Needing a Microsoft AD service for the virtual GNS3 network laboratory . Since i am using linux, installing samba 4 AD DC is a good enough for authentication and authorization testing. The use case for a Active Directory Service is authenticating and authorizing users to networking components using TACACS+ protocol. Networking components like routers and switches. This works for all TACACS+ client implementations as soon as the used TACACS+ server/daemon is able to read the directory service (LDAP), here the Active Directory flavour of LDAP protocol, to get the credentials, and group assignments.

Now let's begin with a citation from the official samba page:

... Starting from version 4.0 (released in 2012,) Samba is able to serve as an Active Directory (AD) domain controller (DC). Samba operates at the forest functional level of Windows Server 2008 R2 w ...

So samba should be able to work as a simple Windows AD DC server

The setup explained below is a samba 4 AD Domain Controller, stand alone, for authentication service only. Stand alone in the sense of the only one AD Domain Controller running samba in that networking environment, no clustering, no FSM roles etc. Not to be mixed up with the samba server role, which is also called stand alone. The samba server role is set to dc when populating the directory service.

Samba version used in this setup

This setup is build on top of alpinelinux, first read the initial GNS3 appliance setup here: Building 64bit alpine linux GNS3 FRRouting appliance. Then apply the configuration process described here below.

Configuration

Configure alpinelinux samba to get a fully working AD DC for Authentication and Authorization. The essential packages needed are the 3 listed below. Install following packages:

Overview of setup variables used to for the samba 4 AD DC configuration:

hostname = ADS11
IP Address = 10.100.32.68
realm = ADS.EXAMPLE.ORG
(NetBIOS) domain = ADSDOM
server-role = dc

Install packages

mv /etc/smb.conf

Move the default created samba configuration file to a backup:

/etc/hosts

Edit file /etc/hosts, add the IP address of the eth0 interface to the list:

127.0.0.1     localhost
10.100.32.68  ADS11.ads.example.org   ADS11

/etc/hostname

Edit file /etc/hostname, add the hostname:

ADS11

/etc/resolv.conf

Configuring the DNS Resolver once again here, /etc/resolv.conf (optional) not using a external resolver. Add the entry search.ads.example.org.

search ads.example.org
nameserver 127.0.0.1
nameserver 10.100.32.68

Provisioning

Use the non interactive script to initially provision the domain controller, less prone to error. Mandatory set the --adminpass and write it down, otherwise it will be generated, the documentation says.

The non interactive script will provision the domain with a lengthy output.

Kerberos

Create a backup of the original, copy samba generated kerberos configuration file to /etc directory:

Samba daemon

Edit the /etc/conf.d/samba file to start samba 4 indeed (the AD related samba service), comment out smbd and nmbd services. The file MUST list only samba for the Active Directory Service to get running. This is what this file needs to contain:

daemon_list="samba"

Start the service

Verify DNS

Verify the samba service if the internal samba DNS daemon has been started too:

ss -tlpn | grep :53
LISTEN 0      10           0.0.0.0:53         0.0.0.0:*    users:(("dns[master]",pid=2464,fd=48))
LISTEN 0      10              [::]:53            [::]:*    users:(("dns[master]",pid=2464,fd=45))

Create reverse-zone

When DNS service is running, create a reverse zone:

Create PTR

Now that reversezone has been created , create the PTR (reverse) DNS record for the new AD DC:

Change default password policy

Since this setup is only meant for testing, adjust the password strategy for new users.

• no complexity
• no password history
• shorter passwords (4 chars)

Following command to set the password settings mentioned above:

Few other settings are also available like change minimimal/maximal password age.

Now the setup is finished.

Verify setup

Tests can be run from the AD server itself. Verify the tcp-based _ldap SRV record in the domain:

host -t SRV _ldap._tcp.ads.example.org.

Should show following output:

_ldap._tcp.ads.example.org has SRV record 0 100 389 ads11.ads.example.org.

Check the udp-based _kerberos SRV resource record in the domain:

host -t SRV _kerberos._udp.ads.example.org.

Should show following output:

_kerberos._udp.ads.example.org has SRV record 0 100 88 ads11.ads.example.org.

The A record of the domain controller, if you have created one:

When a reverse zone has been created, test the PTR record of the domain controller:

Populate the directory (optional)

At this point the samba 4 Active Directory Domain Controller setup is finished.

Populating the directory service is a optional setup, adjust everything to your liking or skip everything. This is the part that will be used to identify authenticating users and to assign TACACS+ profiles in next netlabs that use samba 4 directory services.

All commands shown below need root privilege.

Create new LDAP users

Create a read-only user for querying the LDAP tree, with the password readonly

samba-tool user create ro "readonly" --given-name=ReadOnly

This user will be querying the LDAP directory from the TACACS+ service. That is the only use-case for this particular ro user.

Create demo users for AAA testing, all with the password demo:

samba-tool user create demo0 "demo" --given-name=Demo0
samba-tool user create demo1 "demo" --given-name=Demo1
samba-tool user create demo2 "demo" --given-name=Demo2
samba-tool user create demo3 "demo" --given-name=Demo3

Create new LDAP groups

Create new LDAP groups:

samba-tool group add NET-exp
samba-tool group add NET-pro
samba-tool group add NET-ent
samba-tool group add NET-tac

Add users to groups

Now at the end add the newly created users to the groups.

samba-tool group addmembers NET-exp demo0
samba-tool group addmembers NET-pro demo1
samba-tool group addmembers NET-ent demo2
samba-tool group addmembers NET-tac demo3

The LDAP groups will be used in TACACS+ to match the group name with the configured TACACS+ users profile template, and to assign a authenticating user a TACACS+ profile with priv-lvl or with a RBAC role.

Change Administrator passwd

This is optional. Change the Administrator password to admin

samba-tool user setpassword Administrator
New Password:
Retype Password:
Change password OK

Done.

Verify

Testing command on one of the created users:

List all users:

AD LDAP structure

This is the visualisation of the above created LDAP users and the LDAP groups, skipping the default users, which are initially created like f.e. Administrator:

DC=ads,DC=example,DC=org
├── OU=Users
│   ├── demo0
│   ├── demo1
│   ├── demo2
│   ├── demo3
│   └── ro 
└── OU=Groups
    ├── NET-exp
    ├── NET-pro
    ├── NET-ent
    └── NET-tac

This is good enough for this use-case authenticating and authorizing users using TACACS+ protocol.

samba4 AD adjustments (optional)

Optional settings to easify the netlab usage

Passwordpolicy

Forest Function Level 2016 and AD Scheme 2022

• https://samba.tranquil.it/doc/en/samba_advanced_methods-samba_raise_fl2016.html

Determine the domain functional level You can determine the function level for your domain with this samba-tool command :

root:~# samba-tool domain level show

Domain and forest function level for domain 'DC=domain,DC=lan'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2

Raising functional level from new Samba-AD version 4.19.0 or later For new domain from 4.19.0, just add to your /etc/samba/smb.conf on the [global] section to all your Samba-AD domain controllers :

ad dc functional level = 2016

 And restart samba :

rc-service samba restart

On the FSMO owner domain controller, run this :

samba-tool domain schemaupgrade --schema=2019
samba-tool domain functionalprep --function-level=2016
samba-tool domain level raise --domain-level=2016 --forest-level=2016

 You are now on Forest Level 2016 and AD Schema version 88 (Windows Server 2019 / 2025).

GUI LDAP management tools

For editing and viewing the samba4 Active Directory Service (ADS) entries a GUI is useful, it has always been. Using MS Windows it ships the MMC for that and MMC's snap-ins for management.

Get access using one of the following GUI management applications to the directory service, which all run native on linux and all ship a binary ready to download:

• Apachedirectorystudio
• LDAP Admin
• OpenRSAT

This is a alphabetical listing of linux native GUI ADS management tools. Try the software out and decide what suits you best. Test it.

Troubleshooting

This is a generic way to find out what might have gone wrong. The best way to find out when the daemon does not start is running samba interactively

In this particular case, above the issue were following IP settings:

• Samba not recognise /31 IPv4 networks as such or can not operate with such subnet. Use at least /30 as smallest subnet for IPv4
• Samba does not recognize short IPv4 addressing like f.e.: 127.1. Use written out IPv4 syntax like: 127.0.0.1 when adding entries to resolv.conf file.

RFC3021 - Using 31-Bit Prefixes on IPv4 Point-to-Point Links.

This eventually is true for all samba files.

GUI authentication

The credentials to log in to AD LDAP are like that for the LDAP clients:

username: administrator.ads.example.org

Whereas the login credentials needed to login to a different LDAP directory service are like below:

username: cn=ldapadmin,ou=people,dc=example,dc=org

That is a common issue that happens. It is simple when you know about this, but difficult to find out when you are not aware about this specific authentication setting.

TLS

Verify certificate

openssl s_client -showcerts -connect ADS11.ads.example.org:636

See also

The instructions above apply to this on how to build a small linux appliance for GNS3. You can apply the steps from above to the instructions in that blog entry to get a tiny fully working GNS3 server appliance:

• Building 64bit alpine linux GNS3 FRRouting appliance

Add the samba package, install and configure it, then use the Samba4 appliance based on alpinelinux.

Summary

There is not much to say. Samba 4 AD DC setup works like a charm. And I do not need to run and deploy a commercial full blown windows server installation for my limited use case. This samba 4 appliance runs using 128 MB RAM and one vCPU in QEMU. This is right after the boot sequence:

ADS11 [~]# free
              total        used        free      shared  buff/cache   available
Mem:          87192       32700       23288        4112       31204       41704
Swap:        524284           0      524284

128 MB of RAM is NOT SUFFICIENT for the samba 4 AD DC GNS3 appliance. As soon as using a GUI tool to edit the directory server, or events happen the appliance begins swapping.

A RAM setting for limited use-case is like is assigning 512 MB RAM at minimum it should then run smoothly without swapping. 1024 MB of RAM when deploying big trees in LDAP and doing replication tests.

References

• Setting up Samba as a Active Directory Domain Controller
• Users and Group management
• Tranquil.it - Applying a password strategy with Samba-AD
• https://samba.tranquil.it/doc/en/samba_advanced_methods-advanced_features_of_Samba_Active_Directory.html