mirror of
https://github.com/samba-team/samba.git
synced 2025-01-20 14:03:59 +03:00
720396f0fb
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
46 lines
2.2 KiB
Plaintext
46 lines
2.2 KiB
Plaintext
# Additional information for DNS setup using BIND
|
|
|
|
# If you are running a capable version of BIND and you wish to support
|
|
# secure GSS-TSIG updates, you must make the following configuration
|
|
# changes:
|
|
|
|
#
|
|
# Steps for BIND 9.8.x and 9.9.x -----------------------------------------
|
|
#
|
|
|
|
# 1. Insert following lines into the options {} section of your named.conf
|
|
# file:
|
|
tkey-gssapi-keytab "/data/samba/git/samba4.1/st/promoted_dc/bind-dns/dns.keytab";
|
|
|
|
#
|
|
# Common Steps for BIND 9.x.x --------------------------------------------
|
|
#
|
|
|
|
# 2. Set appropriate ownership and permissions on the dns.keytab file.
|
|
# Note that the most distributions have BIND configured to run under a
|
|
# non-root user account. For example, Fedora 9 runs BIND as the user
|
|
# "named" once the daemon relinquishes its rights. Therefore, the file
|
|
# dns.keytab must be readable by the user that BIND run as. If BIND
|
|
# is running as a non-root user, the "dns.keytab" file must have its
|
|
# permissions altered to allow the daemon to read it. Under Fedora 9,
|
|
# execute the following commands:
|
|
chgrp named /data/samba/git/samba4.1/st/promoted_dc/bind-dns/dns.keytab
|
|
chmod g+r /data/samba/git/samba4.1/st/promoted_dc/bind-dns/dns.keytab
|
|
|
|
# 3. Ensure the BIND zone file(s) that will be dynamically updated are in
|
|
# a directory where the BIND daemon can write. When BIND performs
|
|
# dynamic updates, it not only needs to update the zone file itself but
|
|
# it must also create a journal (.jnl) file to track the dynamic updates
|
|
# as they occur. Under Fedora 9, the /var/named directory can not be
|
|
# written to by the "named" user. However, the directory /var/named/dynamic
|
|
# directory does provide write access. Therefore the zone files were
|
|
# placed under the /var/named/dynamic directory. The file directives in
|
|
# both example zone statements at the beginning of this file were changed
|
|
# by prepending the directory "dynamic/".
|
|
|
|
# 4. If SELinux is enabled, ensure that all files have the appropriate
|
|
# SELinux file contexts. The dns.keytab file must be accessible by the
|
|
# BIND daemon and should have a SELinux type of named_conf_t. This can be
|
|
# set with the following command:
|
|
chcon -t named_conf_t /data/samba/git/samba4.1/st/promoted_dc/bind-dns/dns.keytab
|