Samba4 4.7.0 Setup OpenSUSE 42.3

Samba 4 is still the free AD: LDAP, Kerberos, DNS and SYSVOL in the same process. In 2017 this post provisioned 4.7.0 on Leap 42.3. In 2026 the official wiki and Leap 15.6 speak the same language — samba-tool — but through the distro RPM, not the tarball in /opt.

The video is the 2017 lab. The provisioning commands remain; the package and systemd have changed.

What you need

• openSUSE Leap, x86_64, VM or bare metal, static IP. Watch the version: Leap 15.6 ended support on 30 April 2026, so the current series is 16.0 (supported until October 2027). On 16.0 the samba-ad-dc may not be in the default OSS repository — in that case, the path is OBS network:samba:ADDC. Check with zypper se samba-ad-dc before starting.
• FQDN hostname, NTP, a single nameserver after provisioning: the DC itself.
• Do not mix smbd/nmbd classic daemons with the AD DC. The DC binary is samba.

hostnamectl hostname dc1.linuxpro.net
echo '192.168.56.100 dc1.linuxpro.net dc1' >> /etc/hosts
timedatectl set-ntp true

Packages (not the 2017 OBS)

The Samba wiki lists for SUSE/openSUSE:

zypper refresh
zypper in -y samba samba-winbind samba-ad-dc samba-tool krb5-client bind-utils chrony
systemctl disable --now smb nmb winbind 2>/dev/null || true
mv /etc/samba/smb.conf /etc/samba/smb.conf.bak 2>/dev/null || true

The repository home:jniltinho + samba4-4.7.0 + symlink in /usr/local/bin is not needed. The samba-tool already comes in PATH.

Provision

The Administrator password must meet Samba policy (length, complexity). Do not paste passwords into the command line on a shared host — shell history stores them. Lab example:

samba-tool domain provision --use-rfc2307 --interactive
# realm: LINUXPRO.NET
# domain: LINUXPRO
# role: dc
# DNS: SAMBA_INTERNAL
# forwarder: o DNS da sua rede (ou 9.9.9.9)

Non-interactive (lab):

samba-tool domain provision 
  --server-role=dc --use-rfc2307 
  --dns-backend=SAMBA_INTERNAL 
  --realm=LINUXPRO.NET --domain=LINUXPRO 
  --adminpass='TroqueEstaSenha!23'

cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
# o DC resolve a si mesmo:
echo -e 'search linuxpro.netnnameserver 127.0.0.1' > /etc/resolv.conf
systemctl enable --now samba-ad-dc chronyd
samba-tool domain info 127.0.0.1
kinit administrator@LINUXPRO.NET

Firewall: 53, 88, 135, 139, 389, 445, 464, 636, 3268, 3269 and high RPC ports. Without this Windows will not join.

Users and Administrator password

samba-tool user create joao
samba-tool user setpassword Administrator
samba-tool user list

Linux client in the domain: the howto Ubuntu in Active Directory (sssd/realmd). Windows 10/11: DNS pointing to the DC + RSAT. Wiki: Installing RSAT.

What remained

zypper in samba-ad-dc, provision, samba-ad-dc.service, kinit. Leap 42.3, Samba 4.7 in /opt and the unit samba4.service from the homemade package, no. Docs: Samba Wiki — AD DC · packages: Distribution-specific Package Installation.