Control: severity -1 important Control: tag -1 + confirmed
On 08.03.2026 11:15, Steinar H. Gunderson wrote:
Package: samba-ad-dc Version: 2:4.22.6+dfsg-0+deb13u1 Severity: normal Hi, If you do as the trixie release notes say, and “apt install samba-ad-dc” on your DC upgrade, you will (more or less silently) get libnss-winbind and libpam-winbind on your DC. This means that by default (i.e., unless you add some extra restrictions somewhere), every user on your domain can log into your DC.
Actually this is worse. When splitting up samba-ad-dc out of samba, besides the release notes, I also added Recommends: samba-ad-dc to the samba package, - in a hope that for those who used samba with DC functionality, no extra package installation will be required (and it works). However, as you correctly noted, samba-ad-dc recommends libpam-winbind and libnss-winbind - which means that now, everyone who used to have samba installed for any reason, pam+nss winbind modules are installed *too*. And this leads to somewhat unusual password prompts, strange error messages when password is incorrect, and so on. All these are cosmetics, but the problem is actually much deeper, as you noted above. I never thought about it all this way. And yes, you're right, pam-winbind isn't needed for ad-dc in any way. However, I'm not at all sure about nss-winbind. I just don't know if AD-DC uses it or not.
This is an unusual configuration; pretty much every DC I've seen is set up separated from normal users for security reasons. And given that the main samba package does _not_ have such a Recommends (winbind itself has a Suggests, which sounds like the right thing to me), I'm not sure why samba-ad-dc specifically would have it? It doesn't seem to fit with what Recommends generally means in Policy (“The Recommends field should list packages that would be found together with this one in all but unusual installations”; I would assume _installing_ them is the unusual setup). Of course you can install them and then set up e.g. group ACLs in sshd_config, but it's not obvious to me why this should be the default setup. I must admit I don't even understand why winbind is needed to run a DC, but I'm sure there is some internal Samba reason, given that it is a Depends. :-)
This is another very good question. I don't know. And this is more about documentation, or lack thereof. It would be excellent to have some comments from the samba team on the matter, - I'll ask there. I don't know if it's possible to address this in trixie (definitely not in the upcoming 13.4 release as it will happen next week already). But I'll fix this for forky at least. Thanks, /mjt
