Fresh Install of Samba Active Directory Provisioning Tool Takes Forever: A Comprehensive Guide
If you're trying to install a Samba Active Directory domain controller on a server with an AMD Ryzen 9 processor and 32GB of RAM, you might have encountered a strange issue where the provisioning tool takes forever to complete. This article will provide a detailed context of the topic, covering key concepts and subtitles, and will help you troubleshoot and resolve this issue.
Background: Samba Active Directory Provisioning Tool
Samba is an open-source software suite that provides file and print services to SMB/CIFS clients. It is a popular choice for building Active Directory (AD) domain controllers on Linux systems. The Samba AD provisioning tool, also known as samba-tool, is a command-line utility that automates the process of setting up a new AD domain controller.
Issue: Samba AD Provisioning Tool Takes Forever
When running the samba-tool command to provision a new AD domain controller on an AMD Ryzen 9 server with 32GB of RAM, the process might take an unusually long time to complete. This issue has been reported by several users, and it seems to be specific to servers with a high number of CPU cores and a large amount of RAM.
Cause: Resource Allocation and Threading Issues
The root cause of this issue is still under investigation, but it appears to be related to resource allocation and threading issues in the Samba AD provisioning tool. Specifically, the tool seems to have trouble handling the high number of CPU cores and large amount of RAM available on the server, leading to a significant slowdown in the provisioning process.
Solution: Limit the Number of CPU Cores and Increase the Thread Stack Size
A workaround for this issue is to limit the number of CPU cores used by the Samba AD provisioning tool and increase the thread stack size. This can be done by adding the following options to the smb.conf file:
[global]
interfaces = lo eth0
bind interfaces only = yes
server role = active directory domain controller
max protocol = SMB3
idmap config * : backend = tdb
idmap config * : range = 1000000-2000000
idmap config DOMAIN : backend = ad
idmap config DOMAIN : range = 1000000-2000000
idmap config DOMAIN : schema_mode = rfc2307
template homedir = /home/%D/%U
template shell = /bin/bash
winbind use default domain = yes
winbind offline logon = yes
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
winbind separator = +
realm = DOMAIN.COM
workgroup = DOMAIN
security = user
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
private dir = /var/lib/samba/private
dedicated keytab file = /etc/samba/keytab.%U
kerberos method = secrets and keytab
client signing = mandatory
client use spnego = yes
client ntlmv2 auth = yes
server signing = mandatory
load printers = no
disable spoolss = yes
printcap name = /dev/null
printing = bsd
print command = cat > /dev/null
lpq command = cat > /dev/null
lprm command = cat > /dev/null
unix extensions = no
map archive = no
map hidden = no
map system = no
map char = no
map block = no
store dos attributes = no
vfs objects = acl_xattr
acl group control = yes
acl map full control = yes
nfs4:mode = special
nfs4:chowns = yes
nfs4:acedup = merge
winbind max clients = 1000
winbind max domains = 100
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
winbind separator = +
winbind use default domain = yes
winbind offline logon = yes
server multi channel support = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
smbd threads = 16
smbd thread stack size = 262144
smbd max open files = 100000
smbd min spares threads = 32
smbd max spares threads = 32
smbd ctdbd socket = /var/run/ctdb/ctdbd.sock
smb2 leases = yes
smb2 max credits = 100000
smb2 max read = 16777216
smb2 max write = 16777216
smb2 max trans = 16777216
smb2 min receivefile size = 16384
smb2 max receivefile size = 16777216
smb2 min write size = 16384
smb2 max write size = 65536
smb2 min async receive size = 16384
smb2 max async receive size = 16777216
smb2 min async write size = 16384
smb2 max async write size = 65536
smb2 min async io size = 16384
smb2 max async io size = 16777216
smb2 async io delay = 1
smb2 oplocks = yes
smb2 Durable handles = yes
smb2 strict allocate = yes
smb2 recover delete = yes
smb2 min protocol = SMB2
smb2 max protocol = SMB3
smb2 client max protocol = SMB3
smb2 client min protocol = SMB2
smb2 client max read = 16777216
smb2 client max write = 16777216
smb2 client max trans = 16777216
smb2 client async read = yes
smb2 client async write = yes
smb2 client async trans = yes
smb2 client oplocks = yes
smb2 client durable handles = yes
smb2 client strict allocate = yes
smb2 client recover delete = yes
smb2 client min receivefile size = 16384
smb2 client max receivefile size = 16777216
smb2 client min write size = 16384
smb2 client max write size = 65536
smb2 client min async receive size = 16384
smb2 client max async receive size = 16777216
smb2 client min async write size = 16384
smb2 client max async write size = 65536
smb2 client min async io size = 16384
smb2 client max async io size = 16777216
smb2 client async io delay = 1
smb2 client oplocks = yes
smb2 client Durable handles = yes
smb2 client strict allocate = yes
smb2 client recover delete = yes
In this example, the smbd threads option is set to 16, and the smbd thread stack size option is set to 262144. These settings limit the number of CPU cores used by the Samba AD provisioning tool and increase the thread stack size, which can help resolve the issue of the tool taking forever to complete.
- The Samba AD provisioning tool might take an unusually long time to complete on servers with a high number of CPU cores and a large amount of RAM.
- The root cause of this issue is still under investigation, but it appears to be related to resource allocation and threading issues in the Samba AD provisioning tool.
- A workaround for this issue is to limit the number of CPU cores used by the Samba AD provisioning tool and increase the thread stack size by adding the
smbd threadsandsmbd thread stack sizeoptions to thesmb.conffile.