samba - Sep 2021 - Packages necessary to set up a Samba AD controller on Ubuntu?

Hi -

I'm setting up a Samba AD controller for the first time, and have been 
looking over available documentation and Internet HOWTOs. I'm a bit 
confused about what packages need to be installed for Ubuntu 20.04.

According to the Samba Wiki, I need:

  acl attr samba samba-dsdb-modules samba-vfs-modules winbind 
libpam-winbind libnss-winbind  libpam-krb5 krb5-config krb5-user

with the cryptic note:
Note: For a DC you do not need libpam-winbind libnss-winbind 
libpam-krb5, unless you require AD users  to login

I think this means I only need these packages if I plan to have AD users 
log in directly to the AD server? I don't, why would anyone want this? 
This leaves:

   acl attr samba samba-dsdb-modules samba-vfs-modules winbind 
krb5-config krb5-user

I'm pretty sure acl and attr are installed by default on Ubuntu 20.04 
server.

However, my question has to do with samba-dsdb-modules and 
samba-vfs-modules packages.

None of the online howto's I've looked at install these packages. For 
example, this seems to be the typical minimal package list:

   samba krb5-user krb5-config winbind smbclient

(krb5-config is a dependency of krb5-user and could be omitted)

What exactly are they needed for?  The Ubuntu package descriptions are 
sufficiently vague that it's not clear.

Thanks;

On Fri, 2021-09-17 at 13:02 -0500, Patrick Goetz via samba
wrote:
> Hi -
> 
> I'm setting up a Samba AD controller for the first time, and have
> been 
> looking over available documentation and Internet HOWTOs. I'm a bit 
> confused about what packages need to be installed for Ubuntu 20.04.
> 
> According to the Samba Wiki, I need:
> 
>   acl attr samba samba-dsdb-modules samba-vfs-modules winbind 
> libpam-winbind libnss-winbind  libpam-krb5 krb5-config krb5-user
You missed dnsutils and ntp or chrony

The list is the minimum packages required to setup a Unix domain member
and, as it points out, you do not need all of them for a DC.
> 
> with the cryptic note:
> Note: For a DC you do not need libpam-winbind libnss-winbind 
> libpam-krb5, unless you require AD users  to login
> 
> I think this means I only need these packages if I plan to have AD
> users 
> log in directly to the AD server? I don't, why would anyone want
> this? 
You are correct, they are only required if you want to use a DC as a
fileserver, but this does happen.
> This leaves:
> 
>    acl attr samba samba-dsdb-modules samba-vfs-modules winbind 
> krb5-config krb5-user
> 
> I'm pretty sure acl and attr are installed by default on Ubuntu
> 20.04 
> server.
They possibly are, but there would only be complaints if they were not
listed and they were not installed.
> 
> However, my question has to do with samba-dsdb-modules and 
> samba-vfs-modules packages.
> 
> None of the online howto's I've looked at install these packages.
> For 
> example, this seems to be the typical minimal package list:
> 
>    samba krb5-user krb5-config winbind smbclient
> 
> (krb5-config is a dependency of krb5-user and could be omitted)
They may be dependencies of other packages, but you need them and it
doesn't hurt to list them in the apt list.
> 
> What exactly are they needed for?  
Your DC will not work without them, 'vfs_acl_xattr' is part of samba-
vfs-modules and is required to allow the use of acl's and attrs in
shares.

Rowland