Windows AD authentication for Linux Clients
Release:
RedHat Enterprise Linux 5
Windows Enterprise Server 2003 R2
Problem:
Need to login linux client using the windows active directory authentication using kerberos and samba winbind.
Solution:
Assumption:
Domain Name : TESTDOM.COM
AD Server IP Address : 192.168.1.60
AD Server Hostname : WIN2K3
Linux Client IP Address : 192.168.1.26
Linux Clinet Hostname : CLIENT
1) Install the required RPMs
# yum install krb5-libs pam_krb5 krb5-workstation samba-common samba-client
2) Add the domain server entry in the host file
# vi /etc/hosts
192.168.1.60 win2k3.testdom.com win2k3
192.168.1.26 client.testdom.com client
3) Mention the name server ipaddress in the resolv.conf file
# vi /etc/resolv.conf
nameserver 192.168.1.60
Configure Kerberos for AD Integration:
4) Modify the /etc/krb5.conf file, to enable the Domain controller authentication in Linux.
# vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = WIN2K3.TESTDOM.COM
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
TESTDOM.COM = {
kdc = win2k3.testdom.com
admin_server = win2k3.testdom.com:749
default_domain = testdom.com
}
[domain_realm]
.testdom.com = TESTDOM.COM
testdom.com = TESTDOM.COM
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
5) PAM needs to be configured to use Active Directory authentication. Edit the system-auth file like below
# vi /etc/pam.d/system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_winbind.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session optional pam_mkhomedir.so skel=/etc/skel/ umask=0077
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
Create Users and Group from DC:
6) Add the below entries in /etc/samba/smb.conf file, will cause the winbind service to enumerate users and groups from the domain controller.
# vi /etc/samba/smb.conf
workgroup = TESTDOM
password server = win2k3.testdom.com
server string = Samba Server Version %v
realm = TESTDOM.COM
security = ads
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
winbind separator = #
winbind enum groups = yes
winbind enum users = yes
template homedir = /home/%U
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false
Where,
idmap uid - the range of numeric uid's that winbind will use to enumerate domain users with on your system. You should select a range that does not conflict with uid numbers already in use on the system.
idmap gid - the range of numeric gid's that winbind will use to enumerate domain groups on your system.
winbind enum groups and winbind enum users - whether winbind should "create" the domain's groups/users on the system or not.
winbind separator - the character winbind will use to separate the domain name from the user or group name The template homedir statement is used to generate the home directory path for domain users.
realm - is used to describe a Kerberos-based security architecture
template homedir = /home/%U – here %u substituted with the user's Windows NT user name
template shell = /bin/bash – login shell for that user
7) Change the user information and authentication type to winbind using the “authconfig-tui” command
# authconfig-tui
Then Select “Next” and Select “ok”.
8) Restart the winbind service and also configure winbind to start automatically.
# service winbind restart
# chkconfig --level 35 winbind on
9) Join the Domain using the below command
# net ads join -U administrator
10) To test the enumeration function of the winbind use the below commands.
# wbinfo –u
# wbinfo –g
