Enterprise Samba4 Active Directory with Ansible & Linux Hardening

Most homelab and small-business environments manage users manually — separate logins per machine, no central authentication, no audit trail. This project changes that by deploying enterprise-grade Active Directory using Samba4, fully automated with Ansible, with Linux hardening and monitoring baked in from day one.

Why Samba4 Active Directory?

Active Directory (AD) is the industry standard for centralized identity management. Every enterprise uses it. Microsoft charges accordingly. Samba4 is the open-source implementation that runs on Linux and provides full AD compatibility — LDAP, Kerberos, DNS, Group Policy — at zero licensing cost.

For a DevOps engineer, running Samba4 in a lab environment means learning real enterprise identity concepts without a Windows Server license.

Architecture

Vagrant → provisions Debian VMs automatically ├── DC Node → Samba4 Domain Controller (AD, DNS, Kerberos) ├── Member Server → domain-joined Linux server └── Admin Node → Ansible control node Ansible → configures all nodes idempotently Linux Hardening → SSH keys, firewall rules, disabled root login Monitoring → Prometheus + Grafana watching all nodes

What Ansible Automates

The entire provisioning sequence is codified in Ansible roles. Running the playbook on a fresh Vagrant environment produces a fully functional AD domain in minutes:

# Roles applied in order
1. base-hardening     # SSH config, UFW, fail2ban, disabled root
2. samba4-dc          # Installs samba, provisions domain
3. dns-config         # Configures internal DNS for domain resolution
4. kerberos-client    # Configures Kerberos on member servers
5. domain-join        # Joins member servers to the domain
6. monitoring-agent   # Deploys Node Exporter on all nodes

Linux Hardening

Security wasn't an afterthought. Every node gets the same hardening baseline before any service is installed:

Root login disabled — only key-based SSH allowed
UFW configured with allow-list rules — only necessary ports open
fail2ban blocking brute-force SSH attempts
Unattended security upgrades enabled
Audit logging for privileged command execution

- name: Harden SSH configuration
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ item.key }}"
    line: "{{ item.value }}"
  loop:
    - {key: "^PermitRootLogin", value: "PermitRootLogin no"}
    - {key: "^PasswordAuthentication", value: "PasswordAuthentication no"}
    - {key: "^X11Forwarding", value: "X11Forwarding no"}

Samba4 Domain Provisioning

The DC provisioning role runs samba-tool domain provision with all parameters passed as Ansible variables — no interactive prompts, fully automated:

- name: Provision Samba4 domain
  command: >
    samba-tool domain provision
    --realm={{ samba_realm }}
    --domain={{ samba_domain }}
    --adminpass={{ samba_admin_pass }}
    --dns-backend=SAMBA_INTERNAL
    --server-role=dc
    --use-rfc2307

Key Lessons

Kerberos clock skew will break authentication — always sync time across all nodes with NTP before joining a domain
DNS is the foundation of AD — if DNS is wrong, everything breaks silently
Ansible roles make complex multi-node setups reproducible — structure matters more than cleverness
Hardening before services, not after — retrofitting security is always harder

What's Next

Group Policy Object (GPO) automation via Ansible
LDAP integration with web applications
Certificate Authority (CA) for internal TLS
Centralised log collection from all domain nodes

samba4ansiblelinuxactive-directoryvagranthardeningkerberos