Run Your Own Domain Authentication on Linux
Running your own domain authentication system on Linux can significantly enhance security and manageability in your IT environment. Whether you're setting up centralized login for a small network or a more complex domain environment, Linux provides powerful tools to become your own domain controller using open-source software.
In this guide, we’ll walk you through setting up Samba as an Active Directory (AD) Domain Controller on a Linux server.
These tutorial should work fine on Debian 12 (Bookworm), though it should work with minor modifications on pretty much most of recent Debs and deb based distros.
What is Domain Authentication?
Domain authentication allows users to log in to any authorized machine within a network using the same set of credentials. It provides centralized management of:
- Users and groups
- Computer accounts
- Group policies
- File and printer sharing
- Access control
Microsoft's Active Directory is the most well-known implementation, but you can achieve similar functionality using Samba on Linux.
Pre-requirements
- A fresh Linux installation (Ubuntu Server 22.04 LTS or Debian 12 recommended)
- Static IP address
- Root or sudo access
- Domain name (e.g., mydomain.local)
1. Update System and Set proper Hostname
# apt update && sudo apt upgrade -y
# hostnamectl set-hostname dc1.mydomain.local
Add the hostname to /etc/hosts:
# vim /etc/hosts
Add the local network IP the SMB Domain controller will have locally on the machine:
192.168.1.100 dc1.mydomain.local dc1
2. Install Samba and Required Packages
# apt install samba krb5-config krb5-user winbind smbclient dnsutils -y
During the installation, you may be prompted for Kerberos configuration:
- Default realm: MYDOMAIN.LOCAL
- KDC: dc1.mydomain.local
- Admin server: dc1.mydomain.local
3. Provision Samba as a Domain Controller
First, stop any running Samba services:
# systemctl stop smbd nmbd winbind
# systemctl disable smbd nmbd winbind
Move default config:
# mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
Now provision the domain:
# samba-tool domain provision –use-rfc2307 –interactive
Answer prompts:
- Realm: MYDOMAIN.LOCAL
- Domain: MYDOMAIN
- Server role: dc
- DNS backend: SAMBA_INTERNAL
- Admin password: (choose a strong one)
Once done, configure Kerberos using the samba krb5.conf template file:
# mv /etc/krb5.conf /etc/krb5.conf.bak
# cp /var/lib/samba/private/krb5.conf /etc/
4. Start and Enable Samba AD Services
# systemctl unmask samba-ad-dc
# systemctl enable samba-ad-dc –now
Verify it’s working by running:
# samba-tool domain level show
Check Kerberos authentication is OK:
# kinit administrator
# klist
You should see a valid Kerberos ticket.
5. Configure DNS (Optional but Recommended)
If using SAMBA_INTERNAL DNS backend:
Check DNS resolution is OK:
# host -t A dc1.mydomain.local
# host -t SRV _kerberos._udp.mydomain.local
If you want clients to resolve domain names, configure them to use the Samba DC's IP as their DNS server.
6. Add Users and Join Client Machines
Add a new user:
# samba-tool user add your.samba.user
Join a Windows client:
- Go to System Properties → Computer Name → Change settings
- Click Domain, enter MYDOMAIN
- Authenticate with Administrator and the password you set
- Reboot
7. Managing the Domain
You can manage users, groups, and policies simply via commands or GUI interface or LDAP tools:
- samba-tool (CLI)
- RSAT tools on Windows (for GUI management)
- via LDAP tools (if you have to stick to RFC2307)
Example commands:
# samba-tool user list
# samba-tool group list
# samba-tool user setpassword your.samba.user
8. Managing Samba AD Samba Linux Domain easily with UI
You can manage a Samba domain (especially when it's running as an Active Directory Domain Controller) via a web interface — but not directly through Samba itself, since it doesn't come with a built-in web UI.
Instead, you can integrate Samba with third-party web-based tools that provide management interfaces for:
- Users and groups
- Computer accounts
- LDAP directory entries
- Domain policies (to a limited extent)
Popular Web Interfaces to Manage a Samba Domain
Here are the most reliable options:
8.1. [Cockpit + 389 Directory Server or FreeIPA (for LDAP-based domains)]
- Cockpit is a modern web admin interface for Linux servers.
- When paired with FreeIPA, you can manage users, groups, policies, and more.
- However, this is more suited for FreeIPA-based domains, not Samba AD.
✅ Great for: Linux-native domains
❌ Not compatible with Windows-style Samba AD
8.2. [LDAP Account Manager (LAM)] – RECOMMENDED FOR SAMBA + AD
Website: https://www.ldap-account-manager.org/
LDAP Account Manager (LAM) is one of the best tools to manage a Samba domain via LDAP, especially when:
- You use Samba in AD DC mode with RFC2307 extensions (for Unix attributes)
- Or, you're using Samba as a member server with an external LDAP backend
Features:
- Web-based GUI to manage:
- Users and groups
- Samba-specific attributes (like SID, RID, home directories)
- POSIX and Windows-compatible accounts
- Can bind directly to the Samba LDAP directory
Authentication: Admin binds via LDAP (either over plain or TLS)
✅ Works with Samba AD (with some config)
✅ Handles Samba3/4 user schemas
✅ Active development and documentation
8.3. Samba Web Administration Tool (SWAT) ❌ Deprecated
SWAT was the original web interface for Samba but:
- It was deprecated and removed from Samba after version 4.1
- It's no longer secure or maintained
- Not suitable for Samba AD DC environments
Recommendation: Do not use SWAT
8.4. Webmin (Partial Support)
- Webmin is a general Linux web admin tool
- It has a Samba module, but:
- Designed for traditional Samba file sharing (not AD/DC mode)
- Cannot manage Samba AD users/groups
- Doesn’t interact with samba-tool or the AD schema
✅ Works for standalone Samba file servers
❌ Not suitable for Samba AD DCs
Can You really Use RSAT Instead ?
If you want full Active Directory-style control (like Group Policy, OU structure, DNS, etc.), the best GUI tool is actually RSAT (Remote Server Administration Tools) on Windows
but for that of course you will have to have an own Windows Server setup especailly for it.
- Connects to your Samba AD DC
- Fully supports:
- Users and groups
- Group Policy Objects (GPO)
- DNS management (if using internal Samba DNS)
Install RSAT on a Windows machine and run dsa.msc (Active Directory Users and Computers).
✅ Officially supported
✅ Full compatibility with Samba AD
❌ Requires a Windows machine
Summary: Web UI for Samba Domain Management
| Tool | Works with Samba AD DC? | Features | Notes |
|---|---|---|---|
| LDAP Account Manager (LAM) | Yes | User/group management | Best web option |
| Cockpit + FreeIPA | ❌ No (not Samba AD) | Excellent for FreeIPA domains | Not compatible with Samba AD |
| Webmin | ❌ Not fully | File shares only | No AD/DC management |
| RSAT (Windows) | ✅ Yes | Full AD management | Not web-based |
Recommendation
If you're running a Samba AD DC and want a web-based interface:
- Use LAM (LDAP Account Manager) for basic account management
- Use RSAT tools on Windows for full domain administration
- Avoid SWAT and Webmin for this purpose
Security Considerations
- Ensure firewall allows relevant ports (e.g., 53, 88, 389, 445, etc.) with Iptables / firewalld or whatever firewall solution you have present on the server and in the Network in which you hosted the server
- Keep the system updated
- Use secure passwords and rotate them regularly
- Consider setting up replication if high availability is needed
Conclusion
Running your own domain authentication system on Linux using Samba is a powerful way to control user access in a centralized manner. It’s ideal for small to mid-sized networks, homelabs, or even enterprise environments looking for a cost-effective alternative to Windows Server.
With Samba acting as your domain controller, you can enjoy the benefits of centralized authentication, integrated DNS, and a high degree of compatibility with Windows clients — all while staying in the open-source ecosystem.
References
- Samba Wiki: Setting up Samba as an AD Domain Controller
- man samba-tool
- man smb.conf
Notes and things to consider:
/var/lib/samba/private/krb5.conf file is generated only after you provision Samba as an Active Directory (AD) Domain Controller using:
# samba-tool domain provision
After provisioning, Samba creates a custom Kerberos config at:
/var/lib/samba/private/krb5.conf
This is true for both Debian and Ubuntu because it's handled by the Samba package itself, not the distro.
Why use that krb5.conf instead of Debian's default?
Well because:
The default /etc/krb5.conf on Debian isn't tailored for Samba AD.
The one Samba generates includes correct realm, KDC, and admin server settings.
It avoids subtle issues like failed kinit or broken Kerberos trust.
So you copy it over Debian’s default:
Gotchas on Debian to be aware of
Do not install samba via tasksel (like tasksel's “Samba file server” role), as it sets up a traditional SMB server, not AD.
Only use samba-tool domain provision if you're setting up AD DC.
Debian sometimes separates systemd services (e.g., samba-ad-dc might not be enabled by default). So make sure to enable samba-ad-dc instead of smbd/nmbd.
