Andrew Bartlett
2020-Dec-11 20:39 UTC
[Samba] placing sam.ldb (was dns.keytab doesn't exist)
Please don't try and copy thole files around. You will break the hard links and you will just suffer pain. The default location comes from the smb.conf defaults, so it should already be set up in the right spot, assuming of course you are running the correct dlz plugin. Perhaps you are running an old one? Andrew Bartlett On Fri, 2020-12-11 at 13:02 -0700, Dan Egli via samba wrote:> I have the keytab file, and it's pointed there. What line do I put in > for the sam.ldb file? I can see where the good one and the bogus one > were created. I'm perfectly content to copy the good one over the bogus > one, but if there's a better option, I'd like to know about it. I have > NO lines dealing with sam.ldb at all. the tkey-gssapt-keytab line > already existed in my config, no worries there. > > Once I do all of this, in theory I should be able to start named in > association with samba, right? And then samba should be able to tell > named when to update the zone files for the domain, right? > > On 12/11/2020 12:47 PM, Rowland penny via samba wrote: > > On 11/12/2020 19:32, Dan Egli via samba wrote: > > > Since _I_ didn't point it anywhere, I can only wonder if it would be > > > acceptable to copy the correctly created one to where samba is > > > looking, since I don't know how to tell it to look in a separate > > > location. I've checked the named.conf* files, and there's no line > > > pointing to it at all, so it must be something internal to the code. > > > If it's okay to simply copy the correct sam.ldb to where it's > > > looking, then let me know, please? Or, if there's a better option I > > > can use please tell me what it is. > > > > What you are proposing is actually what the code does, it copies the > > created keytab to the new location, ensures it belongs to the correct > > user & group with the correct permissions, on Debian this would be > > root:bind with 0770 permissions. > > > > You also need to add a line similar to this to 'options' in your > > named.conf files: > > > > tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab"; > > > > Rowland > > > > > > > -- > Dan Egli > ?From my Test Server > >-- Andrew Bartlett (he/him) https://samba.org/~abartlet/ Samba Team Member (since 2001) https://samba.org Samba Developer, Catalyst IT https://catalyst.net.nz/services/samba
Well, I'm running the dlz plugin for bind 9.12. I happen to actually be using 9.16, but there's no later plugin than 9.12. As for the file locations in the smb.conf, my smb.conf is VERY tiny, as it's only what was generated by samba-tool domain provision.? Here's the WHOLE FILE: # Global parameters [global] ??????? dns forwarder = 192.168.43.1 ??????? netbios name = PLUTO ??????? realm = HOME.EGLIFAMILY.NAME ??????? server role = active directory domain controller ??????? workgroup = HOME [sysvol] ??????? path = /var/lib/samba/sysvol ??????? read only = No [netlogon] ??????? path = /var/lib/samba/sysvol/home.eglifamily.name/scripts ??????? read only = No So I don't see a mention of sam.ldb in there. Is it something I should add? And if so, where? On 12/11/2020 1:39 PM, Andrew Bartlett wrote:> Please don't try and copy thole files around. You will break the hard > links and you will just suffer pain. > > The default location comes from the smb.conf defaults, so it should > already be set up in the right spot, assuming of course you are running > the correct dlz plugin. Perhaps you are running an old one? > > Andrew Bartlett > > On Fri, 2020-12-11 at 13:02 -0700, Dan Egli via samba wrote: >> I have the keytab file, and it's pointed there. What line do I put in >> for the sam.ldb file? I can see where the good one and the bogus one >> were created. I'm perfectly content to copy the good one over the bogus >> one, but if there's a better option, I'd like to know about it. I have >> NO lines dealing with sam.ldb at all. the tkey-gssapt-keytab line >> already existed in my config, no worries there. >> >> Once I do all of this, in theory I should be able to start named in >> association with samba, right? And then samba should be able to tell >> named when to update the zone files for the domain, right? >> >> On 12/11/2020 12:47 PM, Rowland penny via samba wrote: >>> On 11/12/2020 19:32, Dan Egli via samba wrote: >>>> Since _I_ didn't point it anywhere, I can only wonder if it would be >>>> acceptable to copy the correctly created one to where samba is >>>> looking, since I don't know how to tell it to look in a separate >>>> location. I've checked the named.conf* files, and there's no line >>>> pointing to it at all, so it must be something internal to the code. >>>> If it's okay to simply copy the correct sam.ldb to where it's >>>> looking, then let me know, please? Or, if there's a better option I >>>> can use please tell me what it is. >>> What you are proposing is actually what the code does, it copies the >>> created keytab to the new location, ensures it belongs to the correct >>> user & group with the correct permissions, on Debian this would be >>> root:bind with 0770 permissions. >>> >>> You also need to add a line similar to this to 'options' in your >>> named.conf files: >>> >>> tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab"; >>> >>> Rowland >>> >>> >>> >> -- >> Dan Egli >> ?From my Test Server >> >>-- Dan Egli From my Test Server