?

JimBass · 01-10-2008, 10:33 PM

Ok, first things first, what are you trying to accomplish here, and what is the network topology like?

I see in the original post that you were doing this for, "fun and the experience." That is fine, but what is it that you are trying to accomplish? Were you trying to set up the server as a router? So that all the other computers in your LAN connect to the internet through this server? I think that is the case, but I'm unsure.

I see you have 4 computers in total, and 2 printers. Do you have a router? Can the computers see each other? If so how, wirelessly, over ethernet cables, homing pigeons?

If you were simply trying to get all the computers online through the phone (I hope you have unlimited data!), you have no need of BIND. What would work very well would just be to modify the /etc/hosts file to include the addresses of all the computers, if those addresses are fixed. For example, my desktop computer runs the program BackupPC, and it backs up the 4 other machines at my apartment. All the other people here use some form of windows, so I have it search for their machines through SAMBA. It finds their IP addresses that way. For my laptop, I have the wireless router set to always give my MAC address the same IP, in my case 192.168.68.106. Then I edited my desktop's /etc/hosts so that it knows the computer named just "jimsworktop" can always be found at 192.168.68.106 -

Code:

jim@JimsBeastie:~$ cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 JimsBeastie.jimmcnamara.net JimsBeastie
192.168.68.106 jimsworktop

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

You could put The IP addresses of each computer in your /etc/hosts file, but then you have to make sure the addresses don't change. You either need to set them all statically (in both OSes on the dual-booters), or fix the DHCP server (router if one exists) so that each given MAC always gets the same address.

Looking over everything now that I had more than 120 seconds to post, the reason you failed to get online when you set the ethernet gateway to 192.168.0.1 was because you don't get online through your ethernet at present, you do it through your cell phone. A computer can only have one gateway, and you tried to tell your computer to use its ethernet IP address to get online, when it should have been using the quasi-interface that is created by the kppp process.

So please tell us specifically what you are trying to do, and all the pieces of the puzzle.

Peace,
JimBass

rbees · 01-11-2008, 06:36 AM

Later:

My lovely wife finally finished doing her work so I could play with my server. I changed the files some. I added my server in the hosts file the way I think it should be. I did not change the interfaces file. And changed my host name back to "server" as it was before the how-to.

When I put bind in 'jail' I MOVED, per the how-to, the contents of /etc/bind to /var/lib/named/etc. I did not copy it. I moved it. Yet the config files, a copy of them actually, are back in /etc/bind

I still can't resolve local names. I issued

Code:

# /etc/init.d/bind9 stop

to stop bind and I still can't resolve local names but am still able to surf. I thought that would stop all dns but it appears that it doesn't stop any of it.

I did read in a post that if I add a (.) to the end of the name when i do something like smbclient -L server it will not append the domain name and resolve. But it didn't work. Maybe a windows thing.

next day:

Thanks JimBass

The whole purpose in setting up this caching-only dns:
1 experience
2 take advantage of the small increase in connecting speed by having a local cache of the sites visited by my network.
3 migrate this server to a full blown dns when I know enough and get a legitimate domain setup.

My current working system.

evdo cell phone provides internet service (unlimited service) connected to:
hp 4440 acting as server which provides firewall, dhcp, dns, nfs (not currently implemented), samba share, domain-master-browser:
hardwired to linksys switch (4 port) to a wireless netgear router (4 port, router disabled):
The 2 desktops and the 2 printers are connected directly to one or the other:
The laptop is connected via wireless:

This whole system works as connected, with the exception of this new dns feature I am trying to incorporate.

The dns is working in the respect that I can surf from every machine connected to my network, but it is not resolving names for my local hosts.

My samba shares are very simple on the linux boxes with config files such as:

Code:

# Global Parameters
[global]
        workgroup = BATHIVE
        security = SHARE
	perfered master = Yes	# on server only
	domain master = Yes	# on server only
[Plans]
        path = /home/test
        read only = Yes
        guest ok = Yes

I had just gotten these samba shares working when I jumped into the dns thing. Is it possible that my problem originates in samba and not in dns? Maybe the 'domain master' line?

KnightHawk · 01-11-2008, 01:06 PM

Again, your problem has ZERO to do with Samba. And it seems your DNS is in fact not working. Your clients that can surf the net, probably are not even trying to use it as a DNS server.

Trying to get DNS to resolve your host names is a moot point given that we can't even confirm you can use it as a cache.

The domain master line in the samba config deals with "browse lists". Something unique to windows, but supported by samba. So that when you open "network neighborhood" the browse list is what populates the neighborhood. Perhaps your getting confused with this vs DNS? vs Wins? All 3 do name resolution just differently.

rbees · 01-11-2008, 02:18 PM

Thanks

I don't have a lot of time with Sabbath comming on to work on this now.

Come Sunday I think I will uninstall bind9 and confirm that every thing else is working correctly and all the folders from the jail are gone. Then start oven installing bind9.

I have been reading about another package that does the same thing as bind. Can't recall the name right off hand. Does it have a smaller foot print, use fewer resources? The reason I ask is that my server is getting into swap and I would like to try to minimize that.

Shabbat Shalom

JimBass · 01-11-2008, 03:04 PM

Ok, thanks for the more complete picture. That helps immensely.

You will not be able to resolve "short" network names with BIND, basically ever. You can somewhat "trick" BIND into resolving short names only by incorporating DHCP with BIND and making every client query by appending a FQDN. It is a lot of work, and you might want to get a bit more comfortable before you try to tackle that one.

You basically have 2 routers in your setup - the server and the actual router which is behind it. That presents a few issues. I'm assuming you disabled DHCP on the router, and have all requests forwarded to your server? If not, you're basically double-NATing your network. Once from your machine to the router, then again behind the router. Also, check your DHCP configs, and see what IP address the client computers are using for DNS. If it isn't your servers LAN address, it probably is your ISP DNS servers.

You don't want the server swapping, but BIND is fairly lightweight. I strongly suspect you have it doing a ton of junk that it just doesn't need (like a GUI, severs should be headless, with no X windows).

Enjoy the Sabbath, and if you have questions, write back I'll probably be near my computer Saturday night as I watch the football.

Peace,
JimBass

rbees · 01-15-2008, 08:12 AM

Thanks to all.

After Shabbat

OK. One question answered. The reason that smb4k is able to resolve the samba shares is that it is set up to use 'nmblookup' instead of smbclient.

Two days later:

I have uninstalled (purge) everything that had 'bind' in its name off from my server. It did take two other packages with it, one was something about dns and I can't recall the other one.

I have attempted to return the files I modified per the how-to back to there pre bind state. The only thing I have not been able to undo is the character devices that I made when I put bind in jail. For some reason Thunar (as root) hangs when I try to access them, and I have kill Thunar from the command line. I don't know the commands to delete them from the command line. I don't think they are causing the problem.

Even with bind purged from my server the other machines on my network are still able to surf the web.

The laptop is configured to use the cell phone for internet service when I am on the road, although I have not needed to in a couple of months. It is set up to access the cell via kppp through either a data cable or bluetooth. Both were working fine the last time I used them. I do have to disable the nic's to get them to work, not a big issue.

My wonderful wife's machine is also setup to use the cell phone directly to access the internet. This machine was acting as my internet access server at that time. It was also providing dhcp and firewall to my network. It performed these services in both windows and Lenny, but very erratic in windows requiring constant reset up. Dhcp has since been disabled because these responsibilities have been taken over by the server.

My point is that these two machine's ability to surf may be related to them having been setup to access my isp independent of my server. I am not sure that matters in windows.

The other desktop has always gotten it's internet service from my network, never another source. It too is able to surf, so apparently my server is resolving queries from opera.

However when I "smbclient -L (hostname)" I still get

Code:

Error connecting to 63.251.179.32 (Connection refused)
Connection to server failed (Error NT_STATUS_CONNECTION_REFUSED)
:~$

This was from the laptop, but I get the same thing from the server. Why is it still trying to resolve from my isp? It did not do this befor I installed bind9.

rbees · 01-15-2008, 04:20 PM

Thanks JimBass

I have not confirmed this but I did disable the dhcp server in the Netgear wireless router, so it is acting as a switch only. My server is providing all dhcp. In the past when I have ended up with two dhcp servers on my network nothing would work, so I am sure I disabled it. My intension was that all the services on my network be controlled by my server.

You are right JimBass, I need to get the basics of bind under my belt before I start with the tricky stuff.

I do know that my laptop has my isp's ips in the resolv.conf file. That is not suprising because it is set up to access the web via the cell when needed. I am assuming that it is the same with my wife's machine when booted to Lenny, but it spends most of it's time in windows and I don't know how to check it there. Also the other desktop which runs win98 I don't know how to check either. But they will all surf.

Yes the server is running x with fluxbox. As I have time I plan on getting things to work without x, but when I set it up I didn't have time to spend learning what that will take. On the other hand I am pretty sure that it is running some daemons that it doesn't need to, maybe some modules too. One more thing to learn about when I have time. I had thought to compile a custom kernel at some point too.

Anyway back to the problem at hand. The samba how-to on the samba site says

Quote:

Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux this is done via the appropriate firewall maintenance commands ip chains or iptables).

This makes me wonder If the whole problem is not "Firestarter". I had some trouble getting the shares to work because of Firestarter. I don't know how Firestarter does it, but it takes care of sharing my internet connection. I use it because it was recommended hear on LQ verses setting up iptables, which from what I can tell is difficult to get setup and working correctly. (One of the reasons I need X for now)

OK. My Dad brought over his laptop (xp) and was able to connect to my network. He picker up an ip, so my dhcp is working correctly. Shortly after he connected Windows notified him that updates were available. I did fire up Opera an was able to do a quick search. His laptop is still in the process of updating. So, however it is doing it, my server seams to be resolving.

I have tried the smbclient thing after stopping Firestarter but not before ever starting it. Guess I will have to try that.

KnightHawk · 01-15-2008, 05:02 PM

Curious rbees. I have this nagging doubt reading thru this that you actually have DHCP working. Could you post your dhcpd.conf just to satisfy my curiosity?

What puzzles me, is you talk about your dad's laptop connecting to your network and working fine. Now if I read thru this right.. you've disabled your routers dhcp, so it should be using your servers dhcp. That begs the question what dns servers did you tell it to assign? Thus why I ask.

Sry dont' know much of anything about firestarter.

JimBass · 01-15-2008, 05:42 PM

Firestarter is just a GUI front-end for iptables, the built-in linux firewall.

To find what DNS info you are giving out, please post the dhcp.conf as requested above. To check the DNS servers for a windows computer, open a command prompt (start->run->cmd) and type "ipconfig /all" without the quotes. Some of the output (I believe towards the end) will be the DNS servers.

Also, your wife's computer shouldn't be able to access the cell-phone gateway directly. It should have to go through your server. If she can directly access the cell-phone gateway, then your server won't be functioning as a firewall, as traffic can get around it. The only way to use your server as a firewall would be to directly connect the cell-phone to the server, and then all other machines use your server's internal address as the gateway.

So please post dhcp.conf, and "cat /etc/resolv.conf" from a LAN linux box, or "ipconfig /all" from windows.

Peace,
JimBass

rbees · 01-15-2008, 05:56 PM

Thanks NightHawk

I have not altered this file if I remember correctly
The dhcpd.conf on my server

Code:

# DHCP configuration generated by Firestarter
ddns-update-style interim;
ignore client-updates;

subnet 192.168.0.0 netmask 255.255.255.0 {
	option routers 192.168.0.1;
	option subnet-mask 255.255.255.0;
	option domain-name-servers 166.102.165.11, 166.102.165.13, 166.102.165.11, 166.102.165.13;
	option ip-forwarding off;
	range dynamic-bootp 192.168.0.100 192.168.0.254;
	default-lease-time 21600;
	max-lease-time 43200;
}

Looking at this file I think I see how the name resolution is happening. My isp's ips are listed as name servers, and it makes sense to me, the machines that connect to my network are getting there name servers from my dhcp server.

rbees · 01-15-2008, 06:55 PM

Thanks JimBass

I think you misunderstand

Quote:

Also, your wife's computer shouldn't be able to access the cell-phone gateway directly. It should have to go through your server. If she can directly access the cell-phone gateway, then your server won't be functioning as a firewall, as traffic can get around it. The only way to use your server as a firewall would be to directly connect the cell-phone to the server, and then all other machines use your server's internal address as the gateway.

My wife's computer is still setup so that it could step in as server if I were to connect the cell to it and re-enable the dhcp server. I see that my laptop has the nessessary software installed too. I am sorry I didn't make myself clear.

"ipconfig /all" from wife's computer

Code:

Windows IP Configuration
        Host Name . . . . . . . . . . . . : RBees
        Primary Dns Suffix  . . . . . . . : 
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . : 
        Description . . . . . . . . . . . : VIA Rhine II Fast Ethernet Adapter
        Physical Address. . . . . . . . . : 00-0C-76-15-7B-D0
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.0.254
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.0.1
        DHCP Server . . . . . . . . . . . : 192.168.0.1
        DNS Servers . . . . . . . . . . . : 166.102.165.11
                                            166.102.165.13
        Lease Obtained. . . . . . . . . . : Tuesday, January 15, 2008 6:07:13 PM
        Lease Expires . . . . . . . . . . : Wednesday, January 16, 2008 12:07:13 AM

Thanks

JimBass · 01-15-2008, 09:39 PM

That's cool man. I thought you had some questionable setup where the laptop could get around your server. Having it setup to work as a DHCP server is fine, I just didn't understand the logistics.

Yes, as you see, your DHCP is giving out the ISP DNS servers. That is why your machines are all getting access. That also is why you get the same errors for shortname lookups.

Peace,
JimBass

rbees · 01-15-2008, 10:07 PM

Thanks JimBass

I don't know when the dhcp server was installed on the laptop. And as far as I know it has never run. I only know it is installed.

I figured that was why I kept getting the errors on short name lookup. I was reading in the samba how-to and it said something about wins being the best way to resolve net-bios names. Is that what I need to implement to fix this problem? Also will that keep it fixed if I reinstall bind?

Thanks

JimBass · 01-15-2008, 11:41 PM

Yes, the easiest short name resolution is to set up SAMBA to do WINS resolution. Here is a good short bit of info on that setup, including the order for name resolution within SAMBA -
http://www.onlamp.com/pub/a/onlamp/e...ex.html?page=2

You can use the 'name resolve order' directive to determine what order things should get resolved in. In a situation like yours, you would want to set WINS ahead of DNS. That way "rbees" would get answered by WINS first, and if WINS doesn't have the answer, (say for yahoo.com), it will get passed to BIND.

Peace,
JimBass