chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 17:54:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(scripts): enforce Kerberos usage and improve validation in DNS sync script

Browse Source 
- Replaced `-k yes` with `--use-kerberos=required` for all `samba-tool` commands.
- Added Kerberos ticket validation with warnings for unset or missing `KRB5CCNAME`.
- Updated usage example to emphasize preserving Kerberos ticket via `sudo -E`.
This commit is contained in:
chrisfu 2026-01-02 21:18:51 -08:00
parent 89dfd9e1be
commit b38bd39145
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
prole-dns/init-prole-dns.sh
View File

@ -187,7 +187,7 @@ dig_records() {
samba_query_rr() {
local dc="$1" zone="$2" name="$3" rrtype="$4"
samba-tool dns query "$dc" "$zone" "$name" "$rrtype" -k yes 2>/dev/null \
samba-tool dns query "$dc" "$zone" "$name" "$rrtype" --use-kerberos=required 2>/dev/null \
| awk '
BEGIN{inrec=0}
/Records:/ {inrec=1; next}
@ -199,19 +199,19 @@ samba_query_rr() {
samba_add_rr() {
local dc="$1" zone="$2" name="$3" rrtype="$4" value="$5"
if [[ "$DRY_RUN" == "1" ]]; then
log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value -k yes"
log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value --use-kerberos=required"
return 0
fi
samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" -k yes
samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required
}
samba_update_rr() {
local dc="$1" zone="$2" name="$3" rrtype="$4" old="$5" new="$6"
if [[ "$DRY_RUN" == "1" ]]; then
log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new -k yes"
log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new --use-kerberos=required"
return 0
fi
samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" -k yes
samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required
}
sync_rr_set() {
@ -398,6 +398,13 @@ cmd_sync() {
log "Starting sync: zone=${AD_DNS_ZONE}, dc=${dc_fqdn} (${dc_ip}), public_dns=${public_dns}, source=${source}, db=${DB_ENDPOINT}, dry_run=${DRY_RUN}"
# Verify Kerberos ticket if running as root via sudo (common case)
if [[ -z "${KRB5CCNAME:-}" ]]; then
log "WARN: KRB5CCNAME is not set. If samba-tool fails, try running with: sudo -E $0 sync"
elif [[ ! -f "${KRB5CCNAME#FILE:}" ]]; then
log "WARN: Kerberos cache ${KRB5CCNAME} not found. samba-tool might fail."
fi
local exit_code=0
# Helper to process a single host entry
@ -499,7 +506,7 @@ Host list sources:
Examples:
sudo $0 sync
sudo $0 -db=localhost:5432/prole-db sync
sudo -E $0 sync (preserves Kerberos ticket environment)
sudo DRY_RUN=1 $0 sync
sudo $0 start
sudo $0 status