1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
samba-mirror/source4/setup/named.txt
Amitay Isaacs 41e9f9d504 s4-provision: Add Seperate instructions for BIND 9.7.x and 9.8.x.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-09-12 20:42:13 +10:00

67 lines
3.0 KiB
Plaintext

# Additional informations for DNS setup using BIND
# If you are running a capable version of BIND and you wish to support
# secure GSS-TSIG updates, you must make the following configuration
# changes:
#
# Steps for BIND 9.7.x ---------------------------------------------------
#
# 1a. Insert following lines into the options {} section of your named.conf
# file:
tkey-gssapi-credential "DNS/${DNSNAME}";
tkey-domain "${REALM}";
# 1b. Modify BIND init scripts to pass the location of the keytab file.
# Fedora 8 & later provide a variable named KEYTAB_FILE in
# /etc/sysconfig/named for this purpose:
KEYTAB_FILE="${DNS_KEYTAB_ABS}"
# Note that the Fedora scripts translate KEYTAB_FILE behind the scenes
# into a variable named KRB5_KTNAME, which is ultimately passed to the
# BIND daemon. If your distribution does not provide a variable like
# KEYTAB_FILE to pass a keytab file to the BIND daemon, a workaround is
# to place the following line in BIND's sysconfig file or in the init
# script for BIND:
export KRB5_KTNAME="${DNS_KEYTAB_ABS}"
#
# Steps for BIND 9.8.x ---------------------------------------------------
#
# 1. Insert following lines into the options {} section of your named.conf
# file:
tkey-gssapi-keytab "${DNS_KEYTAB_ABS}";
#
# Common Steps for BIND 9.x.x --------------------------------------------
#
# 2. Set appropriate ownership and permissions on the ${DNS_KEYTAB} file.
# Note that the most distributions have BIND configured to run under a
# non-root user account. For example, Fedora 9 runs BIND as the user
# "named" once the daemon relinquishes its rights. Therefore, the file
# ${DNS_KEYTAB} must be readable by the user that BIND run as. If BIND
# is running as a non-root user, the "${DNS_KEYTAB}" file must have its
# permissions altered to allow the daemon to read it. Under Fedora 9,
# execute the following commands:
chgrp named ${DNS_KEYTAB_ABS}
chmod g+r ${DNS_KEYTAB_ABS}
# 3. Ensure the BIND zone file(s) that will be dynamically updated are in
# a directory where the BIND daemon can write. When BIND performs
# dynamic updates, it not only needs to update the zone file itself but
# it must also create a journal (.jnl) file to track the dynamic updates
# as they occur. Under Fedora 9, the /var/named directory can not be
# written to by the "named" user. However, the directory /var/named/dynamic
# directory does provide write access. Therefore the zone files were
# placed under the /var/named/dynamic directory. The file directives in
# both example zone statements at the beginning of this file were changed
# by prepending the directory "dynamic/".
# 4. If SELinux is enabled, ensure that all files have the appropriate
# SELinux file contexts. The ${DNS_KEYTAB} file must be accessible by the
# BIND daemon and should have a SELinux type of named_conf_t. This can be
# set with the following command:
chcon -t named_conf_t ${DNS_KEYTAB_ABS}