Monitoring Samba Active Directory with Vigilmon

Samba as an Active Directory Domain Controller brings full Windows-compatible identity services to Linux: Kerberos authentication, LDAP directory, DNS, and SMB file sharing — all without a Windows Server license. But when a Samba DC goes dark, the impact is immediate and wide: domain logins fail across every joined workstation, file shares become inaccessible, and password changes stop working. Vigilmon monitors Samba's LDAP, SMB, and Kerberos ports individually so you catch the exact component that failed, not just that "AD is down."

What You'll Set Up

• TCP probe for Samba LDAP availability (port 389)
• TCP probe for Samba SMB file sharing availability (port 445)
• TCP probe for Samba Kerberos KDC availability (port 88)
• SSL certificate expiry alert for LDAPS (port 636)
• Heartbeat monitor for Samba AD replication and directory health

Prerequisites

• Samba 4.x deployed as an Active Directory Domain Controller
• Samba services running (smbd, nmbd, samba-ad-dc or unified samba daemon)
• A free Vigilmon account

Step 1: Monitor Samba LDAP (Port 389)

LDAP on port 389 is the backbone of Active Directory authentication. Every domain join, login, and directory query flows through this port. A TCP probe confirms Samba's LDAP server is accepting connections.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to TCP Port.
3. Set Host to your Samba DC hostname or IP.
4. Set Port to 389.
5. Set Check interval to 1 minute.
6. Click Save.

A port 389 TCP failure means domain authentication is broken across all joined machines immediately. Alert on the first failure — there is no grace period for LDAP outages in an Active Directory environment.

Step 2: Monitor Samba SMB File Sharing (Port 445)

SMB on port 445 handles all Windows and macOS file share access. Domain users accessing shared drives, SYSVOL, and NETLOGON — which clients need for Group Policy — all use this port.

1. In Vigilmon, click Add Monitor → TCP Port.
2. Set Host to your Samba DC hostname or IP.
3. Set Port to 445.
4. Set Check interval to 1 minute.
5. Click Save.

SYSVOL and NETLOGON shares are accessed over SMB. If port 445 is unreachable, Windows clients cannot apply Group Policy, and new logins on machines without cached credentials will fail even if LDAP and Kerberos are healthy.

Step 3: Monitor the Samba Kerberos KDC (Port 88)

Kerberos is required for modern Windows authentication. When a Windows client authenticates to the domain, it first requests a Kerberos ticket from the KDC on port 88. If port 88 is unreachable, domain logins and service ticket requests fail.

1. In Vigilmon, click Add Monitor → TCP Port.
2. Set Host to your Samba DC hostname or IP.
3. Set Port to 88.
4. Set Check interval to 1 minute.
5. Click Save.

Monitor port 88 independently from LDAP — Kerberos and LDAP are separate Samba components and can fail independently. A Kerberos failure while LDAP is healthy produces a confusing user experience where directory queries work but interactive logins fail.

Step 4: SSL Certificate Alert for LDAPS (Port 636)

Applications that connect to Samba AD over LDAPS (encrypted LDAP on port 636) need a valid certificate. Many enterprise applications — Grafana, GitLab, Nextcloud, and others — use LDAPS for secure directory queries.

Add a TCP probe for LDAPS availability and an SSL certificate monitor:

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Set Type to TCP Port and monitor port 636 for basic connectivity.
3. For certificate monitoring, add a second monitor:
   • Set Type to HTTP / HTTPS.
   • Set URL to https://your-samba-dc:636 (or the LDAPS endpoint if it responds to HTTP probes; otherwise use the SSL monitoring on any HTTPS service using the same certificate).
   • Enable Monitor SSL certificate.
   • Set Alert when certificate expires in less than 21 days.
4. Click Save.

To view the current LDAPS certificate expiry:

openssl s_client -connect your-samba-dc:636 -showcerts < /dev/null 2>/dev/null \
  | openssl x509 -noout -enddate

LDAPS certificate expiry causes application authentication failures that can be difficult to diagnose — the LDAP port is open but TLS handshakes fail. The 21-day alert gives you time to renew the certificate before applications start breaking.

Step 5: Heartbeat Monitoring for Samba AD Replication and Directory Health

For multi-DC Samba deployments, replication health is critical. A replication failure means domain changes (new users, password resets, Group Policy updates) don't propagate across DCs. Even in single-DC deployments, an authenticated LDAP query confirms the full Kerberos + LDAP + directory chain is operational.

Set up a scheduled script that verifies directory health and sends a Vigilmon heartbeat:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to 10 minutes.
3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a monitoring script on the Samba DC or a joined Linux machine:

#!/bin/bash
# check-samba-health.sh — run every 10 minutes via cron

SAMBA_DC="your-samba-dc"
BIND_DN="CN=monitoring,CN=Users,DC=yourdomain,DC=com"
BIND_PW="monitoring_password"
BASE_DN="DC=yourdomain,DC=com"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# Authenticated LDAP search — confirms Kerberos + LDAP + directory chain
RESULT=$(ldapsearch -x -H "ldap://${SAMBA_DC}" \
  -D "$BIND_DN" \
  -w "$BIND_PW" \
  -b "$BASE_DN" \
  "(objectClass=domain)" \
  distinguishedName 2>&1)

if echo "$RESULT" | grep -q "$BASE_DN"; then
  curl -s "$HEARTBEAT_URL"
  exit 0
fi

echo "Samba LDAP health check failed: $RESULT" >&2
exit 1

For multi-DC deployments, extend the script to check AD replication:

# Check replication status via samba-tool
REPL=$(samba-tool drs showrepl 2>&1)
if echo "$REPL" | grep -qi "error\|failed"; then
  echo "Samba replication error detected" >&2
  exit 1
fi

Add to cron:

*/10 * * * * /usr/local/bin/check-samba-health.sh

Create the monitoring account in Samba AD:

samba-tool user create monitoring MonitoringP@ssw0rd \
  --description="Vigilmon health check account"

# Give read-only permissions to the domain
samba-tool dsacl set \
  --objectDN="DC=yourdomain,DC=com" \
  --sddl="(A;;LCRPLORC;;;monitoring)"

If the LDAP search returns the expected base DN, the heartbeat fires. If Samba is running but the directory is corrupted or LDAP authentication is broken, the search fails and Vigilmon alerts after the 10-minute window passes.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a PagerDuty webhook for on-call routing.
2. Set Consecutive failures before alert to 1 on all three TCP monitors (LDAP, SMB, Kerberos) — AD outages impact all users immediately.
3. For the LDAPS certificate monitor, use 1 failure and a 21-day expiry window.
4. Use Maintenance windows during Samba upgrades:

curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "MONITOR_ID", "duration_minutes": 30}'

Summary

| Monitor | Target | What It Catches | |---|---|---| | LDAP TCP | host:389 | LDAP server down, domain auth broken | | SMB TCP | host:445 | File shares inaccessible, SYSVOL/NETLOGON down | | Kerberos TCP | host:88 | KDC down, domain logins failing | | LDAPS SSL | host:636 | Certificate expiry, LDAPS auth failures | | AD heartbeat | LDAP bind script → heartbeat URL | Directory corruption, replication failure |

Samba AD DC puts enterprise-grade identity services on Linux hardware — but a silent failure in any one of LDAP, Kerberos, or SMB cascades into domain-wide authentication outages. With Vigilmon monitoring each port independently and an authenticated LDAP heartbeat confirming end-to-end directory health, you get the per-component visibility needed to diagnose and fix Samba failures before users start calling the helpdesk.