mirror of
https://github.com/samba-team/samba.git
synced 2025-01-07 17:18:11 +03:00
720396f0fb
Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
47 lines
2.7 KiB
Plaintext
47 lines
2.7 KiB
Plaintext
# Additional information for DNS setup using BIND
|
|
|
|
# If you are running a capable version of BIND and you wish to support secure
|
|
# GSS-TSIG updates, you must make the following configuration changes:
|
|
|
|
# - Insert the following lines into the options {} section of your named.conf
|
|
# file:
|
|
tkey-gssapi-credential "DNS/alpha13.samba.corp";
|
|
tkey-domain "ALPHA13.SAMBA.CORP";
|
|
|
|
# - Modify BIND init scripts to pass the location of the generated keytab file.
|
|
# Fedora 8 & later provide a variable named KEYTAB_FILE in /etc/sysconfig/named
|
|
# for this purpose:
|
|
KEYTAB_FILE="/home/mat/workspace/samba/alpha13/bind-dns/dns.keytab"
|
|
# Note that the Fedora scripts translate KEYTAB_FILE behind the scenes into a
|
|
# variable named KRB5_KTNAME, which is ultimately passed to the BIND daemon. If
|
|
# your distribution does not provide a variable like KEYTAB_FILE to pass a
|
|
# keytab file to the BIND daemon, a workaround is to place the following line in
|
|
# BIND's sysconfig file or in the init script for BIND:
|
|
export KRB5_KTNAME="/home/mat/workspace/samba/alpha13/bind-dns/dns.keytab"
|
|
|
|
# - Set appropriate ownership and permissions on the dns.keytab file. Note
|
|
# that most distributions have BIND configured to run under a non-root user
|
|
# account. For example, Fedora 9 runs BIND as the user "named" once the daemon
|
|
# relinquishes its rights. Therefore, the file dns.keytab must be readable
|
|
# by the user that BIND run as. If BIND is running as a non-root user, the
|
|
# "dns.keytab" file must have its permissions altered to allow the daemon to
|
|
# read it. Under Fedora 9, execute the following commands:
|
|
chgrp named /home/mat/workspace/samba/alpha13/bind-dns/dns.keytab
|
|
chmod g+r /home/mat/workspace/samba/alpha13/bind-dns/dns.keytab
|
|
|
|
# - Ensure the BIND zone file(s) that will be dynamically updated are in a
|
|
# directory where the BIND daemon can write. When BIND performs dynamic
|
|
# updates, it not only needs to update the zone file itself but it must also
|
|
# create a journal (.jnl) file to track the dynamic updates as they occur.
|
|
# Under Fedora 9, the /var/named directory can not be written to by the "named"
|
|
# user. However, the directory /var/named/dynamic directory does provide write
|
|
# access. Therefore the zone files were placed under the /var/named/dynamic
|
|
# directory. The file directives in both example zone statements at the
|
|
# beginning of this file were changed by prepending the directory "dynamic/".
|
|
|
|
# - If SELinux is enabled, ensure that all files have the appropriate SELinux
|
|
# file contexts. The dns.keytab file must be accessible by the BIND daemon
|
|
# and should have a SELinux type of named_conf_t. This can be set with the
|
|
# following command:
|
|
chcon -t named_conf_t /home/mat/workspace/samba/alpha13/bind-dns/dns.keytab
|