I have Windows and Linux clients and I want to provide Active Directory authentication for both but keeping DHCP and DNS on Linux servers. Is this possible ? I have very little experience in administration and I'm kind of lost here on how I should implement this so it all works together.

What is the best way to do this ? I'm free to choose linux distributions and windows server version as long as it's 2003 or more recent

  • "as long as it's earlier than 2003" - are you sure that you mean earlier than 2003? That basically leaves you with unsupported versions. – Frands Hansen Sep 16 '12 at 15:49
  • Windows server earlier than version 2003? That leaves Windows NT 4 Server and Windows 2000 Server. – joeqwerty Sep 16 '12 at 15:51
  • I meant more recent actually, I corrected the post – Steve Nadie Sep 16 '12 at 16:38

I have Windows and Linux clients and I want to provide Active Directory authentication for both but keeping DHCP and DNS on Linux servers. Is this possible?

It's really a PITA to use Linux servers for AD DNS, since AD and DNS are so tightly integrated. You can do it, but good luck getting support. What I would recommend is pointing all of your clients and servers to the AD DNS servers for DNS and putting a global forwarder on your AD DNS servers to point to your Linux servers that host the rest of your infrastructure. As long as your AD namespace doesn't overlap with an existing namespace (it shouldn't), this will work just fine.

I'm free to choose linux distributions and windows server version as long as it's earlier than 2003

Um. If I were you, I wouldn't do this at all with this restriction. This leaves you with Windows 2000, which won't install on most modern hardware (no drivers, etc). It's also end-of-life meaning that there are zero patches of any kind.

  • Well I really have to leave DNS and DHCP on the Linux servers and I'm sorry I meant 2003 or more recent – Steve Nadie Sep 16 '12 at 16:36
  • "I really have to leave DNS and DHCP on the Linux servers" Why? – Ansgar Wiechers Sep 16 '12 at 16:58
  • You can leave DHCP there, that doesn't matter much. You can also leave DNS there, but you should use a global forwarder from your AD DNS servers to point to it. You shouldn't point your clients directly at servers that aren't domain controllers. Your DCs don't need to host the zones for anything other than AD. Also, I'd avoid Server 2003. It goes end of life in July 2014, which isn't all that far away. I really think you should do some heavy reading into AD, how it works, and how DNS is critical to it and then decide whether it's really right for you. – MDMarra Sep 16 '12 at 17:09
  • It's an exigence from my employer to leave as much as possible on Linux servers and DHCP and DNS have to stay. I don't really know why but they want it like so.. – Steve Nadie Sep 16 '12 at 17:10
  • I don't think you understand what I'm saying. Do you actually understand how AD and DNS work? When you create AD, you create a new DNS zone as well (if you have company.com you'd create internal.company.com or something like that). You can leave company.com on your Linux boxes and just run internal.company.com on the DCs. You can then configure the DCs to forward all DNS requests that aren't for internal.company.com to the Linux boxes. The Linux servers will resolve every other DNS request, except for ones involving the internal.company.com zone. – MDMarra Sep 16 '12 at 17:12

The main issue you are going to have is making ActiveDirectory happy with the DNS as AD uses DNS for its service location protocol (via the SRV record type). However, using Linux DNS and DHCP (i.e. the BIND DNS server and the standard dhcpd daemon) in large-scale Microsoft environments is fairly easy to support and there are a number of large Microsoft customers who do insist on using the Unix services for DNS and DHCP.

For DHCP, you will want to make sure that you are passing all the options required in your environment. As options vary considerably, I will leave you to the mercy of Google, although there is a nice Microsoft Technet article that will give you the basics ( http://technet.microsoft.com/en-us/library/cc958929.aspx ). Just make sure you have dhcpd configured to serve the mentioned parameters appropriate to your environment (and an okay dhcpd tutorial can be found at https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-dhcp-configuring-server.html)

DNS is the more important part. All servers in your organization should have proper forward (A record) and reverse (in-addr.arpa record) lookup entries. Additionally, each Windows server will want several service (SRV) entries to let clients know which services can be found on that server. You can go about creating server entries in two ways. The first way is to create them yourself manually, and you can find a fairly good discussion of that by Googling "Active Directory BIND DNS" (for example http://technet.microsoft.com/en-us/library/dd316373.aspx and http://itsjustanotherlayer.com/2009/11/running-20008-active-directory-with-bind/ are the top two searches).

There is another way, however, that I recommend. Before you set up the Windows servers, I would give their IP addresses the right to write and update entries in your Linux BIND DNS server. Then, when you set up (or refresh) your Windows servers, make sure that under the advanced networking control panel you specify the domain suffix and check the box to have the server try to update its entry. Thereafter, the server will attempt to create its own entries in DNS for any services that are configured on it. In theory this is a security hole, since you are letting a server that may be compromised write arbitrary DNS records. In practice, however, we have found that it makes maintenance of AD much, much simpler.

You will likely also want to set up Dynamic DNS (DDNS), which allows dhcp servers to pass on client hostnames to the DNS server to be added as forward and reverse entries. A failry good tutorial on that can be found at http://www.semicomplete.com/articles/dynamic-dns-with-dhcp/

Once you understand the DNS and DHCP concepts you are working with, having AD configured via Linux DNS and DHCP is not hard, and easy to maintain. On the whole, though, I wish that Microsoft hadn't shoehorned service discovery into DNS and had used an actual service protocol like SLP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.