freeipa/install/share/smb.conf.template

[global]
workgroup = $NETBIOS_NAME
netbios name = $HOST_NETBIOS_NAME
realm = $REALM
kerberos method = dedicated keytab
dedicated keytab file = /etc/samba/samba.keytab
create krb5 conf = no
security = user
domain master = yes
domain logons = yes
log level = 1
max log size = 100000
log file = /var/log/samba/log.%m
passdb backend = ipasam:ldapi://$LDAPI_SOCKET
disable spoolss = yes
ldapsam:trusted=yes
ldap ssl = off
ldap suffix = $SUFFIX
ldap user suffix = cn=users,cn=accounts
ldap group suffix = cn=groups,cn=accounts
ldap machine suffix = cn=computers,cn=accounts
rpc_server:epmapper = external
rpc_server:lsarpc = external
rpc_server:lsass = external
rpc_server:lsasd = external
rpc_server:samr = external
rpc_server:netlogon = external
rpc_server:tcpip = yes
rpc_daemon:epmd = fork
rpc_daemon:lsasd = fork
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619 2011-09-07 03:17:12 -05:00			`[global]`
			`workgroup = $NETBIOS_NAME`
ipa-adtrust-install: configure host netbios name by default Ensure we set host netbios name by default in smb.conf https://fedorahosted.org/freeipa/ticket/4116 2014-01-17 06:09:34 -06:00			`netbios name = $HOST_NETBIOS_NAME`
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619 2011-09-07 03:17:12 -05:00			`realm = $REALM`
Use dedicated keytab for Samba Samba just needs the cifs/ key on the ipa server. Configure samba to use a different keytab file so that we do not risk samba commands (net, or similar) to mess up the system keytab. https://fedorahosted.org/freeipa/ticket/2168 2012-02-28 05:23:51 -06:00			`kerberos method = dedicated keytab`
adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.conf Samba 4.5 does not allow to specify access mode for the keytab (FILE: or WRFILE:) from external sources. Thus, change the defaults to a path (implies FILE: prefix) while Samba Team fixes the code to allow the access mode prefix for keytabs. On upgrade we need to replace 'dedicated keytab file' value with the path to the Samba keytab that FreeIPA maintains. Since the configuration is stored in the Samba registry, we use net utility to manipulate the configuration: net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab Fixes https://fedorahosted.org/freeipa/ticket/6551 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2016-12-12 02:30:51 -06:00			`dedicated keytab file = /etc/samba/samba.keytab`
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619 2011-09-07 03:17:12 -05:00			`create krb5 conf = no`
			`security = user`
			`domain master = yes`
			`domain logons = yes`
			`log level = 1`
			`max log size = 100000`
			`log file = /var/log/samba/log.%m`
Add ipasam samba passdb backend https://fedorahosted.org/freeipa/ticket/1874 2011-10-25 03:33:30 -05:00			`passdb backend = ipasam:ldapi://$LDAPI_SOCKET`
Use dedicated keytab for Samba Samba just needs the cifs/ key on the ipa server. Configure samba to use a different keytab file so that we do not risk samba commands (net, or similar) to mess up the system keytab. https://fedorahosted.org/freeipa/ticket/2168 2012-02-28 05:23:51 -06:00			`disable spoolss = yes`
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619 2011-09-07 03:17:12 -05:00			`ldapsam:trusted=yes`
			`ldap ssl = off`
			`ldap suffix = $SUFFIX`
			`ldap user suffix = cn=users,cn=accounts`
			`ldap group suffix = cn=groups,cn=accounts`
			`ldap machine suffix = cn=computers,cn=accounts`
			`rpc_server:epmapper = external`
			`rpc_server:lsarpc = external`
			`rpc_server:lsass = external`
			`rpc_server:lsasd = external`
			`rpc_server:samr = external`
			`rpc_server:netlogon = external`
			`rpc_server:tcpip = yes`
			`rpc_daemon:epmd = fork`
			`rpc_daemon:lsasd = fork`