Join Debian to Active Directory

Debian 8

This section is for Joining Debian 8 to Active Directory

Install Required Packages

Use apt to install the following required packages

sudo
realmd
adcli
sssd
ntp
libsss-sudo

root # apt-get install sudo realmd adcli sssd ntp libsss-sudo samba-common-bin sssd-tools

Create Required Files and Configuration

Run the following as root:

mkdir -p /var/lib/samba/private

echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" | tee -a /etc/pam.d/common-session

echo "%domain\ admins@$DOMAIN ALL=(ALL) ALL" | tee -a /etc/sudoers.d/domain_admins

vim /etc/sssd/sssd.conf

Modify the line to be: use_fully_qualified_names = False

Join the Domain

The following command can be executed to check if the server can find the YOURDOMAIN.lan domain

realm discover yourdomain.lan

The output should be similar below

yourdomain.lan

type: kerberos

realm-name: yourdomain.LAN

domain-name: yourdomain.lan

configured: kerberos-member

server-software: active-directory

client-software: sssd

required-package: sssd-tools

required-package: sssd

required-package: libnss-sss

required-package: libpam-sss

required-package: adcli

required-package: samba-common-bin

login-formats: %U

login-policy: allow-realm-logins

realm join --user=administrator yourdomain.lan #Enter the administrator password ( Domain one)

systemctl enable sssd

systemctl start sssd

Test

getent passwd <user>@yourdomain.lan
The output should be something similar to the /etc/passwd

Shortcuts

The following can be written as an executable script and ran in one shot:

aptitude install ntp sudo

aptitude install realmd adcli sssd

mkdir -p /var/lib/samba/private

realm join --user=administrator yourdomain.lan

if [ $? -ne 0 ]; then

echo "AD join failed. Please run 'journalctl -xn' to determine why."

exit 1

fi

systemctl enable sssd

systemctl start sssd

echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" | sudo tee -a /etc/pam.d/common-session

aptitude install libsss-sudo

echo "%domain\ admins@$DOMAIN ALL=(ALL) ALL" | sudo tee -a /etc/sudoers.d/domain_admins

This should be the contents of /etc/sssd/sssd.conf

[sssd]

domains = yourdomain.lan

config_file_version = 2

services = nss, pam

[domain/yourdomain.lan]

ad_domain = yourdomain.lan

krb5_realm = yourdomain.LAN

realmd_tags = manages-system joined-with-samba

cache_credentials = True

id_provider = ad

krb5_store_password_if_offline = True

default_shell = /bin/bash

ldap_id_mapping = True

use_fully_qualified_names = False

fallback_homedir = /home/%d/%u

access_provider = ad

Restart sssd when the sssd.conf is modified

Debian 7

This section is for Joining Debian 7 (and lower) to Active Directory

Install Required Packages

Use apt to install the following required packages

sudo
ntp
samba smbclient samba-common
winbind
krb5-user libpam-krb5

Create Required Files and Configuration

mv /etc/krb5.conf /etc/krb5.conf.orig
vi /etc/krb5.conf

[libdefaults]

default_realm = yourdomain.LAN

 kdc_timesync = 1

 ccache_type = 4

 forwardable = true

 proxiable = true

dns_lookup_realm = false

dns_lookup_kdc = true

fcc-mit-ticketflags = true

default_keytab_name = FILE:/etc/krb5.keytab

ticket_lifetime = "10h 0m 0s"

renew_lifetime = "7d 0h 0m 0s"

realms]

yourdomain.LAN = {

kdc = dc1-ma.yourdomain.lan                    #multiple kdc lines can be added if desired to include other domain controllers

admin_server = dc1-ma.yourdomain.lan

default_domain = yourdomain.LAN

[domain_realm]

.yourdomain.lan = yourdomain.LAN

yourdomain.lan = yourdomain.LAN

[login]

krb4_convert = true

krb4_get_tickets = false

mv /etc/samba/smb.conf /etc/samba/smb.conf.orig

vi /etc/samba/smb.conf

[global]

workgroup = yourdomain

security = ads

realm = yourdomain.lan

password server = dc1-ma.yourdomain.lan

domain logons = no

template homedir = /home/%D/%U

template shell = /bin/bash

winbind enum groups = yes

winbind enum users = yes

winbind use default domain = yes

domain master = no

local master = no

prefered master = no

os level = 0

idmap config *:backend = tdb

idmap config *:range = 11000-20000

idmap config DOMAIN:backend = rid

idmap config DOMAIN:range=10000000-19000000

vi /etc/nsswitch.conf

passwd: compat winbind

group: compat winbind

shadow: compat

vi /etc/pam.d/common-session #add the following lines to automatically create home folders for users when they first log on

session required pam_unix.so

session required pam_mkhomedir.so umask=0022 skel=/etc/skel

Restart the Services

/etc/init.d/winbind stop
/etc/init.d/samba restart
/etc/init.d/winbind start

Test the Services

kdestroy #clear anything cached and then try to get a kerberos ticket
klist
kinit <username>@yourdomain.LAN #note on the all-caps domain name
klist #should show expiry dates for the user's kerberos ticket
net join -S dc1-ma -U administrator # ERROR_DNS_GSS_ERROR can be ignored, this is a bug
net ads info
wbinfo -u
wbinfo -g
getent passwd
getent group

Login using Domain Account

You should now be able to log in to the system using a domain username/password combination and a home folder will be automatically created for you on first logon.

CentOS 7

This section is for Joining CentOS 7 to Active Directory

root # yum install adcli realmd oddjob oddjob-mkhomedir sssd samba-common-tools ipa-python -y

root # realm discover YOURDOMAIN.COM

yourdomain.com

  type: kerberos

  realm-name: YOURDOMAIN.COM

  domain-name: yourdomain.com

  configured: no

  server-software: active-directory

  client-software: sssd

  required-package: oddjob

  required-package: oddjob-mkhomedir

  required-package: sssd

  required-package: adcli

  required-package: samba-common-tools

root # realm join --user=administrator YOURDOMAIN.COM

vim /etc/sssd/sssd.conf

Modify the line to be: use_fully_qualified_names = False

Then restart or start the service

root  # systemctl enable sssd

root # systemctl start sssd

root # systemctl restart sssd

root # echo "session required pam_mkhomedir.so skel=/etc/skel/ umask=0022" | sudo tee -a /etc/pam.d/common-session

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

Change the sudoers file to add the line below

root # visudo

# Allow members of group internal-it to execute any command

%internal-it   ALL=(ALL:ALL) ALL

Change the smb.conf file with the following Workgroup :

root :~ cat /etc/samba/smb.conf

# See smb.conf.example for a more detailed config file or

# read the smb.conf manpage.

# Run 'testparm' to verify the config is correct after

# you modified it.

[global]

        workgroup = YOURDOMAIN

        security = user

        passdb backend = tdbsam

        printing = cups

        printcap name = cups

        load printers = yes

        cups options = raw

Google Sites

Report abuse