From b38bd391453a7b139c46557953d9f5793ba33927 Mon Sep 17 00:00:00 2001
From: chrisfu <chrisfu@prole.org>
Date: Fri, 2 Jan 2026 21:18:51 -0800
Subject: [PATCH] feat(scripts): enforce Kerberos usage and improve validation
 in DNS sync script

- Replaced `-k yes` with `--use-kerberos=required` for all `samba-tool` commands.
- Added Kerberos ticket validation with warnings for unset or missing `KRB5CCNAME`.
- Updated usage example to emphasize preserving Kerberos ticket via `sudo -E`.
---
 prole-dns/init-prole-dns.sh | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/prole-dns/init-prole-dns.sh b/prole-dns/init-prole-dns.sh
index 6dd08a3..97abbf8 100644
--- a/prole-dns/init-prole-dns.sh
+++ b/prole-dns/init-prole-dns.sh
@@ -187,7 +187,7 @@ dig_records() {
 
 samba_query_rr() {
   local dc="$1" zone="$2" name="$3" rrtype="$4"
-  samba-tool dns query "$dc" "$zone" "$name" "$rrtype" -k yes 2>/dev/null \
+  samba-tool dns query "$dc" "$zone" "$name" "$rrtype" --use-kerberos=required 2>/dev/null \
     | awk '
       BEGIN{inrec=0}
       /Records:/ {inrec=1; next}
@@ -199,19 +199,19 @@ samba_query_rr() {
 samba_add_rr() {
   local dc="$1" zone="$2" name="$3" rrtype="$4" value="$5"
   if [[ "$DRY_RUN" == "1" ]]; then
-    log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value -k yes"
+    log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value --use-kerberos=required"
     return 0
   fi
-  samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" -k yes
+  samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required
 }
 
 samba_update_rr() {
   local dc="$1" zone="$2" name="$3" rrtype="$4" old="$5" new="$6"
   if [[ "$DRY_RUN" == "1" ]]; then
-    log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new -k yes"
+    log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new --use-kerberos=required"
     return 0
   fi
-  samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" -k yes
+  samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required
 }
 
 sync_rr_set() {
@@ -398,6 +398,13 @@ cmd_sync() {
 
   log "Starting sync: zone=${AD_DNS_ZONE}, dc=${dc_fqdn} (${dc_ip}), public_dns=${public_dns}, source=${source}, db=${DB_ENDPOINT}, dry_run=${DRY_RUN}"
 
+  # Verify Kerberos ticket if running as root via sudo (common case)
+  if [[ -z "${KRB5CCNAME:-}" ]]; then
+    log "WARN: KRB5CCNAME is not set. If samba-tool fails, try running with: sudo -E $0 sync"
+  elif [[ ! -f "${KRB5CCNAME#FILE:}" ]]; then
+     log "WARN: Kerberos cache ${KRB5CCNAME} not found. samba-tool might fail."
+  fi
+
   local exit_code=0
 
   # Helper to process a single host entry
@@ -499,7 +506,7 @@ Host list sources:
 
 Examples:
   sudo $0 sync
-  sudo $0 -db=localhost:5432/prole-db sync
+  sudo -E $0 sync (preserves Kerberos ticket environment)
   sudo DRY_RUN=1 $0 sync
   sudo $0 start
   sudo $0 status