Hi,
this went unanswered so ...
On 2014-04-17 14:16, Marko Myllynen wrote:
On 2014-04-17 13:18, Jakub Hrozek wrote:
> On Thu, Apr 17, 2014 at 09:05:42AM +0300, Marko Myllynen wrote:
>
>> - for completeness sake I'd add dns_lookup_kdc = true and master_kdc =
>>
server.ad.example.com to the krb5.conf example
>
> I've added dns_lookup_kdc, but I'm not sure about master_kdc, why do you
> think it's needed? I normally prefer to stick to the defaults and let
> the autodiscovery do its magic.
sorry, I meant adding master_kdc commented like kdc / admin_server
already are. Under certain circumstances if you wanted to force using a
certain KDC it was not enough to specify kdc / admin_server, you needed
also master_kdc. In the past it was undocumented and when it was
discovered it explained quite a few situations. Sumit or Alexander might
remember the exact details, the bug report about it being undocumented
doesn't go into details:
https://bugzilla.redhat.com/show_bug.cgi?id=859961.
I added master_kdc to the example config based on the rationale above.
> Right, after re-reading the section in man smb.conf, I agree
password
> server should not be used.
What do you think about adding create krb5 conf = no?
This seems unnecessary. So does actually currently listed client signing
= yes which is IMHO ambiguous, "yes" is not documented in the man page
and I don't know what would be the reason for changing this. But I
didn't remove that, perhaps someone had a reason to add it there.
Thanks,
--
Marko Myllynen