Discuss: samba-tool configure subcommand

William Brown william at blackhats.net.au
Tue Apr 24 06:05:48 UTC 2018


Hi,

I've been setting up and trying to use samba 4 at home as my primary
authentication source. While doing this, I've noticed a few things in
samba-tool that could be improved to aid usability of the domain
controller functions for administrators.

In my setup I would like to "easily" be able to change domain
configuration options and forest configuration options. Some obvious
ones that come to mind are:

* CN=Directory Service,CN=Windows
NT,CN=Services,CN=Configuration,${DOMAIN}:
dsHeuristics: ...
* ${DOMAIN}: ms-DS-MachineAccountQuota

I'm sure that as I continue I will find more of course. There is a
clear distinction between these though. First, the ${DOMAIN} settings
could be part of:

samba-tool domain configure <setting>
OR
samba-tool domain <setting>

For example, the passwordsettings are already in the domain subcommand
so it could be logical to retain these here at the top level of the
domain command.

The other part of this is that cn=configuration is replicated in the
forest, so a new subcommand could be a better location. For example,

samba-tool forest <setting>
OR
samba-tool forest configure <setting>

Having these in samba-tool is a good start as it means we can build out
and extend what configurations can be altered from the CLI - avoiding
messy ldifs and changes. 

Thoughts and suggestions? For now I'll start writing the patch, but
I'll alter it based on comments later.

Thanks,

William



More information about the samba-technical mailing list