diff options
author | Matthieu Patou <mat@matws.net> | 2011-06-09 01:01:25 +0400 |
---|---|---|
committer | Andrew Tridgell <tridge@samba.org> | 2011-07-21 11:44:35 +1000 |
commit | fa194c33b2963c84b406beb1008b8de565b531b6 (patch) | |
tree | 16931b194235f7cebbc3cea14d78d277dedb83f0 /source4/selftest/provisions/alpha13/private/named.txt | |
parent | 72ca5c39c9a911791af3d0abb8a146093b5e3e67 (diff) | |
download | samba-fa194c33b2963c84b406beb1008b8de565b531b6.tar.gz samba-fa194c33b2963c84b406beb1008b8de565b531b6.tar.bz2 samba-fa194c33b2963c84b406beb1008b8de565b531b6.zip |
tests: Add alpha13 dumped provision
Diffstat (limited to 'source4/selftest/provisions/alpha13/private/named.txt')
-rw-r--r-- | source4/selftest/provisions/alpha13/private/named.txt | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/source4/selftest/provisions/alpha13/private/named.txt b/source4/selftest/provisions/alpha13/private/named.txt new file mode 100644 index 0000000000..e44414776d --- /dev/null +++ b/source4/selftest/provisions/alpha13/private/named.txt @@ -0,0 +1,46 @@ +# Additional informations for DNS setup using BIND + +# If you are running a capable version of BIND and you wish to support secure +# GSS-TSIG updates, you must make the following configuration changes: + +# - Insert the following lines into the options {} section of your named.conf +# file: +tkey-gssapi-credential "DNS/alpha13.samba.corp"; +tkey-domain "ALPHA13.SAMBA.CORP"; + +# - Modify BIND init scripts to pass the location of the generated keytab file. +# Fedora 8 & later provide a variable named KEYTAB_FILE in /etc/sysconfig/named +# for this purpose: +KEYTAB_FILE="/home/mat/workspace/samba/alpha13/private/dns.keytab" +# Note that the Fedora scripts translate KEYTAB_FILE behind the scenes into a +# variable named KRB5_KTNAME, which is ultimately passed to the BIND daemon. If +# your distribution does not provide a variable like KEYTAB_FILE to pass a +# keytab file to the BIND daemon, a workaround is to place the following line in +# BIND's sysconfig file or in the init script for BIND: +export KRB5_KTNAME="/home/mat/workspace/samba/alpha13/private/dns.keytab" + +# - Set appropriate ownership and permissions on the dns.keytab file. Note +# that most distributions have BIND configured to run under a non-root user +# account. For example, Fedora 9 runs BIND as the user "named" once the daemon +# relinquishes its rights. Therefore, the file dns.keytab must be readable +# by the user that BIND run as. If BIND is running as a non-root user, the +# "dns.keytab" file must have its permissions altered to allow the daemon to +# read it. Under Fedora 9, execute the following commands: +chgrp named /home/mat/workspace/samba/alpha13/private/dns.keytab +chmod g+r /home/mat/workspace/samba/alpha13/private/dns.keytab + +# - Ensure the BIND zone file(s) that will be dynamically updated are in a +# directory where the BIND daemon can write. When BIND performs dynamic +# updates, it not only needs to update the zone file itself but it must also +# create a journal (.jnl) file to track the dynamic updates as they occur. +# Under Fedora 9, the /var/named directory can not be written to by the "named" +# user. However, the directory /var/named/dynamic directory does provide write +# access. Therefore the zone files were placed under the /var/named/dynamic +# directory. The file directives in both example zone statements at the +# beginning of this file were changed by prepending the directory "dynamic/". + +# - If SELinux is enabled, ensure that all files have the appropriate SELinux +# file contexts. The dns.keytab file must be accessible by the BIND daemon +# and should have a SELinux type of named_conf_t. This can be set with the +# following command: +chcon -t named_conf_t /home/mat/workspace/samba/alpha13/private/dns.keytab |