From 0a49af87f108d88944a551190213d5ed468093f0 Mon Sep 17 00:00:00 2001
From: Dimitris Aragiorgis <dimara@grnet.gr>
Date: Sun, 24 Aug 2014 00:02:58 +0300
Subject: [PATCH] Add kerberos authentication support for nsupdate
Up until now snf-network used nsupdate with a keyfile to
dynamically update DNS entries on an external nameserver
(bind9). This patch adds support for authenticating against an
AD controller using Kerberos.
Specifically we use "k5start -H" to ensure there is a happy ticket,
otherwise use a keytab containing the password to obtain a ticket
automatically. Finally, we use nsupdate in GSS-TSIG mode (with -g option
and with KRB5CCNAME environment variable pointing to the ticket
obtained previously by k5start) to update AD-integrated DNS server.
The keytab file can be added with:
# ktutil -v add -V 1 -e aes256-cts -p PRINCIPAL
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
---
common.sh | 8 +++++++-
snf-network-dnshook | 19 ++++++++++++++++++-
2 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/common.sh b/common.sh
index 86bcf02..8ed33fd 100755
--- a/common.sh
+++ b/common.sh
@@ -372,7 +372,13 @@ send_command () {
local command="$1"
log "* $command"
- nsupdate -k $KEYFILE > /dev/null << EOF
+ if [ -e "$KEYFILE" ]; then
+ nsupdate_command="nsupdate -k $KEYFILE"
+ elif [ -n "$KERBEROS_PRINCIPAL" ]; then
+ nsupdate_command="KR5BCCNAME=$KERBEROS_TICKET nsupdate -g"
+ k5start -k $KERBEROS_TICKET -u $KERBEROS_PRINCIPAL -f $KERBEROS_KEYTAB $KERBEROS_KSTART_ARGS
+ fi
+ $nsupdate_command > /dev/null << EOF
server $SERVER
$command
send
diff --git a/snf-network-dnshook b/snf-network-dnshook
index a83e8c0..2a68501 100755
--- a/snf-network-dnshook
+++ b/snf-network-dnshook
@@ -45,10 +45,27 @@ FZONE=""
KEYFILE=""
MAC2EUI64="/usr/bin/mac2eui64"
+# kerberos authentication settings
+# Will be used with kstart and ktutil
+KERBEROS_PRINCIPAL=
+KERBEROS_KEYTAB=/etc/krb5.keytab
+KERBEROS_KSTART_ARGS="-H 1 -l 1h"
+KERBEROS_TICKET=/var/lib/snf-network/snf-network-kerberos.tkt
+
source /etc/default/snf-network
source /usr/lib/snf-network/common.sh
-if [ -z "$SERVER" -o -z "$FZONE" -o ! -e "$KEYFILE" ]; then
+if [ -z "$SERVER" -o -z "$FZONE" ]; then
+ log "SERVER and FZONE not defined! Aborting.."
+ exit 0
+fi
+
+if [ -e "$KEYFILE" ]; then
+ log "Will use $KEYFILE keyfile for nsupdate."
+elif [ -n "$KERBEROS_PRINCIPAL" ]; then
+ log "Will use $KERBEROS_PRINCIPAL kerberos principal for nsupdate."
+else
+ log "Neither KEYFILE nor KERBEROS_PRINCIPAL defined! Aborting.."
exit 0
fi
--
GitLab