Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-wsgi
[samba.git] / source4 / scripting / python / samba / provision.py
index 4d5a9cb1f1e2ad6000fc333596e8172b0c7a24ef..fe9b582d567d213b0d6d55905f1ed2a8c0636e79 100644 (file)
@@ -43,6 +43,8 @@ from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError, \
 
 """Functions for setting up a Samba configuration."""
 
+__docformat__ = "restructuredText"
+
 DEFAULTSITE = "Default-First-Site-Name"
 
 class InvalidNetbiosName(Exception):
@@ -87,6 +89,7 @@ class ProvisionNames:
         self.domain = None
         self.hostname = None
         self.sitename = None
+        self.smbconf = None
     
 class ProvisionResult:
     def __init__(self):
@@ -239,6 +242,8 @@ def provision_paths_from_lp(lp, dnsdomain):
     paths.secrets = os.path.join(paths.private_dir, lp.get("secrets database") or "secrets.ldb")
     paths.templates = os.path.join(paths.private_dir, "templates.ldb")
     paths.dns = os.path.join(paths.private_dir, dnsdomain + ".zone")
+    paths.namedconf = os.path.join(paths.private_dir, "named.conf")
+    paths.krb5conf = os.path.join(paths.private_dir, "krb5.conf")
     paths.winsdb = os.path.join(paths.private_dir, "wins.ldb")
     paths.s4_ldapi_path = os.path.join(paths.private_dir, "ldapi")
     paths.phpldapadminconfig = os.path.join(paths.private_dir, 
@@ -266,12 +271,15 @@ def provision_paths_from_lp(lp, dnsdomain):
 
     paths.netlogon = lp.get("path", "netlogon")
 
+    paths.smbconf = lp.configfile()
+
     return paths
 
 
-def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, 
-                serverrole=None, rootdn=None, domaindn=None, configdn=None, 
-                schemadn=None, sitename=None):
+def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None, serverrole=None,
+                rootdn=None, domaindn=None, configdn=None, schemadn=None, serverdn=None, 
+                sitename=None):
+    """Guess configuration settings to use."""
 
     if hostname is None:
         hostname = socket.gethostname().split(".")[0].lower()
@@ -292,8 +300,8 @@ def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
     realm = dnsdomain.upper()
 
     if lp.get("realm").upper() != realm:
-        raise Exception("realm '%s' must match chosen realm '%s'" %
-                        (lp.get("realm"), realm))
+        raise Exception("realm '%s' in %s must match chosen realm '%s'" %
+                        (lp.get("realm"), lp.configfile(), realm))
     
     dnsdomain = dnsdomain.lower()
 
@@ -338,6 +346,7 @@ def guess_names(lp=None, hostname=None, domain=None, dnsdomain=None,
     names.netbiosname = netbiosname
     names.hostname = hostname
     names.sitename = sitename
+    names.serverdn = "CN=%s,CN=Servers,CN=%s,CN=Sites,%s" % (netbiosname, sitename, configdn)
     
     return names
     
@@ -390,6 +399,7 @@ def make_smbconf(smbconf, setup_path, hostname, domain, realm, serverrole,
             })
 
 
+
 def setup_name_mappings(samdb, idmap, sid, domaindn, root_uid, nobody_uid,
                         users_gid, wheel_gid):
     """setup reasonable name mappings for sam names to unix names.
@@ -536,10 +546,7 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info,
         samdb.load_ldif_file_add(setup_path("provision_init.ldif"))
 
         message("Setting up sam.ldb rootDSE")
-        setup_samdb_rootdse(samdb, setup_path, names.schemadn, names.domaindn, 
-                            names.hostname, names.dnsdomain, names.realm, 
-                            names.rootdn, names.configdn, names.netbiosname,
-                            names.sitename)
+        setup_samdb_rootdse(samdb, setup_path, names)
 
         if erase:
             message("Erasing data from partitions")
@@ -652,25 +659,22 @@ def setup_idmapdb(path, setup_path, session_info, credentials, lp):
     return idmap_ldb
 
 
-def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, 
-                        dnsdomain, realm, rootdn, configdn, netbiosname,
-                        sitename):
+def setup_samdb_rootdse(samdb, setup_path, names):
     """Setup the SamDB rootdse.
 
     :param samdb: Sam Database handle
     :param setup_path: Obtain setup path
     """
     setup_add_ldif(samdb, setup_path("provision_rootdse_add.ldif"), {
-        "SCHEMADN": schemadn, 
-        "NETBIOSNAME": netbiosname,
-        "DNSDOMAIN": dnsdomain,
-        "DEFAULTSITE": sitename,
-        "REALM": realm,
-        "DNSNAME": "%s.%s" % (hostname, dnsdomain),
-        "DOMAINDN": domaindn,
-        "ROOTDN": rootdn,
-        "CONFIGDN": configdn,
-        "VERSION": samba.version(),
+        "SCHEMADN": names.schemadn, 
+        "NETBIOSNAME": names.netbiosname,
+        "DNSDOMAIN": names.dnsdomain,
+        "REALM": names.realm,
+        "DNSNAME": "%s.%s" % (names.hostname, names.dnsdomain),
+        "DOMAINDN": names.domaindn,
+        "ROOTDN": names.rootdn,
+        "CONFIGDN": names.configdn,
+        "SERVERDN": names.serverdn,
         })
         
 
@@ -679,10 +683,12 @@ def setup_self_join(samdb, names,
                     domainsid, invocationid, setup_path,
                     policyguid):
     """Join a host to its own domain."""
+    assert isinstance(invocationid, str)
     setup_add_ldif(samdb, setup_path("provision_self_join.ldif"), { 
               "CONFIGDN": names.configdn, 
               "SCHEMADN": names.schemadn,
               "DOMAINDN": names.domaindn,
+              "SERVERDN": names.serverdn,
               "INVOCATIONID": invocationid,
               "NETBIOSNAME": names.netbiosname,
               "DEFAULTSITE": names.sitename,
@@ -730,8 +736,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
         return samdb
 
     message("Pre-loading the Samba 4 and AD schema")
-    samdb = SamDB(path, session_info=session_info, 
-                  credentials=credentials, lp=lp)
     samdb.set_domain_sid(domainsid)
     if serverrole == "domain controller":
         samdb.set_invocation_id(invocationid)
@@ -767,6 +771,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "NETBIOSNAME": names.netbiosname,
             "DEFAULTSITE": names.sitename,
             "CONFIGDN": names.configdn,
+            "SERVERDN": names.serverdn,
             "POLICYGUID": policyguid,
             "DOMAINDN": names.domaindn,
             "DOMAINGUID_MOD": domainguid_mod,
@@ -797,6 +802,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "NETBIOSNAME": names.netbiosname,
             "DEFAULTSITE": names.sitename,
             "CONFIGDN": names.configdn,
+            "SERVERDN": names.serverdn
             })
 
         message("Setting up sam.ldb Samba4 schema")
@@ -815,6 +821,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "DOMAIN": names.domain,
             "SCHEMADN": names.schemadn,
             "DOMAINDN": names.domaindn,
+            "SERVERDN": names.serverdn
             })
 
         message("Setting up display specifiers")
@@ -839,6 +846,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
             "NETBIOSNAME": names.netbiosname,
             "DEFAULTSITE": names.sitename,
             "CONFIGDN": names.configdn,
+            "SERVERDN": names.serverdn
             })
 
         if fill == FILL_FULL:
@@ -875,15 +883,15 @@ FILL_NT4SYNC = "NT4SYNC"
 FILL_DRS = "DRS"
 
 def provision(setup_dir, message, session_info, 
-              credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, 
-              realm=None, rootdn=None, domaindn=None, schemadn=None, 
-              configdn=None, domain=None, hostname=None, hostip=None, 
-              hostip6=None, domainsid=None, adminpass=None, krbtgtpass=None, 
-              domainguid=None, policyguid=None, invocationid=None, 
-              machinepass=None, dnspass=None, root=None, nobody=None, 
-              nogroup=None, users=None, wheel=None, backup=None, aci=None, 
-              serverrole=None, ldap_backend=None, ldap_backend_type=None, 
-              sitename=None):
+              credentials, smbconf=None, targetdir=None, samdb_fill=FILL_FULL, realm=None, 
+              rootdn=None, domaindn=None, schemadn=None, configdn=None, 
+              serverdn=None,
+              domain=None, hostname=None, hostip=None, hostip6=None, 
+              domainsid=None, adminpass=None, krbtgtpass=None, domainguid=None, 
+              policyguid=None, invocationid=None, machinepass=None, 
+              dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
+              wheel=None, backup=None, aci=None, serverrole=None, 
+              ldap_backend=None, ldap_backend_type=None, sitename=None):
     """Provision samba4
     
     :note: caution, this wipes all existing data!
@@ -898,7 +906,7 @@ def provision(setup_dir, message, session_info,
         domainsid = security.Sid(domainsid)
 
     if policyguid is None:
-        policyguid = uuid.random()
+        policyguid = str(uuid.uuid4())
     if adminpass is None:
         adminpass = misc.random_password(12)
     if krbtgtpass is None:
@@ -930,9 +938,9 @@ def provision(setup_dir, message, session_info,
     lp.load(smbconf)
 
     names = guess_names(lp=lp, hostname=hostname, domain=domain, 
-                        dnsdomain=realm, serverrole=serverrole, 
-                        sitename=sitename, rootdn=rootdn, domaindn=domaindn, 
-                        configdn=configdn, schemadn=schemadn)
+                        dnsdomain=realm, serverrole=serverrole, sitename=sitename,
+                        rootdn=rootdn, domaindn=domaindn, configdn=configdn, schemadn=schemadn,
+                        serverdn=serverdn)
 
     paths = provision_paths_from_lp(lp, names.dnsdomain)
 
@@ -950,7 +958,7 @@ def provision(setup_dir, message, session_info,
 
     assert serverrole in ("domain controller", "member server", "standalone")
     if invocationid is None and serverrole == "domain controller":
-        invocationid = uuid.random()
+        invocationid = str(uuid.uuid4())
 
     if not os.path.exists(paths.private_dir):
         os.mkdir(paths.private_dir)
@@ -1000,20 +1008,25 @@ def provision(setup_dir, message, session_info,
                         ldap_backend_type=ldap_backend_type)
 
     if lp.get("server role") == "domain controller":
-       policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
-                                  "{" + policyguid + "}")
-       os.makedirs(policy_path, 0755)
-       os.makedirs(os.path.join(policy_path, "Machine"), 0755)
-       os.makedirs(os.path.join(policy_path, "User"), 0755)
-       if not os.path.isdir(paths.netlogon):
+        if paths.netlogon is None:
+            message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
+            message("Please either remove %s or see the template at %s" % 
+                    ( paths.smbconf, setup_path("provision.smb.conf.dc")))
+            assert(paths.netlogon is not None)
+
+        if paths.sysvol is None:
+            message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
+            message("Please either remove %s or see the template at %s" % 
+                    (paths.smbconf, setup_path("provision.smb.conf.dc")))
+            assert(paths.sysvol is not None)            
+            
+        policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies", 
+                                   "{" + policyguid + "}")
+        os.makedirs(policy_path, 0755)
+        os.makedirs(os.path.join(policy_path, "Machine"), 0755)
+        os.makedirs(os.path.join(policy_path, "User"), 0755)
+        if not os.path.isdir(paths.netlogon):
             os.makedirs(paths.netlogon, 0755)
-       secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
-                         credentials=credentials, lp=lp)
-       secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
-                           netbiosname=names.netbiosname, domainsid=domainsid, 
-                           keytab_path=paths.keytab, samdb_url=paths.samdb, 
-                           dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
-                           machinepass=machinepass, dnsdomain=names.dnsdomain)
 
     if samdb_fill == FILL_FULL:
         setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
@@ -1025,6 +1038,14 @@ def provision(setup_dir, message, session_info,
 
         # Only make a zone file on the first DC, it should be replicated with DNS replication
         if serverrole == "domain controller":
+            secrets_ldb = Ldb(paths.secrets, session_info=session_info, 
+                              credentials=credentials, lp=lp)
+            secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
+                                netbiosname=names.netbiosname, domainsid=domainsid, 
+                                keytab_path=paths.keytab, samdb_url=paths.samdb, 
+                                dns_keytab_path=paths.dns_keytab, dnspass=dnspass, 
+                                machinepass=machinepass, dnsdomain=names.dnsdomain)
+
             samdb = SamDB(paths.samdb, session_info=session_info, 
                       credentials=credentials, lp=lp)
 
@@ -1034,21 +1055,30 @@ def provision(setup_dir, message, session_info,
                                        expression="(&(objectClass=computer)(cn=%s))" % names.hostname,
                                        scope=SCOPE_SUBTREE)
             assert isinstance(hostguid, str)
-            
-            create_zone_file(paths.dns, setup_path, samdb, 
-                             hostname=names.hostname, hostip=hostip,
-                             hostip6=hostip6, dnsdomain=names.dnsdomain,
-                             domaindn=names.domaindn, dnspass=dnspass, realm=names.realm, 
+
+            create_zone_file(paths.dns, setup_path, dnsdomain=names.dnsdomain,
+                             domaindn=names.domaindn, hostip=hostip,
+                             hostip6=hostip6, hostname=names.hostname,
+                             dnspass=dnspass, realm=names.realm,
                              domainguid=domainguid, hostguid=hostguid)
             message("Please install the zone located in %s into your DNS server" % paths.dns)
-            
+
+            create_named_conf(paths.namedconf, setup_path, realm=names.realm,
+                              dnsdomain=names.dnsdomain, private_dir=paths.private_dir,
+                              keytab_name=paths.dns_keytab)
+            message("See %s for example configuration statements for secure GSS-TSIG updates" % paths.namedconf)
+
+            create_krb5_conf(paths.krb5conf, setup_path, dnsdomain=names.dnsdomain,
+                             hostname=names.hostname, realm=names.realm)
+            message("A Kerberos configuration suitable for Samba 4 has been generated at %s" % paths.krb5conf)
+
     create_phpldapadmin_config(paths.phpldapadminconfig, setup_path, 
                                ldapi_url)
 
     message("Please install the phpLDAPadmin configuration located at %s into /etc/phpldapadmin/config.php" % paths.phpldapadminconfig)
 
-    message("Once the above files are installed, your server will be ready to use")
-    message("Server Type:    %s" % serverrole)
+    message("Once the above files are installed, your Samba4 server will be ready to use")
+    message("Server Role:    %s" % serverrole)
     message("Hostname:       %s" % names.hostname)
     message("NetBIOS Domain: %s" % names.domain)
     message("DNS Domain:     %s" % names.dnsdomain)
@@ -1062,27 +1092,33 @@ def provision(setup_dir, message, session_info,
     result.samdb = samdb
     return result
 
+
 def provision_become_dc(setup_dir=None,
                         smbconf=None, targetdir=None, realm=None, 
                         rootdn=None, domaindn=None, schemadn=None, configdn=None,
+                        serverdn=None,
                         domain=None, hostname=None, domainsid=None, 
                         adminpass=None, krbtgtpass=None, domainguid=None, 
                         policyguid=None, invocationid=None, machinepass=None, 
                         dnspass=None, root=None, nobody=None, nogroup=None, users=None, 
                         wheel=None, backup=None, aci=None, serverrole=None, 
-                        ldap_backend=None, ldap_backend_type=None, sitename=DEFAULTSITE):
+                        ldap_backend=None, ldap_backend_type=None, sitename=None):
 
     def message(text):
         """print a message if quiet is not set."""
         print text
 
-    provision(setup_dir, message, system_session(), None,
+    return provision(setup_dir, message, system_session(), None,
               smbconf=smbconf, targetdir=targetdir, samdb_fill=FILL_DRS, realm=realm, 
-              rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, 
+              rootdn=rootdn, domaindn=domaindn, schemadn=schemadn, configdn=configdn, serverdn=serverdn,
               domain=domain, hostname=hostname, hostip="127.0.0.1", domainsid=domainsid, machinepass=machinepass, serverrole="domain controller", sitename=sitename);
     
 
-def setup_db_config(setup_path, file, dbdir):
+def setup_db_config(setup_path, dbdir):
+    """Setup a Berkeley database.
+    
+    :param setup_path: Setup path function.
+    :param dbdir: Database directory."""
     if not os.path.isdir(os.path.join(dbdir, "bdb-logs")):
         os.makedirs(os.path.join(dbdir, "bdb-logs"), 0700);
     if not os.path.isdir(os.path.join(dbdir, "tmp")):
@@ -1097,7 +1133,7 @@ def provision_backend(setup_dir=None, message=None,
                       smbconf=None, targetdir=None, realm=None, 
                       rootdn=None, domaindn=None, schemadn=None, configdn=None,
                       domain=None, hostname=None, adminpass=None, root=None, serverrole=None, 
-                      ldap_backend_type=None):
+                      ldap_backend_type=None, ldap_backend_port=None):
 
     def setup_path(file):
         return os.path.join(setup_dir, file)
@@ -1148,6 +1184,7 @@ def provision_backend(setup_dir=None, message=None,
                            "NETBIOSNAME": names.netbiosname,
                            "DEFAULTSITE": DEFAULTSITE,
                            "CONFIGDN": names.configdn,
+                           "SERVERDN": names.serverdn
                            })
     
     setup_add_ldif(schemadb, setup_path("schema_samba4.ldif"), 
@@ -1156,7 +1193,12 @@ def provision_backend(setup_dir=None, message=None,
                    {"SCHEMADN": names.schemadn})
 
     if ldap_backend_type == "fedora-ds":
-        setup_file(setup_path("fedora-ds.inf"), paths.fedoradsinf, 
+        if ldap_backend_port is not None:
+            serverport = "ServerPort=%d" % ldap_backend_port
+        else:
+            serverport = ""
+
+        setup_file(setup_path("fedorads.inf"), paths.fedoradsinf, 
                    {"ROOT": root,
                     "HOSTNAME": hostname,
                     "DNSDOMAIN": names.dnsdomain,
@@ -1164,19 +1206,18 @@ def provision_backend(setup_dir=None, message=None,
                     "DOMAINDN": names.domaindn,
                     "LDAPMANAGERDN": names.ldapmanagerdn,
                     "LDAPMANAGERPASS": adminpass, 
-                    "SERVERPORT": ""})
+                    "SERVERPORT": serverport})
         
-        setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
+        setup_file(setup_path("fedorads-partitions.ldif"), paths.fedoradspartitions, 
                    {"CONFIGDN": names.configdn,
                     "SCHEMADN": names.schemadn,
                     })
         
-        setup_file(setup_path("fedora-partitions.ldif"), paths.fedoradspartitions, 
-                   {"CONFIGDN": names.configdn,
-                    "SCHEMADN": names.schemadn,
-                    })
         mapping = "schema-map-fedora-ds-1.0"
         backend_schema = "99_ad.ldif"
+        
+        slapdcommand="Initailise Fedora DS with: setup-ds.pl --file=%s" % paths.fedoradsinf
+       
     elif ldap_backend_type == "openldap":
         attrs = ["linkID", "lDAPDisplayName"]
     res = schemadb.search(expression="(&(&(linkID=*)(!(linkID:1.2.840.113556.1.4.803:=1)))(objectclass=attributeSchema))", base=names.schemadn, scope=SCOPE_SUBTREE, attrs=attrs);
@@ -1219,22 +1260,33 @@ refint_attributes""" + refint_attributes + "\n";
     setup_file(setup_path("modules.conf"), paths.modulesconf,
                    {"REALM": names.realm})
         
-    setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "user"))
-    setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "config"))
-    setup_db_config(setup_path, file, os.path.join(paths.ldapdir, "db", "schema"))
-    mapping = "schema-map-openldap-2.3"
-    backend_schema = "backend-schema.schema"
-        
-
-    ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
-    message("Start slapd with: slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri)
-                
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "user")))
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "config")))
+        setup_db_config(setup_path, os.path.join(paths.ldapdir, os.path.join("db", "schema")))
+        mapping = "schema-map-openldap-2.3"
+        backend_schema = "backend-schema.schema"
+
+        ldapi_uri = "ldapi://" + urllib.quote(os.path.join(paths.private_dir, "ldap", "ldapi"), safe="")
+        if ldap_backend_port is not None:
+            server_port_string = " -h ldap://0.0.0.0:%d" % ldap_backend_port
+        else:
+            server_port_string = ""
+        slapdcommand="Start slapd with:    slapd -f " + paths.ldapdir + "/slapd.conf -h " + ldapi_uri + server_port_string
 
     schema_command = "bin/ad2oLschema --option=convert:target=" + ldap_backend_type + " -I " + setup_path(mapping) + " -H tdb://" + schemadb_path + " -O " + os.path.join(paths.ldapdir, backend_schema);
 
     os.system(schema_command)
 
 
+    message("Your %s Backend for Samba4 is now configured, and is ready to be started" % ( ldap_backend_type) )
+    message("Server Role:         %s" % serverrole)
+    message("Hostname:            %s" % names.hostname)
+    message("DNS Domain:          %s" % names.dnsdomain)
+    message("Base DN:             %s" % names.domaindn)
+    message("LDAP admin DN:       %s" % names.ldapmanagerdn)
+    message("LDAP admin password: %s" % adminpass)
+    message(slapdcommand)
+
 
 def create_phpldapadmin_config(path, setup_path, ldapi_uri):
     """Create a PHP LDAP admin configuration file.
@@ -1246,13 +1298,12 @@ def create_phpldapadmin_config(path, setup_path, ldapi_uri):
             {"S4_LDAPI_URI": ldapi_uri})
 
 
-def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn, 
-                  hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
+def create_zone_file(path, setup_path, dnsdomain, domaindn, 
+                     hostip, hostip6, hostname, dnspass, realm, domainguid, hostguid):
     """Write out a DNS zone file, from the info in the current database.
-    
-    :param path: Path of the new file.
-    :param setup_path": Setup path function.
-    :param samdb: SamDB object
+
+    :param path: Path of the new zone file.
+    :param setup_path: Setup path function.
     :param dnsdomain: DNS Domain name
     :param domaindn: DN of the Domain
     :param hostip: Local IPv4 IP
@@ -1286,6 +1337,44 @@ def create_zone_file(path, setup_path, samdb, dnsdomain, domaindn,
             "HOSTIP6_HOST_LINE": hostip6_host_line,
         })
 
+def create_named_conf(path, setup_path, realm, dnsdomain,
+                      private_dir, keytab_name):
+    """Write out a file containing zone statements suitable for inclusion in a
+    named.conf file (including GSS-TSIG configuration).
+    
+    :param path: Path of the new named.conf file.
+    :param setup_path: Setup path function.
+    :param realm: Realm name
+    :param dnsdomain: DNS Domain name
+    :param private_dir: Path to private directory
+    :param keytab_name: File name of DNS keytab file
+    """
+
+    setup_file(setup_path("named.conf"), path, {
+            "DNSDOMAIN": dnsdomain,
+            "REALM": realm,
+            "REALM_WC": "*." + ".".join(realm.split(".")[1:]),
+            "DNS_KEYTAB": keytab_name,
+            "DNS_KEYTAB_ABS": os.path.join(private_dir, keytab_name),
+        })
+
+def create_krb5_conf(path, setup_path, dnsdomain, hostname, realm):
+    """Write out a file containing zone statements suitable for inclusion in a
+    named.conf file (including GSS-TSIG configuration).
+    
+    :param path: Path of the new named.conf file.
+    :param setup_path: Setup path function.
+    :param dnsdomain: DNS Domain name
+    :param hostname: Local hostname
+    :param realm: Realm name
+    """
+
+    setup_file(setup_path("krb5.conf"), path, {
+            "DNSDOMAIN": dnsdomain,
+            "HOSTNAME": hostname,
+            "REALM": realm,
+        })
+
 def load_schema(setup_path, samdb, schemadn, netbiosname, configdn, sitename):
     """Load schema for the SamDB.