Bug 14181 - on domain join with dns-backend=BIND9_DLZ, dns.keytab is created in private directory
Summary: on domain join with dns-backend=BIND9_DLZ, dns.keytab is created in private d...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.10.10
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-05 01:05 UTC by Val Kulkov
Modified: 2019-11-05 05:41 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Val Kulkov 2019-11-05 01:05:36 UTC 
Executing:

kinit -p administrator
samba-tool domain join samdom.example.dom DC -k yes --dns-backend=BIND9_DLZ --option='idmap_ldb:use rfc2307 = yes' --option="password hash userPassword schemes = CryptSHA256"

succeeds and generates entries in binddir/dns/. However, dns.keytab file is placed into private/ directory instead of binddir/, which is where it belongs.

Additionally, dns.keytab is owned by root.root and has 0700 permissions. It probably should be owned by named. Most Bind9 installations run the daemon as named.
Comment 1 Val Kulkov 2019-11-05 05:41:25 UTC 
To be more specific, in my case:

private = /var/lib/samba/private
binddir = /var/lib/samba/bind-dns