FreeBSD Manual Pages
ipa-client-samba(1) IPA Manual Pages ipa-client-samba(1) NAME ipa-client-samba - Configure Samba file server on an IPA client SYNOPSIS ipa-client-samba [OPTION]... DESCRIPTION Configures a Samba file server on the client machine to use IPA domain con- troller for authentication and identity services. The tool configures Samba file server to be a domain member of IPA domain. Samba file server will use SSSD to resolve information about users and groups, and will use IPA master it is enrolled against as its domain con- troller. It is not possible to reconciliate original Samba environment if that was pre-existing on the client with new configuration. Samba databases will be updated to follow IPA domain details and smb.conf configuration will will be overwritten. It is recommended to enable Samba suite on a freshly de- ployed IPA client. During the configuration process, the tool will perform following steps: 1. Discover details of IPA domain: realm, domain SID, domain ID range 2. Discover details of trusted Active Directory domains: domain name, domain SID, domain ID range 3. Create Samba configuration file using the details discovered above. 4. Create Samba Kerberos service using host credentials and fetch its keytab into /etc/samba/samba.keytab. The Kerberos service key is pre-set to a randomly generated value that is shared with Samba. 5. Populate Samba databases by setting the domain details and the randomly generated machine account password from the previous step. 6. Create a default [homes] share to allow users to log in to their home directories unless --no-homes option was specified. The tool does not start nor does it enable Samba file services after the configuration. In order to enable and start Samba file services, one needs to enable both smb.service and winbind.service system services. Please check that /etc/samba/smb.conf contains all settings for your use case as starting Samba service will make identity mapping details written into the Samba databases. To enable and start Samba file services at the same time one can use systemctl enable --now command: systemctl enable --now smb winbind Assumptions The ipa-client-samba script assumes that the machine has already been en- rolled into IPA. IPA Master Requirements At least one IPA master must hold a Trust Controller role. This can be achieved by running ipa-adtrust-install on the IPA master. The utility will configure IPA master to be a domain controller for IPA domain. IPA master holding a Trust Controller role has also to have support for a special service command to create SMB service, ipa service-add-smb. This command is available with IPA 4.8.0 or later release. OPTIONS BASIC OPTIONS --server=SERVER Set the FQDN of the IPA server to connect to. Under normal circum- stances, this option is not needed as the server to use is discov- ered automatically. --no-homes Do not configure a [homes] share by default to allow users to access their home directories. --no-nfs Do not enable SELinux booleans to allow Samba to re-share NFS shares. --netbios-name=NETBIOS_NAME NetBIOS name of this machine. If not provided then this is deter- mined based on the leading component of the hostname. -d, --debug Print debugging information to stdout -U, --unattended Unattended installation. The user will not be prompted. --uninstall Revert Samba suite configuration changes and remove SMB service principal. It is not possible to preserve original Samba configura- tion: while smb.conf configuration file will be restored, various Samba databases would not be restored. In general, it is not possi- ble to restore full original Samba environment. --force Force through the installation steps even if they were done before FILES Files that will be replaced if Samba is configured: /etc/samba/smb.conf /etc/samba/samba.keytab EXIT STATUS 0 if the installation was successful 1 if an error occurred SEE ALSO smb.conf(5), krb5.conf(5), sssd.conf(5), systemctl(1) IPA Jun 10 2019 ipa-client-samba(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | FILES | EXIT STATUS | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=ipa-client-samba&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>