Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am a bit confuse here, I'm trying to establish a connection to Active Directory server from linux, someone told me to use this command:

host -t srv zeus.company.com

Assuming the Active Directory server is having this host name > [zeus.company.com] and the output shows:

zeus.company.com has no SRV record

According to the documentation, if the output doesn't return an SRV record, then it could be a problem with my DNS. Does this means zeus.company.com is not register in my linux's /etc/resolv.conf or it has to be register in Active Directory server?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

SRV records typically follow this structure:

_service._protocol.dns-domain-name

For example, Microsoft AD relies on both LDAP and Kerberos to operate. So, in order to advertise these services, the following SRV records are created in the DNS domain representing the AD domain (let's say example.com is our domain):

_kerberos._tcp.example.com  
_ldap._tcp.example.com

So really, what you should be running is this command:

host -t srv _ldap._tcp.zeus.company.com

For a more detailed explanation of how SRV records work, see this: http://en.wikipedia.org/wiki/SRV_record

For a full listing and explanation of ActiveDirectory DNS SRV records, see this page: http://technet.microsoft.com/en-us/library/cc961719.aspx

And here is an example of a successful query for a Microsoft Key Management Server using the host command:

rouben@BeagleBoard-Black:~$ host -t srv _vlmcs._tcp.it.cornell.edu  
_vlmcs._tcp.it.cornell.edu has SRV record 20 0 1688 kms02.cit.cornell.edu.  
_vlmcs._tcp.it.cornell.edu has SRV record 10 0 1688 kms01.cit.cornell.edu.  
rouben@BeagleBoard-Black:~$
share|improve this answer

In an AD domain the typical service records, SRV records, published in DNS are the ones pointing to LDAP and Kerberos servers.

Those allow you to use DNS for the discovery so you don't have to configure explicit host names to use the LDAP and Kerberos services, giving you more flexibility to add and remove servers in your AD topology.

You find the LDAP and Kerberos servers in the AD domain <domain> by looking for the _ldap._tcp.<domain> and _kerberos._tcp.<domain> SRV records. e.g.

host -t srv _ldap._tcp.domain.com
host -t srv _kerberos._tcp.domain.com

If zeus.domain.com is the only AD directory server you'd expect a result like:

_ldap._tcp.domain.com SRV record location:
    priority     = 0
    weight       = 100
    port         = 389
    srv hostname = zeus.domain.com 

AFAIK normally no SRV records are added for the hostnames of the actual domain controllers, so it is expected that the host command in your question wouldn't find any.

If you can resolve the hostname of zeus.domain.com to the actual IP-address of that AD server, then your DNS works well enough to connect to the AD domain. i.e. plain host zeus.domain.com must work.

share|improve this answer

The mistake is in the use of the actual hostname of the AD server. That isn't necessary you just need to list the "AD service names" along with your domain name.

  • _kerberos._tcp
  • _ldap._tcp

Examples

$ host -t srv _ldap._tcp.mydom.com
_ldap._tcp.mydom.com has SRV record 0 100 389 ad1.mydom.com.
_ldap._tcp.mydom.com has SRV record 0 100 389 ad2.mydom.com.
_ldap._tcp.mydom.com has SRV record 0 100 389 ad3.mydom.com.

Where my domain is mydom.com and my AD servers are named ad1 - ad3.

SRV records

These records typically have this form (from wikipedia):

_service._proto.name. TTL class SRV priority weight port target.

References

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.