Usability of 'samba-tool domain provision'

[Andreas Schneider]

Hi,

I'm preparing a big demo for Samba XP conference. I need to get my demo 
working so I don't have time to fix stuff right now. This documents issues I 
found during provisioning. samba-tool is far away from being user friendly.

I'm running master from today.

Maybe someone has time to work on them (Rowland? :). Else I will start to work 
on them during SambaXP or afterwards.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

a) It isn't clear what domain is from 'samba-tool domain provison --help' it 
stats: set domain.

It expects the netbios name.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

b) The --realm option is essential but at the end of the help ...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

c) [root at smbdc ~]# samba-tool domain provision --realm=SAMBA.SITE --
domain=samba.site --adminpass=passw0rd --use-rfc2307                                                                   
ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed - 
ProvisioningError: guess_names: 'server role=auto' in /etc/samba/smb.conf must 
match chosen server role 'active d
irectory domain controller'!  Please remove the smb.conf file and let 
provision generate it

I would expects that provision creates smb.conf until I tell it to use it.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

d) I removed /etc/smb.conf and tried to provision which failed.

[root at smbdc ~]# samba-tool domain provision --realm=SAMBA.SITE --
domain=samba.site --adminpass=passw0rd --server-role=dc --use-rfc2307
ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed - 
ProvisioningError: guess_names: Realm 'SAMBA.SITE' must not be equal to short 
domain name 'SAMBA.SITE'!

ok, --domain is not the netbios name so it failed. Next try

[root at smbdc ~]# samba-tool domain provision --realm=SAMBA.SITE --domain=SAMBA 
--adminpass=passw0rd --server-role=dc --use-rfc2307                                                       
ERROR(<class 'samba.provision.ProvisioningError'>): Provision failed - 
ProvisioningError: guess_names: Workgroup 'SAMBA.SITE' in smb.conf must match 
chosen domain 'SAMBA'!  Please remo
ve the /etc/samba/smb.conf file and let provision generate it

What? In the first try I set --domain wrong and it fails but creates a wrong 
smb.conf?

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

e) I would guess that it fails earlier if password restrictions are not met 
and not setup half the domain ...

[root at smbdc ~]# samba-tool domain provision --realm=SAMBA.SITE --domain=SAMBA 
--adminpass=passw0rd --server-role=dc --use-rfc2307
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=samba,DC=site
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
ERROR(ldb): uncaught exception - 0000052D: Constraint violation - 
check_password_restrictions: the password does not meet the complexity 
criteria!

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

f) Note to myself

samba-tool with MIT KDC needs to create /etc/krb5.conf.d/samba_ad_dc with the 
following content:

[libdefaults]
        default_realm = SAMBA.SITE
        dns_lookup_realm = false
        dns_lookup_kdc = true
        ticket_lifetime = 24h
        forwardable = yes
        allow_weak_crypto = yes

[realms]
        SAMBA.SITE = {
                kdc = 192.168.122.10:88
                admin_server = 192.168.122.10:88
                default_domain = samba.site
        }
        samba.site = {
                kdc = 192.168.122.10:88
                admin_server = 192.168.122.10:88
                default_domain = samba.site
        }
        SAMBADOMAIN = {
                kdc = 192.168.122.10:88
                admin_server = 192.168.122.10:88
                default_domain = samba.site
        }
        sambadomain = {
                kdc = 192.168.122.10:88
                admin_server = 192.168.122.10:88
                default_domain = samba.site
        }


-- 
Andreas Schneider                   GPG-ID: CC014E3D
Samba Team                             asn at samba.org
www.samba.org