Difference between revisions of "Setting up a samba-ad-dc"

From Alpine Linux
Jump to: navigation, search
m (Mention the problem which a lack of MS-SNTP support in the NTP server will cause)
m (Added link to chrony version 3.2 package for Alpine edge)
Line 15: Line 15:
NTP implementations which do support MS-SNTP signing:
NTP implementations which do support MS-SNTP signing:
* chrony (version >= 3.2) [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Review the applicable v3.2 commit]
* chrony (version >= 3.2) [https://pkgs.alpinelinux.org/packages?name=chrony&branch=edge&repo=&arch=&maintainer= Alpine package in edge] [https://git.tuxfamily.org/chrony/chrony.git/tag/?h=3.2 Source download v3.2] [https://git.tuxfamily.org/chrony/chrony.git/commit/?h=3.2&id=577aed484207addd054441ee8be7e6e30ce36cb2 - Source code commit]
* The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]
* The ntp.org "ntpd" server [http://ntp.org/downloads.html - Download ntpd]
* Windows
* Windows

Revision as of 13:34, 25 October 2017


Active Directory Naming

In all examples below, replace EXAMPLE with your NetBIOS domain name in caps, example.com with your DNS domain name, HOSTNAME with your system's host name in caps, and hostname with your system's host name.

Refer to the Active Directory naming FAQ before choosing your domain name.

MS-SNTP signing support

AD Domain time sync requires MS-SNTP signing support, so be sure to check whether the NTP server you choose to deploy, does support it.

Some of the NTP server versions available in the Alpine repositories (chrony, openntpd, busybox) do not currently support it. This will cause time sync issues for the domain, so be forewarned.

NTP implementations which do support MS-SNTP signing:


Install packages:

apk add samba-dc krb5

Edit hosts file

You need to modify your /etc/hosts file to look similar to this.       localhost.localdomain localhost       hostname.example.com hostname

Create smb.conf

Alpine doesn't provide an example configuration file in the package so you'll need to create one at /etc/samba/smb.conf.

        server role = domain controller
        workgroup = EXAMPLE
        realm = example.com
        netbios name = HOSTNAME
        passdb backend = samba4
        idmap_ldb:use rfc2307 = yes

        path = /var/lib/samba/sysvol/example.com/scripts
        read only = No

        path = /var/lib/samba/sysvol
        read only = No

Provision your Samba domain

Answer the questions with your domain information:

samba-tool domain provision --use-rfc2307 --interactive

Use the SAMBA_INTERNAL DNS option. When asked for a forwarder IP, choose your internet DNS server. You can use your ISP or other public services (like Google) here.

Configure resolv.conf

Modify your /etc/resolv.conf to include your new domain as a search domain and point to itself as the first nameserver.

search example.com

Configure Kerberos

You need to replace krb5.conf with a link to the one generated by samba.

ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf

Install new init script

As of 3/31/2016 and Alpine 3.3.3, the included samba init script doesn't support starting it as a domain controller. Modify your /etc/init.d/samba script like the one below.



SERVER_ROLE=`samba-tool testparm --parameter-name="server role"  2>/dev/null | tail -1`
if [ "$SERVER_ROLE" = "active directory domain controller" ]; then
elif [ "$DAEMON" != "samba" ]; then

depend() {
        need net
        after firewall

start_samba() {
        mkdir -p /var/run/samba
        start-stop-daemon --start --quiet --exec /usr/sbin/samba --

stop_samba() {
        start-stop-daemon --stop --quiet --pidfile /var/run/samba/samba.pid

start_smbd() {
        start-stop-daemon --start --quiet --exec /usr/sbin/smbd -- \

stop_smbd() {
        start-stop-daemon --stop --quiet --pidfile /var/run/samba/smbd.pid

start_nmbd() {
        start-stop-daemon --start --quiet --exec /usr/sbin/nmbd -- \

stop_nmbd() {
        start-stop-daemon --stop --quiet --pidfile /var/run/samba/nmbd.pid

start_winbindd() {
        start-stop-daemon --start --quiet --exec /usr/sbin/winbindd -- \

stop_winbindd() {
        start-stop-daemon --stop --quiet --pidfile /var/run/samba/winbindd.pid

start() {
        for i in $daemon_list; do
                ebegin "Starting $i"
                eend $?

stop() {
        for i in $daemon_list; do
                ebegin "Stopping $i"
                eend $?

reload() {
        for i in $daemon_list; do
                ebegin "Reloading $i"
                killall -HUP $i
                eend $?

Configure the Samba service

Run this command to start the service on boot.

rc-update add samba

Run this command to start the service right now.

rc-service samba start