Windows – Getting Linux computer integrated with Windows domain

domainsambawindows

I've tried to figure it out for several months, with no success. I have a Windows 2008R2 domain, and one Linux server (first it was Fedora 15, then 16, and now it's Centos 6.2). I am trying to make it member of the domain to the extent possible. Ideally, I would like to login and get authenticated against domain (say, login 'DOMAIN+john'). If not – at least be able to map directories through Samba with Windows credentials (better, map drives without specifying credentials, and just passing Windows credentials).

I followed several articles, most closely this one; but still can't map the drive (as soon as I switch security from USER to ADS, I can't expand the server)… let alone login. I know I am close (eg., I am getting pam_get_item returned a password from winbind when I log in) – but pointers to something definitive would be great!

Best Answer

Look at www.likewiseopen.org

My colleagues at work succeeded to join the AD using their Ubuntu machines, but I couldn't do it on my Debian... I don't think you can do it jusing just Samba.

Related Solutions

Linux – Connecting to Active Directory with Winbind

Undo all of your changes and delete the computer account from AD. Remove the winbind package.

Install a suitable selection of packages. On Debian-based systems you can use apt-get install samba smbclient sssd realmd dnsutils policykit-1 packagekit sssd-tools sssd libnss-sss libpam-sss adcli.

Don't worry at this point if sssd fails to start. It needs to be configured with the realm command, which we're going to address in a moment.

Make sure your local Linux-based system has your DC at its DNS server. Do not add any additional DNS server unless it is part of your Active Directory environment. If you simply edit /etc/resolv.conf and ignore the "do not edit this file" warning, your changes will probably get overwritten. At this point your system will fail to authenticate anyone and may even eventually fall off the domain. (Users tend to get unhappy at this point.)

Make sure your local time matches the time in Active Directory, since Kerberos won't work with a skew of greater than about 5 minutes (300 seconds).

For your local domain contoso.com run these three commands as root:

domain=contoso.com          # The FQDN itself. Not machine.FQDN
realm discover "$domain"    # If this fails, stop and recheck everything
realm join "$domain"        # [--user <ad_username>] [--computer-ou <ou>]

If you need to provide an AD account name for the realm join, do so with realm join --user <ad_username> "$domain", where <ad_username> represents an unqualified sAMAccountName. Your own AD account should work for a minimum of ten clients even if it is not a domain administrator, although administrator is a useful choice if you know its password. The --computer-ou option allows you to specify the initial OU for the account. Leave this blank unless you know its correct value (don't guess it).

Fix up the sssd.conf file. The ad_hostname is necessary for some versions to work around a bug. The LDAP group nesting level allows sssd to handle membership of nested groups.

sed -i "/^ad_domain /s/$/\nad_hostname = $(hostname).$domain/" /etc/sssd/sssd.conf
( echo; echo 'ldap_group_nesting_level = 5'; echo 'ldap_use_tokengroups = false' ) >>/etc/sssd/sssd.conf
service sssd restart

Linux clients can’t login on samba share while windows and mac can (active directory env)

I found this article which may help you mount the SMB shares.

https://askubuntu.com/questions/1026316/cifs-mounts-and-kerberos-permissions-on-access-or-best-practice

I believe that the issue is related to Kerberos and Sebastian Stark does a great job of explaining exactly what I would have said.

Best Answer

Related Solutions

Linux – Connecting to Active Directory with Winbind

Linux clients can’t login on samba share while windows and mac can (active directory env)

Related Question