≡ Menu

How to Setup Samba as Primary Domain Controller in Linux

Samba is used by sysadmin to overcome the problem of interoperability in a mixed environment where you have both Linux and Windows. It provides a common platform for both Windows and Linux to have a common sharing space.

Domain controller is a service which is used for centralized administration of users, groups or any objects in the network. This service enables us to manage, authenticate, and secure the users login and related data.

This tutorial explains how we can configure Samba on Linux as a primary domain controller.

1. Setup Proper Host Name

Make sure you’ve setup the appropriate hostname and static ip. If you are using internal ip-address, and if you like to access it from the internet, setup appropriate NAT rules on your firewall.

In this tutorial will use tgs.example.com as the hostname.

# vi /etc/sysconfig/network 

Make sure it has appropriate static ip-address setup in the ifcfg-eth0 file.

# vi /etc/sysconfig/network-script/ifcfg-eth0

Also, assign the gateway and dns accordingly in your /etc/sysconfig/network and /etc/resolv.conf file.

Verify that your /etc/hosts file has an entry similar to the following.

# vi /etc/hosts	tgs.example.com	tgs

Also, make sure NTP service is setup and running properly on this server.

2. Install Samba from Source

On CentOS, by default samba packages will not be installed for minimal installation type.

First, install the following dependent packages.

# yum install glibc glibc-devel gcc python* libacl-devel krb5-workstation krb5-libs pam_krb5 git-core openldap-devel 

Next, download the samba source as shown below.

# git clone git://git.samba.org/samba.git sambaserver

The files will be downloaded to sambaserver directory. Install the samba server as shown below.

cd sambaserver

./configure  --enable-debug --enable-selftest


make install

Samba will be installed in the default location /usr/local/samba/bin. You’ll see several samba client utilities installed under this directory.

# cd /usr/local/samba/bin/ 

# ls 
cifsdd       ldbsearch   ntdbrestore    regshell    smbcquotas  tdbbackup 
dbwrap_tool  locktest    ntdbtool       regtree     smbget      tdbdump 
eventlogadm  masktest    ntlm_auth      rpcclient   smbpasswd   tdbrestore 
gentest      ndrdump     oLschema2ldif  samba-tool  smbspool    tdbtool 
ldbadd       net         pdbedit        sharesec    smbstatus   testparm 
ldbdel       nmblookup   pidl           smbcacls    smbtar      wbinfo 
ldbedit      nmblookup4  profiles       smbclient   smbta-util 
ldbmodify    ntdbbackup  regdiff        smbclient4  smbtorture 
ldbrename    ntdbdump    regpatch       smbcontrol  smbtree 

3. Setup Domain Provision

To start the domain provision, execute the samba-tool as shown below. This will pickup the default hostname and domain name from the configuration files.

# /usr/local/samba/bin/samba-tool domain provision 
 Domain [EXAMPLE]: 
 Server Role (dc, member, standalone) [dc]: 
 DNS forwarder IP address (write 'none' to disable forwarding) []: 
Administrator password: 
Retype password: 
Adding DNS accounts 
Creating CN=MicrosoftDNS,CN=System,DC=example,DC=com 
Creating DomainDnsZones and ForestDnsZones partitions 
Populating DomainDnsZones and ForestDnsZones partitions 
Setting up sam.ldb rootDSE marking as synchronized 
Fixing provision GUIDs 
A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf 
Once the above files are installed, your Samba4 server will be ready to use 
Server Role:           active directory domain controller 
Hostname:              tgs 
NetBIOS Domain:        EXAMPLE 
DNS Domain:            example.com 
DOMAIN SID:            S-1-5-21-2869186506-3515775153-2841826798 

4. Start Samba Service

Start the samba service, as shown below.


Add the following entry to rc.local file to make sure samba service starts automatically during system startup.

# echo /usr/local/samba/sbin/samba >> /etc/rc.d/rc.local 

# cat /etc/rc.d/rc.local 
touch /var/lock/subsys/local 

5. Check Samba Version

YOu can verify the samba version using samba or smbclient command as shown below.

# /usr/local/samba/sbin/samba -V 
Version 4.2.0pre1-GIT-913b2a1 

# /usr/local/samba/bin/smbclient -V 
Version 4.2.0pre1-GIT-913b2a1 

The following command will display all Samba shares that are currently available.

# /usr/local/samba/bin/smbclient -L localhost -U% 
Domain=[EXAMPLE] OS=[Windows 6.1] Server=[Samba 4.2.0pre1-GIT-913b2a1] 

	Sharename       Type      Comment 
	---------       ----      ------- 
	netlogon        Disk      
	sysvol          Disk      
	IPC$            IPC       IPC Service (Samba 4.2.0pre1-GIT-913b2a1) 
Domain=[EXAMPLE] OS=[Windows 6.1] Server=[Samba 4.2.0pre1-GIT-913b2a1] 

	Server               Comment 
	---------            ------- 

	Workgroup            Master 
	---------            ------- 

Verify that you are able to login using the administrator username and password.

# /usr/local/samba/bin/smbclient //localhost/netlogon -Uadministrator -c 'ls' 
Enter administrator's password: 
Domain=[EXAMPLE] OS=[Windows 6.1] Server=[Samba 4.2.0pre1-GIT-913b2a1] 
  .   D        0  Fri Feb 21 15:06:15 2014 
  ..  D        0  Fri Feb 21 15:06:28 2014 
57901 blocks of size 8388608. 54372 blocks available 

6. Verify Domains

Now let us check if the domain is functioning as expected. Check the SRV and A record as shown below.

# host -t SRV _ldap._tcp.example.com 
_ldap._tcp.example.com has SRV record 0 100 389 tgs.example.com. 

# host -t SRV _kerberos._udp.example.com 
_kerberos._udp.example.com has SRV record 0 100 88 tgs.example.com. 

# host -t A tgs.example.com 
tgs.example.com has address

Use the samba-tool command to verify the realm name as shown below.

# /usr/local/samba/bin/samba-tool testparm --suppress-prompt | grep realm 
	realm = EXAMPLE.COM 

7. Configure Kerberos

Copy the sample krb5.conf file to the /etc directory.

cp /usr/local/samba/share/setup/krb5.conf /etc/krb5.conf 

Set the default_realm to your domain name. In this case, we’ll set it to example.com

# cat /etc/krb5.conf 
	default_realm = EXAMPLE.COM 
	dns_lookup_realm = false 
	dns_lookup_kdc = true 

Use kinit command to make sure the Kerberos is setup properly as shown below.

# kinit administrator@EXAMPLE.COM 
Password for administrator@EXAMPLE.COM: 
Warning: Your password will expire in 41 days on Fri Apr  4 15:06:25 2014 

Finally, you can use Windows remote administrator tool to connect to the Samba server and use it as a domain controller.

If you face any issues during the above process, make sure you bring the system up-to-date by updating all packages. You can also disable SELinux temporarily, and review the audit.log for any SELinux related error messages. Also, make sure your IPTables rules are not blocking the ports that are required by Samba to communicate between the servers.

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 14 comments… add one }

  • Jonathan March 4, 2014, 6:34 am

    You also can use this repos.

    I did it and it has the last version Samba 4.1, the best replacement for windows active directory 😉

  • Bob March 4, 2014, 8:24 am

    Thanks. Good article. One question. What is the reason for step 7 and what is kerberos. A one line explanation in that section would be helpful

  • cybernard March 4, 2014, 9:07 am

    yum install python* ?? why?
    That is 2000+ packages surely they aren’t all necessary.

  • Jalal Hajigholamali March 4, 2014, 11:02 pm


    Thanks a lot….

  • Mc.Sim March 5, 2014, 10:33 pm

    I think more correct the article name will be “How to Setup Samba as Acive Directory Domain Controller in Linux”.
    Primary Domain Controller it is Windows NT Domain. less level.

  • deandownouth June 2, 2014, 10:53 am

    Why install from source? Is there a specific parameter or feature that is not in the RHEL/CentOS repository?

    I ask because one of the reasons for using a RHEL binary compatible distro like CentOS is the tight integration of versions of various packages.

    Of course there’s nothing wrong with using the latest source but it does add complexity.

    Just curious…

  • Farhad Jamali November 15, 2014, 10:24 am

    Very nice tutorial with 100% success. thank you very.

    i want to ask how do I configure a member dc server with pdc. both are on different subnet, connected via routers. and also wanna know how will be DNS configured for my scenario.

    awaited for your reply
    farhad jamali

  • ladyynek December 9, 2014, 4:38 pm

    Working ok until step
    # host -t SRV _ldap._tcp.example.com
    with answer
    Host _ldap._tcp.example.com not found: 3(NXDOMAIN)

    and samba not starting automatically after reboot
    /usr/local/samba/sbin/samba -V
    Version 4.3.0pre1-GIT-8c56989
    /usr/local/samba/bin/smbclient -V
    Version 4.3.0pre1-GIT-8c56989

  • drivekiller April 18, 2015, 5:12 pm

    | Working ok until step
    | # host -t SRV _ldap._tcp.example.com
    | with answer
    | Host _ldap._tcp.example.com not found: 3(NXDOMAIN)

    Assuming you replaced “example.com” with your domain—
    In my case, this was solved by making sure that the
    /etc/sysconfig/network-scripts/ifcfg-eth0 file has the following 2 lines:

  • drivekiller April 18, 2015, 5:35 pm

    | Why install from source? Is there a specific parameter or feature
    | that is not in the RHEL/CentOS repository?

    Apparently samba active directory domain controller uses/requires a different implementation of kerberos (heimdahl) than distributed RPM packages on RHEL and CentOS use (MIT). Not sure that is still the case.

  • Alireza Khalili April 28, 2015, 8:15 am

    very good article
    I havd some problem
    when i execute this command : # id user@domain
    I get this answer : id:user@domain : No such user
    I need to login on my linux (DC) machine with ldap users
    what can i do ??

  • Anonymous September 16, 2015, 11:11 am

    I am not able to create users using Remote Server Administration Tool in Windows 10. But I am able to create Oraganization Units in Active Directory Users and computers.

  • Sahil November 17, 2015, 11:03 pm

    Hi Sir,
    How can i add a CENTOS6 machine to this SAMBA4 Domain controller ? Please help

  • govind lepide May 18, 2016, 6:40 am

    Very nice tutorial with 100% success.
    but i want to know, can i login on linux(centos 7) domain controller by domain user (administrator) .

    if possible how we can do this ?

Leave a Comment