http://samba.bigbird.es/ 2026-08-23T23:08:03+00:00 http://samba.bigbird.es/ http://samba.bigbird.es/lib/exe/fetch.php?media=wiki:dokuwiki.svg text/html 2025-06-08T11:04:15+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:ad-replication&rev=1749380655&do=diff Checking AD replication Every DC needs to replicate its databases with other DCs. After joining an AD, reboot the other DCs too to re-establish replication. After 20 minutes or so, you can check replication with this tool. The only thing you should *really* care about is whether changes are being replicated in a timely fashion, and to quickly check that, see if: text/html 2025-07-07T13:35:01+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:aditional-dc&rev=1751895301&do=diff Installing an additional Domain Controller If you are reading this, you already have a functioning Active Directory (AD) - Domain Controller (DC) infrastructure in your network with a minimum of one DC. For security reasons, it is now recommended to install an additional DC in your AD. text/html 2023-09-28T11:24:54+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:allow-rdc&rev=1695900294&do=diff Allow Remote Desktop connection to a group of users This is what works for me: This may or may not work for you but this is what I have in the “Allow RDC GPO”: * Using ADUC, create a Remote Desktop users group (I named it RDU) (remember to assign a guiNumber of using 'ad' idmap backend) text/html 2024-04-09T09:56:14+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:allow-remote-desktop&rev=1712656574&do=diff Allow an AD group to Remote Desktop via GPO. Let's assume you have created a AD group with users you want to allow to RDC into workstations. Let's assume the group is called “AllowRDU”. This procedure will not revome existing users from the local 'Administrators' group, it will just add to the group. text/html 2025-05-28T15:50:58+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:automatic-drivers&rev=1748447458&do=diff Automatic Printer Driver Downloads for Windows Clients This article is heavily based on the official Samba Wiki. ---------- Create the print driver share on the print server * Add the following to `smb.conf`: [print$] path = /var/lib/samba/printer_drivers/ read only = no text/html 2025-05-28T13:49:45+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:configuring-shares&rev=1748440185&do=diff Configure Shares on a a Member Server from Windows Warning: Do not use a Domain Controller as a file server. Do not set / modify permissions on “SysVol” share of a Domain Controller using this article. See this for more info on SysVol share. Shares and folders text/html 2025-05-28T15:04:45+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:create-new-users&rev=1748444685&do=diff Creating and Configuring New Users for use with ad idmap Work in progress — Use at your own risk You can create a new user using `samba-tool` with extended options, including NIS and RFC2307 attributes. Syntax is correct but options are not explained. Example: text/html 2024-04-25T16:48:06+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:create-user&rev=1714063686&do=diff Creating Samba users & groups from the command line You can create your users & groups using ADUC from Windows, or else you can create the from the command line. If you are using the 'ad' idmap backend, I suggest you use the command line. Any field can be edited from ADUC later if needs be. text/html 2025-06-08T11:06:26+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:dc-maintenance&rev=1749380786&do=diff Samba DC maintenance I try to keep Samba servers up to date at least on a weekly basis. This is my routine: Backup your domain (online, from DC1 for example) You can locally back up your domain and save this file for disaster recovery purposes, but: text/html 2025-02-28T09:29:15+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:debian-trixie-notes&rev=1740734955&do=diff WORK IN PROGRESS RANDOM NOTES If using CT: backup CT / restore CT priviledge Cloned CT: /bin/rm -f -v /etc/ssh/ssh_host_*_key* && /usr/bin/ssh-keygen -A -vtouch /etc/.pve-ignore.resolv.conf edit /etc/resolv.conf touch /etc/.pve-ignore.hosts AD DC apt-get update && apt-get install --no-install-recommends samba-ad-dc samba-ad-provision krb5-user python3-cryptography text/html 2025-06-29T18:24:01+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:demote-dc&rev=1751221441&do=diff Demote a Domain Controller There may be circumstances where you need to demote a DC. For example, one reason is upgrading to a new version of Samba, another being that a DC is dead (and will never come back up). Please note: * Before demoting a DC, check if it owns any or all seven text/html 2025-09-15T17:01:42+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:file-server&rev=1757955702&do=diff Setting up a Member Server (file server for our purposes) This article will show you how to set up an Active Directory Member server, typically used as a file server. For simplicity, we will call this machine “FS1”. You have prepared your server in advance, and have text/html 2026-06-01T14:50:19+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:freeradius-ad&rev=1780325419&do=diff Setting up Freeradius and Samba AD for WPA2 WiFi Auth Warning: This configuration works on a Debian 12 setup, has not been tested on Debian 13. There are several steps to make this work. This is not a pure Samba article, but I think it's good to have it here in my notebook for my reference. Radius is quite a complex system; it took me a while to make things work. Most of this has been possible with the text/html 2025-07-23T17:49:03+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:fsmo-roles&rev=1753292943&do=diff Check, Reassign and Seize FSMO Roles All domain controllers (DCs) in an Active Directory infrastructure are identical except for one key difference. There are seven Active Directory Domain Controller Roles distributed among the DCs. Typically, one DC will have all seven roles, but this is not a requirement. Any DC can have any role. These roles are transferable and can be seized if needed — for example, from a dead server. text/html 2025-06-08T11:13:13+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:hardening-samba&rev=1749381193&do=diff Hardening a Samba server Disable NetBIOS Add the following line to the `[global]` section of `smb.conf`: # Disable NetBIOS disable netbios = yes Allow minimum SMB3 protocol Add the following line to the `[global]` section of `smb.conf`. If you experience problems with older clients not being able to connect, comment out this line. text/html 2023-11-06T16:38:08+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:home-folders&rev=1699288688&do=diff Home folders notes Work in progress ---------- Caponato's Samba notebook. Start here or else Main menu text/html 2025-05-28T13:44:25+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:idmap-backends&rev=1748439865&do=diff Samba Member Server idmap backend Important:These id-mappings are for **member servers** only (not DCs) Do not use any of these idmap backends on a Domain Controller. Domain Controllers use their own `idmap.ldb` for ID mapping, which is only valid and used on a DC. text/html 2025-11-17T17:23:07+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:install-as-member&rev=1763400187&do=diff Install Samba Binaries for a Member Server (File Server) (Updated for Trixie) This will install Samba from your current repository. Debian does not upgrade Samba to a major release until a new Debian version is released. Therefore, it is advisable to install from Debian backports or use Michael Tokarev's Samba repositories (Michael is the official Debian Samba packager and maintainer for Debian). text/html 2025-11-07T17:13:01+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:install-chrony&rev=1762535581&do=diff Install and Configure NTP Server Chrony to Work with a Samba Domain Controller Time is critical for AD infrastructure. DCs provide time (via NTP protocol) to all machines in the network. DCs must be configured as NTP servers. Other machines, such as file servers, will sync to them via systemd-timesyncd. text/html 2026-01-23T10:23:09+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:install-samba-as-dc&rev=1769163789&do=diff Install Samba Binaries for a Domain Controller This will install Samba from your current repository. Debian does not upgrade Samba to a major release until a new Debian version is released. Therefore, it is advisable to install from Debian Backports or use Michael Tokarev's Samba repositories (Michael is the official Samba packager and maintainer for Debian). text/html 2026-05-29T09:19:05+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:installing-from-backports&rev=1780046345&do=diff Install Samba Binaries from Backports Updated for Trixie Debian does not upgrade to major Samba versions within a stable release. For example, Debian 13 includes and will remain on version 4.22.x. However, the Backports repository provides newer versions — as of Nov 2025, version text/html 2025-05-28T13:01:29+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:installing-from-mt-repos&rev=1748437289&do=diff Using Michael Tokarev's Repo Michael is the designated Samba packager and maintainer for Debian (and Ubuntu). His responsibilities include configuring Samba to operate on Debian and creating updated versions of Samba in advance of the official Debian release process. This allows you to access binaries weeks before they become generally available. text/html 2024-08-08T19:16:05+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:linux-acls&rev=1723144565&do=diff Please read this article in full to understand how this settings are insufficient to properly manage a Linux Samba server. Consider using the acl_xattr module because Linux ACLs alone cannot fully manage the complexity of Windows ACLs. Access Control Lists (ACLs) in Linux provide a more fine-grained permission mechanism compared to the traditional Unix file permissions. ACLs allow you to set different permissions for different users or groups for a single file or directory. text/html 2024-10-19T16:49:04+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:linux-dns-admin&rev=1729356544&do=diff Work In Progress List Existing Zones in the main tree samba-tool dns zonelist dc1.mad.caponato.es -U Administrator 2 zone(s) found pszZoneName : mad.caponato.es Flags : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE ZoneType : DNS_ZONE_TYPE_PRIMARY Version : 50 dwDpFlags : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED pszDpFqdn : DomainDnsZones.mad.caponato.es ps… text/html 2023-09-27T11:55:19+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:list-all-computers&rev=1695815719&do=diff List all computers in a Samba AD * From a terminal in any DC using ldbsearch: apt-get install ldb-tools #If not installed ldbsearch -H /var/lib/samba/private/sam.ldb '(objectclass=computer)' dn ldbsearch -H /var/lib/samba/private/sam.ldb '(objectclass=computer)' dn | grep dn | cut -d"=" -f2 | cut -d, -f1 | sort -V text/html 2024-04-09T08:43:35+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:local-admins&rev=1712652215&do=diff Make an AD group local Workstation Administrators via GPO. See this article from the Samba Wiki. In order to facilitate some users manage their own computer, we can add a list of users or groups to the local 'Administrators' group. This procedure will not revome existing users from the local 'Administrators' group, it will just add to the group. text/html 2025-06-08T11:20:43+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:main-menu&rev=1749381643&do=diff Caponato's Samba notebook The how-to-get-samba-ad-working-in-20-minutes guide Main Articles * Preparing your server for Samba. * Choose your sources for Samba: Using Debian Backports. * Choose your sources for Samba: Using Tokarev's repo. * Install binaries for a Samba Domain Controller. * Install binaries for a Member Server. * Setting up (provisioning) your first text/html 2024-06-18T07:06:41+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:more-idmapping-notes&rev=1718694401&do=diff Work In Progress Linux - Samba ID mapping notes Abbreviations and Definitions used * AD: Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It provides the following: * Centralized Management: Manages users, computers, and other resources. text/html 2025-06-30T11:33:30+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:no-need-for-use-rfc2307&rev=1751283210&do=diff Why you should not use --use-rfc2307 when provisioning This article clarifies the technical and practical implications using the '--use-rfc2307' option when provisioning, and the specific consequences of enabling 'idmap_ldb:use rfc2307 = yes' in a Samba DC (from a discussion in the Samba mailing list in June 2024) text/html 2025-12-11T10:00:02+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:prepare-your-server&rev=1765447202&do=diff Prepare your Debian server for Samba You have installed a fresh Debian 13 Trixie system without a graphical interface. To access the system, only SSH is required. I prefer running Samba servers in a KVM environment. Further instructions on how to prepare a KVM domain (virtual machine) text/html 2025-05-28T15:06:32+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:print-server&rev=1748444792&do=diff Setting up a Print Server A Samba print server is simply a member server that shares printers in addition to files. Any member server can serve as a print server. Because I use small KVM domains (i.e., virtual machines) and aim for redundancy, I prefer to dedicate a separate machine for printing. text/html 2025-07-07T13:30:57+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:provision-dc&rev=1751895057&do=diff Provision your Active Directory on a new DC These instructions provide a basic guide for provisioning your Active Directory using Samba. For more detailed explanations, please consult the official Samba wiki pages. This guide will provision Samba as an AD-DC with internal text/html 2025-02-24T15:18:57+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:recommendations&rev=1740410337&do=diff Samba AD DC Security and Resiliency Ideas and Recommendations 1. Optimize Virtual Machine Placement Deploy your Samba AD DCs on containers or virtual machines (VMs) using Proxmox. Ensure each VM runs on a separate physical server within its location to avoid a single hardware failure affecting both DCs. Allocate sufficient resources (these figures look small but this can take on 1000+ users and computers): text/html 2024-06-09T09:26:47+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:remove-sama&rev=1717925207&do=diff Completely remove samba from your system This is how I do it. apt-get autoremove --purge krb5-user krb5-config libwbclient0 libldb2 python3-ldb python3-samba samba-common samba-common-bin samba-ad-dc samba-dsdb-modules samba-libs ldb-tools libldb2 libnss-winbind libpam-winbind libsmbclient smbclient winbind apt autoremove -y && apt-get autoclean && apt-get clean && apt-get remove --purge $(dpkg -l | grep “^rc” | grep "samba" | awk ‘{print $2}’) rm -Rf /etc/samba rm -Rfv /var/lib/samba reb… text/html 2026-04-13T13:14:03+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:resilient-dns&rev=1776086043&do=diff Resilient DNS Forwarding Setup for Samba AD This setting is recommended if you use more than one DNS forwarder for resilience. This setup uses dnsdist as an intelligent DNS proxy in front of your normal forwarders, with Samba DCs configured to forward external text/html 2025-01-15T17:09:44+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:server-privileges&rev=1736960984&do=diff Grant users rights to manage services in Member Servers Please note: Members of "Domain Admins" already have these privileges granted by default (as a member of BUILTIN\Administrators). “Privileged” accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform actions in Active Directory and on domain-joined servers. text/html 2025-06-08T11:00:52+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:setmachineaccount&rev=1749380452&do=diff Delegating permissions to manage (add/remove) computers in specific organizational units (OUs) in Active Directory In environments where you want specific users or groups to manage computer objects (including adding or removing computers) within certain Organizational Units (OUs) without giving them full domain-wide administrative rights, you can delegate control using the Active Directory Users and Computers (ADUC) tool. This delegation allows you to assign granular permissions, such as the ab… text/html 2024-10-12T08:19:37+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:smb.conf&rev=1728721177&do=diff # Global parameters [global] security = ADS workgroup = MAD realm = MAD.CAPONATO.ES server role = member server log file = /var/log/samba/%m.log bind interfaces only = yes # Please substitute your own physical eth adapter here: interfaces = lo ens3 # winbind config: winbind use default domain = yes # The following options are only useful for testing. Comment out in production. # winbind enum users = yes # winbind enum groups = yes # Kerberos winbind refresh tickets = Yes dedicated keyta… text/html 2025-02-24T09:47:41+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:ssh-passwordless&rev=1740390461&do=diff Passwordless SSH using Private/Public Keys This guide explains how to set up private/public key authentication for passwordless SSH, (specifically tailored for Debian systems.) Step 1: Generate Key Pair On your local machine, generate an RSA key pair: text/html 2026-02-27T16:02:59+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:start&rev=1772208179&do=diff Welcome to my Samba Notebook. This is my notebook where I aim to create a simplified approach to deploy a Samba AD infrastructure, specifically for Debian. I hope this will be useful for you. Most samba info is here on the Official Samba Wiki, and much of it has been used for this wiki, text/html 2025-06-08T10:50:23+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:sync-idmap.ldb&rev=1749379823&do=diff Synchronize idmap.ldb Between Domain Controllers Notes from Rowland Penny (Samba Team): “You need to sync idmap.ldb from the DC holding the PDC_Emulator FSMO role to all other DCs. This ensures that all DCs will use the same IDs. If you do not sync idmap.ldb, you can and will get different IDs on each DC. […] The reason why idmap.ldb must be synced between DCs is simple. On DCs the users and groups (which are all stored in AD) are mapped to 'xidNumber' attributes in idmap.ldb, this is done so … text/html 2025-06-17T10:06:03+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:sync-sysvol&rev=1750154763&do=diff Sync Domain Controller's SysVol Folder (SysVol Replication) The SysVol share on domain controllers holds GPOs and other scripts for clients. When you create or edit GPOs in AD, the GPO RSAT tool connects by default to the DC that holds the PDC Emulator role. You will need to manually synchronise SysVol folders to the other DCs after creating or editing GPOs, because there is no provision in Samba for synchronising SysVol folders between DCs. text/html 2024-07-16T17:00:11+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:update-dns&rev=1721149211&do=diff Force clients to update the DNS in a timely manner I have run in the past with some issues where clients were unable to update their IP in the DNS servers. This solved my problems: Create a new GPO and assign to the domain. Browse to Computer Configuration / Policies / Administrative Templates / Network / text/html 2025-03-01T09:50:06+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:upgrade-file-server&rev=1740822606&do=diff Seamlessly upgrading a Samba Member Server Upgrade a Samba member server on Debian, ensuring minimal downtime and user disruption. ---------- 1. Prepare the new server System Setup: * Install and prepare your system for Samba. * Hostname Configuration: Ensure the new server has the text/html 2025-06-08T13:25:52+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:upgrade-fl-2016&rev=1749389152&do=diff Upgrading Samba AD schema and functional level This is the procedure to upgrade the Active Directory schema and functional level of a Samba AD domain. You will typically do this after upgrading Samba to a new major version that supports a higher functional level. text/html 2025-10-06T15:45:26+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:upgrade-sama&rev=1759765526&do=diff Upgrading a Samba DC the right way Whilst it is possible to upgrade Samba by using the usual `apt` tools, the Samba Team recommends that a DC should first be demoted, followed by an upgrade to the desired version, and then rejoining the domain. This is especially important if you are upgrading to a major version, for example, 4.22 to 4.23. text/html 2024-08-05T10:28:54+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:using-extended-attr&rev=1722853734&do=diff Extended attributes (EAs) in Linux provide a way to associate metadata with files beyond the standard set of attributes like owner, group, permissions, etc. This metadata can be used by various applications for a range of purposes such as security, access control, or even storing arbitrary data. text/html 2023-09-27T16:04:00+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:whoami&rev=1695830640&do=diff I am Caponato ---------- Caponato's Samba notebook. Start here or else Main menu text/html 2024-06-09T19:17:49+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:windows-rsat&rev=1717960669&do=diff Installing Windows RSAT tools Remote Server Administration Tools (RSAT) enables IT administrators to remotely manage roles and features in Windows (and Samba) Servers from a computer that is running Windows. For a Windows 10 PC, open a CMD window with administrator privileges and type: text/html 2024-10-28T09:49:28+00:00 Anonymous (anonymous@undisclosed.example.com) http://samba.bigbird.es/doku.php?id=samba:workstation-admins&rev=1730108968&do=diff Allow 'Workstation-Admins' to Join and Remove computers from the Domain Setting the ms-DS-MachineAccountQuota to 0 removes the default ability for authenticated users (i.e., any domain user) to add computers to the domain, which is essential for minimizing security risks. By default, this attribute allows any authenticated user to add up to 10 computers, which can potentially expose the domain to attacks involving unauthorized device additions