Bug 14181 - on domain join with dns-backend=BIND9_DLZ, dns.keytab is created in private directory
Summary: on domain join with dns-backend=BIND9_DLZ, dns.keytab is created in private d...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.10.10
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Joseph Sutton
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-05 01:05 UTC by Val Kulkov
Modified: 2021-06-11 08:29 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Val Kulkov 2019-11-05 01:05:36 UTC 
Executing:

kinit -p administrator
samba-tool domain join samdom.example.dom DC -k yes --dns-backend=BIND9_DLZ --option='idmap_ldb:use rfc2307 = yes' --option="password hash userPassword schemes = CryptSHA256"

succeeds and generates entries in binddir/dns/. However, dns.keytab file is placed into private/ directory instead of binddir/, which is where it belongs.

Additionally, dns.keytab is owned by root.root and has 0700 permissions. It probably should be owned by named. Most Bind9 installations run the daemon as named.
Comment 1 Val Kulkov 2019-11-05 05:41:25 UTC 
To be more specific, in my case:

private = /var/lib/samba/private
binddir = /var/lib/samba/bind-dns
Comment 2 Andrew Bartlett 2021-03-18 23:56:21 UTC 
Joseph can you take a look at finishing the MR and finalising this?
Comment 3 Samba QA Contact 2021-06-11 08:29:29 UTC 
This bug was referenced in samba master:

ae5964be42459beed8c174b8e2dd4d4167623158
9f1e5637bc5fe51c56ad996dd881779e6ef3c0aa