Samba Active Directory Domain Controller on Debian

Samba enables a Debian system to function as a native Microsoft Active Directory Domain Controller (AD DC) by implementing the core enterprise protocols required by Windows environments, including LDAP, Kerberos, and DNS. Through modern versions of Samba, Debian administrators can manage users, enforce Group Policy Objects (GPOs), join domain workstations, and replicate directory data with other domain controllers without requiring a Windows Server license. This article explains the architectural components, integration mechanisms, and operational workflows Samba utilizes to achieve full AD DC functionality on Debian.

Core Architectural Components

To serve as a drop-in replacement for a Windows AD DC, Samba integrates several foundational network services into a unified daemon (samba):

  • Directory Service (LDB): Samba replaces traditional directory engines with LDB, an embedded LDAP-like database. It stores the directory schema, user objects, group memberships, and configuration partitions required by Active Directory specifications.
  • Kerberos Key Distribution Center (KDC): Samba incorporates a native Heimdal or MIT Kerberos KDC directly into its process structure, providing ticket-granting services for single sign-on (SSO) and mutual authentication across the domain.
  • Domain Name System (DNS): Active Directory relies heavily on DNS SRV records for service location. Samba provides an internal DNS server for turnkey deployments, or it can integrate with BIND 9 using the Dynamically Loadable Zones (DLZ) plugin for complex environments.
  • SMB/CIFS File Sharing: Samba natively handles the core Server Message Block protocol (SMBv2/v3), serving the standard SYSVOL and NETLOGON shares critical for distributing Group Policy templates and login scripts.
  • MSRPC (Microsoft Remote Procedure Call): Samba implements the Windows RPC services required for domain joins, password changes, and inter-controller replication.

Debian Package Integration and Execution

On Debian, standard Samba installations traditionally run as two distinct background services: smbd (file sharing) and nmbd (NetBIOS name service). When functioning as an AD DC, this execution model fundamentally changes:

  1. Unified Process Execution: In AD DC mode, the standalone smbd and nmbd services are disabled and masked. Instead, the unified samba systemd unit is enabled, executing the monolithic AD DC binary that orchestrates the internal LDAP, Kerberos, and RPC subsystems concurrently.
  2. Winbind Service Integration: The Winbind subsystem maps Windows Security Identifiers (SIDs) directly to Debian POSIX user IDs (UIDs) and group IDs (GIDs). This allows the underlying Debian kernel and filesystem to understand and enforce Windows Access Control Lists (ACLs).
  3. Kernel-Level ACL Support: Debian filesystems hosting the SYSVOL and data partitions (such as ext4 or xfs) must have extended attributes (user_xattr) and POSIX Access Control Lists (acl) enabled, allowing Samba to translate Windows NT ACLs directly to disk.

Provisioning and Operational Workflow

Samba provisions the Active Directory environment using the built-in management utility samba-tool:

  • Domain Provisioning: Executing samba-tool domain provision initializes the directory structure. It generates the domain SID, creates the Kerberos realm, sets up the default schema, establishes the administrative account, and populates the smb.conf file with the server role defined as active directory domain controller.
  • Kerberos Configuration: The provisioning process automatically creates a production-ready krb5.conf file. Symlinking this generated file to /etc/krb5.conf binds Debian's native system utilities to Samba's internal KDC.
  • Replication and FSMO Roles: Samba supports the Directory Replication Service (DRS) Remote Protocol, allowing a Debian-based Samba DC to hold all Flexible Single Master Operation (FSMO) roles and replicate directory partitions bidirectionally with other Samba or Windows Server domain controllers.

Management and Windows Interoperability

Once running on Debian, Samba is indistinguishable from a standard Windows Server to connected endpoints. Systems can be joined to the domain using standard Windows or Linux domain-join procedures.

System administrators manage the Debian-hosted domain either through the command-line interface using samba-tool or via standard Microsoft Remote Server Administration Tools (RSAT). RSAT utilities—such as Active Directory Users and Computers (ADUC), DNS Manager, and the Group Policy Management Console (GPMC)—interact directly with Samba over standard MSRPC and LDAP channels, enabling full administrative parity without modifying client-side workflows.