79 lines
2.5 KiB
Markdown
79 lines
2.5 KiB
Markdown
|
---
|
||
|
|
date: 2014-06-17
|
||
|
|
title: New Linux Active Directory Integration
|
||
|
|
category: devops
|
||
|
|
---
|
||
|
|
|
||
|
|
This used to be quite complex, but now is astoundingly simple. Now there
|
||
|
|
is a new project call
|
||
|
|
[realmd](https://freedesktop.org/software/realmd/). It is in recent
|
||
|
|
version of Debian (Jessie and Sid) and Ubuntu (since 13.04). For Red Hat
|
||
|
|
types, it is RHEL7 and Fedora (since 18).
|
||
|
|
|
||
|
|
If you\'re on Debian/Ubuntu, install with:
|
||
|
|
|
||
|
|
apt-get install realmd
|
||
|
|
|
||
|
|
For RHEL/Fedora:
|
||
|
|
|
||
|
|
sudo yum install realmd
|
||
|
|
|
||
|
|
Now you can go ahead and join the domain:
|
||
|
|
|
||
|
|
sudo realm join --user=<admin-user> example.com
|
||
|
|
|
||
|
|
That is it, you can check this by running `sudo realm list`, which will
|
||
|
|
give you something like:
|
||
|
|
|
||
|
|
example.com
|
||
|
|
type: kerberos
|
||
|
|
realm-name: EXAMPLE.COM
|
||
|
|
domain-name: example.com
|
||
|
|
configured: kerberos-member
|
||
|
|
server-software: active-directory
|
||
|
|
client-software: sssd
|
||
|
|
required-package: oddjob
|
||
|
|
required-package: oddjob-mkhomedir
|
||
|
|
required-package: sssd
|
||
|
|
required-package: adcli
|
||
|
|
required-package: samba-common
|
||
|
|
login-formats: %U@example.com
|
||
|
|
login-policy: allow-realm-logins
|
||
|
|
|
||
|
|
The last step is `sudo`. If you want to have everyone in *Domain Admins*
|
||
|
|
have permission to run everything as root, then add the following to
|
||
|
|
`sudoers`:
|
||
|
|
|
||
|
|
%domain\ admins@example.com ALL=(ALL) ALL
|
||
|
|
|
||
|
|
By default `realmd` used SSSD to perform the authentication. This in
|
||
|
|
turn configures Kerberos and LDAP.
|
||
|
|
|
||
|
|
My initial testing has been performed with an Active Directory that has
|
||
|
|
"Identity Managment for UNIX" installed. However, I forgot to actually
|
||
|
|
enable my user for UNIX. Even so, it worked perfectly. It sees my
|
||
|
|
Windows groups and defines a home directory of
|
||
|
|
`/home/example.com/<username>`. I am pretty certain that you do not need
|
||
|
|
to extend AD, it should work out of the box from what I can see.
|
||
|
|
|
||
|
|
As a bonus, it seems to respect nested groups, something that has always
|
||
|
|
been a bug bear in these things.
|
||
|
|
|
||
|
|
# Edit (18/6/2014)
|
||
|
|
|
||
|
|
It has been bought to my attention that there is dependency problems in
|
||
|
|
Ubuntu 14.04. The [work
|
||
|
|
around](https://funwithlinux.net/2014/04/join-ubuntu-14-04-to-active-directory-domain-using-realmd)
|
||
|
|
is to not let `realm` install the dependencies. To `/etc/realmd.conf`
|
||
|
|
add:
|
||
|
|
|
||
|
|
[service]
|
||
|
|
automatic-install = no
|
||
|
|
|
||
|
|
Now you need to install the necessary packages yourself:
|
||
|
|
|
||
|
|
sudo apt install samba-common-bin, samba-libs sssd-tools krb5-user adcli
|
||
|
|
|
||
|
|
You will need to enter your kerberos domain (e.g. EXAMPLE.COM) during
|
||
|
|
the install. You should be able to get a ticket and join the domain.
|