s4-provision: Add Seperate instructions for BIND 9.7.x and 9.8.x.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

1 files changed, 53 insertions, 33 deletions

diff --git a/source4/setup/named.txt b/source4/setup/named.txt
index 97de69d8ebb..efd45998e9c 100644
--- a/source4/setup/named.txt
+++ b/source4/setup/named.txt
@@ -1,46 +1,66 @@
 # Additional informations for DNS setup using BIND
 
-# If you are running a capable version of BIND and you wish to support secure
-# GSS-TSIG updates, you must make the following configuration changes:
+# If you are running a capable version of BIND and you wish to support
+# secure GSS-TSIG updates, you must make the following configuration
+# changes:
 
-# - Insert the following lines into the options {} section of your named.conf
-# file:
+#
+# Steps for BIND 9.7.x ---------------------------------------------------
+#
+
+# 1a. Insert following lines into the options {} section of your named.conf
+#     file:
 tkey-gssapi-credential "DNS/${DNSNAME}";
 tkey-domain "${REALM}";
 
-# - Modify BIND init scripts to pass the location of the generated keytab file.
-# Fedora 8 & later provide a variable named KEYTAB_FILE in /etc/sysconfig/named
-# for this purpose:
+# 1b. Modify BIND init scripts to pass the location of the keytab file.
+#     Fedora 8 & later provide a variable named KEYTAB_FILE in 
+#     /etc/sysconfig/named for this purpose:
 KEYTAB_FILE="${DNS_KEYTAB_ABS}"
-# Note that the Fedora scripts translate KEYTAB_FILE behind the scenes into a
-# variable named KRB5_KTNAME, which is ultimately passed to the BIND daemon.  If
-# your distribution does not provide a variable like KEYTAB_FILE to pass a
-# keytab file to the BIND daemon, a workaround is to place the following line in
-# BIND's sysconfig file or in the init script for BIND:
+#     Note that the Fedora scripts translate KEYTAB_FILE behind the scenes 
+#     into a variable named KRB5_KTNAME, which is ultimately passed to the 
+#     BIND daemon.  If your distribution does not provide a variable like 
+#     KEYTAB_FILE to pass a keytab file to the BIND daemon, a workaround is 
+#     to place the following line in BIND's sysconfig file or in the init 
+#     script for BIND:
 export KRB5_KTNAME="${DNS_KEYTAB_ABS}"
 
-# - Set appropriate ownership and permissions on the ${DNS_KEYTAB} file.  Note
-# that most distributions have BIND configured to run under a non-root user
-# account.  For example, Fedora 9 runs BIND as the user "named" once the daemon
-# relinquishes its rights.  Therefore, the file ${DNS_KEYTAB} must be readable
-# by the user that BIND run as.  If BIND is running as a non-root user, the
-# "${DNS_KEYTAB}" file must have its permissions altered to allow the daemon to
-# read it.  Under Fedora 9, execute the following commands:
+#
+# Steps for BIND 9.8.x ---------------------------------------------------
+#
+
+# 1. Insert following lines into the options {} section of your named.conf 
+#    file:
+tkey-gssapi-keytab "${DNS_KEYTAB_ABS}";
+
+#
+# Common Steps for BIND 9.x.x --------------------------------------------
+#
+
+# 2. Set appropriate ownership and permissions on the ${DNS_KEYTAB} file.  
+#    Note that the most distributions have BIND configured to run under a 
+#    non-root user account.  For example, Fedora 9 runs BIND as the user 
+#    "named" once the daemon relinquishes its rights.  Therefore, the file 
+#    ${DNS_KEYTAB} must be readable by the user that BIND run as.  If BIND 
+#    is running as a non-root user, the "${DNS_KEYTAB}" file must have its 
+#    permissions altered to allow the daemon to read it.  Under Fedora 9, 
+#    execute the following commands:
 chgrp named ${DNS_KEYTAB_ABS}
 chmod g+r ${DNS_KEYTAB_ABS}
 
-# - Ensure the BIND zone file(s) that will be dynamically updated are in a
-# directory where the BIND daemon can write.  When BIND performs dynamic
-# updates, it not only needs to update the zone file itself but it must also
-# create a journal (.jnl) file to track the dynamic updates as they occur.
-# Under Fedora 9, the /var/named directory can not be written to by the "named"
-# user.  However, the directory /var/named/dynamic directory does provide write
-# access.  Therefore the zone files were placed under the /var/named/dynamic
-# directory.  The file directives in both example zone statements at the
-# beginning of this file were changed by prepending the directory "dynamic/".
-
-# - If SELinux is enabled, ensure that all files have the appropriate SELinux
-# file contexts.  The ${DNS_KEYTAB} file must be accessible by the BIND daemon
-# and should have a SELinux type of named_conf_t.  This can be set with the
-# following command:
+# 3. Ensure the BIND zone file(s) that will be dynamically updated are in 
+#    a directory where the BIND daemon can write.  When BIND performs 
+#    dynamic updates, it not only needs to update the zone file itself but 
+#    it must also create a journal (.jnl) file to track the dynamic updates 
+#    as they occur.  Under Fedora 9, the /var/named directory can not be 
+#    written to by the "named" user.  However, the directory /var/named/dynamic 
+#    directory does provide write access.  Therefore the zone files were 
+#    placed under the /var/named/dynamic directory.  The file directives in 
+#    both example zone statements at the beginning of this file were changed 
+#    by prepending the directory "dynamic/".
+
+# 4. If SELinux is enabled, ensure that all files have the appropriate 
+#    SELinux file contexts.  The ${DNS_KEYTAB} file must be accessible by the 
+#    BIND daemon and should have a SELinux type of named_conf_t.  This can be 
+#    set with the following command:
 chcon -t named_conf_t ${DNS_KEYTAB_ABS}