Add DNS and DHCP server to Domain Controller appliance

[renne]

The internal DNS backend of Samba4 is quite limited and does not allow to interface with e.g. DHCP servers, DDNS clients, Let's Encrypt tools or use recursion, caching or DNSSEC validation.

I suggest to use the BIND9 DLZ DNS Back End for DNS services and ISC KEA or ISC DHCPd for DHCP services.

Documentation for interfacing:
Samba4 BIND9 DLZ DNS Back End
KEA DHCP-DDNS Server
Configure DHCP to update DNS records with BIND9

For SOHO installations it should be possible to use BIND9 as a (recursive) resolver on the LAN interface and as hidden primary nameserver on the WAN interface.

[JedMeister]

Hi @renne - Thanks for the feature request.

I think that the DNS suggestion is a really good one! We should aim to include that in the next release of the Domain Controller.

The DHCP server inclusion suggestion also makes a lot of sense. Although I'd be inclined to not enable that by default. My rationale is that by default all of our servers (including the DC appliance) attempt to get an IP via DHCP. If we have an internal DHCP enabled by default, I suspect that might cause issues.

Having said that, it looks like KEA is a very different beast compared to any DHCP server I've used before. So perhaps there is something that I'm missing regarding that?!

[renne]

I suggest to query if a DHCP server should be enabled in the first setup menu of the DC appliance.

ISC KEA is the successor of ISC DHCPd. Because of the REST-API/JSON integration in web-interfaces is much simpler. The separate database-backends allows to manage large networks in real-time without restarts of the DHCP server (e.g generate host configurations/leases dynamically from the IT inventory database by database views). Running multiple service processes and a database makes it more complex to administer.

KEA doesn't seem to allow static leases with file backend for now. If you don't want a database backend or reloading configuration without restarting it is easier to go for ISC DHCPd for now.

[JedMeister]

I suggest to query if a DHCP server should be enabled in the first setup menu of the DC appliance.

Great idea! 😄

Thanks for the additional info re KEA too. I think we'll stick with ISC-DHCP for now then.

Unfortunately, we're currently working on the transition to v16.0 (based on Debian 10/Buster) so it'll probably be a little while before we do a new release of our DC appliance, but I like your ideas and we'll aim to implement them for the next release.

[JedMeister]

I did start having a look at this for the v16.0 release but the v16.0 update alone turned out to be a whole lot more work than I'd anticipated. I updated the existing initialisation and consolidated the python2 script and the 2 bash scripts into a single python3 script.

So this additional work got deferred. I've since then had more of a look at it, and this is going to be a fair bit of work, and so unfortunately, I'm unclear when I might get to it... 😢

I definitely still think that it would still be a good idea and a DC-DNS-DHCP would be a killer infrastructure app, but I'm not really sure when we might get to it...

[JedMeister]

@renne If you'd like to have a look at implementation, I'd be happy to give you some guidance and coaching?! That would help push it ahead...

[JedMeister]

I still think that this could be cool, but I'm going to push it to v17.0 for now as I haven't really had a chance to look into this much further.