LPI 300-300 - LPIC-3: Mixed Environments - Exam 300 - version 3.0

To establish a trust between a FreeIPA domain and an Active Directory domain, the correct command isipa trust-add. This command is used to add a trust relationshipwith an Active Directory (AD) domain. The--type adspecifies the type of the trust,addomis the domain name,--admin Administratorspecifies the AD administrator account, and--passwordprompts for the administrator's password.

The complete command looks like this:

a trust-add --typead addom --admin Administrator --password

This command will initiate the trust creation process, which involves providing the credentials of the AD administrator.

References

FreeIPA Trusts

FreeIPA Trust Management

Samba 4 Features:Samba 4 introduces major enhancements over Samba 3, including the ability to function as an Active Directory (AD) Domain Controller.

Capability as AD Controller:

Samba 4 includes support for AD protocols, allowing it to manage domain users and computers similar to a Windows AD server.

Incorrect Statements Clarified:

Samba 4 is a significant update with new features.

Windows clients can connect to Samba 4 servers.

Samba 4 does not include a proprietary file system called sambafs.

Samba 4 can integrate with existing AD domains.

References:

Samba Wiki - Samba4

Thesmbclientcommand is used to access shared resources on a server running the SMB/CIFS protocol. To authenticate using an existing Kerberos token, the-koption is used. This instructssmbclientto use Kerberos for authentication, assuming that the user already has a valid Kerberos ticket (usually obtained via thekinitcommand).

Example:

smbclient //server/share -k

References

smbclient man page

Kerberos Authentication with Samba

Thesmbclientcommand is used to access shared resources on a network that uses the SMB (Server Message Block) protocol. To list the available SMB shares on a remote Samba server, the correct invocation issmbclient -L <server_name>. Here,-Lstands for "list" and<server_name>is the name of the Samba server. Therefore,smbclient -L FileSrv1will list all the available SMB shares on the server named FileSrv1.

References

smbclient man page

Samba: smbclient Command

Individual Log Files:

A. log file = /var/log/samba/log.%m: To generate an individual log file for each machine connecting to a Samba server, the%mvariable is used in the log file path. Thisvariable represents the machine name of the connecting client. Thus, the configuration linelog file = /var/log/samba/log.%mcreates a unique log file for each client machine.

References:

Sambasmb.confmanual

Logging configurations in Samba

In the context of a Samba configuration for printer shares, the[printers]section usually requires theprintable = yesdirective to indicate that the share is meant for printing. Without this directive, Samba would not treat the share as a printer share, even if other settings likepathare configured properly.

The given snippet is:

The lineprintable = yesis missing and is essential for defining a printer share.

References:

Samba Official Documentation - Printer Sharing

Command Explanation:Thesamba-tool dns addcommand is used to add DNS records in Samba.

Parameters:

dc1: Specifies the Samba DNS server.

samba.private: The DNS zone.

fileserver01: The hostname for the new DNS record.

AAAA: Specifies that the record is for an IPv6 address.

2001:db8::190: The IPv6 address to be assigned to the hostname.

-U Administrator: Specifies the user performing the operation, in this case, the Administrator.

Usage:This command properly adds a forward DNS record forfileserver01with the specified IPv6 address into thesamba.privatezone on the serverdc1.

References

Samba DNS Administration

In FreeIPA, ID views allow administrators to override default POSIX attributes for users and groups. This feature is useful when integrating with other identity management systems, enabling specific attribute values to be used on a per-host basis. This way, different POSIX attributes can be set for the same user or group in different contexts.

References

FreeIPA: ID Views

FreeIPA Documentation

In the SSSD (System Security Services Daemon) configuration file, various services can be defined to handle different types of access and authentication. The services listed in the SSSD configuration file under the[sssd]section can include:

kerberos:This service allows SSSD to handle Kerberos authentication.

nss (Name Service Switch):This service provides name resolution and manages user and group information.

sudo:This service enables SSSD to provide sudo rules based on the identity provider.

These services are specified in theservicesattribute of the[sssd]section of thesssd.conffile.

Example:

[sssd]services= nss, pam, sudodomains= LDAP[nss]filter_users= rootfilter_groups= root[sudo]sudo_provider= ldap

References

SSSD Services

SSSD Man Pages