Setting up a samba-ad-dc - Revision history

John3-16: /* See also */ Removed Helpful links to Samba entry, added in error: linked to Main Page.

2025-12-22T05:11:58Z

See also: Removed Helpful links to Samba entry, added in error: linked to Main Page.

← Older revision		Revision as of 05:11, 22 December 2025
Line 157:		Line 157:
	* [[Samba Roaming Profiles]]		* [[Samba Roaming Profiles]]
	* [https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Official Samba Wikipage]		* [https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Official Samba Wikipage]
	* [[Main Page\|Helpful links to Samba]]

	[[Category:Printers]]		[[Category:Printers]]
	[[Category:Authentication]]		[[Category:Authentication]]

John3-16: /* See also */ Added internal Samba links

2025-12-06T06:10:31Z

Prabuanand: removed outdated information about chrony, fixed heading levels, added links

2025-09-19T10:32:10Z

removed outdated information about chrony, fixed heading levels, added links

← Older revision		Revision as of 10:32, 19 September 2025
Line 1:		Line 1:
	~~= Notes =~~		This page documents the setting up a [[Setting up a Samba server\|Samba]] based Active Directory (AD) domain controller (DC).

	==~~== Active Directory Naming ==~~==		== Prerequisites ==

	~~In all examples~~ below~~, replace EXAMPLE with your NetBIOS domain name in caps, example.com with your DNS domain name, HOSTNAME with your system's host name in caps, and hostname with your system's host name.~~		AD Domain time sync requires MS-SNTP signing support, so install one of the below NTP server implementations which do support MS-SNTP signing:

	~~Refer to the [https://wiki.samba~~.org~~/index.php/Active_Directory_Naming_FAQ Active Directory naming FAQ] before choosing your domain name.~~		* {{Pkg\|chrony}} - Chrony
			* {{pkg\|ntpd-rs}} - The ntp.org "ntpd" server

	==~~== MS-SNTP signing support ==~~==		== Installation ==

	~~AD Domain time sync requires MS~~-~~SNTP signing support, so be sure to check whether the NTP server you choose to deploy, does support it.~~		Install packages:{{Cmd\|apk add samba-dc krb5 py3-cryptography }}

	~~<span style~~="color:red">Some of the NTP server versions available in the Alpine repositories (chrony, openntpd, busybox) do not currently support it. This will cause time sync issues for the domain, so be forewarned.</span>		== Configuration ==

	~~NTP implementations which do support MS-SNTP signing:~~		In all examples below, replace EXAMPLE with your NetBIOS domain name in caps, example.com with your DNS domain name, HOSTNAME with your system's host name in caps, and hostname with your system's host name.

	* chrony (version >= 3.2) [https://~~pkgs~~.~~alpinelinux~~.org/~~packages?name=chrony&branch=edge&repo=&arch=&maintainer= Alpine package in edge] [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Source download v3.2] [https://git.tuxfamily~~.~~org~~/~~chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Source code commit~~]		Refer to the [https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ Active Directory naming FAQ] before choosing your domain name.
	* The ntp.org "ntpd" server [https://ntp.org/downloads.html - Download ntpd]
	* Windows

	~~'''Install Chrony version 3.2 on Alpine 3.6.2:'''~~

	~~Uncomment and pin the edge/main repository in /etc/apk/repositories~~

	~~Note that the below URLs are invalid and used for illustrative purposes only. Replace with the valid repository URLs used by~~ your ~~installation.~~

	~~See [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management#Repository_pinning Package Repository Pinning] for further details.~~

	~~<pre>~~
	~~https://mirror/alpine/v3~~.~~6/main~~
	~~@edge https://mirror/alpine/edge/main~~
	~~</pre>~~

	~~Update the package index:~~

	~~{{Cmd\|apk update}}~~

	~~Upgrade chrony using the @edge tag~~

	~~{{Cmd\|apk add chrony chrony@edge}}~~

	~~Upgrade chrony-doc using the @edge tag~~

	~~{{Cmd\|apk add chrony-doc chrony-doc@edge}}~~

	~~Confirm that the installed version is from the edge repository:~~

	~~{{Cmd\|cat /etc/apk/world \| grep chrony}}~~

	~~<pre>~~		=== Edit hosts file ===
	~~chrony@edge~~
	~~chrony-doc@edge~~
	~~</pre>~~

	~~Restart chronyd to use the newly upgraded version:~~

	~~{{Cmd\|/etc/init.d/chronyd restart}}~~

	~~= Installation =~~
	~~Install packages:~~
	~~{{Cmd\|apk add samba-dc krb5 py3-cryptography }}~~

	~~= Edit hosts file =~~
	You need to modify your {{Path\|/etc/hosts}} file to look similar to this.		You need to modify your {{Path\|/etc/hosts}} file to look similar to this.

Line 67:		Line 25:
	10.1.1.10 hostname.example.com hostname		10.1.1.10 hostname.example.com hostname

	= Create smb.conf =		=== Create smb.conf ===

	Alpine doesn't provide an example configuration file in the package so you'll need to create one at {{Path\|/etc/samba/smb.conf}}.		Alpine doesn't provide an example configuration file in the package so you'll need to create one at {{Path\|/etc/samba/smb.conf}}.

Line 86:		Line 45:
	read only = No		read only = No

	= Provision your Samba domain =		=== Provision your Samba domain ===

	Answer the questions with your domain information:		Answer the questions with your domain information:
	{{Cmd\|samba-tool domain provision --use-rfc2307 --interactive}}		{{Cmd\|samba-tool domain provision --use-rfc2307 --interactive}}
Line 92:		Line 52:
	When asked for a forwarder IP, choose your internet DNS server. You can use your ISP or other public services (like Google) here.		When asked for a forwarder IP, choose your internet DNS server. You can use your ISP or other public services (like Google) here.

	= Configure resolv.conf =		=== Configure resolv.conf ===

	Modify your {{Path\|/etc/resolv.conf}} to include your new domain as a search domain and point to itself as the first nameserver.		Modify your {{Path\|/etc/resolv.conf}} to include your new domain as a search domain and point to itself as the first nameserver.

Line 98:		Line 59:
	nameserver 10.1.1.10		nameserver 10.1.1.10

	= Configure Kerberos =		=== Configure Kerberos ===

	You need to replace krb5.conf with a link to the one generated by samba.		You need to replace krb5.conf with a link to the one generated by samba.
	{{Cmd\|ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf}}		{{Cmd\|ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf}}

	= Install new init script =		=== Install new init script ===
	~~As of 3/31/2016 and Alpine 3.3.3, the included samba init script doesn't support starting it as a domain controller.~~ Modify your {{Path\|/etc/init.d/samba}} script like the one below.
			Modify your {{Path\|/etc/init.d/samba}} script like the one below to support starting Samba as a domain controller as follows:

	#!/sbin/openrc-run		#!/sbin/openrc-run
Line 184:		Line 147:
	}		}

	= Configure the Samba service =		=== Configure the Samba service ===
	~~Run this command to start~~ the service on ~~boot.~~
	{{Cmd\|rc-update add samba}}		To enable the service on startup:{{Cmd\|rc-update add samba}}

			To start the service right now:{{Cmd\|rc-service samba start}}

			== See also ==

	~~Run this command to start the service right now~~.		* [[https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Official Samba Wikipage]]
	~~{{Cmd\|rc-service~~ samba ~~start}}~~

	[[Category:Printers]]		[[Category:Printers]]
	[[Category:Authentication]]		[[Category:Authentication]]

Fabio.homework: /* Installation */

2025-08-31T00:53:35Z

Installation

← Older revision		Revision as of 00:53, 31 August 2025
Line 59:		Line 59:
	= Installation =		= Installation =
	Install packages:		Install packages:
	{{Cmd\|apk add samba-dc krb5 }}		{{Cmd\|apk add samba-dc krb5 py3-cryptography }}

	= Edit hosts file =		= Edit hosts file =

Sertonix: use https

2023-08-25T21:17:24Z

use https

← Older revision		Revision as of 21:17, 25 August 2023
Line 16:		Line 16:

	* chrony (version >= 3.2) [https://pkgs.alpinelinux.org/packages?name=chrony&branch=edge&repo=&arch=&maintainer= Alpine package in edge] [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Source download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Source code commit]		* chrony (version >= 3.2) [https://pkgs.alpinelinux.org/packages?name=chrony&branch=edge&repo=&arch=&maintainer= Alpine package in edge] [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Source download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Source code commit]
	* The ntp.org "ntpd" server [~~http~~://ntp.org/downloads.html - Download ntpd]		* The ntp.org "ntpd" server [https://ntp.org/downloads.html - Download ntpd]
	* Windows		* Windows

Line 28:		Line 28:

	<pre>		<pre>
	~~http~~://mirror/alpine/v3.6/main		https://mirror/alpine/v3.6/main
	@edge ~~http~~://mirror/alpine/edge/main		@edge https://mirror/alpine/edge/main
	</pre>		</pre>

Zoot: /* MS-SNTP signing support */ - include restarting chronyd after upgrade

2017-11-21T11:51:15Z

MS-SNTP signing support: - include restarting chronyd after upgrade

← Older revision		Revision as of 11:51, 21 November 2017
Line 52:		Line 52:
	chrony-doc@edge		chrony-doc@edge
	</pre>		</pre>

			Restart chronyd to use the newly upgraded version:

			{{Cmd\|/etc/init.d/chronyd restart}}

	= Installation =		= Installation =

Zoot: /* MS-SNTP signing support */ - clarify how to install the latest chrony version from the edge package repository

2017-11-21T11:49:17Z

MS-SNTP signing support: - clarify how to install the latest chrony version from the edge package repository

@@ Line 18: / Line 18: @@
 * The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]
 * Windows
 = Installation =

Zoot: Added link to chrony version 3.2 package for Alpine edge

2017-10-25T13:34:28Z

Added link to chrony version 3.2 package for Alpine edge

← Older revision		Revision as of 13:34, 25 October 2017
Line 15:		Line 15:
	NTP implementations which do support MS-SNTP signing:		NTP implementations which do support MS-SNTP signing:

	* chrony (version >= 3.2) [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 ~~Download~~ v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - ~~Review the applicable v3.2~~ commit]		* chrony (version >= 3.2) [https://pkgs.alpinelinux.org/packages?name=chrony&branch=edge&repo=&arch=&maintainer= Alpine package in edge] [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Source download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Source code commit]
	* The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]		* The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]
	* Windows		* Windows

Zoot: Mention the problem which a lack of MS-SNTP support in the NTP server will cause

2017-10-25T13:18:29Z

Mention the problem which a lack of MS-SNTP support in the NTP server will cause

← Older revision		Revision as of 13:18, 25 October 2017
Line 11:		Line 11:
	AD Domain time sync requires MS-SNTP signing support, so be sure to check whether the NTP server you choose to deploy, does support it.		AD Domain time sync requires MS-SNTP signing support, so be sure to check whether the NTP server you choose to deploy, does support it.

	<span style="color:red">Some of the NTP server versions available in the Alpine repositories (chrony, openntpd, busybox) do not currently support it.</span>		<span style="color:red">Some of the NTP server versions available in the Alpine repositories (chrony, openntpd, busybox) do not currently support it. This will cause time sync issues for the domain, so be forewarned.</span>

	NTP implementations which do support MS-SNTP signing:		NTP implementations which do support MS-SNTP signing:

Zoot: Consolidated Notes & Caveats under Notes section and corrected information related to chrony supporting MS-SNTP

2017-10-25T13:13:58Z

Consolidated Notes & Caveats under Notes section and corrected information related to chrony supporting MS-SNTP

← Older revision		Revision as of 13:13, 25 October 2017
Line 1:		Line 1:
	~~NOTES:~~		= Notes =

			==== Active Directory Naming ====

	In all examples below, replace EXAMPLE with your NetBIOS domain name in caps, example.com with your DNS domain name, HOSTNAME with your system's host name in caps, and hostname with your system's host name.		In all examples below, replace EXAMPLE with your NetBIOS domain name in caps, example.com with your DNS domain name, HOSTNAME with your system's host name in caps, and hostname with your system's host name.

	Refer to the [https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ Active Directory naming FAQ] before choosing your domain name.		Refer to the [https://wiki.samba.org/index.php/Active_Directory_Naming_FAQ Active Directory naming FAQ] before choosing your domain name.

			==== MS-SNTP signing support ====

			AD Domain time sync requires MS-SNTP signing support, so be sure to check whether the NTP server you choose to deploy, does support it.

			<span style="color:red">Some of the NTP server versions available in the Alpine repositories (chrony, openntpd, busybox) do not currently support it.</span>

			NTP implementations which do support MS-SNTP signing:

	~~CAVEATS~~:		* chrony (version >= 3.2) [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Review the applicable v3.2 commit]
	~~If you run your domain's PDC Emulator on Alpine, Windows members on your domain will have time sync issues~~. ~~AD Domain time sync requires MS~~-~~SNTP signing support, and none of the NTP daemons available on Alpine (chrony, openntpd, busybox) currently support it, only~~ the ntp.org "ntpd" ~~and~~ Windows ~~do.~~		* The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]
			* Windows

	= Installation =		= Installation =

← Older revision		Revision as of 06:10, 6 December 2025
Line 154:		Line 154:

	== See also ==		== See also ==
			* [[Setting up a Samba server]]
	* [[https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Official Samba Wikipage]]		* [[Samba Roaming Profiles]]
			* [https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Official Samba Wikipage]
			* [[Main Page\|Helpful links to Samba]]

	[[Category:Printers]]		[[Category:Printers]]
	[[Category:Authentication]]		[[Category:Authentication]]