ipa-client-samba(1)

💖 ipa-client-samba — the manual page, but make it make sense 💖

okay bestie, welcome to ipa-client-samba(1), a page from the IPA Manual Pages. it's giving "set up a Samba file server on your IPA client" and honestly? it's a whole vibe. let's get into it 🫶

✨ NAME ✨

ipa-client-samba — configure a Samba file server on an IPA client 🌸

✨ SYNOPSIS ✨

ipa-client-samba [OPTION]...

✨ DESCRIPTION ✨

so what this does is it configures a Samba file server on the client machine so it uses the IPA domain controller for authentication and identity services. slay 💅

the tool sets up the Samba file server to be a domain member of the IPA domain. the Samba file server will use SSSD to resolve info about users and groups, and it will use the IPA master it's enrolled against as its domain controller. iconic, no notes 👑

heads up bestie — there is literally no way to reconciliate your original Samba environment if there was one already living on the client before this. the Samba databases will get updated to follow IPA domain details, and the smb.conf configuration will be overwritten. the recommendation is fr fr to enable the Samba suite on a freshly deployed IPA client. don't do it on your messy old setup, i'm begging 😭

during the configuration process, the tool will perform the following steps:

1. discover details of the IPA domain: realm, domain SID, domain ID range
2. discover details of trusted Active Directory domains: domain name, domain SID, domain ID range
3. create the Samba configuration file using the details discovered above.
4. create a Samba Kerberos service using host credentials and fetch its keytab into /etc/samba/samba.keytab. the Kerberos service key is pre-set to a randomly generated value that is shared with Samba 🔐
5. populate Samba databases by setting the domain details and the randomly generated machine account password from the previous step.
6. create a default [homes] share to allow users to log in to their home directories — unless the --no-homes option was specified. 🏠

and here's the thing: the tool does not start and does not enable Samba file services after the configuration. nope. not doing it. in order to enable and start Samba file services, you need to enable both smb.service and winbind.service system services. please check that /etc/samba/smb.conf contains all settings for your use case, because starting the Samba service will make identity mapping details get written into the Samba databases. 👀

to enable and start Samba file services at the same time, you can use the systemctl enable --now command:

systemctl enable --now smb winbind

🌈 Assumptions 🌈

the ipa-client-samba script assumes that the machine has already been enrolled into IPA. like, that part's on you bestie 💜

👑 IPA Master Requirements 👑

at least one IPA master must hold a Trust Controller role. you get that by running ipa-adtrust-install on the IPA master. the utility will configure the IPA master to be a domain controller for the IPA domain. periodt.

the IPA master holding a Trust Controller role also has to have support for a special service command to create the SMB service, ipa service-add-smb. this command is available with IPA 4.8.0 or later release. so if you're on something older... bestie, upgrade 😭

✨ OPTIONS ✨

💅 BASIC OPTIONS 💅

• --server=SERVER — sets the FQDN of the IPA server to connect to. under normal circumstances you don't even need this option, because the server to use gets discovered automatically. main character energy, it finds itself ✨
• --no-homes — do not configure a [homes] share by default to allow users to access their home directories.
• --no-nfs — do not enable SELinux booleans to allow Samba to re-share NFS shares.
• --netbios-name=NETBIOS_NAME — the NetBIOS name of this machine. if you don't provide it, then it's determined based on the leading component of the hostname. 🖥️
• -d, --debug — print debugging information to stdout. 🐛
• -U, --unattended — unattended installation. the user will not be prompted. go off, no questions asked 🙈
• --uninstall — revert the Samba suite configuration changes and remove the SMB service principal. and ngl, it is not possible to preserve the original Samba configuration: while the smb.conf configuration file will be restored, various Samba databases would not be restored. in general, it is not possible to restore the full original Samba environment. 💀
• --force — force through the installation steps even if they were done before. yeah, just send it 🔥

✨ FILES ✨

files that will be replaced if Samba is configured:

/etc/samba/smb.conf
/etc/samba/samba.keytab

✨ EXIT STATUS ✨

• 0 — if the installation was successful 🎉
• 1 — if an error occurred 😭

✨ SEE ALSO ✨

smb.conf(5), krb5.conf(5), sssd.conf(5), systemctl(1)

and that's the whole page bestie, you ate that 🎀 this one comes from the IPA manual, dated Jun 10 2019 — so yeah, she's been around, and she still serves. byeeee 💖🦋🌸