[Samba] Still confused about Kerberos password expiry

[Sketch]

On Wed, 2 Jul 2014, jimc wrote:

> I haven't found an example there for how to properly set up a dns zone 
> either.

When you run "samba-tool domain provision", it should properly set up the 
DNS zone, assuming you used internal or bind9_dlz DNS.  Beyond that, I 
think you may need to refer to Microsoft's documentation on how to set up 
the DNS manually.

> Where is the real documentation? How do I learn what the options are to the 
> samba-tool commands that demand them but won't tell me what they are?

samba-tool does seem to be pretty poorly documented.  The only 
documentation seems to be is in the previously-mentioned --help option. 
It took me a while to figure this out, but you can apply --help to every 
subcommand in samba-tool, and it gives you usage and examples.  Some of 
the commands are scattered about, so you may have to poke around a bit to 
find them.  The ones you're looking for are:

samba-tool user setexpiry --help
samba-tool domain passwordsettings --help

> Am I really the only person in the whole world who is frustrated with the 
> state of the documentation?

I find that for configuring samba itself (primarily the fileserver), the 
man page for smb.conf is quite comprehensive.  But for setting up an 
active directory domain, there's basically just the relatively sparse 
documentation on the samba wiki, though some linux distributions do have 
more fleshed out versions on their own documentation sites.  I think this 
is partly due to that this functionality is only out of beta relatively 
recently.  Also for much of it, like configuring DNS, GPOs, etc, you can 
refer to MS's documentation.