As per my other related post, I am trying to configure Samba as an Active Directory Domain Controller on Slackware. One snag I have hit is that it appears to be impossible to get Samba to do dynamic dns updates against Bind - as Samba uses nsupdate with something called GSS-TSIG. And nsupdate complains:

This is pretty important, as, when configured with the BIND9_DLZ dns back-end, both Samba and ISC Dhcpd need GSS-TSIG to do secure dns updates.

I suppose another option would be to use the Samba internal dns back-end - but that doesn't support ddns updates from Dhcpd - which means that all non-Windows devices on the network (printers, Linux pc's etc.) would be completely unable to register themselves through dns - which would break a lot of things.

Would it be possible to re-compile nsupdate with gssapi support somehow? Is there any chance that this could become part of Slackware? Is there an alternative to the above?

Just a follow-up to my original post - in case it is useful for others who might wish to configure Samba4 as an AD DC. I've installed the krb5 package from SBo - which was painless. Then I re-downloaded the Slackware sources and configs for Bind, and re-compiled Bind with the "--with-gssapi" argument. One interesting note is that, if krb5 is not installed, the compilation doesn't fail, but no gssapi support is enabled. Which can be a little confusing.

Now Samba and Dhcpd are able to do dynamic updates against Bind - using GSS-TSIG - after I installed the script and example configs found here:

https://wiki.samba.org/index.php/Con...rds_with_BIND9

1 members found this post helpful.