Debian – add Samba users without having to add UNIX ones

Make sure the winbind service is running.

Set up in your /etc/pam.d/samba:

account     [default=bad success=ok user_unknown=ignore]  pam_winbind.so
account     required      pam_permit.so

password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so
session     required      pam_limits.so

auth       required pam_nologin.so
auth sufficient pam_winbind.so use_first_pass
auth required   pam_deny.so

Pam changes sometimes require a winbind restart. Shouldn't, but practical experience says do it anyway.

In smb.conf you also need:

realm = YOURKERBEROSREALMNAME
password server = the host or IP of your ADC
idmap backend = rid:DOMAIN=5000-100000000
idmap uid = 10000-10000000
idmap gid = 10000-10000000
winbind use default domain = Yes
winbind enum users = Yes
winbind enum groups = Yes

Where DOMAIN is your workgroup or domain name and realm matches what is in your krb5.conf

Restart samba services after the changes in smb.conf

To hide the full share, you can use the following option:

[global]
access based share enum = yes

To hide files/folders inside a share to users who do not have read permission on those files/folders, you can use:

[share]
...
hide unreadable = yes