chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 16:24:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(scripts): enhance error handling and logging in Samba DNS operations

Browse Source 
- Added error checks for `samba-tool dns add` and `update` to handle pre-existing records gracefully.
- Improved Kerberos cache validation with warnings and hints for unreadable or missing caches.
- Updated usage examples to provide better guidance for Kerberos authentication.
This commit is contained in:
chrisfu 2026-01-02 21:41:48 -08:00
parent 67fac13c55
commit 3061fb36a5
1 changed files with 39 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
prole-dns/init-prole-dns.sh
View File

@ -202,7 +202,17 @@ samba_add_rr() {
log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value --use-kerberos=required"
return 0
fi
samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required
local out
if out=$(samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required 2>&1); then
return 0
else
if [[ "$out" == *"WERR_DNS_ERROR_RECORD_ALREADY_EXISTS"* ]]; then
log "INFO: Record $name $rrtype $value already exists (ignored error)"
return 0
fi
echo "$out" >&2
return 1
fi
}
samba_update_rr() {
@ -211,7 +221,17 @@ samba_update_rr() {
log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new --use-kerberos=required"
return 0
fi
samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required
local out
if out=$(samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required 2>&1); then
return 0
else
if [[ "$out" == *"WERR_DNS_ERROR_RECORD_ALREADY_EXISTS"* ]]; then
log "INFO: Record $name $rrtype $new already exists (ignored error)"
return 0
fi
echo "$out" >&2
return 1
fi
}
sync_rr_set() {
@ -401,18 +421,28 @@ cmd_sync() {
# Verify Kerberos ticket if running as root via sudo (common case)
if [[ -z "${KRB5CCNAME:-}" ]]; then
if [[ -n "${SUDO_UID:-}" ]]; then
local candidate="FILE:/tmp/krb5cc_${SUDO_UID}"
if [[ -f "${candidate#FILE:}" ]]; then
export KRB5CCNAME="$candidate"
log "INFO: Automatically using Kerberos cache from sudoer: $KRB5CCNAME"
local user_candidate="FILE:/tmp/krb5cc_${SUDO_UID}"
if [[ -f "${user_candidate#FILE:}" ]]; then
# Try to use it, but if it's not readable by root (Operation not permitted),
# we might need to tell the user to kinit as root or fix permissions.
if [[ -r "${user_candidate#FILE:}" ]]; then
export KRB5CCNAME="$user_candidate"
log "INFO: Automatically using Kerberos cache from sudoer: $KRB5CCNAME"
else
log "WARN: Found Kerberos cache at ${user_candidate}, but it is not readable by root. Try: sudo kinit administrator@${AD_DNS_ZONE^^}"
fi
fi
fi
fi
# If KRB5CCNAME is set but not readable, it will fail later.
if [[ -n "${KRB5CCNAME:-}" && ! -r "${KRB5CCNAME#FILE:}" ]]; then
log "WARN: Kerberos cache ${KRB5CCNAME} is not readable by current user ($(id -u)). samba-tool will likely fail."
log "HINT: Try running 'kinit' as root, or use 'sudo kinit administrator@${AD_DNS_ZONE^^}'"
fi
if [[ -z "${KRB5CCNAME:-}" ]]; then
log "WARN: KRB5CCNAME is not set. If samba-tool fails, try running with: sudo -E $0 sync"
elif [[ ! -f "${KRB5CCNAME#FILE:}" ]]; then
log "WARN: Kerberos cache ${KRB5CCNAME} not found. samba-tool might fail."
fi
local exit_code=0
@ -516,6 +546,7 @@ Host list sources:
Examples:
sudo $0 sync
sudo kinit administrator@PROLE.ORG && sudo $0 sync
sudo -E $0 sync (preserves Kerberos ticket environment)
sudo DRY_RUN=1 $0 sync
sudo $0 start