I have the keytab file, and it's pointed there. What line do I put in
for the sam.ldb file? I can see where the good one and the bogus one
were created. I'm perfectly content to copy the good one over the bogus
one, but if there's a better option, I'd like to know about it. I have
NO lines dealing with sam.ldb at all. the tkey-gssapt-keytab line
already existed in my config, no worries there.
Once I do all of this, in theory I should be able to start named in
association with samba, right? And then samba should be able to tell
named when to update the zone files for the domain, right?
On 12/11/2020 12:47 PM, Rowland penny via samba wrote:> On 11/12/2020 19:32, Dan Egli via samba wrote:
>> Since _I_ didn't point it anywhere, I can only wonder if it would
be
>> acceptable to copy the correctly created one to where samba is
>> looking, since I don't know how to tell it to look in a separate
>> location. I've checked the named.conf* files, and there's no
line
>> pointing to it at all, so it must be something internal to the code.
>> If it's okay to simply copy the correct sam.ldb to where it's
>> looking, then let me know, please? Or, if there's a better option I
>> can use please tell me what it is.
>
> What you are proposing is actually what the code does, it copies the
> created keytab to the new location, ensures it belongs to the correct
> user & group with the correct permissions, on Debian this would be
> root:bind with 0770 permissions.
>
> You also need to add a line similar to this to 'options' in your
> named.conf files:
>
> tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";
>
> Rowland
>
>
>
--
Dan Egli
From my Test Server