.. Reminder for header structure:        
  Parts (H1)          : #################### with overline
  Chapters (H2)       : ******************** with overline
  Sections (H3)       : ====================
  Subsections (H4)    : --------------------
  Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^
  Paragraphs (H6)     : """""""""""""""""""""

.. |date| date::

.. meta::
  :description: Installing and configuring Bind-DLZ for Samba-AD
  :keywords: BindDLZ, SAmba-AD, documentation

.. _server_install_binddlz_debian:

################################################
Installing and configuring Bind-DLZ for Samba-AD
################################################

Although Samba-AD comes by default with its own internal DNS server, Tranquil IT recommends the use of Bind-DLZ.

The Samba-AD server will probably be on a *NAT* network and it will then be preferable to configure a DNS *forwarder*:

* Install the Bind package:

  .. code-block:: bash

    apt-get install bind9

* Modify the options section of the file :file:`/etc/bind/named.conf.options` (remember to modify the *forwarder*):

  .. code-block:: ini

    options {
      directory "/var/cache/bind";

      forwarders {
              1.1.1.1;
      };

      allow-query {  any;};

      dnssec-validation no;

      auth-nxdomain no;    # conform to RFC1035
      listen-on-v6 { any; };

      tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
      
      minimal-responses yes;
    };

* Modify the local section of the file :file:`/etc/bind/named.conf.local`:

  .. code-block:: ini

    dlz "mydomain.lan" {
    # For BIND 9.10.0
    database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
    };

* Disable IPv6 bind on the local network in :file:`/etc/default/named`:

  .. code-block:: ini

    # run resolvconf?
    RESOLVCONF=no

    # startup options for the server
    OPTIONS="-4 -u bind"

.. hint::

  The DLZ plugin must directly access Samba’s LDB databases (the equivalent of NTDS.DIT).
  This mode of operation is certainly not optimal for the separation of services within the AD.
  However, it is necessary.

* In :file:`/etc/samba/smb.conf`, add the following line and comment the line ``dns forwarders``:

  .. code-block:: ini

    [global]
    ...
    server services = -dns
    # dns forwarder =

.. hint::

  The following commands will create an account in the AD server for the Bind server.
  This is not necessary if you do not want to benefit from dynamic updates (which may be desirable).

* Create two directories in :file:`/var/lib/samba`:

  .. code-block:: bash

    mkdir /var/lib/samba/bind-dns
    mkdir /var/lib/samba/bind-dns/dns

* Configure dynamic updates of DNS entries:

  .. code-block:: bash

    samba_upgradedns --dns-backend=BIND9_DLZ

* Finally restart the **samba** and **bind** services:

  .. code-block:: bash

    systemctl restart samba-ad-dc
    systemctl restart bind9

**************************************************
Ensuring the correct configuration of Bind and DLZ
**************************************************

* Ensure that it is the Bind server listening on port 53:

  .. code-block:: bash

    netstat -tapn | grep 53
      tcp     0    0 192.168.149.11:53    0.0.0.0:*    LISTEN      5291/named

* Test local and recursive queries:

  .. code-block:: bash

    dig @localhost google.fr
    dig @localhost srvads.mydomain.lan
    dig -t SRV @localhost _ldap._tcp.mydomain.lan

Congratulations, your configuration is moving forward and you have just taken another step towards the solidity and efficacy of your Samba-AD installation.

Now, we will :ref:`configure the NTP service <server_install_ntp_debian>` so that your Samba-AD and the workstations of your network are all on the right time and synchronized!!