Skip to main content

Installation on Debian 13

This expects a freshly installed Debian 13 VM. Not a LXC Container

Preparation

What you need

  • Decide a Hostname, Domain and IP

It will be srv-dc01 as Hostname, samba-test.lan as Domain and 10.0.0.5 as IP

Updates & Upgrades

apt update -y
apt upgrade -y
apt full-upgrade -y

Core Dependencies

apt install -y chrony vim ethtool

Configure Hostname

hostnamectl set-hostname srv-dc01

Configure /etc/hosts

127.0.0.1       localhost
10.0.0.5        srv-dc01.samba-test.lan srv-dc01

Configure Network

Modify /etc/network/interfaces

Interface ens18 might be named differently for you

auto ens18
iface ens18 inet static
  address 10.0.0.5/20
  gateway 10.0.0.254

Configure Timesync

systemctl enable --now chrony
chronyc tracking

Validate that Time-Sync offset is within max. 5 Seconds

Disable systemd-resolved

systemctl disable --now systemd-resolved
rm -f /etc/resolv.conf

Create /etc/resolv.conf

For Provisioning, set namserver to your Router or Firewall so apt works. After that, change to 127.0.0.1

nameserver 10.0.0.254
search samba-test.lan

Ensure no DNS Server is running anymore

ss -tlnp | grep :53

This should not return anything.

Install Samba4

Install Packages

apt install -y acl attr samba winbind libpam-winbind libnss-winbind krb5-config krb5-user dnsutils python3-setproctitle samba-ad-dc
  • Kerberos Servers is your DC Hostname (Example: srv-dc01.samba-test.lan)

Mask Servies

systemctl disable --now smbd nmbd winbind
systemctl mask smbd nmbd winbind

Domain Provisioning

Remove existing Configuration File

rm -f /etc/samba/smb.conf

Provisiong Samba Domain

samba-tool domain provision --use-rfc2307 --realm=SAMBA-TEST.LAN \
  --domain=SAMBA-TEST --server-role=dc --dns-backend=SAMBA_INTERNAL

Deploy Kerberos Config

cp /var/lib/samba/private/krb5.conf /etc/krb5.conf

Fix Nameservers in /etc/resolv.conf

nameserver 10.0.0.5
search samba-test.lan

Setup DNS Forwarding for Samba-DNS in /etc/samba/smb.conf

[global]
dns forwarder = 1.1.1.1

Start samba4

Start Services

systemctl unmask samba-ad-dc
systemctl enable --now samba-ad-dc
systemctl status samba-ad-dc

Set Domain Admin Password

samba-tool user setpassword Administrator

Create Reverse DNS Zone

Verifications

General Verifications

ss -tlnp | grep -E ':(53|88|389|445|464|636)\b'
smbclient -L localhost -N
host -t SRV _ldap._tcp.samba-test.lan localhost
host -t SRV _kerberos._udp.samba-test.lan localhost
host -t A srv-dc01.samba-test.lan localhost
kinit administrator@SAMBA-TEST.LAN && klist
samba-tool dbcheck --cross-ncs
getent passwd administrator

Verify Password Policy

samba-tool domain passwordsettings show

Verify Domain Level

samba-tool domain level show

Default Domain level is (Windows) 2008 R2. If you have an existing Zone you can already provisiong with a newer Level

Back to top