SMB Authentication with AD on Linux

Learn how to integrate Linux SMB file servers with Active Directory for seamless Windows authentication.

Introduction

After many days of configuration and internet research, I couldn’t find anything that covered all the information needed to integrate this type of configuration into a system. My current job, for example, absolutely requires centralized SSSD across all Linux servers, so below is the configuration I managed to implement on both RedHat 8 and OpenSUSE 15.6.

Architecture Overview

The solution combines several components:

Samba - SMB/CIFS file server
SSSD - System Security Services Daemon for AD integration
Kerberos - Authentication protocol
realmd - Domain join utility

Prerequisites

System Requirements

Red Hat/CentOS/Rocky Linux 8+ or Ubuntu 20.04+
Network connectivity to Active Directory Domain Controllers
DNS resolution properly configured
NTP/Chrony for time synchronization

Required Information

Domain name: company.com
Domain Controller: dc1.company.com
Domain admin account with join privileges
Target OU for computer objects (optional)

Step 1: Package Installation

RHEL/CentOS/Rocky Linux

# Install required packages
sudo dnf install -y realmd sssd oddjob oddjob-mkhomedir adcli \
    samba-common-tools krb5-workstation chrony samba samba-client \
    cifs-utils policycoreutils-python-utils

# Enable and start services
sudo systemctl enable --now chronyd
sudo systemctl enable --now sssd

Ubuntu/Debian

# Update package list
sudo apt update

# Install required packages
sudo apt install -y realmd sssd sssd-tools libnss-sss libpam-sss \
    adcli samba-common-bin krb5-user chrony samba samba-client \
    cifs-utils policycoreutils-python-utils

# Enable and start services
sudo systemctl enable --now chrony
sudo systemctl enable --now sssd

Step 2: DNS and Time Configuration

DNS Configuration

# Verify DNS resolution
dig company.com
dig _ldap._tcp.company.com SRV

# Find domain controllers
dig +short NS company.com

Edit /etc/resolv.conf:

sudo nano /etc/resolv.conf

1
nameserver 192.168.1.10  # Primary DC IP
2
nameserver 192.168.1.11  # Secondary DC IP (optional)
3
search company.com
4
domain company.com

Time Synchronization

# Configure chrony to sync with domain controller
sudo nano /etc/chrony.conf

Add/modify:

1
server dc1.company.com iburst prefer
2
server dc2.company.com iburst

# Restart and verify
sudo systemctl restart chronyd
chrony sources -v
timedatectl status

Step 3: Kerberos Configuration

# Create Kerberos configuration
sudo nano /etc/krb5.conf

1
[libdefaults]
2
    default_realm = COMPANY.COM
3
    dns_lookup_kdc = true
4
    dns_lookup_realm = false
5
    rdns = false
6
    ticket_lifetime = 24h
7
    renew_lifetime = 7d
8
    forwardable = true
9
    udp_preference_limit = 0
10

11
[realms]
12
    COMPANY.COM = {
13
        kdc = dc1.company.com
14
        admin_server = dc1.company.com
15
        default_domain = company.com
16
    }
17

18
[domain_realm]
19
    .company.com = COMPANY.COM
20
    company.com = COMPANY.COM
21

22
[logging]
23
    kdc = FILE:/var/log/krb5/krb5kdc.log
24
    admin_server = FILE:/var/log/krb5/kadmind.log
25
    default = SYSLOG:NOTICE:DAEMON

Test Kerberos

# Test authentication
kinit [email protected]
klist
kdestroy

Step 4: Domain Join with realmd

Discover Domain

# Discover the domain
sudo realm discover company.com

Join Domain

# Join domain with SSSD and Samba integration
sudo realm join company.com -U administrator \
    --client-software=sssd \
    --membership-software=samba

Verify Join

# Check realm status
sudo realm list

# Verify computer account
net ads testjoin

Step 5: SSSD Configuration

# Edit SSSD configuration
sudo nano /etc/sssd/sssd.conf

1
[sssd]
2
enable_files_domain = true
3
domains = company.com
4
config_file_version = 2
5
services = nss, pam
6

7
[domain/local]
8
id_provider = files
9

10
[domain/company.com]
11
# Basic AD configuration
12
ad_domain = company.com
13
krb5_realm = COMPANY.COM
14
realmd_tags = manages-system joined-with-samba
15
cache_credentials = True
16
id_provider = ad
17
ad_update_samba_machine_account_password = True
18

19
# User/Group formatting
20
full_name_format = %3$s\%1$s
21
use_fully_qualified_names = False
22
fallback_homedir = /home/%u
23
default_shell = /bin/bash
24

25
# ID mapping (disable for consistent UIDs across servers)
26
ldap_id_mapping = False
27

28
# Kerberos settings
29
krb5_store_password_if_offline = True
30

31
# Access control
32
access_provider = simple
33
simple_allow_groups = [email protected], [email protected]
34
simple_allow_users = [email protected]
35

36
# Performance tuning
37
enumerate = False
38
cache_first = True

Set permissions and restart

sudo chmod 600 /etc/sssd/sssd.conf
sudo systemctl restart sssd
sudo systemctl enable sssd

Step 6: NSS Configuration

The nsswitch.conf should include both sss and winbind:

sudo nano /etc/nsswitch.conf

Key lines should look like:

1
passwd:     files sss winbind
2
group:      files sss winbind
3
shadow:     files sss
4
netgroup:   sss files

Step 7: Samba Configuration

Create Samba configuration

sudo nano /etc/samba/smb.conf

1
[global]
2
    # Domain settings
3
    realm = COMPANY.COM
4
    workgroup = COMPANY
5
    security = ads
6

7
    # Kerberos configuration
8
    kerberos method = secrets and keytab
9
    dedicated keytab file = /etc/krb5.keytab
10

11
    # Logging
12
    log file = /var/log/samba/log.%m
13
    log level = 2
14

15
    # VFS and ACL support
16
    vfs objects = acl_xattr
17
    map acl inherit = yes
18
    store dos attributes = yes
19

20
    # User mapping
21
    template homedir = /home/%U
22
    template shell = /bin/bash
23

24
    # ID mapping configuration
25
    idmap config * : backend = tdb
26
    idmap config * : range = 10000-199999
27
    idmap config COMPANY : range = 200000-2147483647
28
    idmap config COMPANY : backend = sss
29

30
    # Security settings
31
    client signing = mandatory
32
    server signing = mandatory
33

34
    # Performance
35
    socket options = TCP_NODELAY IPTOS_LOWDELAY
36

37
# Example share configuration
38
[shared]
39
    path = /srv/shared
40
    read only = no
41
    browsable = yes
42
    valid users = @[email protected], @[email protected]
43
    force group = linuxadmins
44
    create mask = 0664
45
    directory mask = 0775
46

47
[data]
48
    path = /srv/data
49
    read only = no
50
    browsable = yes
51
    valid users = @[email protected]
52
    force group = dataaccess
53
    create mask = 0660
54
    directory mask = 0770
55

56
[homes]
57
    comment = Home Directories
58
    browsable = no
59
    read only = no
60
    create mask = 0700
61
    directory mask = 0700

# Create dirs
sudo mkdir -p /srv/shared /srv/data

# Set permissions
sudo chgrp linuxadmins /srv/shared
sudo chmod 775 /srv/shared
sudo chgrp dataaccess /srv/data
sudo chmod 770 /srv/data

# Set SELinux contexts (RHEL/CentOS)
sudo setsebool -P samba_export_all_ro=1 samba_export_all_rw=1
sudo semanage fcontext -a -t samba_share_t "/srv/shared(/.*)?"
sudo semanage fcontext -a -t samba_share_t "/srv/data(/.*)?"
sudo restorecon -R /srv/shared /srv/data

Step 8: Join Samba to Domain

Alternative join method with net command

# Join using net command (alternative to realm join)
sudo net ads join -U administrator

# Verify join
sudo net ads testjoin
# Should return: Join is OK

Test authentication

# Test user lookup
getent passwd [email protected]
id [email protected]

# Test group lookup
getent group [email protected]

Step 9: Service Management and Testing

Start Samba services

sudo systemctl enable --now smb winbind
sudo systemctl status smb winbind

Test SMB shares

# List shares
sudo smbclient -L localhost -U [email protected]

# Test access to share
sudo smbclient //localhost/shared -U [email protected]

# From Windows client
# \\linux-server\shared

Step 10: Troubleshooting and Maintenance

Cache Management

# Clear SSSD cache
sudo sss_cache -E
sudo systemctl restart sssd

# Clear Samba cache
sudo net cache flush

# Remove Samba TDB files (if corruption suspected)
sudo systemctl stop smb winbind
sudo rm -f /var/lib/samba/*.tdb
sudo systemctl start winbind smb

Log Analysis

# SSSD logs
sudo tail -f /var/log/sssd/sssd_company.com.log

# Samba logs
sudo tail -f /var/log/samba/log.smbd

# Enable debug logging in SSSD
sudo nano /etc/sssd/sssd.conf
# Add: debug_level = 9 in [domain/company.com] section
sudo systemctl restart sssd

Connection Testing

# Test AD connectivity
sudo net ads info

# Test user authentication
sudo net ads lookup testuser

# Test group membership
sudo net ads group info "linuxadmins"

# Kerberos ticket status
klist -k /etc/krb5.keytab

Performance Monitoring

# Monitor active SMB connections
sudo smbstatus

# Check winbind status
sudo wbinfo -t  # Trust secret
sudo wbinfo -u  # List users
sudo wbinfo -g  # List groups

Advanced Configuration

User and Group Mapping

# Map Windows groups to Linux groups
sudo net groupmap add ntgroup="Domain Admins" unixgroup=wheel type=domain

# List current mappings
sudo net groupmap list

1
# Advanced share configuration
2
[finance]
3
    path = /srv/finance
4
    read only = no
5
    browsable = yes
6
    valid users = @[email protected]
7
    admin users = @[email protected]
8
    force group = finance
9
    create mask = 0640
10
    directory mask = 0750
11
    veto files = /*.mp3/*.avi/*.mpg/
12
    hide unreadable = yes

Security Considerations

Firewall Configuration

# Open required ports
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --permanent --add-port=445/tcp
sudo firewall-cmd --permanent --add-port=139/tcp
sudo firewall-cmd --reload

SELinux Configuration (RHEL/CentOS)

# Required SELinux booleans
sudo setsebool -P samba_domain_controller=on
sudo setsebool -P use_samba_home_dirs=on
sudo setsebool -P samba_enable_home_dirs=on

# Check SELinux status
sudo getsebool -a | grep samba

Regular Maintenance Tasks

# Create maintenance script
sudo nano /usr/local/bin/samba-maintenance.sh

#!/bin/bash
# Samba/AD maintenance script

# Refresh machine account password
net ads changetrustpw

# Clear old cache entries
sss_cache -E

# Backup TDB files
tdbbackup /var/lib/samba/*.tdb

# Check domain trust
net ads testjoin

echo "Maintenance completed: $(date)"

sudo chmod +x /usr/local/bin/samba-maintenance.sh

# Add to crontab (weekly maintenance)
echo "0 2 * * 0 /usr/local/bin/samba-maintenance.sh >> /var/log/samba-maintenance.log 2>&1" | sudo crontab -

Common Issues and Solutions

Issue: “NT_STATUS_ACCESS_DENIED” errors

# Check user permissions
id [email protected]

# Verify share configuration
sudo testparm -s

# Check SELinux contexts
ls -Z /srv/shared

Issue: Users not resolving

# Clear cache and restart services
sudo sss_cache -E
sudo systemctl restart sssd winbind

# Check NSS configuration
getent passwd [email protected]

Issue: Authentication failures

# Check Kerberos tickets
klist
kinit [email protected]

# Verify time sync
chrony sources -v

# Check domain trust
net ads testjoin

Conclusion

This setup provides robust SMB/CIFS file sharing with Active Directory authentication. The combination of SSSD for user resolution and Samba for file services offers excellent performance and reliability. Regular maintenance and monitoring ensure continued operation in enterprise environments.

Key benefits of this configuration:

Seamless Windows integration
Centralized user management
Kerberos SSO support
Scalable for large environments
Comprehensive logging and monitoring

Remember to regularly update your systems and monitor the logs for any authentication or connectivity issues.