Best practice DNS (resolving IP to hostname in LAN)?

Question

Recently I've created my own thin client operating system (Xubuntu based, so basically Linux yes) that will run across our thin clients. Currently I'm testing the OS in my test environment, but I've come across the following problem.

Our production environments will assign them DHCP private IP-Addresses, and add the client in the domain using SAMBA4. They are now reachable based on IP, but since it's DHCP, the IP will change basically every two weeks. It will be too hard for me to note down all IP's every week and document them. So the solution will probably be DNS, but I'm quite unsure what is the most efficient way?

I've thought about the following solutions:

• Place the hosts in a special subnet, give them static ip addresses and create A record in DNS.
• Why do I want to reach it hostname?
• I want to UltraVNC using a standard hostname, and not every 2 weeks having to change another IP.
• I will be pushing changes with Ansible, I prefer to have a standard hostname, instead of a random IP.

Answer 1

I would use a mix of strategies.

Define static IP addresses for the network/netblock of desktop PCs where people give you the MAC address and you register the name.

Define dynamic IP addresses for BYOD networks, such as wifi networks.

The added advantage of having static IP addresses is to be able to pick up logs a few months old, and not have to cross-reference them with DHCP logs to find out what machine you are dealing with.

Another approach might be @roaima solution of DDNS, however in that case I would use far more than 1-2 weeks time for the lease time.

Answer 2

Dynamic DNS is what you need. The client updates its own A record each time it changes. (This isn't a paid Dynamic DNS service you can get for DHCP-based hosts on the Internet, but it's the same principle.) The bind DNS server can handle DDNS for a zone; dnsmasq also will do it.

Domain-joined Windows clients have used DDNS automatically with AD for a long time. I now see this with recent domain-joined Linux clients against Windows AD, but I haven't tested against a SAMBA AD.

You should find that SAMBA will provide this service automatically - see https://wiki.samba.org/index.php/Samba_Internal_DNS_Back_End#Setting_up_Dynamic_DNS_Updates_Using_Kerberos for what appears to be a statement that it is supported through the allow dns updates parameter in the server's smb.conf file. However, as I've already mentioned, I don't run SAMBA as an AD domain controller so I have not tested this.

Answer 3

If it's private IP address, I'd definitely assign static leases. In ISC dhpcd, for example, you can do that with the fixed-address keyword, matching e.g. on the hardware ethernet (i.e. MAC) address.

ISC dhcp can also dynamically update your DNS server, if you still need that after assigning static leases. The keyword hostname will set the host name.

Having each client dynamically update the DNS server is overkill IMHO; this makes sense for public IPs when the ISP assigns the address and you have no control over it, but not for private IPs.

Answer 4

I have a similar setup, where I have an AD domain (running on Windows 2008) but want to manage the network with a Linux box. I have set up dnsmasq so that it's the authoritative DHCP server for the network and the authoritative DNS server for the AD zone, forwarding the infrastructure DNS queries to the AD server; dnsmasq then automatically maintains the DNS entries.

Here's a redacted version of my dnsmasq.conf (with most comments removed):

domain-needed
bogus-priv

server=8.8.8.8
server=4.4.4.4
server=2001:4860:4860::8888
server=2001:4860:4860::4444
# Refer infrastructure DNS requests to an AD server
server=/_msdcs.ad.domain.example/_sites.ad.domain.example/_tcp.ad.domain.example/_udp.ad.domain.example/DomainDnsZones.ad.domain.example/ForestDnsZones.ad.domain.example/2001:db8:1234::254
local=/ad.domain.example/

no-resolv
no-hosts
addn-hosts=/etc/dnsmasq/hosts
expand-hosts

domain=ad.domain.example
dhcp-range=set:normal,10.100.0.20,10.100.0.200,255.255.255.0,24h
dhcp-range=2001:db8:1234::20,2001:db8:1234::ffff,slaac,ra-names,64,24h
enable-ra

dhcp-option=option:router,10.100.0.1
dhcp-option=option:ntp-server,0.0.0.0
dhcp-option=option:time-offset,-25200
dhcp-option=101,Canada/Mountain
dhcp-option=option:domain-search,ad.domain.example

dhcp-option=option6:ntp-server,[::]
dhcp-option=option6:domain-search,ad.domain.example
dhcp-option=vendor:MSFT,2,1i

dhcp-leasefile=/var/cache/dnsmasq/dnsmasq.leases
dhcp-authoritative
local-ttl=3600

The /etc/dnsmasq/hosts contains any hosts that are needed to contact to AD servers (or use static IP addresses):

10.100.0.254 ad1
2001:db8:1234::254 ad1
10.100.0.253 ad2
2001:db8:1234::253 ad2
10.100.0.1 router
2001:db8:1234::1 router
10.100.0.2 dns
2001:db8:1234::2 dns

You don't need to change any DNS settings on the AD server, but you may want to set the forwarder to the dnsmasq box (the AD server will work in split-horizon mode locally, which is fine.)