Samba Active Directory

1.5.1.2 Prepare Samba AD DC

bash console

sudo apt install -y samba samba-ad-dc smbclient winbind krb5-user

During Kerberos installation, it will ask for:

- Kerberos realm - use your domain in uppercase (e.g., YOURDOMAIN.LOCAL).

- Kerberos servers for your realm - you can use any server IP that can provide KDC functions

- Administrative server for your kerberos realm - use the IP of the kerberos server responsible of principals editing (users and service accounts)

2.1 Provision the Domain

Stop Samba services first:

bash console

sudo systemctl stop samba-ad-dc smbd nmbd winbind
sudo systemctl disable smbd nmbd winbind

Remove default config and provision:

bash console

make a backup copy of the current file smb.conf :

sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
sudo samba-tool domain provision --use-rfc2307 --interactive

It'll ask you several questions - you can accept most defaults, but set a strong Administrator password.

sis@dc1:~$ sudo samba-tool domain provision --use-rfc2307 --interactive
Realm [VMMAURLX01.LOCAL]:
Domain [VMMAURLX01]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]: #this is an example, put an existing DNS here
Administrator password:
Retype password:

- make sure /etc/samba/smb.conf section [global] looks like this for [global] section

sudo nano /etc/samba/smb.conf

[global]
dns forwarder = 8.8.8.8 #this is an example, put an existing DNS here
netbios name = DC1
realm = YOURDOMAIN.LOCAL
server role = active directory domain controller
workgroup = YOURDOMAIN
idmap_ldb:use rfc2307 = yes

2.2 Start Samba AD DC

bash console

sudo systemctl unmask samba-ad-dc
sudo systemctl enable samba-ad-dc
sudo systemctl start samba-ad-dc


- Test DNS

Samba AD DC includes its own DNS server. Test it:

bash console
host -t SRV _ldap._tcp.yourdomain.local
host -t A dc1.yourdomain.local

You should see your domain controller in the results:
sis@dc1:~$ host -t SRV _ldap._tcp.vmmaurlx01.local
_ldap._tcp.vmmaurlx01.local has SRV record 0 100 389 dc1.vmmaurlx01.local.
sis@dc1:~$ host -t A dc1.vmmaurlx01.local
dc1.vmmaurlx01.local has address 172.31.99.142

- Test Kerberos Authentication

bash console
kinit administrator@YOURDOMAIN.LOCAL
klist
sis@dc1:~$ kinit administrator@VMMAURLX01.LOCAL
Password for administrator@VMMAURLX01.LOCAL:
Warning: Your password will expire in 41 days on Wed 26 Aug 2026 12:14:03 PM UTC
sis@dc1:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: administrator@VMMAURLX01.LOCAL

Valid starting       Expires              Service principal
07/15/2026 12:58:50  07/15/2026 22:58:50  krbtgt/VMMAURLX01.LOCAL@VMMAURLX01.LOCAL
        renew until 07/16/2026 12:58:40

This should authenticate and show you a ticket. If this fails, it could depend from /etc/krb5.conf, which still has
a default configuration. In that case, Samba creates a personalised /var/lib/samba/private/krb5.conf,
just copy it in /etc/krb5.conf
bash console
sudo cp /etc/krb5.conf /etc/krb5.conf.bak
sudo cp /var/lib/samba/private/krb5.conf /etc/krb5.conf


- Verify Samba

bash console
smbclient -L localhost -U administrator
sudo samba-tool domain level show

sis@dc1:~$ smbclient -L localhost -U administrator
Password for [VMMAURLX01\administrator]:

        Sharename       Type      Comment
        ---------       ----      -------
        sysvol          Disk
        netlogon        Disk
        IPC$            IPC       IPC Service (Samba 4.19.5-Ubuntu)
SMB1 disabled -- no workgroup available
sis@dc1:~$ sudo samba-tool domain level show
Domain and forest function level for domain 'DC=vmmaurlx01,DC=local'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2



- or you can use the "dig" command to test 
the bash console
# Test Kerberos
dig @127.0.0.1 _kerberos._tcp.yourdomain.local SRV
sis@dc1:~$ dig @127.0.0.1 _kerberos._tcp.vmmaurlx01.local SRV

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> @127.0.0.1 _kerberos._tcp.vmmaurlx01.local SRV
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8942
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;_kerberos._tcp.vmmaurlx01.local. IN    SRV

;; ANSWER SECTION:
_kerberos._tcp.vmmaurlx01.local. 900 IN SRV     0 100 88 dc1.vmmaurlx01.local.

;; AUTHORITY SECTION:
vmmaurlx01.local.       3600    IN      SOA     dc1.vmmaurlx01.local. hostmaster.vmmaurlx01.local. 1 900 600 86400 3600

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Jul 15 13:03:43 UTC 2026
;; MSG SIZE  rcvd: 120




# Test domain controller location
dig @127.0.0.1 _ldap._tcp.dc._msdcs.yourdomain.local SRV
sis@dc1:~$ dig @127.0.0.1 _ldap._tcp.dc._msdcs.vmmaurlx01.local SRV

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> @127.0.0.1 _ldap._tcp.dc._msdcs.vmmaurlx01.local SRV
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16934
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;_ldap._tcp.dc._msdcs.vmmaurlx01.local. IN SRV

;; ANSWER SECTION:
_ldap._tcp.dc._msdcs.vmmaurlx01.local. 900 IN SRV 0 100 389 dc1.vmmaurlx01.local.

;; AUTHORITY SECTION:
_msdcs.vmmaurlx01.local. 3600   IN      SOA     dc1.vmmaurlx01.local. hostmaster.vmmaurlx01.local. 1 900 600 86400 3600

;; Query time: 990 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Jul 15 13:05:36 UTC 2026
;; MSG SIZE  rcvd: 126

sis@dc1:~$



# Test DNS resolution of DC
dig @127.0.0.1 dc1.yourdomain.local A

sis@dc1:~$ dig @127.0.0.1 dc1.vmmaurlx01.local A

; <<>> DiG 9.18.39-0ubuntu0.24.04.5-Ubuntu <<>> @127.0.0.1 dc1.vmmaurlx01.local A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42707
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;dc1.vmmaurlx01.local.          IN      A

;; ANSWER SECTION:
dc1.vmmaurlx01.local.   900     IN      A       172.31.99.72

;; AUTHORITY SECTION:
vmmaurlx01.local.       3600    IN      SOA     dc1.vmmaurlx01.local. hostmaster.vmmaurlx01.local. 1 900 600 86400 3600

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Jul 15 13:06:21 UTC 2026
;; MSG SIZE  rcvd: 101