thr3ads.net - samba - [Samba] samba-tool auth in scripts [Jan 2019]

If this information is useful, please help other people find it:
Share via:

Jakob Lenfers

2019-Jan-10 10:42 UTC

[Samba] samba-tool auth in scripts

Am 09.01.19 um 14:01 schrieb Rowland Penny via samba:
> Try reading this:
> 
>
https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_records_with_BIND9
> 
> It's for DHCP updating dns records, but it uses a dedicated user and
> kerberos, so it should help you.
Thats exactly what I wanted, thanks. Just a little problem, "samba-tool
[...] -k yes" after manual kinit works fine. If I want to use a special
ticket cache as in your example, I cannot find an option in man
samba-tool to supply that filename and the following command therefore
fails (asking for password):

| # init ticket if necessary
| klist -c ~/tmp/ticket-cache -s || kinit -F -k -t
~/etc/dehydrated-service.keytab -c ~/tmp/ticket-cache
dehydrated-service at MY.DOMAIN
| # change records
| samba-tool dns add barva.my.domain my.domain jakob-test TXT "TEEEST"
-k yes

Thanks again,
Jakob

Rowland Penny

2019-Jan-10 13:09 UTC

head link

[Samba] samba-tool auth in scripts

On Thu, 10 Jan 2019 11:42:46 +0100
Jakob Lenfers <lenfers at bigsss-bremen.de> wrote:
> Am 09.01.19 um 14:01 schrieb Rowland Penny via samba:
> 
> > Try reading this:
> > 
> >
https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_records_with_BIND9
> > 
> > It's for DHCP updating dns records, but it uses a dedicated user
and
> > kerberos, so it should help you.
> 
> Thats exactly what I wanted, thanks. Just a little problem,
> "samba-tool [...] -k yes" after manual kinit works fine. If I
want to
> use a special ticket cache as in your example, I cannot find an
> option in man samba-tool to supply that filename and the following
> command therefore fails (asking for password):
> 
> | # init ticket if necessary
> | klist -c ~/tmp/ticket-cache -s || kinit -F -k -t
> ~/etc/dehydrated-service.keytab -c ~/tmp/ticket-cache
> dehydrated-service at MY.DOMAIN
> | # change records
> | samba-tool dns add barva.my.domain my.domain jakob-test TXT
"TEEEST"
> -k yes
> 
You don't ;-)
You do what the script should have done (I feel version 0.8.10 will
soon make an appearance), export the cache to use <export
KRB5CCNAME="/tmp/dhcp-dyndns.cc"> and then use
'$KRB5CCNAME' wherever
'/tmp/dhcp-dyndns.cc' appears, except for:

kinit -F -k -t /etc/dhcpduser.keytab -c /tmp/dhcp-dyndns.cc
"${SETPRINCIPAL}"

Where all you need is:

kinit -F -k -t /etc/dhcpduser.keytab "${SETPRINCIPAL}"

I have updated my dhcp-dyndns.sh script to match the above and it
appears to be working without errors. If this continues for 24hrs the
wikipage will be updated.

As far as samba-tool is concerned, you will probably have to add
-Udehydrated-service to the command.

Rowland

L.P.H. van Belle

2019-Jan-10 13:38 UTC

head link

[Samba] samba-tool auth in scripts

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: donderdag 10 januari 2019 14:09
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] samba-tool auth in scripts
> 
> On Thu, 10 Jan 2019 11:42:46 +0100
> Jakob Lenfers <lenfers at bigsss-bremen.de> wrote:
> 
> > Am 09.01.19 um 14:01 schrieb Rowland Penny via samba:
> > 
> > > Try reading this:
> > > 
> > > 
> https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_
> records_with_BIND9
> > > 
> > > It's for DHCP updating dns records, but it uses a 
> dedicated user and
> > > kerberos, so it should help you.
> > 
> > Thats exactly what I wanted, thanks. Just a little problem,
> > "samba-tool [...] -k yes" after manual kinit works fine. If 
> I want to
> > use a special ticket cache as in your example, I cannot find an
> > option in man samba-tool to supply that filename and the following
> > command therefore fails (asking for password):
> > 
> > | # init ticket if necessary
> > | klist -c ~/tmp/ticket-cache -s || kinit -F -k -t
> > ~/etc/dehydrated-service.keytab -c ~/tmp/ticket-cache
> > dehydrated-service at MY.DOMAIN
> > | # change records
> > | samba-tool dns add barva.my.domain my.domain jakob-test 
> TXT "TEEEST"
> > -k yes
> > 
> 
> You don't ;-)
> You do what the script should have done (I feel version 0.8.10 will
> soon make an appearance), export the cache to use <export
> KRB5CCNAME="/tmp/dhcp-dyndns.cc"> and then use
'$KRB5CCNAME' wherever
> '/tmp/dhcp-dyndns.cc' appears, except for:
> 
> kinit -F -k -t /etc/dhcpduser.keytab -c /tmp/dhcp-dyndns.cc
> "${SETPRINCIPAL}"
> 
> Where all you need is:
> 
> kinit -F -k -t /etc/dhcpduser.keytab "${SETPRINCIPAL}"
> 
> I have updated my dhcp-dyndns.sh script to match the above and it
> appears to be working without errors. If this continues for 24hrs the
> wikipage will be updated.
> 
> As far as samba-tool is concerned, you will probably have to add
> -Udehydrated-service to the command.

Hmm, that will miss the cache file also, maybe this works after the kinit:

su - dehydrated-service -c "samba-tool dns add barva.my.domain my.domain
jakob-test TXT 'TEEEST' -k yes"

And dont forget to add this user to DNSAdmins Also. 

Greetz, 

Louis

Rowland Penny

2019-Jan-10 14:18 UTC

head link

[Samba] samba-tool auth in scripts

On Thu, 10 Jan 2019 14:38:11 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
>  
> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > Rowland Penny via samba
> > Verzonden: donderdag 10 januari 2019 14:09
> > Aan: samba at lists.samba.org
> > Onderwerp: Re: [Samba] samba-tool auth in scripts
> > 
> > On Thu, 10 Jan 2019 11:42:46 +0100
> > Jakob Lenfers <lenfers at bigsss-bremen.de> wrote:
> > 
> > > Am 09.01.19 um 14:01 schrieb Rowland Penny via samba:
> > > 
> > > > Try reading this:
> > > > 
> > > > 
> > https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_
> > records_with_BIND9
> > > > 
> > > > It's for DHCP updating dns records, but it uses a 
> > dedicated user and
> > > > kerberos, so it should help you.
> > > 
> > > Thats exactly what I wanted, thanks. Just a little problem,
> > > "samba-tool [...] -k yes" after manual kinit works
fine. If
> > I want to
> > > use a special ticket cache as in your example, I cannot find an
> > > option in man samba-tool to supply that filename and the
following
> > > command therefore fails (asking for password):
> > > 
> > > | # init ticket if necessary
> > > | klist -c ~/tmp/ticket-cache -s || kinit -F -k -t
> > > ~/etc/dehydrated-service.keytab -c ~/tmp/ticket-cache
> > > dehydrated-service at MY.DOMAIN
> > > | # change records
> > > | samba-tool dns add barva.my.domain my.domain jakob-test 
> > TXT "TEEEST"
> > > -k yes
> > > 
> > 
> > You don't ;-)
> > You do what the script should have done (I feel version 0.8.10 will
> > soon make an appearance), export the cache to use <export
> > KRB5CCNAME="/tmp/dhcp-dyndns.cc"> and then use
'$KRB5CCNAME'
> > wherever '/tmp/dhcp-dyndns.cc' appears, except for:
> > 
> > kinit -F -k -t /etc/dhcpduser.keytab -c /tmp/dhcp-dyndns.cc
> > "${SETPRINCIPAL}"
> > 
> > Where all you need is:
> > 
> > kinit -F -k -t /etc/dhcpduser.keytab "${SETPRINCIPAL}"
> > 
> > I have updated my dhcp-dyndns.sh script to match the above and it
> > appears to be working without errors. If this continues for 24hrs
> > the wikipage will be updated.
> > 
> > As far as samba-tool is concerned, you will probably have to add
> > -Udehydrated-service to the command.
> 
> 
> Hmm, that will miss the cache file also, maybe this works after the
> kinit:
> 
> su - dehydrated-service -c "samba-tool dns add barva.my.domain
> my.domain jakob-test TXT 'TEEEST' -k yes"
> 
> And dont forget to add this user to DNSAdmins Also. 
> 
If it was run from the command line, yes it wouldn't use the wanted
cache, but in a script you can set the cache to use.

This works for me:

export KRB5CCNAME="/tmp/dhcp-dyndns.cc"; kinit -F -k
-t /etc/dhcpduser.keytab dhcpduser at SAMDOM.EXAMPLE.COM; samba-tool dns
add dc4.samdom.example.com samdom.example.com devstation TXT 'TEEEST'
-k yes

The above is all one line.

and results in:
Record added successfully

and this in AD:

dnsRecord:     NDR: struct dnsp_DnssrvRpcRecord
        wDataLength              : 0x0007 (7)
        wType                    : DNS_TYPE_TXT (16)
        version                  : 0x05 (5)
        rank                     : DNS_RANK_ZONE (240)
        flags                    : 0x0000 (0)
        dwSerial                 : 0x000009cc (2508)
        dwTtlSeconds             : 0x00000384 (900)
        dwReserved               : 0x00000000 (0)
        dwTimeStamp              : 0x00000000 (0)
        data                     : union dnsRecordData(case 16)
        txt                      : "TEEEST"

Rowland

Jakob Lenfers

2019-Jan-11 10:17 UTC

head link

[Samba] samba-tool auth in scripts

Am 10.01.19 um 14:09 schrieb Rowland Penny via samba:
> You don't ;-)
> You do what the script should have done (I feel version 0.8.10 will
> soon make an appearance), export the cache to use <export
> KRB5CCNAME="/tmp/dhcp-dyndns.cc"> and then use
'$KRB5CCNAME' wherever
> '/tmp/dhcp-dyndns.cc' appears, except for:
> [...]Yes, that worked. Thanks both of you!

Best,
Jakob

Reasonably Related Threads

Search for more apparently analagous threads

samba - Jan 2019 - samba-tool auth in scripts

[Samba] samba-tool auth in scripts

[Samba] samba-tool auth in scripts

[Samba] samba-tool auth in scripts

[Samba] samba-tool auth in scripts

[Samba] samba-tool auth in scripts

Reasonably Related Threads