diff options
Diffstat (limited to 'source4/setup/named.conf')
| -rw-r--r-- | source4/setup/named.conf | 39 |
1 files changed, 4 insertions, 35 deletions
diff --git a/source4/setup/named.conf b/source4/setup/named.conf index dad1f1f2f9..e7f0684d5f 100644 --- a/source4/setup/named.conf +++ b/source4/setup/named.conf @@ -7,42 +7,11 @@ zone "${DNSDOMAIN}." IN { type master; file "${ZONE_FILE}"; /* - * Attention: Not all BIND versions support "ms-self". The instead use - * of allow-update { any; }; is another, but less secure possibility. + * the list of principals and what they can change is created + * dynamically by Samba, based on the membership of the domain controllers + * group. The provision just creates this file as an empty file. */ - update-policy { - /* - * A rather long description here, as the "ms-self" option does - * not appear in any docs yet (it can only be found in the - * source code). - * - * The short of it is that each host is allowed to update its - * own A and AAAA records, when the update request is properly - * signed by the host itself. - * - * The long description is (look at the - * dst_gssapi_identitymatchesrealmms() call in lib/dns/ssu.c and - * its definition in lib/dns/gssapictx.c for details): - * - * A GSS-TSIG update request will be signed by a given signer - * (e.g. machine-name$@${REALM}). The signer name is split into - * the machine component (e.g. "machine-name") and the realm - * component (e.g. "${REALM}"). The update is allowed if the - * following conditions are met: - * - * 1) The machine component of the signer name matches the first - * (host) component of the FQDN that is being updated. - * - * 2) The realm component of the signer name matches the realm - * in the grant statement below (${REALM}). - * - * 3) The domain component of the FQDN that is being updated - * matches the realm in the grant statement below. - * - * If the 3 conditions above are satisfied, the update succeeds. - */ - grant ${REALM} ms-self * A AAAA; - }; + include "${NAMED_CONF_UPDATE}"; /* we need to use check-names ignore so _msdcs A records can be created */ check-names ignore; |