A financial services company is using Samba as a domain member server to provide access to sensitive audit logs. A requirement exists to prevent users from permanently deleting files, instead moving them to a per-user, date-stamped recycle bin directory located within their own home directory. The home directories are on a separate, faster storage tier. Which VFS module and configuration parameter would achieve this specific requirement?
An administrator is configuring an SSSD client to authenticate against a FreeIPA domain. A key requirement is that users must be able to log in using their short name (e.g., 'jdoe') instead of the fully qualified name ('[email protected]'). However, the system must still enforce that only users from the 'ipa.example.com' domain are queried. Which `sssd.conf` parameter, when set to `true`, achieves this behavior?
A university has a FreeIPA domain for its staff (`staff.university.edu`) and a separate Active Directory domain for its students (`students.university.edu`). The goal is to allow staff members to access a Samba file server that is a member of the student AD domain, using their staff credentials. Which FreeIPA and Samba feature is required to make this cross-domain authentication possible?
A consultant needs to securely mount a Windows SMB share on a Linux client using Kerberos authentication. The client is already joined to the Active Directory domain and the user can successfully run `kinit`. Which of the following `mount.cifs` command lines is the correct syntax to mount the share using Kerberos? (Select TWO).
When configuring a secure NFSv4 export on a server that is part of a FreeIPA domain, which mechanism is used to translate user and group names to numeric IDs between the client and server, avoiding mismatches?
A system administrator is troubleshooting a Samba file share. Users report that they cannot see certain files they know exist and to which they have read permissions at the filesystem level. The administrator suspects a Samba configuration issue is hiding these files. Which parameter in `smb.conf` is the most likely cause of this behavior?
True or False: When a Linux client uses SSSD to connect to an Active Directory domain, the `ad_access_filter` option in `sssd.conf` can be used to restrict access based on a user's AD group membership using a standard LDAP filter.
An organization is migrating from a legacy NIS-based identity management system to FreeIPA. To ensure a smooth transition, they want to continue serving NIS clients from the FreeIPA servers. What must be configured on the FreeIPA server to enable this functionality?
A system administrator needs to troubleshoot a failing Samba domain provision process. To get the most detailed output possible during the `samba-tool domain provision` command, which command-line option should be used?
**Case Study:** A medium-sized media production company, 'CreativeFrames', is restructuring its IT infrastructure. They have an existing Windows Active Directory domain (`corp.creativeframes.com`) used for workstations and administrative staff. The video editing department uses a fleet of high-performance Linux workstations and needs access to a large, high-speed storage server running Linux. **Current Situation:** The Linux workstations currently authenticate against a legacy OpenLDAP server, and home directories are provided via NFSv3. This setup is unreliable, and managing user identities across AD and OpenLDAP is a significant administrative burden. The storage server is a standalone Samba server using `security = user` with a local `smbpasswd` file, requiring separate credentials. **Requirements:** 1. Consolidate user identity management. All users (AD and Linux-specific) should be managed from a single point of truth where possible. 2. Linux users must be able to log into their workstations using their primary corporate credentials. 3. The new storage solution must support Windows ACLs to provide granular permissions for cross-departmental projects. 4. The solution should provide centralized management for sudo rules and automount maps for the Linux workstations. **Constraints:** - The existing Active Directory domain must remain the primary identity source for corporate users. - A complete migration away from AD is not an option. Which solution best meets all of CreativeFrames' requirements?