SMB Authentication with AD on Linux

After days of configuration and research, I couldn’t find a single source that covered everything needed for this setup end to end. My job requires centralized SSSD across all Linux servers, so here’s what I got working on both RHEL 8 and OpenSUSE 15.6.

The stack: Samba for SMB/CIFS, SSSD for AD integration, Kerberos for authentication, and realmd for domain join.

What you need before starting: DNS resolving your domain controllers, NTP/Chrony running and synced, a domain admin account with join privileges, and the following info on hand — domain name (company.com), DC hostname (dc1.company.com).

Step 1: Package Installation

RHEL/CentOS/Rocky Linux

sudo dnf install -y realmd sssd oddjob oddjob-mkhomedir adcli \
    samba-common-tools krb5-workstation chrony samba samba-client \
    cifs-utils policycoreutils-python-utils

sudo systemctl enable --now chronyd
sudo systemctl enable --now sssd

Ubuntu/Debian

sudo apt update
sudo apt install -y realmd sssd sssd-tools libnss-sss libpam-sss \
    adcli samba-common-bin krb5-user chrony samba samba-client \
    cifs-utils policycoreutils-python-utils

sudo systemctl enable --now chrony
sudo systemctl enable --now sssd

Step 2: DNS and Time

`/etc/resolv.conf`

1
nameserver 192.168.1.10
2
nameserver 192.168.1.11
3
search company.com
4
domain company.com

Verify:

dig company.com
dig _ldap._tcp.company.com SRV

`/etc/chrony.conf`

1
server dc1.company.com iburst prefer
2
server dc2.company.com iburst

sudo systemctl restart chronyd
chrony sources -v
timedatectl status

Step 3: Kerberos Configuration

`/etc/krb5.conf`

1
[libdefaults]
2
    default_realm = COMPANY.COM
3
    dns_lookup_kdc = true
4
    dns_lookup_realm = false
5
    rdns = false
6
    ticket_lifetime = 24h
7
    renew_lifetime = 7d
8
    forwardable = true
9
    udp_preference_limit = 0
10

11
[realms]
12
    COMPANY.COM = {
13
        kdc = dc1.company.com
14
        admin_server = dc1.company.com
15
        default_domain = company.com
16
    }
17

18
[domain_realm]
19
    .company.com = COMPANY.COM
20
    company.com = COMPANY.COM
21

22
[logging]
23
    kdc = FILE:/var/log/krb5/krb5kdc.log
24
    admin_server = FILE:/var/log/krb5/kadmind.log
25
    default = SYSLOG:NOTICE:DAEMON

Test it:

kinit administrator@COMPANY.COM
klist
kdestroy

Step 4: Domain Join

sudo realm discover company.com

sudo realm join company.com -U administrator \
    --client-software=sssd \
    --membership-software=samba

sudo realm list
net ads testjoin

Step 5: SSSD Configuration

`/etc/sssd/sssd.conf`

1
[sssd]
2
enable_files_domain = true
3
domains = company.com
4
config_file_version = 2
5
services = nss, pam
6

7
[domain/local]
8
id_provider = files
9

10
[domain/company.com]
11
ad_domain = company.com
12
krb5_realm = COMPANY.COM
13
realmd_tags = manages-system joined-with-samba
14
cache_credentials = True
15
id_provider = ad
16
ad_update_samba_machine_account_password = True
17

18
full_name_format = %3$s\%1$s
19
use_fully_qualified_names = False
20
fallback_homedir = /home/%u
21
default_shell = /bin/bash
22

23
# Disable for consistent UIDs across servers
24
ldap_id_mapping = False
25

26
krb5_store_password_if_offline = True
27

28
access_provider = simple
29
simple_allow_groups = linuxadmins@company.com, itstaff@company.com
30
simple_allow_users = testuser@company.com
31

32
enumerate = False
33
cache_first = True

sudo chmod 600 /etc/sssd/sssd.conf
sudo systemctl restart sssd
sudo systemctl enable sssd

Step 6: NSS Configuration

`/etc/nsswitch.conf`

1
passwd:     files sss winbind
2
group:      files sss winbind
3
shadow:     files sss
4
netgroup:   sss files

Step 7: Samba Configuration

`/etc/samba/smb.conf`

1
[global]
2
    realm = COMPANY.COM
3
    workgroup = COMPANY
4
    security = ads
5

6
    kerberos method = secrets and keytab
7
    dedicated keytab file = /etc/krb5.keytab
8

9
    log file = /var/log/samba/log.%m
10
    log level = 2
11

12
    vfs objects = acl_xattr
13
    map acl inherit = yes
14
    store dos attributes = yes
15

16
    template homedir = /home/%U
17
    template shell = /bin/bash
18

19
    idmap config * : backend = tdb
20
    idmap config * : range = 10000-199999
21
    idmap config COMPANY : range = 200000-2147483647
22
    idmap config COMPANY : backend = sss
23

24
    client signing = mandatory
25
    server signing = mandatory
26

27
    socket options = TCP_NODELAY IPTOS_LOWDELAY
28

29
[shared]
30
    path = /srv/shared
31
    read only = no
32
    browsable = yes
33
    valid users = @linuxadmins@company.com, @itstaff@company.com
34
    force group = linuxadmins
35
    create mask = 0664
36
    directory mask = 0775
37

38
[data]
39
    path = /srv/data
40
    read only = no
41
    browsable = yes
42
    valid users = @dataaccess@company.com
43
    force group = dataaccess
44
    create mask = 0660
45
    directory mask = 0770
46

47
[homes]
48
    comment = Home Directories
49
    browsable = no
50
    read only = no
51
    create mask = 0700
52
    directory mask = 0700

sudo mkdir -p /srv/shared /srv/data

sudo chgrp linuxadmins /srv/shared
sudo chmod 775 /srv/shared
sudo chgrp dataaccess /srv/data
sudo chmod 770 /srv/data

# SELinux (RHEL/CentOS)
sudo setsebool -P samba_export_all_ro=1 samba_export_all_rw=1
sudo semanage fcontext -a -t samba_share_t "/srv/shared(/.*)?"
sudo semanage fcontext -a -t samba_share_t "/srv/data(/.*)?"
sudo restorecon -R /srv/shared /srv/data

Step 8: Join Samba to Domain

sudo net ads join -U administrator
sudo net ads testjoin
# Should return: Join is OK

# Verify user/group lookup
getent passwd testuser@company.com
id testuser@company.com
getent group linuxadmins@company.com

Step 9: Start Services and Test

sudo systemctl enable --now smb winbind
sudo systemctl status smb winbind

# List shares
sudo smbclient -L localhost -U testuser@company.com

# Test share access
sudo smbclient //localhost/shared -U testuser@company.com

From a Windows client: \\linux-server\shared

Step 10: Troubleshooting

Cache

sudo sss_cache -E
sudo systemctl restart sssd

sudo net cache flush

# If TDB corruption suspected
sudo systemctl stop smb winbind
sudo rm -f /var/lib/samba/*.tdb
sudo systemctl start winbind smb

Logs

sudo tail -f /var/log/sssd/sssd_company.com.log
sudo tail -f /var/log/samba/log.smbd

For deeper SSSD debugging, add debug_level = 9 in the [domain/company.com] section and restart sssd.

AD Connectivity and Auth

sudo net ads info
sudo net ads lookup testuser
sudo net ads group info "linuxadmins"
klist -k /etc/krb5.keytab

# Winbind checks
sudo wbinfo -t  # trust secret
sudo wbinfo -u  # list users
sudo wbinfo -g  # list groups

# Active connections
sudo smbstatus

Common Errors

NT_STATUS_ACCESS_DENIED:

id username@company.com
sudo testparm -s
ls -Z /srv/shared

Users not resolving:

sudo sss_cache -E
sudo systemctl restart sssd winbind
getent passwd username@company.com

Authentication failures:

klist
kinit username@COMPANY.COM
chrony sources -v
net ads testjoin

Firewall and SELinux

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --permanent --add-port=445/tcp
sudo firewall-cmd --permanent --add-port=139/tcp
sudo firewall-cmd --reload

# SELinux booleans (RHEL/CentOS)
sudo setsebool -P samba_domain_controller=on
sudo setsebool -P use_samba_home_dirs=on
sudo setsebool -P samba_enable_home_dirs=on

Maintenance Script

sudo nano /usr/local/bin/samba-maintenance.sh

#!/bin/bash
net ads changetrustpw
sss_cache -E
tdbbackup /var/lib/samba/*.tdb
net ads testjoin
echo "Maintenance completed: $(date)"

sudo chmod +x /usr/local/bin/samba-maintenance.sh

# Weekly cron
echo "0 2 * * 0 /usr/local/bin/samba-maintenance.sh >> /var/log/samba-maintenance.log 2>&1" | sudo crontab -

SMB Authentication with AD on Linux

Step 1: Package Installation

RHEL/CentOS/Rocky Linux

Ubuntu/Debian

Step 2: DNS and Time

`/etc/resolv.conf`

`/etc/chrony.conf`

Step 3: Kerberos Configuration

`/etc/krb5.conf`

Step 4: Domain Join

Step 5: SSSD Configuration

`/etc/sssd/sssd.conf`

Step 6: NSS Configuration

`/etc/nsswitch.conf`

Step 7: Samba Configuration

`/etc/samba/smb.conf`

Step 8: Join Samba to Domain

Step 9: Start Services and Test

Step 10: Troubleshooting

Cache

Logs

AD Connectivity and Auth

Common Errors

Firewall and SELinux

Maintenance Script

Share this post

Related Posts

Introducing merox-erudite: My Customized Astro Blogging Theme

Homelab as Code: Packer + Terraform + Ansible

How to Set Up Your Own AI at Home

SMB Authentication with AD on Linux

Step 1: Package Installation

RHEL/CentOS/Rocky Linux

Ubuntu/Debian

Step 2: DNS and Time

/etc/resolv.conf

/etc/chrony.conf

Step 3: Kerberos Configuration

/etc/krb5.conf

Step 4: Domain Join

Step 5: SSSD Configuration

/etc/sssd/sssd.conf

Step 6: NSS Configuration

/etc/nsswitch.conf

Step 7: Samba Configuration

/etc/samba/smb.conf

Create share directories

Step 8: Join Samba to Domain

Step 9: Start Services and Test

Step 10: Troubleshooting

Cache

Logs

AD Connectivity and Auth

Common Errors

Firewall and SELinux

Maintenance Script

Share this post

Related Posts

Introducing merox-erudite: My Customized Astro Blogging Theme

Homelab as Code: Packer + Terraform + Ansible

How to Set Up Your Own AI at Home

`/etc/resolv.conf`

`/etc/chrony.conf`

`/etc/krb5.conf`

`/etc/sssd/sssd.conf`

`/etc/nsswitch.conf`

`/etc/samba/smb.conf`