r24729: First try and publishing a DNS service account, for folks to play with.

The keytab in dns.keytab should (I hope) do the job.

Andrew Bartlett
(This used to be commit af4d331eef91ef7699d179d15e7337fff1eff7bb)

diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js
index 6ec29748f6c6b8eb2fa5da419f3d69d150eabcaa..57531a28b91d8aba10d8a2adf855ca20062a3331 100644 (file)
--- a/source4/scripting/libjs/provision.js
+++ b/source4/scripting/libjs/provision.js
@@ -379,6 +379,7 @@ function provision_default_paths(subobj)
        paths.samdb = lp.get("sam database");
        paths.secrets = lp.get("secrets database");
        paths.keytab = "secrets.keytab";
+       paths.dns_keytab = "dns.keytab";
        paths.dns = lp.get("private dir") + "/" + dnsdomain + ".zone";
        paths.named_conf = lp.get("private dir") + "/named.conf";
        paths.winsdb = "wins.ldb";
@@ -469,6 +470,7 @@ function provision_fix_subobj(subobj, paths)
 
        subobj.SAM_LDB          = "tdb://" + paths.samdb;
        subobj.SECRETS_KEYTAB   = paths.keytab;
+       subobj.DNS_KEYTAB       = paths.dns_keytab;
 
        subobj.LDAPDIR = paths.ldapdir;
        var ldap_path_list = split("/", paths.ldapdir);
@@ -891,6 +893,7 @@ function provision_guess()
        subobj.POLICYGUID   = randguid();
        subobj.KRBTGTPASS   = randpass(12);
        subobj.MACHINEPASS  = randpass(12);
+       subobj.DNSPASS  = randpass(12);
        subobj.ADMINPASS    = randpass(12);
        subobj.LDAPMANAGERPASS     = randpass(12);
        subobj.DEFAULTSITE  = "Default-First-Site-Name";

diff --git a/source4/setup/provision b/source4/setup/provision
index ddb424477bda91b3f26becad291c85dc3d8c25be..f6b9cde188b60d7ec429f91b691f18e7bd3f0551 100755 (executable)
--- a/source4/setup/provision
+++ b/source4/setup/provision
@@ -24,6 +24,7 @@ options = GetOptions(ARGV,
                'adminpass=s',
                'krbtgtpass=s',
                'machinepass=s',
+               'dnspass=s',
                'root=s',
                'nobody=s',
                'nogroup=s',

diff --git a/source4/setup/provision_users.ldif b/source4/setup/provision_users.ldif
index dcb9ef14fa133faa6eda127789024d5ef0b1cfc2..60a26c1ebf900ac94c6e5a363d4463a0fd97c997 100644 (file)
--- a/source4/setup/provision_users.ldif
+++ b/source4/setup/provision_users.ldif
@@ -205,6 +205,22 @@ servicePrincipalName: kadmin/changepw
 isCriticalSystemObject: TRUE
 sambaPassword: ${KRBTGTPASS}
 
+dn: CN=dns,CN=Users,${DOMAINDN}
+objectClass: top
+objectClass: person
+objectClass: organizationalPerson
+objectClass: user
+cn: dns
+description: DNS Service Account
+showInAdvancedViewOnly: TRUE
+userAccountControl: 514
+accountExpires: 9223372036854775807
+sAMAccountName: dns
+sAMAccountType: 805306368
+servicePrincipalName: DNS/${DNSDOMAIN}
+isCriticalSystemObject: TRUE
+sambaPassword: ${DNSPASS}
+
 dn: CN=Domain Computers,CN=Users,${DOMAINDN}
 objectClass: top
 objectClass: group

diff --git a/source4/setup/secrets.ldif b/source4/setup/secrets.ldif
index ef5cb695d0118a395a9ae54bfdf8b1b8561433af..8c61c06a54f958be9468e0182ea7931c3ac43860 100644 (file)
--- a/source4/setup/secrets.ldif
+++ b/source4/setup/secrets.ldif
@@ -38,3 +38,17 @@ objectSid: ${DOMAINSID}
 servicePrincipalName: kadmin/changepw
 krb5Keytab: HDB:ldb:${SAM_LDB}:
 #The trailing : here is a HACK, but it matches the Heimdal format. 
+
+# A hook from our credentials system into HDB, as we must be on a KDC,
+# we can look directly into the database.
+dn: servicePrincipalName=DNS/${DNSDOMAIN},CN=Principals
+objectClass: top
+objectClass: secret
+objectClass: kerberosSecret
+realm: ${REALM}
+whenCreated: ${LDAPTIME}
+whenChanged: ${LDAPTIME}
+servicePrincipalName: DNS/${DNSDOMAIN}
+privateKeytab: ${DNS_KEYTAB}
+secret: ${DNSPASS}
+