[Samba] Is LDAP + Kerberos without Active Directory no longer supported?

[Zombie Ryushu]

On 4/13/23 15:28, Daniel Lakeland via samba wrote:
> I have a server that runs stand-alone with an LDAP directory and a KDC 
> . The linux machines have sssd to allow unified users etc. The clients 
> are mostly MacOS and Windows machines that aren't part of an AD.
>
>
> This config has worked for 15 years, but after upgrading Debian and 
> bringing in Samba Version 4.17.7-Debian it seems to be broken.
>
>
> I believe this is related to: 
> https://lists.samba.org/archive/samba/2021-November/238720.html
>
> And other related discussions from earlier here: 
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001053
>
> It seems like some significant work has gone into security for samba 
> and that it's affected this kind of usage.
>
>
> My question is, what settings should I try or would be expected to 
> work for a Samba server that is connected to an MIT Krb5 Realm and has 
> users in an LDAP directory and does not have any kind of Active 
> Directory anything? Especially settings for the following:
>
> Right now I have:
>
>    workgroup = SOMEREALM.REALM
>
> log level = 3
>
> #security = user #this doesn't work either
> security = ads
> realm = SOMEREALM.REALM
> kerberos method = system keytab
>
> server signing = mandatory
> client signing = mandatory
> smb encrypt = mandatory
>
> server min protocol = SMB2
>
> strict locking = no
> dns proxy = no
>
> ...
>
> server role = standalone server
>
> idmap config * : backend = nss
> idmap config * : range = 1000-70000
> idmap config * : read only = yes
>
>
>
>
>
>
Not as an ADS Server, I think you can still do that Weird 
OpenLDAP/Kerberos enhanced Samba Classic NT Domain mode, but what you 
will create is not something Modern Windows can login too. But you have 
to set Samba to be an NT4 PDC with OpenLDAP backend and Kerberos 
Frontend. I think the last Windows OS to support this is Windows 7.