diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2014-08-27 15:09:22 +1200 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2014-09-27 01:35:36 +0200 |
| commit | f80780925fa1dfd15dc18b5b307d7ff4bd72a795 (patch) | |
| tree | be4b3795422d346404749c324e4cb18be0962153 | |
| parent | d0a0af3550ddb5f08ab683bc54ab99f9e2b1a74c (diff) | |
| download | samba-f80780925fa1dfd15dc18b5b307d7ff4bd72a795.tar.gz | |
provision: explain why this is required
Change-Id: Iaf8b13010b52e03db2eefe1ad565d7ca768ffb48
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
| -rw-r--r-- | python/samba/provision/sambadns.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/python/samba/provision/sambadns.py b/python/samba/provision/sambadns.py index 9dbea4ef2a5..29224c8cf69 100644 --- a/python/samba/provision/sambadns.py +++ b/python/samba/provision/sambadns.py @@ -801,6 +801,14 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid): logger.error( "Failed to setup database for BIND, AD based DNS cannot be used") raise + + # This line is critical to the security of the whole scheme. + # We assume there is no secret data in the (to be left out of + # date and essentially read-only) config, schema and metadata partitions. + # + # Only the stub of the domain partition is created above. + # + # That way, things like the krbtgt key do not leak. del partfile[domaindn] # Link dns partitions and metadata |