The Role of smb.conf in Linux Samba Domain Controllers

This article explores the critical function of the smb.conf file when deploying and managing a Samba Active Directory Domain Controller (AD DC) on a Linux operating system. It details how this single configuration file dictates the server’s domain identity, governs authentication mechanisms, manages essential network shares like Sysvol, and directs Samba’s internal network and DNS services.

The Central Control Hub for Samba

The smb.conf file is the master configuration file for the Samba suite. When Linux operates as an Active Directory Domain Controller, smb.conf defines how the Samba daemon initializes its services, communicates with Windows and Linux clients, and enforces domain-wide policies. Without this file, Samba cannot determine its operational mode or network responsibilities.

Defining Server Role and Identity

The primary purpose of smb.conf during domain controller setup is establishing the machine's role within the network. Under the [global] section, critical directives define the domain infrastructure:

• server role = active directory domain controller: Instructs Samba to start the integrated AD DC services, including the embedded Kerberos Key Distribution Center (KDC), LDAP server, and authentication endpoints, rather than running as a standard standalone file server.
• realm: Specifies the fully qualified domain name (FQDN) in uppercase (e.g., EXAMPLE.COM), which is essential for Kerberos authentication.
• workgroup: Defines the NetBIOS name of the domain (e.g., EXAMPLE), enabling backward compatibility with legacy Windows network browsing and resolution.

Managing Integrated DNS and Networking

An Active Directory environment relies heavily on DNS for service discovery. The smb.conf file specifies how the domain controller handles DNS requests:

• DNS Backend: Directs Samba to use either its internal DNS server (SAMBA_INTERNAL) or bind with an external DNS server like BIND9 (BIND9_DLZ).
• Forwarder Configuration: Directs queries outside the local domain to external upstream DNS resolvers using the dns forwarder parameter.
• Network Interfaces: Restricts the domain controller services to specific network adapters or IP subnets via parameters like interfaces and bind interfaces only.

Configuring Critical Domain Shares

Active Directory requires standard network shares to distribute policies and scripts to domain members. The smb.conf file defines these vital shares:

• [sysvol]: Points to the filesystem location housing Group Policy Objects (GPOs) and domain-wide administrative templates. It ensures that Windows and Linux domain members can replicate and apply centralized security policies.
• [netlogon]: Houses logon scripts and batch files executed when clients log into the domain.

Both shares require precise POSIX and Windows Access Control List (ACL) configurations, which are declared and mapped through directives inside smb.conf.

Provisioning and Administration

When creating a new domain using the samba-tool domain provision command, Samba automatically generates a baseline smb.conf tailored to the specified parameters. Administrators modify this file post-provisioning to fine-tune Kerberos settings, enforce SMB signing and encryption protocols, and optimize performance parameters for LDAP and database access. Any syntax changes can be validated using the testparm utility to prevent service interruptions before restarting the Samba service.